botmux 3.10.0 → 3.23.1

package/dist/codex-rpc-engine.js

@@ -1,640 +0,0 @@
-// Hybrid Codex input engine.
-//
-// Runs one `codex app-server --listen ws://127.0.0.1:<port>` per session (the
-// shared engine) and speaks JSON-RPC to it. The session's tmux pane runs the
-// real `codex --remote ws://... resume <threadId>` TUI, so rendering / web
-// terminal / idle detection are unchanged. User input is delivered via
-// `turn/start` (an acked RPC) instead of a tmux paste — bypassing the terminal
-// entirely, which is where codex drops bracketed pastes during its startup /
-// settings-churn terminal re-init (see codex-0144 investigation).
-//
-// Coordination (verified — raw-WS repro + real `codex --remote` TUI): the
-// app-server BROADCASTS a thread's turn/item events to EVERY connection that has
-// the thread open (engine `thread/start`/`resume` + TUI `resume`), and the real
-// TUI renders events for a turn another connection issued. So the engine owns the
-// thread (`thread/start`, then the first turn — an empty thread has no rollout so
-// the TUI can't resume it, hence the first turn persists the rollout BEFORE the
-// TUI attaches), the TUI `resume`s it, and every engine turn thereafter renders
-// live in the TUI via that broadcast. On a botmux resume (daemon restart /
-// re-fork), the engine `thread/resume`s the persisted thread id AND the pane is
-// respawned as a fresh `--remote resume` against the CURRENT app-server (a new
-// port each incarnation) — reattaching the prior pane would leave it pointed at
-// the now-dead prior app-server (that lifecycle bug, not any non-broadcast, is
-// what froze the Web terminal). See codex-rpc-lifecycle + worker engageCodexRpc.
-import { spawn, execFileSync } from 'node:child_process';
-import { createServer } from 'node:net';
-import { get as httpGet } from 'node:http';
-import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-import { WebSocket } from 'ws';
-async function findFreePort() {
-    return new Promise((resolve, reject) => {
-        const srv = createServer();
-        srv.once('error', reject);
-        srv.listen(0, '127.0.0.1', () => {
-            const addr = srv.address();
-            const port = addr && typeof addr === 'object' ? addr.port : 0;
-            srv.close(() => (port ? resolve(port) : reject(new Error('no free port'))));
-        });
-    });
-}
-function isAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Kill the whole process group (node wrapper + its native app-server child).
- *  The app-server is spawned `detached`, so its pid is the group leader. */
-function killGroup(pid, signal) {
-    try {
-        process.kill(-pid, signal);
-    }
-    catch {
-        try {
-            process.kill(pid, signal);
-        }
-        catch { /* gone */ }
-    }
-}
-/** Server→client requests are auto-answered so codex never blocks on a human;
- *  botmux already runs codex with approvals bypassed. Mirrors codex-app-runner. */
-function autoApproval(method) {
-    if (method === 'item/permissions/requestApproval')
-        return { permissions: {}, scope: 'turn' };
-    if (method === 'item/tool/requestUserInput')
-        return { answers: {} };
-    if (method === 'mcpServer/elicitation/request')
-        return { action: 'cancel', content: null, _meta: null };
-    if (method === 'item/tool/call')
-        return { contentItems: [], success: false };
-    if (method === 'execCommandApproval' || method === 'applyPatchApproval')
-        return { decision: 'approved_for_session' };
-    // commandExecution / fileChange requestApproval + anything else: accept.
-    return { decision: 'acceptForSession' };
-}
-const MARKER_DIR = join(homedir(), '.botmux', 'data', 'codex-rpc-app-servers');
-/** Per JSON-RPC request timeout. Without it, a connected-but-wedged app-server
- *  (never answers turn/start / initialize / thread/*) would leave the caller
- *  awaiting forever — flushPending would stick in isFlushing and silently drop
- *  every later message (P1-5). A rejected request unblocks the caller, which
- *  fails-closed (engage) or surfaces a resync (sendTurn). Generous because the
- *  FIRST turn on a cold app-server pays MCP/model-list startup latency. */
-const REQUEST_TIMEOUT_MS = 60_000;
-/** Floor for a metadata-poll iteration's per-request budget. Below this, the
- *  poll deadline is effectively reached: issuing a thread/read with a
- *  sub-floor client timeout would reliably time out (and REJECT, not return)
- *  before even a fast response lands, and that rejection would escape the poll
- *  loop instead of degrading to "not found". Guards waitForThreadPreview /
- *  waitForThreadUpdatedAfter against a flaky end-of-window request. 50ms is
- *  comfortably above localhost RPC round-trip yet negligible vs the callers'
- *  200ms–10s budgets. */
-const MIN_POLL_REQUEST_BUDGET_MS = 50;
-export class CodexRpcEngine {
-    opts;
-    child;
-    ws;
-    nextId = 1;
-    pending = new Map();
-    port = 0;
-    threadId;
-    closed = false;
-    deadNotified = false;
-    lastStderr = '';
-    log;
-    constructor(opts) {
-        this.opts = opts;
-        this.log = opts.log ?? (() => { });
-    }
-    get wsUrl() { return `ws://127.0.0.1:${this.port}`; }
-    get activeThreadId() { return this.threadId; }
-    get appServerPid() { return this.child?.pid; }
-    /** Spawn the app-server, connect, and complete the initialize handshake. */
-    async start() {
-        this.reapStaleAppServer();
-        this.port = await findFreePort();
-        const featureArgs = (this.opts.appServerFeatures ?? []).flatMap(feature => ['--enable', feature]);
-        this.child = spawn(this.opts.cliBin, ['app-server', ...featureArgs, '--listen', `ws://127.0.0.1:${this.port}`], {
-            cwd: this.opts.cwd,
-            env: this.opts.env,
-            stdio: ['ignore', 'ignore', 'pipe'],
-            // Own process group so stop()/reap can kill the node wrapper AND its
-            // native app-server child in one shot (killGroup → kill(-pid)).
-            detached: true,
-        });
-        this.child.unref(); // don't let the app-server keep the worker's loop alive
-        this.child.stderr?.on('data', (c) => {
-            this.lastStderr = (this.lastStderr + c.toString('utf8')).slice(-4000);
-        });
-        this.child.once('error', err => this.failAll(new Error(`codex app-server spawn failed: ${err.message}`)));
-        this.child.once('exit', (code, signal) => {
-            this.removeMarkerIfOwned(); // child confirmed dead → drop OUR marker only (ABA-safe)
-            if (!this.closed)
-                this.failAll(new Error(`codex app-server exited (code=${code}, signal=${signal})${this.lastStderr ? `\n${this.lastStderr}` : ''}`));
-        });
-        this.writeMarker();
-        await this.waitReady(15_000);
-        await this.connect(8_000);
-        await this.request('initialize', {
-            clientInfo: { name: 'botmux', version: '0.0.0', title: 'botmux' },
-            capabilities: { experimentalApi: true },
-        });
-        this.notify('initialized');
-    }
-    /** Create a fresh session thread. Its id (== codex rollout session id) is what
-     *  the TUI resumes and what botmux persists for future resume. */
-    async startThread() {
-        const r = await this.request('thread/start', this.threadParams());
-        this.threadId = String(r?.thread?.id ?? '');
-        if (!this.threadId)
-            throw new Error('thread/start returned no thread id');
-        return this.threadId;
-    }
-    /** Resume the persisted thread after a botmux reconnect (P0 resume-survival),
-     *  so RPC mode stays engaged across daemon restarts instead of reverting to
-     *  the paste path. */
-    async resumeThread(threadId) {
-        // forResume=true: a cold resume must NOT re-send ANY model-related override.
-        // The codex/TraeX app-server sees any single override (model OR
-        // model_reasoning_effort) as "caller is pinning config" and early-returns out
-        // of `merge_persisted_resume_metadata`, dropping the rest of the persisted
-        // {model, model_provider, reasoning_effort} triple back to the CURRENT
-        // process default. Re-sending only effort (per-turn override, new in PR #639)
-        // — or even the stable configured model (pre-existing on the shared engine) —
-        // therefore silently drifts model/provider whenever the app-server default
-        // changed between restarts. Verified on codex-cli 0.145.0 + traecli 0.200.19.
-        // The safe path is to send nothing model-related and let the app-server
-        // restore the full persisted triple. Fresh thread/start still stamps both.
-        const params = { ...this.threadParams(true), threadId, excludeTurns: true };
-        delete params.serviceName; // resume keeps the original thread's identity
-        const r = await this.request('thread/resume', params);
-        this.threadId = String(r?.thread?.id ?? threadId);
-        return this.threadId;
-    }
-    threadParams(forResume = false) {
-        const config = {
-            // Forward the full env (incl. BOTMUX_SESSION_ID / BOTMUX_LARK_APP_ID) to
-            // shell subprocesses so `botmux send` from within codex finds its bot.
-            shell_environment_policy: { inherit: 'all', ignore_default_excludes: true },
-        };
-        // Only stamp model/effort on a FRESH thread/start. On resume the app-server
-        // owns restoration of the persisted triple (see resumeThread) — sending
-        // either here would trip the app-server's model-resume-override short-circuit.
-        if (!forResume) {
-            if (this.opts.model)
-                config.model = this.opts.model;
-            if (this.opts.reasoningEffort)
-                config.model_reasoning_effort = this.opts.reasoningEffort;
-        }
-        return {
-            cwd: this.opts.cwd,
-            approvalPolicy: 'never',
-            sandbox: 'danger-full-access',
-            serviceName: 'botmux',
-            ephemeral: false,
-            persistExtendedHistory: true,
-            config,
-        };
-    }
-    /** Inject one user message as a turn. Resolves when the app-server acks the
-     *  turn start (fast); the turn itself streams to the attached TUI.
-     *  `clientUserMessageId` (a stable botmux turn id) is forwarded so codex can
-     *  CORRELATE the message — NOT relied on for dedupe (the 0.144.1 schema carries
-     *  it but promises no idempotency). Correctness comes from the caller never
-     *  auto-resending an accepted turn (P1-1).
-     *  opts.fatalOnTimeout=false makes a timeout reject only THIS request instead of
-     *  tearing the engine down — used for the fresh first turn, whose ambiguity is
-     *  then resolved against rollout persistence (see sendFirstTurn). */
-    async sendTurn(content, clientUserMessageId, opts) {
-        if (!this.threadId)
-            throw new Error('sendTurn before startThread/resumeThread');
-        const params = {
-            threadId: this.threadId,
-            input: [{ type: 'text', text: content, text_elements: [] }],
-            cwd: this.opts.cwd,
-            approvalPolicy: 'never',
-            sandboxPolicy: { type: 'dangerFullAccess' },
-        };
-        if (clientUserMessageId)
-            params.clientUserMessageId = clientUserMessageId;
-        await this.request('turn/start', params, opts);
-    }
-    /** 首条用户消息落盘后设置线程名；失败不得拖垮仍在执行的模型 turn。 */
-    async setThreadName(name) {
-        if (!this.threadId)
-            throw new Error('setThreadName before startThread/resumeThread');
-        for (let attempt = 0; attempt < 3; attempt += 1) {
-            await this.request('thread/name/set', {
-                threadId: this.threadId,
-                name,
-            }, { timeoutMs: 7000, fatalOnTimeout: false });
-            if ((await this.readThreadMetadata(7000)).name === name)
-                return;
-            await new Promise(resolve => setTimeout(resolve, 200));
-        }
-        throw new Error('Codex thread name did not persist after 3 attempts');
-    }
-    /** 等待 Codex 的首条消息预览落盘；超时后由调用方继续设置标题。 */
-    async waitForThreadPreview(timeoutMs = 10_000) {
-        if (!this.threadId)
-            throw new Error('waitForThreadPreview before startThread/resumeThread');
-        const deadline = Date.now() + timeoutMs;
-        for (;;) {
-            const remaining = deadline - Date.now();
-            // A near-expired budget must not issue a doomed tiny-timeout thread/read:
-            // readThreadMetadata rejects (not returns) on request timeout, and that
-            // rejection would escape this poll instead of degrading to "not found".
-            // Below the floor the deadline is effectively reached — return undefined.
-            if (remaining < MIN_POLL_REQUEST_BUDGET_MS)
-                return undefined;
-            const { preview } = await this.readThreadMetadata(Math.min(remaining, 2000));
-            if (preview)
-                return preview;
-            await new Promise(resolve => setTimeout(resolve, Math.min(250, Math.max(1, deadline - Date.now()))));
-        }
-    }
-    /** 等待 resume 后首次 append 的元数据补丁落库；超时后由调用方继续做最终覆盖。 */
-    async waitForThreadUpdatedAfter(baseline, timeoutMs = 10_000) {
-        const deadline = Date.now() + timeoutMs;
-        while (Date.now() < deadline) {
-            const remaining = deadline - Date.now();
-            // Same near-expiry guard as waitForThreadPreview: don't issue a tiny-timeout
-            // request that would reject and escape; treat sub-floor remaining as done.
-            if (remaining < MIN_POLL_REQUEST_BUDGET_MS)
-                return;
-            const { updatedAt } = await this.readThreadMetadata(Math.min(remaining, 2000));
-            if (updatedAt !== undefined && updatedAt > baseline)
-                return;
-            await new Promise(resolve => setTimeout(resolve, Math.min(250, Math.max(1, deadline - Date.now()))));
-        }
-    }
-    async readThreadMetadata(timeoutMs = 7000) {
-        if (!this.threadId)
-            throw new Error('readThreadMetadata before startThread/resumeThread');
-        const result = await this.request('thread/read', {
-            threadId: this.threadId,
-            includeTurns: false,
-        }, { timeoutMs, fatalOnTimeout: false });
-        const name = typeof result?.thread?.name === 'string' ? result.thread.name.trim() : '';
-        const preview = typeof result?.thread?.preview === 'string' ? result.thread.preview.trim() : '';
-        const updatedAt = typeof result?.thread?.updatedAt === 'number' ? result.thread.updatedAt : undefined;
-        return {
-            ...(name ? { name } : {}),
-            ...(preview ? { preview } : {}),
-            ...(updatedAt !== undefined ? { updatedAt } : {}),
-        };
-    }
-    /** Deliver the FRESH first turn and resolve its outcome as one of THREE states,
-     *  prioritising exactly-once over never-lost (P1-1). An empty thread can't be
-     *  resumed by the TUI, so the first turn must persist the rollout before the
-     *  pane spawns — but a lost/late ack must NOT be blindly re-pasted (that would
-     *  double-execute, the failure users care about most):
-     *    - 'accepted'  — ack received, OR (ack lost) the rollout already contains
-     *                    THIS turn's user message → engaged, never resend.
-     *    - 'not-sent'  — the turn/start FRAME was never dispatched (ws not open /
-     *                    send threw) → the turn cannot have run → safe paste once.
-     *    - 'ambiguous' — the frame WAS dispatched but no ack AND no positive rollout
-     *                    evidence (timeout / transport / server / unknown error) →
-     *                    it may have executed → NEVER auto-paste; the caller notifies
-     *                    the user and lets the viewer resume (recovers if it landed).
-     *  Only "frame not dispatched" is treated as safe; every dispatched-then-failed
-     *  case is ambiguous, and a timeout is non-fatal so the engine survives to serve
-     *  the accepted/ambiguous cases. `rolloutProbe` is the ground-truth positive
-     *  check (matches this turn's user_message in the persisted rollout). */
-    async sendFirstTurn(content, clientUserMessageId, rolloutProbe) {
-        const threadId = this.threadId;
-        if (!threadId)
-            throw new Error('sendFirstTurn before startThread');
-        let dispatched = false;
-        const params = {
-            threadId,
-            input: [{ type: 'text', text: content, text_elements: [] }],
-            cwd: this.opts.cwd,
-            approvalPolicy: 'never',
-            sandboxPolicy: { type: 'dangerFullAccess' },
-        };
-        if (clientUserMessageId)
-            params.clientUserMessageId = clientUserMessageId;
-        try {
-            await this.request('turn/start', params, { timeoutMs: this.opts.requestTimeoutMs ?? 15_000, fatalOnTimeout: false }, () => { dispatched = true; });
-            return 'accepted'; // ack received
-        }
-        catch (err) {
-            if (!dispatched) {
-                this.log(`[codex-rpc] first turn/start not dispatched (${err.message}); safe to paste`);
-                return 'not-sent';
-            }
-            // Dispatched but no ack — the ONLY safe resolution is positive rollout
-            // evidence; absence is NOT proof it didn't run (it may persist >window or be
-            // queued server-side), so no-evidence stays ambiguous.
-            this.log(`[codex-rpc] first turn ack lost after dispatch (${err.message}); checking rollout for positive evidence`);
-            const landed = await rolloutProbe(threadId);
-            return landed ? 'accepted' : 'ambiguous';
-        }
-    }
-    stop() {
-        this.closed = true;
-        try {
-            this.ws?.close();
-        }
-        catch { /* already gone */ }
-        const pid = this.child?.pid;
-        if (pid) {
-            // Bounded SIGTERM → SIGKILL: don't leave a stubborn child as an untracked
-            // orphan. The marker is removed by the child 'exit' handler (confirmed
-            // dead), NOT here — if the child ignores SIGTERM and this worker then dies,
-            // the surviving marker lets the next incarnation reap it (P1-2).
-            try {
-                killGroup(pid, 'SIGTERM');
-            }
-            catch { /* already gone */ }
-            const t = setTimeout(() => { if (isAlive(pid)) {
-                try {
-                    killGroup(pid, 'SIGKILL');
-                }
-                catch { /* */ }
-            } }, 2000);
-            t.unref?.();
-        }
-        else {
-            this.removeMarkerIfOwned();
-        }
-        this.failAll(new Error('engine stopped'));
-    }
-    // ---- app-server orphan marker (P0 teardown) ------------------------------
-    markerPath() {
-        if (!this.opts.sessionId)
-            return undefined;
-        return join(MARKER_DIR, `${this.opts.sessionId}.pid`);
-    }
-    /** Verify a pid is actually OUR app-server before signalling it — the marker
-     *  can outlive a SIGKILLed worker and its pid may be REUSED by an unrelated
-     *  process (daemon runs as root → mis-kill would be severe). Match the process
-     *  argv against `app-server` AND, when recorded, the exact `--listen <url>` a
-     *  reused pid could not carry (P1-2). */
-    processIsOurAppServer(pid, markedUrl) {
-        let argv = '';
-        try {
-            argv = readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
-        }
-        catch {
-            try {
-                argv = execFileSync('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
-            }
-            catch {
-                return false;
-            }
-        }
-        if (!/\bapp-server\b/.test(argv))
-            return false;
-        if (markedUrl && !argv.includes(markedUrl))
-            return false;
-        return true;
-    }
-    /** Kill an app-server left behind by a prior incarnation of this session
-     *  (e.g. the worker was SIGKILLed so its exit hooks never ran). Identity-checked
-     *  so a reused pid is never mis-killed. */
-    reapStaleAppServer() {
-        const mp = this.markerPath();
-        if (!mp || !existsSync(mp))
-            return;
-        try {
-            const [pidStr, markedUrl] = readFileSync(mp, 'utf8').trim().split('\n');
-            const pid = parseInt(pidStr, 10);
-            if (Number.isInteger(pid) && pid > 0 && isAlive(pid) && this.processIsOurAppServer(pid, markedUrl)) {
-                killGroup(pid, 'SIGKILL'); // orphan from a crashed worker — no grace needed
-                this.log(`[codex-rpc] reaped stale app-server pid ${pid}`);
-            }
-            rmSync(mp, { force: true });
-        }
-        catch { /* best effort */ }
-    }
-    writeMarker() {
-        const mp = this.markerPath();
-        if (!mp || !this.child?.pid)
-            return;
-        // pid + the exact --listen url so a reused pid fails the identity check.
-        try {
-            mkdirSync(MARKER_DIR, { recursive: true });
-            writeFileSync(mp, `${this.child.pid}\n${this.wsUrl}`, { mode: 0o600 });
-        }
-        catch { /* best effort */ }
-    }
-    /** Remove the marker ONLY if it still names THIS engine's app-server (pid +
-     *  wsUrl). Prevents an ABA race: a same-session engine B may have already
-     *  reaped + rewritten the marker with its own pid/url by the time this (old)
-     *  engine's child exits late — an unconditional delete would orphan B's live
-     *  app-server (no marker → next incarnation can't reap it). P1-2. */
-    removeMarkerIfOwned() {
-        const mp = this.markerPath();
-        if (!mp)
-            return;
-        try {
-            const [pidStr, url] = readFileSync(mp, 'utf8').trim().split('\n');
-            if (parseInt(pidStr, 10) === this.child?.pid && url === this.wsUrl)
-                rmSync(mp, { force: true });
-        }
-        catch { /* no marker / unreadable → leave it (next reap handles it) */ }
-    }
-    // ---- internals -----------------------------------------------------------
-    waitReady(timeoutMs) {
-        const deadline = Date.now() + timeoutMs;
-        return new Promise((resolve, reject) => {
-            const attempt = () => {
-                if (this.closed)
-                    return reject(new Error('engine closed during startup'));
-                const req = httpGet({ host: '127.0.0.1', port: this.port, path: '/readyz', timeout: 1500 }, res => {
-                    res.resume();
-                    if (res.statusCode && res.statusCode < 500)
-                        return resolve();
-                    retry();
-                });
-                req.once('error', retry);
-                req.once('timeout', () => { req.destroy(); retry(); });
-            };
-            const retry = () => {
-                if (this.closed)
-                    return reject(new Error('engine closed during startup'));
-                if (Date.now() > deadline)
-                    return reject(new Error(`app-server not ready in ${timeoutMs}ms${this.lastStderr ? `\n${this.lastStderr}` : ''}`));
-                setTimeout(attempt, 250);
-            };
-            attempt();
-        });
-    }
-    connect(timeoutMs) {
-        return new Promise((resolve, reject) => {
-            const ws = new WebSocket(this.wsUrl);
-            const timer = setTimeout(() => { try {
-                ws.terminate();
-            }
-            catch { /* */ } reject(new Error('ws connect timeout')); }, timeoutMs);
-            ws.on('open', () => { clearTimeout(timer); this.ws = ws; resolve(); });
-            ws.on('message', (data) => this.onMessage(data.toString('utf8')));
-            ws.on('error', (err) => { clearTimeout(timer); if (!this.ws)
-                reject(err);
-            else
-                this.failAll(err); });
-            ws.on('close', () => { if (!this.closed)
-                this.failAll(new Error('ws closed')); });
-        });
-    }
-    request(method, params, opts, onDispatch) {
-        const timeoutMs = opts?.timeoutMs ?? this.opts.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
-        const fatalOnTimeout = opts?.fatalOnTimeout !== false; // default fatal
-        const id = this.nextId++;
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                if (!this.pending.has(id))
-                    return;
-                const err = new Error(`codex app-server request '${method}' timed out after ${timeoutMs}ms`);
-                if (fatalOnTimeout) {
-                    // A connected-but-wedged app-server is FATAL for live turns: rejecting
-                    // just this request would leave the engine + pane alive and every later
-                    // turn/start would time out again. Route through failAll so ALL inflight
-                    // requests reject AND onDead fires — the worker then replaces the pane
-                    // and re-engages on a fresh app-server (P1-5).
-                    this.failAll(err);
-                }
-                else {
-                    // Non-fatal (the fresh first turn): reject only THIS request and keep
-                    // the engine alive, so its ambiguity can be resolved against rollout
-                    // persistence and the viewer can still resume if the turn landed (P1-1).
-                    this.pending.delete(id);
-                    reject(err);
-                }
-            }, timeoutMs);
-            timer.unref?.();
-            this.pending.set(id, { resolve, reject, timer });
-            // onDispatch fires ONLY after send() succeeds (ws was OPEN + no throw) — the
-            // frame is then on the socket, so any later failure is "dispatched" and must
-            // be treated as ambiguous, never not-sent (Codex P1-1 boundary).
-            try {
-                this.send({ jsonrpc: '2.0', id, method, params });
-                onDispatch?.();
-            }
-            catch (e) {
-                this.pending.delete(id);
-                clearTimeout(timer);
-                reject(e);
-            }
-        });
-    }
-    notify(method, params) {
-        this.send(params !== undefined ? { jsonrpc: '2.0', method, params } : { jsonrpc: '2.0', method });
-    }
-    respond(id, result) {
-        try {
-            this.send({ jsonrpc: '2.0', id, result });
-        }
-        catch { /* connection gone */ }
-    }
-    /** Fail a native user-input request by INTERRUPTING its turn instead of
-     *  replying. Verified on real traex 0.200.19: replying with either empty
-     *  answers or a JSON-RPC error is normalized to `{answers:{}}` and the turn
-     *  still completes (the ask is silently skipped). `turn/interrupt` is the only
-     *  path that actually stops the turn (status → 'interrupted'); the pending
-     *  server request is cancelled along with it, so we do NOT also respond. */
-    interruptTurnFor(id, params, reason) {
-        const p = (params && typeof params === 'object') ? params : {};
-        const threadId = typeof p.threadId === 'string' ? p.threadId : undefined;
-        const turnId = typeof p.turnId === 'string' ? p.turnId : undefined;
-        if (!threadId || !turnId) {
-            // No turn coordinates to interrupt: fall back to a JSON-RPC error so at
-            // least the request does not hang the app-server waiting on a reply.
-            this.log(`[codex-rpc] requestUserInput failure without threadId/turnId; replying error (${reason})`);
-            this.respondError(id, reason);
-            return;
-        }
-        this.request('turn/interrupt', { threadId, turnId }, { timeoutMs: 10_000, fatalOnTimeout: false })
-            .then(() => this.log('[codex-rpc] turn interrupted after requestUserInput failure'))
-            .catch(err => {
-            // If the interrupt itself errors or times out, the turn is still wedged
-            // and we have no other lever. Declare the engine dead so the worker
-            // replaces the pane (onDead → restartCliProcess) rather than leaking a
-            // permanently stuck turn — the whole point of this failure path.
-            this.failAll(new Error(`turn/interrupt failed: ${err instanceof Error ? err.message : String(err)}`));
-        });
-    }
-    /** Reply to a server→client request with a JSON-RPC error. Used only as a
-     *  last resort when a failed requestUserInput has no turn to interrupt. */
-    respondError(id, message) {
-        try {
-            this.send({ jsonrpc: '2.0', id, error: { code: -32000, message } });
-        }
-        catch { /* connection gone */ }
-    }
-    send(msg) {
-        if (!this.ws || this.ws.readyState !== WebSocket.OPEN)
-            throw new Error('app-server ws not open');
-        this.ws.send(JSON.stringify(msg));
-    }
-    onMessage(line) {
-        let msg;
-        try {
-            msg = JSON.parse(line);
-        }
-        catch {
-            return;
-        }
-        // Response to one of our requests.
-        if (typeof msg.id === 'number' && (msg.result !== undefined || msg.error !== undefined)) {
-            const p = this.pending.get(msg.id);
-            if (!p)
-                return;
-            this.pending.delete(msg.id);
-            clearTimeout(p.timer);
-            if (msg.error)
-                p.reject(new Error(typeof msg.error === 'object' ? JSON.stringify(msg.error) : String(msg.error)));
-            else
-                p.resolve(msg.result);
-            return;
-        }
-        // Native user-input requests are the one server→client request that must
-        // wait for a human. In botmux this callback posts a Lark card and returns
-        // the protocol-shaped answers object. Keep all approval requests automatic.
-        if (typeof msg.id === 'number' && typeof msg.method === 'string') {
-            if (msg.method === 'item/tool/requestUserInput' && this.opts.onRequestUserInput) {
-                const requestParams = msg.params;
-                void this.opts.onRequestUserInput(requestParams).then(result => this.respond(msg.id, result), err => {
-                    // Fail VISIBLY, never silently. Verified against real traex 0.200.19:
-                    // ANY response to this request — empty answers OR a JSON-RPC error —
-                    // is normalized by the app-server into `{answers:{}}` and the turn
-                    // still COMPLETES, so unsupported/broker-failed asks would be
-                    // silently skipped. Only `turn/interrupt` (threadId+turnId, both
-                    // carried in this request's params) actually stops the turn
-                    // (status → 'interrupted'). So fail by interrupting the turn.
-                    const message = err instanceof Error ? err.message : String(err);
-                    this.log(`[codex-rpc] requestUserInput bridge failed: ${message}; interrupting turn`);
-                    this.interruptTurnFor(msg.id, requestParams, message);
-                });
-                return;
-            }
-            this.respond(msg.id, autoApproval(msg.method));
-            return;
-        }
-        // Notifications (turn/item/mcp events) are ignored here — the attached TUI
-        // renders them; botmux reads the pane as usual.
-    }
-    failAll(err) {
-        if (this.pending.size)
-            this.log(`[codex-rpc] ${err.message}`);
-        for (const p of this.pending.values()) {
-            clearTimeout(p.timer);
-            p.reject(err);
-        }
-        this.pending.clear();
-        if (!this.closed && !this.deadNotified) {
-            this.deadNotified = true;
-            try {
-                this.opts.onDead?.();
-            }
-            catch { /* best effort */ }
-        }
-    }
-}
-//# sourceMappingURL=codex-rpc-engine.js.map