codex-multi-auth 2.1.13-beta.1 → 2.2.0

package/dist/lib/prompts/codex.js

@@ -1,9 +1,53 @@
 import { promises as fs } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
 import { logWarn, logError, logDebug } from "../logger.js";
 import { getCodexCacheDir } from "../runtime-paths.js";
 import { getModelProfile } from "../request/helpers/model-map.js";
+import { fetchWithTimeout, readBodyTextGuarded, withBodyTimeout } from "./fetch-utils.js";
+import { withFileOperationRetry } from "../fs-retry.js";
+/** SHA-256 of cache content for integrity verification (prompts-03). */
+function sha256(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}
+/**
+ * Atomically write content + meta (prompts-06).
+ *
+ * The previous parallel writeFile of cacheFile and cacheMetaFile could tear:
+ * a crash between them left content and meta (etag/sha) out of sync. Write each
+ * to a temp sibling then rename, and write the content before the meta so the
+ * meta's sha always describes a content file already on disk.
+ *
+ * Note on atomicity: this is a *two-rename* operation (content, then meta), not
+ * a single atomic commit. If the second rename fails permanently the disk holds
+ * new content with stale meta — which the next read self-heals via the sha256
+ * integrity check (mismatch ⇒ discard + refetch). Each fs step is wrapped in
+ * withFileOperationRetry so a transient Windows EBUSY/EPERM/ENOTEMPTY/EACCES
+ * from antivirus, the file indexer, or a concurrent reader is retried with
+ * backoff instead of turning a successful fetch into a cache-write failure.
+ */
+async function writeCacheAtomically(cacheFile, cacheMetaFile, content, meta) {
+    await withFileOperationRetry(() => fs.mkdir(CACHE_DIR, { recursive: true }));
+    const nonce = `${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+    const contentTmp = `${cacheFile}.${nonce}.tmp`;
+    const metaTmp = `${cacheMetaFile}.${nonce}.tmp`;
+    try {
+        await withFileOperationRetry(() => fs.writeFile(contentTmp, content, { encoding: "utf8" }));
+        await withFileOperationRetry(() => fs.writeFile(metaTmp, JSON.stringify(meta), { encoding: "utf8" }));
+        await withFileOperationRetry(() => fs.rename(contentTmp, cacheFile));
+        await withFileOperationRetry(() => fs.rename(metaTmp, cacheMetaFile));
+    }
+    finally {
+        // Route cleanup through withFileOperationRetry too: a transient Windows
+        // EBUSY/EPERM/ENOTEMPTY/EACCES from antivirus/the indexer/a concurrent
+        // reader on the temp sibling would otherwise leak a *.tmp file. force:true
+        // keeps ENOENT (already-renamed) a no-op; the catch swallows a persistent
+        // failure so cleanup never masks a successful write.
+        await withFileOperationRetry(() => fs.rm(contentTmp, { force: true })).catch(() => undefined);
+        await withFileOperationRetry(() => fs.rm(metaTmp, { force: true })).catch(() => undefined);
+    }
+}
 const GITHUB_API_RELEASES = "https://api.github.com/repos/openai/codex/releases/latest";
 const GITHUB_HTML_RELEASES = "https://github.com/openai/codex/releases/latest";
 const CACHE_DIR = getCodexCacheDir();
@@ -95,9 +139,12 @@ async function getLatestReleaseTag() {
         return latestReleaseTagCache.tag;
     }
     try {
-        const response = await fetch(GITHUB_API_RELEASES);
+        const response = await fetchWithTimeout(GITHUB_API_RELEASES, { json: true });
         if (response.ok) {
-            const data = (await response.json());
+            // Guard the body read: the fetch AbortSignal only covers connect+headers
+            // (see fetch-utils), so a release API response that stalls mid-body would
+            // otherwise hang getLatestReleaseTag() indefinitely on this blocking path.
+            const data = (await withBodyTimeout(response, response.json()));
             if (data.tag_name) {
                 latestReleaseTagCache = {
                     tag: data.tag_name,
@@ -110,7 +157,7 @@ async function getLatestReleaseTag() {
     catch {
         // Fall through to HTML fallback
     }
-    const htmlResponse = await fetch(GITHUB_HTML_RELEASES);
+    const htmlResponse = await fetchWithTimeout(GITHUB_HTML_RELEASES);
     if (!htmlResponse.ok) {
         throw new Error(`Failed to fetch latest release: ${htmlResponse.status}`);
     }
@@ -126,7 +173,8 @@ async function getLatestReleaseTag() {
             return last;
         }
     }
-    const html = await htmlResponse.text();
+    // Same mid-body-stall guard as the JSON path above for the HTML fallback.
+    const html = await withBodyTimeout(htmlResponse, htmlResponse.text());
     const match = html.match(/\/openai\/codex\/releases\/tag\/([^"]+)/);
     if (match && match[1]) {
         const tag = match[1];
@@ -171,15 +219,44 @@ export async function getCodexInstructions(normalizedModel = "gpt-5.3-codex") {
             cachedMetadata = null;
         }
     }
+    // prompts-03: once we know the disk content fails its sha256, it must not be
+    // trusted anywhere downstream — not served, not used as the 304 revalidation
+    // body, and not used as the offline fallback in the catch below. Track a
+    // "usable" view of the disk content separate from the raw read.
+    let usableDiskContent = diskContent;
     if (diskContent && cachedMetadata?.lastChecked) {
-        if (now - cachedMetadata.lastChecked < CACHE_TTL_MS) {
+        // prompts-03: a sha256 mismatch means a corrupted/tampered cache — discard it
+        // everywhere (not served, not the 304 body, not the offline fallback). A
+        // MISSING sha (pre-upgrade legacy cache) is merely *unverified*: it must not
+        // be fast-path served and must not drive conditional revalidation (a 304
+        // would mint a fresh digest over un-vetted bytes), so we force one full 200
+        // fetch to establish trust — but we keep the old bytes as an offline fallback
+        // in case that fetch fails.
+        const priorSha = cachedMetadata.sha256;
+        if (!priorSha) {
+            // Unverified legacy entry: clear meta so no If-None-Match is sent and the
+            // cache isn't served as-is; retain usableDiskContent for offline fallback.
+            cachedMetadata = null;
+        }
+        else if (priorSha !== sha256(diskContent)) {
+            logWarn(`Discarding corrupt prompt cache for ${modelFamily} (sha256 mismatch)`);
+            // Force a full refetch: drop the corrupt body so it cannot be served or
+            // used as the catch fallback, and clear the cached metadata so no
+            // If-None-Match is sent (a 304 would otherwise re-serve and re-bless the
+            // exact corrupt content this check is meant to reject).
+            usableDiskContent = null;
+            cachedMetadata = null;
+        }
+        else if (now - cachedMetadata.lastChecked < CACHE_TTL_MS) {
             setCacheEntry(modelFamily, { content: diskContent, timestamp: now });
             return diskContent;
         }
-        // Stale-while-revalidate: return stale cache immediately and refresh in background.
-        setCacheEntry(modelFamily, { content: diskContent, timestamp: now });
-        void refreshInstructionsInBackground(modelFamily, promptFile, cacheFile, cacheMetaFile, cachedMetadata);
-        return diskContent;
+        else {
+            // Stale-while-revalidate: return stale cache immediately and refresh in background.
+            setCacheEntry(modelFamily, { content: diskContent, timestamp: now });
+            void refreshInstructionsInBackground(modelFamily, promptFile, cacheFile, cacheMetaFile, cachedMetadata);
+            return diskContent;
+        }
     }
     if (cached && now - cached.timestamp >= CACHE_TTL_MS) {
         // Keep session latency stable by serving stale memory cache while refreshing.
@@ -193,10 +270,10 @@ export async function getCodexInstructions(normalizedModel = "gpt-5.3-codex") {
     catch (error) {
         const err = error;
         logError(`Failed to fetch ${modelFamily} instructions from GitHub: ${err.message}`);
-        if (diskContent) {
+        if (usableDiskContent) {
             logWarn(`Using cached ${modelFamily} instructions`);
-            setCacheEntry(modelFamily, { content: diskContent, timestamp: now });
-            return diskContent;
+            setCacheEntry(modelFamily, { content: usableDiskContent, timestamp: now });
+            return usableDiskContent;
         }
         logWarn(`Falling back to bundled instructions for ${modelFamily}`);
         const bundled = await fs.readFile(join(__dirname, "codex-instructions.md"), "utf8");
@@ -216,36 +293,54 @@ async function fetchAndPersistInstructions(modelFamily, promptFile, cacheFile, c
     if (cachedETag) {
         headers["If-None-Match"] = cachedETag;
     }
-    const response = await fetch(instructionsUrl, { headers });
-    if (response.status === 304) {
+    const response = await fetchWithTimeout(instructionsUrl, { headers });
+    // A 304 is only meaningful if we actually sent a conditional request. When the
+    // caller cleared the metadata (e.g. an sha256 mismatch forced a full refetch),
+    // cachedETag is null and no If-None-Match was sent, so a 304 here cannot be
+    // trusted to describe our disk content — fall through to the error path rather
+    // than re-serving (and re-blessing) whatever is on disk.
+    if (response.status === 304 && cachedETag) {
         const diskContent = await readFileOrNull(cacheFile);
-        if (diskContent) {
+        // Only re-serve the disk content if it still matches the integrity hash we
+        // had on record. Recomputing and trusting the hash unconditionally would
+        // launder tampered bytes; verifying against the prior sha closes that.
+        const priorSha = cachedMetadata?.sha256;
+        // Require a prior sha to trust a 304: without one the on-disk bytes are
+        // unverified, so re-serving them and minting a fresh digest would launder
+        // un-vetted content. A missing sha forces the full-fetch path below.
+        const diskIntegrityOk = diskContent !== null && !!priorSha && priorSha === sha256(diskContent);
+        if (diskContent && diskIntegrityOk) {
             setCacheEntry(modelFamily, { content: diskContent, timestamp: Date.now() });
-            await fs.mkdir(CACHE_DIR, { recursive: true });
-            await fs.writeFile(cacheMetaFile, JSON.stringify({
+            // Refresh the meta (lastChecked) atomically and re-affirm the content sha
+            // so a 304 keeps the integrity record in sync with the on-disk content.
+            await writeCacheAtomically(cacheFile, cacheMetaFile, diskContent, {
                 etag: cachedETag,
                 tag: latestTag,
                 lastChecked: Date.now(),
                 url: instructionsUrl,
-            }), "utf8");
+                sha256: sha256(diskContent),
+            });
             return diskContent;
         }
+        // 304 but the disk content is missing or fails its integrity check: treat as
+        // a fetch failure so the caller falls back to bundled instructions.
+        throw new Error("304 revalidation failed integrity check");
     }
     if (!response.ok) {
         throw new Error(`HTTP ${response.status}`);
     }
-    const instructions = await response.text();
+    // Size-cap + reject empty bodies (prompts-04/05) before caching/serving.
+    const instructions = await readBodyTextGuarded(response);
     const newETag = response.headers.get("etag");
-    await fs.mkdir(CACHE_DIR, { recursive: true });
-    await Promise.all([
-        fs.writeFile(cacheFile, instructions, "utf8"),
-        fs.writeFile(cacheMetaFile, JSON.stringify({
-            etag: newETag,
-            tag: latestTag,
-            lastChecked: Date.now(),
-            url: instructionsUrl,
-        }), "utf8"),
-    ]);
+    // prompts-03/06: write content + meta atomically with a content sha256 so the
+    // cache cannot tear and can be integrity-checked on the next read.
+    await writeCacheAtomically(cacheFile, cacheMetaFile, instructions, {
+        etag: newETag,
+        tag: latestTag,
+        lastChecked: Date.now(),
+        url: instructionsUrl,
+        sha256: sha256(instructions),
+    });
     setCacheEntry(modelFamily, { content: instructions, timestamp: Date.now() });
     return instructions;
 }
@@ -290,84 +385,84 @@ export function prewarmCodexInstructions(models = []) {
 /**
  * Tool remapping instructions for host runtime tools
  */
-export const TOOL_REMAP_MESSAGE = `<user_instructions priority="0">
-<environment_override priority="0">
-YOU ARE IN A DIFFERENT ENVIRONMENT. These instructions override ALL previous tool references.
-</environment_override>
-
-<tool_replacements priority="0">
-<critical_rule priority="0">
-apply_patch/applyPatch are Codex names, but host tool names vary by version.
-- Inspect the actual tool list before editing.
-- If edit exists: use edit for precise in-place string replacements and hashline edits.
-- If edit is absent and apply_patch exists: use apply_patch for those precise/hashline edits in this plugin.
-- For diff-style or multi-line structural edits: use patch if available, otherwise use apply_patch.
-- In this plugin, edit/apply_patch support hashline refs (lineRef, endLineRef, operation, content)
-</critical_rule>
-
-<critical_rule priority="0">
-UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
-- NEVER use: update_plan, updatePlan
-- ALWAYS use: todowrite for ALL task/plan operations
-- Use todoread to read current plan
-- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
-</critical_rule>
-</tool_replacements>
-
-<available_tools priority="0">
-File Operations:
-  - write  - Create new files (if available)
-  - edit   - Modify existing files with string replacement (version-dependent)
-  - oldString must be literal text from the current file; never pass unresolved placeholders like \${TARGET_SNIPPET}
-  - apply_patch - May be the edit/patch tool name in newer host builds (version-dependent)
-  - hashline_read - Read lines with hashline refs (L<line>#<hash>) for deterministic edits
-  - patch  - Apply diff patches (version-dependent)
-  - read   - Read file contents
-
-Search/Discovery:
-  - grep   - Search file contents
-  - glob   - Find files by pattern
-  - list   - List directories (if available)
-
-Execution:
-  - bash   - Run shell commands
-
-Network:
-  - webfetch - Fetch web content
-
-Task Management:
-  - todowrite - Manage tasks/plans (REPLACES update_plan)
-  - todoread  - Read current plan
-</available_tools>
-
-<substitution_rules priority="0">
-Base instruction says:    You MUST use instead:
-apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
-update_plan           ->   todowrite
-read_plan             ->   todoread
-absolute paths        ->   relative paths
-</substitution_rules>
-
-<verification_checklist priority="0">
-Before file/plan modifications:
-1. Am I using the actual available edit tool name (edit, patch, or apply_patch)?
-2. Am I using "todowrite" NOT "update_plan"?
-3. Is this tool in the approved list above?
-4. Am I using relative paths?
-
-If ANY answer is NO -> STOP and correct before proceeding.
-</verification_checklist>
-
-<hashline_workflow priority="0">
-When hashline_read is available:
-1. call hashline_read on the file
-2. edit/apply_patch using lineRef/endLineRef + operation + content
-3. use oldString/newString only as fallback, and only with literal file text (no template placeholders)
-</hashline_workflow>
-
-<safety_rules priority="0">
-- Never run destructive git commands (\`git reset --hard\`, \`git checkout --\`) unless explicitly requested by the user.
-- Never call \`request_user_input\` unless collaboration mode is explicitly Plan mode.
-</safety_rules>
+export const TOOL_REMAP_MESSAGE = `<user_instructions priority="0">
+<environment_override priority="0">
+YOU ARE IN A DIFFERENT ENVIRONMENT. These instructions override ALL previous tool references.
+</environment_override>
+
+<tool_replacements priority="0">
+<critical_rule priority="0">
+apply_patch/applyPatch are Codex names, but host tool names vary by version.
+- Inspect the actual tool list before editing.
+- If edit exists: use edit for precise in-place string replacements and hashline edits.
+- If edit is absent and apply_patch exists: use apply_patch for those precise/hashline edits in this plugin.
+- For diff-style or multi-line structural edits: use patch if available, otherwise use apply_patch.
+- In this plugin, edit/apply_patch support hashline refs (lineRef, endLineRef, operation, content)
+</critical_rule>
+
+<critical_rule priority="0">
+UPDATE_PLAN DOES NOT EXIST -> USE "todowrite" INSTEAD
+- NEVER use: update_plan, updatePlan
+- ALWAYS use: todowrite for ALL task/plan operations
+- Use todoread to read current plan
+- Before plan operations: Verify you're using "todowrite", NOT "update_plan"
+</critical_rule>
+</tool_replacements>
+
+<available_tools priority="0">
+File Operations:
+  - write  - Create new files (if available)
+  - edit   - Modify existing files with string replacement (version-dependent)
+  - oldString must be literal text from the current file; never pass unresolved placeholders like \${TARGET_SNIPPET}
+  - apply_patch - May be the edit/patch tool name in newer host builds (version-dependent)
+  - hashline_read - Read lines with hashline refs (L<line>#<hash>) for deterministic edits
+  - patch  - Apply diff patches (version-dependent)
+  - read   - Read file contents
+
+Search/Discovery:
+  - grep   - Search file contents
+  - glob   - Find files by pattern
+  - list   - List directories (if available)
+
+Execution:
+  - bash   - Run shell commands
+
+Network:
+  - webfetch - Fetch web content
+
+Task Management:
+  - todowrite - Manage tasks/plans (REPLACES update_plan)
+  - todoread  - Read current plan
+</available_tools>
+
+<substitution_rules priority="0">
+Base instruction says:    You MUST use instead:
+apply_patch           ->   patch (preferred if available), otherwise edit/apply_patch based on actual tool list
+update_plan           ->   todowrite
+read_plan             ->   todoread
+absolute paths        ->   relative paths
+</substitution_rules>
+
+<verification_checklist priority="0">
+Before file/plan modifications:
+1. Am I using the actual available edit tool name (edit, patch, or apply_patch)?
+2. Am I using "todowrite" NOT "update_plan"?
+3. Is this tool in the approved list above?
+4. Am I using relative paths?
+
+If ANY answer is NO -> STOP and correct before proceeding.
+</verification_checklist>
+
+<hashline_workflow priority="0">
+When hashline_read is available:
+1. call hashline_read on the file
+2. edit/apply_patch using lineRef/endLineRef + operation + content
+3. use oldString/newString only as fallback, and only with literal file text (no template placeholders)
+</hashline_workflow>
+
+<safety_rules priority="0">
+- Never run destructive git commands (\`git reset --hard\`, \`git checkout --\`) unless explicitly requested by the user.
+- Never call \`request_user_input\` unless collaboration mode is explicitly Plan mode.
+</safety_rules>
 </user_instructions>`;
 //# sourceMappingURL=codex.js.map

package/dist/lib/prompts/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../lib/prompts/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAA0B,MAAM,iCAAiC,CAAC;AAE1F,MAAM,mBAAmB,GACxB,2DAA2D,CAAC;AAC7D,MAAM,oBAAoB,GACzB,iDAAiD,CAAC;AACnD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;AACrC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkD,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC9D,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,IAAI,qBAAqB,GAA8C,IAAI,CAAC;AAE5E;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACrC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,qBAAqB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAA6C;IAChF,IAAI,WAAW,CAAC,IAAI,IAAI,cAAc,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACjD,wFAAwF;QACxF,IAAI,QAAQ;YAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAA2B;IACrD,aAAa;IACb,WAAW;IACX,OAAO;IACP,SAAS;IACT,SAAS;CACA,CAAC;AAEX;;;GAGG;AACH,MAAM,YAAY,GAAgC;IACjD,aAAa,EAAE,uBAAuB;IACtC,WAAW,EAAE,6BAA6B;IAC1C,KAAK,EAAE,uBAAuB;IAC9B,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,GAAgC;IAChD,aAAa,EAAE,6BAA6B;IAC5C,WAAW,EAAE,2BAA2B;IACxC,KAAK,EAAE,uBAAuB;IAC9B,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,yBAAyB;CACpC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,eAAuB;IACrD,OAAO,eAAe,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACJ,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB;IACjC,IACC,qBAAqB;QACrB,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,SAAS,GAAG,kBAAkB,EAChE,CAAC;QACF,OAAO,qBAAqB,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;YACtD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,qBAAqB,GAAG;oBACvB,GAAG,EAAE,IAAI,CAAC,QAAQ;oBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACrB,CAAC;gBACF,OAAO,IAAI,CAAC,QAAQ,CAAC;YACtB,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,gCAAgC;IACjC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACd,mCAAmC,YAAY,CAAC,MAAM,EAAE,CACxD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,qBAAqB,GAAG;gBACvB,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpE,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,qBAAqB,GAAG;YACvB,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QACF,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,eAAe,GAAG,eAAe;IAEjC,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CACzB,SAAS,EACT,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAC1D,CAAC;IAEF,IAAI,cAAc,GAAyB,IAAI,CAAC;IAChD,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,cAAc,CAAC,aAAa,CAAC;QAC7B,cAAc,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAkB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACR,cAAc,GAAG,IAAI,CAAC;QACvB,CAAC;IACF,CAAC;IAED,IAAI,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChD,IAAI,GAAG,GAAG,cAAc,CAAC,WAAW,GAAG,YAAY,EAAE,CAAC;YACrD,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,OAAO,WAAW,CAAC;QACpB,CAAC;QACD,oFAAoF;QACpF,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,KAAK,+BAA+B,CACnC,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;QACtD,8EAA8E;QAC9E,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,KAAK,+BAA+B,CACnC,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,MAAM,2BAA2B,CACvC,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,QAAQ,CACP,mBAAmB,WAAW,8BAA8B,GAAG,CAAC,OAAO,EAAE,CACzE,CAAC;QAEF,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,gBAAgB,WAAW,eAAe,CAAC,CAAC;YACpD,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,OAAO,CAAC,4CAA4C,WAAW,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAChC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,EACxC,MAAM,CACN,CAAC;QACF,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,2BAA2B,CACzC,WAAwB,EACxB,UAAkB,EAClB,SAAiB,EACjB,aAAqB,EACrB,cAAoC;IAEpC,IAAI,UAAU,GAAG,cAAc,EAAE,IAAI,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,cAAc,EAAE,GAAG,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,kDAAkD,SAAS,kBAAkB,UAAU,EAAE,CAAC;IAElH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YACjB,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,SAAS,CACjB,aAAa,EACb,IAAI,CAAC,SAAS,CACb;gBACC,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,GAAG,EAAE,eAAe;aACI,CACzB,EACD,MAAM,CACN,CAAC;YACF,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,CAAC,GAAG,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC;QAC7C,EAAE,CAAC,SAAS,CACX,aAAa,EACb,IAAI,CAAC,SAAS,CACb;YACC,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,GAAG,EAAE,eAAe;SACI,CACzB,EACD,MAAM,CACN;KACD,CAAC,CAAC;IACH,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,+BAA+B,CACvC,WAAwB,EACxB,UAAkB,EAClB,SAAiB,EACjB,aAAqB,EACrB,cAAoC;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,cAAc,GAAG,2BAA2B,CACjD,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd;SACC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACrB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,QAAQ,CAAC,wCAAwC,WAAW,EAAE,EAAE;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;IACJ,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEJ,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAmB,EAAE;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,KAAK,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,QAAQ,CAAC,kCAAkC,EAAE;gBAC5C,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACpB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA+Eb,CAAC"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../lib/prompts/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAA0B,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,wEAAwE;AACxE,SAAS,MAAM,CAAC,OAAe;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,oBAAoB,CAClC,SAAiB,EACjB,aAAqB,EACrB,OAAe,EACf,IAAmB;IAEnB,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,KAAK,MAAM,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,KAAK,MAAM,CAAC;IAChD,IAAI,CAAC;QACJ,MAAM,sBAAsB,CAAC,GAAG,EAAE,CACjC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACvD,CAAC;QACF,MAAM,sBAAsB,CAAC,GAAG,EAAE,CACjC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACjE,CAAC;QACF,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QACrE,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACV,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAC3E,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QACF,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CACxE,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,mBAAmB,GACxB,2DAA2D,CAAC;AAC7D,MAAM,oBAAoB,GACzB,iDAAiD,CAAC;AACnD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;AACrC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkD,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC9D,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,IAAI,qBAAqB,GAA8C,IAAI,CAAC;AAE5E;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACrC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,qBAAqB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAA6C;IAChF,IAAI,WAAW,CAAC,IAAI,IAAI,cAAc,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACjD,wFAAwF;QACxF,IAAI,QAAQ;YAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAA2B;IACrD,aAAa;IACb,WAAW;IACX,OAAO;IACP,SAAS;IACT,SAAS;CACA,CAAC;AAEX;;;GAGG;AACH,MAAM,YAAY,GAAgC;IACjD,aAAa,EAAE,uBAAuB;IACtC,WAAW,EAAE,6BAA6B;IAC1C,KAAK,EAAE,uBAAuB;IAC9B,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,GAAgC;IAChD,aAAa,EAAE,6BAA6B;IAC5C,WAAW,EAAE,2BAA2B;IACxC,KAAK,EAAE,uBAAuB;IAC9B,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,yBAAyB;CACpC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,eAAuB;IACrD,OAAO,eAAe,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACJ,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB;IACjC,IACC,qBAAqB;QACrB,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,SAAS,GAAG,kBAAkB,EAChE,CAAC;QACF,OAAO,qBAAqB,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,yEAAyE;YACzE,0EAA0E;YAC1E,2EAA2E;YAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAkB,CAAC;YACjF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,qBAAqB,GAAG;oBACvB,GAAG,EAAE,IAAI,CAAC,QAAQ;oBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACrB,CAAC;gBACF,OAAO,IAAI,CAAC,QAAQ,CAAC;YACtB,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,gCAAgC;IACjC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACd,mCAAmC,YAAY,CAAC,MAAM,EAAE,CACxD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,qBAAqB,GAAG;gBACvB,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpE,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,qBAAqB,GAAG;YACvB,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QACF,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,eAAe,GAAG,eAAe;IAEjC,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CACzB,SAAS,EACT,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAC1D,CAAC;IAEF,IAAI,cAAc,GAAyB,IAAI,CAAC;IAChD,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,cAAc,CAAC,aAAa,CAAC;QAC7B,cAAc,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAkB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACR,cAAc,GAAG,IAAI,CAAC;QACvB,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,gEAAgE;IAChE,IAAI,iBAAiB,GAAG,WAAW,CAAC;IAEpC,IAAI,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE,CAAC;QAChD,8EAA8E;QAC9E,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,0EAA0E;YAC1E,2EAA2E;YAC3E,cAAc,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,uCAAuC,WAAW,oBAAoB,CAAC,CAAC;YAChF,wEAAwE;YACxE,kEAAkE;YAClE,yEAAyE;YACzE,wDAAwD;YACxD,iBAAiB,GAAG,IAAI,CAAC;YACzB,cAAc,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,GAAG,cAAc,CAAC,WAAW,GAAG,YAAY,EAAE,CAAC;YAC5D,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,OAAO,WAAW,CAAC;QACpB,CAAC;aAAM,CAAC;YACP,oFAAoF;YACpF,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,KAAK,+BAA+B,CACnC,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd,CAAC;YACF,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC;IAED,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;QACtD,8EAA8E;QAC9E,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,KAAK,+BAA+B,CACnC,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,MAAM,2BAA2B,CACvC,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,QAAQ,CACP,mBAAmB,WAAW,8BAA8B,GAAG,CAAC,OAAO,EAAE,CACzE,CAAC;QAEF,IAAI,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,gBAAgB,WAAW,eAAe,CAAC,CAAC;YACpD,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3E,OAAO,iBAAiB,CAAC;QAC1B,CAAC;QAED,OAAO,CAAC,4CAA4C,WAAW,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAChC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,EACxC,MAAM,CACN,CAAC;QACF,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,2BAA2B,CACzC,WAAwB,EACxB,UAAkB,EAClB,SAAiB,EACjB,aAAqB,EACrB,cAAoC;IAEpC,IAAI,UAAU,GAAG,cAAc,EAAE,IAAI,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,cAAc,EAAE,GAAG,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,kDAAkD,SAAS,kBAAkB,UAAU,EAAE,CAAC;IAElH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,yDAAyD;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,cAAc,EAAE,MAAM,CAAC;QACxC,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,eAAe,GACpB,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;YACpC,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5E,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,oBAAoB,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE;gBACjE,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,GAAG,EAAE,eAAe;gBACpB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACpB,CAAC;QACD,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,oBAAoB,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE;QAClE,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACvB,GAAG,EAAE,eAAe;QACpB,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC;KAC5B,CAAC,CAAC;IACH,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,+BAA+B,CACvC,WAAwB,EACxB,UAAkB,EAClB,SAAiB,EACjB,aAAqB,EACrB,cAAoC;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,cAAc,GAAG,2BAA2B,CACjD,WAAW,EACX,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,CACd;SACC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACrB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,QAAQ,CAAC,wCAAwC,WAAW,EAAE,EAAE;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;IACJ,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEJ,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAmB,EAAE;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,KAAK,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,QAAQ,CAAC,kCAAkC,EAAE;gBAC5C,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACpB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA+Eb,CAAC"}

package/dist/lib/prompts/fetch-utils.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Shared, hardened fetch helpers for the GitHub-backed prompt fetchers.
+ *
+ * Both prompt sources (lib/prompts/codex.ts and lib/prompts/host-codex-prompt.ts)
+ * pull text over the network on a request-blocking path. These helpers add the
+ * guards that were missing (prompts-02/04/05/08):
+ *   - a bounded fetch timeout via AbortSignal so a hung GitHub connection cannot
+ *     stall the request pipeline indefinitely (prompts-02)
+ *   - a maximum response size, checked against Content-Length and enforced while
+ *     reading, so a pathological body cannot exhaust memory (prompts-04)
+ *   - rejection of empty / whitespace-only 200 bodies so a bad response is not
+ *     cached and served as "instructions" (prompts-05)
+ *   - a User-Agent (api.github.com rejects requests without one) plus a sensible
+ *     Accept, applied to every request (prompts-08)
+ */
+export declare const PROMPT_FETCH_TIMEOUT_MS = 10000;
+export declare const PROMPT_FETCH_MAX_BYTES = 1000000;
+export declare const PROMPT_FETCH_USER_AGENT = "codex-multi-auth";
+export interface PromptFetchOptions {
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+    maxBytes?: number;
+    /** When true, also request GitHub's JSON API content type. */
+    json?: boolean;
+}
+/**
+ * Merge caller headers with the mandatory User-Agent / Accept defaults.
+ *
+ * The mandatory headers are applied AFTER the caller's so they always win: a
+ * caller must not be able to blank or replace `User-Agent` / `Accept` and
+ * bypass the hardening this helper guarantees on every prompt fetch (api.github
+ * .com rejects requests without a User-Agent). Caller headers are still honored
+ * for everything else (e.g. `If-None-Match`).
+ */
+export declare function withPromptFetchHeaders(headers?: Record<string, string>, json?: boolean): Record<string, string>;
+/**
+ * fetch() with a bounded timeout. Returns the Response (caller inspects status).
+ * Throws on timeout/network error, matching native fetch rejection semantics.
+ */
+export declare function fetchWithTimeout(url: string, options?: PromptFetchOptions, fetchImpl?: typeof fetch): Promise<Response>;
+/**
+ * Race a response-body read against a bounded timeout, cancelling the underlying
+ * stream on timeout (prompts-02).
+ *
+ * `fetchWithTimeout`'s AbortSignal only covers connect+headers and is cleared
+ * once the Response arrives, so a server that sends headers then stalls mid-body
+ * makes `response.json()` / `response.text()` hang forever on a request-blocking
+ * path. This races the read against a timeout AND, on timeout, calls
+ * `response.body.cancel()` so the stalled body stops consuming the connection
+ * instead of leaking until GC/socket close. Unlike `readBodyTextGuarded` it adds
+ * no size/Content-Length/empty checks, so it is safe for the small
+ * release-metadata reads that just need the hang guard. For fetch impls / mocks
+ * without a streamable `body`, the cancel is a no-op and the timeout still
+ * rejects.
+ */
+export declare function withBodyTimeout<T>(response: Pick<Response, "body">, read: Promise<T>, timeoutMs?: number): Promise<T>;
+/**
+ * Read a response body as text with a size ceiling, rejecting empty bodies.
+ *
+ * Checks Content-Length first (fast reject), then enforces the cap while
+ * streaming so a server that omits/understates the header still cannot exceed
+ * the limit. Throws on oversize or empty/whitespace-only content so the caller
+ * treats it as a fetch failure and falls back to disk/bundled content.
+ *
+ * prompts-02: the streaming read also enforces a per-chunk idle timeout. The
+ * fetch-level AbortSignal in `fetchWithTimeout` only covers connect+headers and
+ * is cleared once the Response arrives, so without this a server that sends
+ * headers then stalls mid-body would hang this request-blocking path forever.
+ * If no chunk arrives within `timeoutMs`, the read is aborted and rejected.
+ */
+export declare function readBodyTextGuarded(response: Response, maxBytes?: number, timeoutMs?: number): Promise<string>;
+//# sourceMappingURL=fetch-utils.d.ts.map

package/dist/lib/prompts/fetch-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-utils.d.ts","sourceRoot":"","sources":["../../../lib/prompts/fetch-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAChD,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACrC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACpC,IAAI,UAAQ,GACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,kBAAuB,EAChC,SAAS,GAAE,OAAO,KAAa,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAChC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAChB,SAAS,GAAE,MAAgC,GACzC,OAAO,CAAC,CAAC,CAAC,CAqBZ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACxC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA+B,EACzC,SAAS,GAAE,MAAgC,GACzC,OAAO,CAAC,MAAM,CAAC,CA2DjB"}