codex-openai-proxy 0.1.0-rc.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 John Chen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,253 @@
+# codex-openai-proxy
+
+`codex-openai-proxy` lets software written for the OpenAI Chat Completions API talk to Codex through a local HTTP endpoint. It runs `codex app-server`, uses your ChatGPT login, and keeps the listener on your machine.
+
+The package is in prerelease. Text completions, streaming, function tools, usage metadata, thread continuation, and per-request Codex policy selection are implemented.
+
+## Quick start
+
+Install Node.js 20 or newer, then start the prerelease from the narrowest directory tree Codex should be allowed to use:
+
+```sh
+npx --yes codex-openai-proxy@next serve --root /absolute/path/to/project
+```
+
+The proxy listens at `http://127.0.0.1:8787` by default. On first use it starts the ChatGPT login flow. Interactive terminals open the authorization page when possible; non-interactive terminals use device-code login.
+
+Check that the HTTP process is alive and that Codex is ready:
+
+```sh
+curl http://127.0.0.1:8787/health
+curl http://127.0.0.1:8787/ready
+```
+
+`/health` reports proxy liveness. `/ready` returns HTTP 503 until app-server initialization and authentication finish, and while the proxy is recovering from an app-server failure.
+
+To install the command instead of using `npx`:
+
+```sh
+npm install --global codex-openai-proxy@next
+codex-openai-proxy serve --root /absolute/path/to/project
+```
+
+After a stable release, omit `@next` from the `npx` and install commands. Installing the package does not start Codex, perform login, or run a proxy install script; those actions begin only when you run `serve`.
+
+The package includes the exact `@openai/codex` version used to generate its app-server contract: `0.144.5`. The proxy uses that package-owned executable by default. An explicit `--codex-path` override must report exactly `codex-cli 0.144.5`; both older and newer overrides are rejected until this package's generated contract is updated.
+
+## Use an OpenAI client
+
+Point an OpenAI-compatible client at the local `/v1` base URL. The proxy does not require a local API key, although some client libraries require a non-empty placeholder value.
+
+```js
+import OpenAI from "openai";
+
+const client = new OpenAI({
+  baseURL: "http://127.0.0.1:8787/v1",
+  apiKey: "local",
+});
+
+const completion = await client.chat.completions.create({
+  model: "gpt-5.4-mini",
+  messages: [{ role: "user", content: "Summarize this project." }],
+});
+
+console.log(completion.choices[0].message.content);
+```
+
+The equivalent request with `curl` is:
+
+```sh
+curl http://127.0.0.1:8787/v1/chat/completions \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "model": "gpt-5.4-mini",
+    "messages": [{"role": "user", "content": "Summarize this project."}]
+  }'
+```
+
+## OpenAI-compatible behavior
+
+The proxy intentionally implements a focused subset of Chat Completions rather than every OpenAI API endpoint.
+
+Standard behavior includes:
+
+- `POST /v1/chat/completions` with text-only `system`, `developer`, `user`, `assistant`, and `tool` messages;
+- streaming and non-streaming responses;
+- Chat Completions SSE framing ending with `data: [DONE]`;
+- assistant text in `choices[].message.content` or `choices[].delta.content`;
+- client-defined function tools, `tool_calls`, and `finish_reason: "tool_calls"`;
+- `stream_options.include_usage`; and
+- OpenAI-shaped JSON errors.
+
+The proxy ignores harmless unsupported top-level Chat Completions fields and writes one structured warning for the request. It rejects malformed, ambiguous, or unsafe input instead of approximating it.
+
+This is not a general OpenAI API server. It does not provide the Responses API, embeddings, images, audio, model management, or remote network serving. Message content is currently text-only, and `tool_choice` currently supports only `"auto"` and `"none"`.
+
+## Streaming
+
+Set `stream: true` as with a standard Chat Completions request:
+
+```sh
+curl -N http://127.0.0.1:8787/v1/chat/completions \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "model": "gpt-5.4-mini",
+    "messages": [{"role": "user", "content": "Describe this repository."}],
+    "stream": true,
+    "stream_options": {"include_usage": true}
+  }'
+```
+
+Standard clients can consume assistant text, client-defined function calls, the final finish reason, and the optional usage chunk without understanding Codex-specific data. Internal activity requires clients that tolerate the direct compatibility fields described below.
+
+## Function tools
+
+Function tools use the normal multi-request Chat Completions flow:
+
+1. Send the function definitions in `tools`.
+2. Receive an assistant response containing `tool_calls`.
+3. Execute the requested functions in your client.
+4. Send the assistant tool-call message followed by matching `role: "tool"` messages, repeating the same `tools` definition and the same `x_codex` policy settings from the original request.
+
+By default, the proxy associates tool results with the one pending Codex turn through their `tool_call_id` values. Start it with `--implicit-tool-continuation false` if every tool-result request should instead supply the Codex continuation field described below. Either way, a tool-result request whose effective `x_codex` settings differ from the original request is rejected with `continuation_policy_mismatch` and leaves the pending call intact for a corrected retry. Omitted settings are allowed only when they resolve to the same effective values.
+
+Pending tool calls are held in memory for five minutes by default. They cannot survive a proxy restart; completed threads can.
+
+## Codex-specific extensions
+
+Codex-specific behavior is additive but nonstandard. Clients that require strict Chat Completions response objects must ignore or strip the response extensions described here.
+
+### Continue a Codex thread
+
+`previous_response_id` is a top-level, nonstandard `x_codex` continuation extension; it is not a standard Chat Completions field and is not nested inside the `x_codex` object. Pass the `id` from the newest completed response to continue its persisted Codex thread:
+
+```json
+{
+  "model": "gpt-5.4-mini",
+  "messages": [{ "role": "user", "content": "Now explain the test strategy." }],
+  "previous_response_id": "chatcmpl_codex_..."
+}
+```
+
+A continuation must use the same model and function-tool definitions as the original thread. The proxy rejects unknown, expired, superseded, busy, or incompatible response IDs and never silently starts a replacement thread. Only the newest response can be continued; branching from an older response is not supported.
+
+### Receive Codex activity
+
+The proxy sends Codex activity directly on the assistant delta/message. Text uses the standard `content` shape and calls use the standard `tool_calls` shape. Exposed reasoning uses the nonstandard `reasoning` field (never `reasoning_summary`) and results use the nonstandard `tool_results` field. These are Codex-specific direct compatibility extensions, not standard Chat Completions fields and not fields inside a response-side `x_codex` object. Streaming order is SSE chunk order; non-streaming responses aggregate those fields while preserving text that appeared before a call.
+
+Internal app-server commands, file changes, MCP calls, web searches, collaboration calls, and other supported tool-like items are represented as function-shaped calls. The first event announces a call in `tool_calls`. Later progress and terminal events place bounded status/content plus the matching function metadata in nonstandard `tool_results` without repeating complete call arguments; an orphan result also introduces its reconstructable call. These calls are observational and are already executed by app-server; clients must not execute them. They do not cause `finish_reason: "tool_calls"`.
+
+Client-defined dynamic functions still suspend with `finish_reason: "tool_calls"` and require the normal follow-up `role: "tool"` messages. The continuation response begins with the accepted calls and nonstandard `tool_results` together, then streams later nonstandard reasoning, standard text, or internal activity from the same turn. The top-level request extension `previous_response_id` and the policy fields nested under `x_codex` remain distinct from these direct response fields.
+
+### Select Codex policy
+
+Working-directory, sandbox, and web-search controls are nonstandard request extensions nested under `x_codex`:
+
+```json
+{
+  "model": "gpt-5.4-mini",
+  "messages": [{ "role": "user", "content": "Review this project." }],
+  "x_codex": {
+    "cwd": "/absolute/path/to/project",
+    "sandbox": "workspace-write",
+    "web_search": "disabled"
+  }
+}
+```
+
+`cwd` must be an existing absolute directory whose resolved path is the configured root or one of its descendants. Symlink escapes, sibling directories, relative paths, files, and nonexistent paths are rejected. Omit it to use the root.
+
+`sandbox` accepts `read-only`, `workspace-write`, or `danger-full-access` and defaults to `read-only`. Full access is never selected implicitly and cannot bypass managed app-server requirements. `web_search` accepts `disabled`, `cached`, `indexed`, or `live` and defaults to `disabled`. The proxy applies web-search configuration per Codex thread and never edits shared Codex configuration to simulate a request setting.
+
+Approval policy is proxy-owned and non-interactive. The proxy prefers `never`, selects `auto_review` when managed policy permits it, and immediately declines any unexpected approval request with the method's supported response. Organization or machine requirements are loaded from app-server and disallowed selections fail instead of falling back.
+
+Continuations must repeat the same effective `x_codex` settings. A change is rejected with `continuation_cwd_mismatch` or `continuation_policy_mismatch` before the thread is resumed.
+
+The machine-readable request-extension schema is [protocol/schemas/x-codex.schema.json](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/protocol/schemas/x-codex.schema.json), shipped inside the installed package at `protocol/schemas/x-codex.schema.json`. `previous_response_id` is the separate top-level nonstandard continuation extension. Response `reasoning` and `tool_results` are nonstandard direct compatibility fields rather than standard Chat Completions fields or fields inside a response-side `x_codex` object.
+
+> **Project trust side effect:** Starting a new thread with `workspace-write` and a `cwd` can cause app-server to mark that project as trusted in the user's `config.toml`. Set `--root` to the narrowest appropriate boundary; the proxy will not cause app-server to trust a directory outside it.
+
+> **State directory placement:** Under `workspace-write` the Codex agent can write anywhere in the effective `cwd`. The proxy therefore derives its continuation store from the canonical root and keeps it outside that root by default (under `~/.codex-openai-proxy`, namespaced per root). Startup fails if a broad root would contain the default store. Relative `--state-dir` values are resolved against the canonical root. Pointing `--state-dir` back inside the root explicitly lets a writable-sandbox turn modify the store, so keep it outside the root.
+
+The versioned on-disk shape is documented by [protocol/schemas/response-mapping.schema.json](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/protocol/schemas/response-mapping.schema.json), shipped inside the installed package at `protocol/schemas/response-mapping.schema.json`.
+
+## Usage metadata
+
+When app-server reports a complete exact last-turn usage record, the proxy returns standard `prompt_tokens`, `completion_tokens`, and `total_tokens`. It also returns cached-input and reasoning-token detail when available. If app-server reports no complete record, the `usage` object is omitted; unavailable optional details are omitted. Malformed partial records fail instead of being estimated.
+
+## Safety and local operation
+
+The listener accepts only `127.0.0.1`, `::1`, or `localhost`; configuration normalizes `localhost` to `127.0.0.1`. Every route requires an exact `Host` authority of `localhost`, `127.0.0.1`, or `[::1]`, optionally followed by a valid port. Missing, malformed, non-loopback, DNS-alias, and rebinding-style authorities are rejected. Any request carrying an `Origin` header is rejected, including health requests. Chat Completions accepts only JSON POST bodies, so browser-simple form submissions fail closed.
+
+There is no proxy bearer-token check, so any process running as your local user may be able to call it. Continuation state is private to that user where the platform supports POSIX permissions. See the [security model](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/docs/security.md) for the threat model, audit boundary, and debug-logging policy.
+
+The launch directory is the default root for Codex work. Set a narrower boundary when needed:
+
+```sh
+npx --yes codex-openai-proxy@next serve --root /absolute/path/to/project
+```
+
+The proxy writes structured JSON logs to stderr. Default logs omit working directories and command details. `--log-level debug` is the opt-in diagnostic mode and may reveal the configured root or redacted app-server diagnostic context, so capture it carefully. Run `npx --yes codex-openai-proxy@next --help` for all server, timeout, capacity, logging, state, and Codex executable options.
+
+## Limits and recovery
+
+The safe defaults are a 1 MiB JSON body, 100 concurrent HTTP requests, a 30-second request deadline, a five-minute suspended dynamic-tool deadline, and a 10-second graceful-shutdown deadline. Each is configurable through the CLI. A full HTTP request pool rejects new work with HTTP 429 `overloaded`; requests never enter an unbounded queue. A second request for an active Codex thread is rejected with HTTP 409 `thread_busy`.
+
+If app-server exits unexpectedly, `/ready` returns 503 while the proxy retries after bounded 1, 3, 5, and 10 second delays. Completed continuation records can survive a restart. Suspended client-defined tool calls cannot: shutdown or transport replacement fails their pending app-server requests and expires their mappings.
+
+## Known incompatibilities
+
+This proxy implements only the focused Chat Completions subset described above. In particular:
+
+- content is text-only; multimodal message parts are unsupported;
+- only one choice is produced, and harmless unsupported sampling/output fields are ignored with one warning;
+- `tool_choice` supports only `auto` and `none`;
+- response `reasoning` and `tool_results` require clients that tolerate nonstandard fields;
+- continuation is linear and bound to the original model, tools, canonical cwd, and effective policy; and
+- no endpoint other than health, readiness, and `POST /v1/chat/completions` is implemented.
+
+## Troubleshooting
+
+- If `/ready` returns 503, inspect the structured terminal logs for authentication, managed-policy, version, or bounded-restart failures.
+- If startup reports an address conflict, choose another loopback `--port` or stop the process already using it.
+- If the package-owned Codex executable is missing, reinstall the package for the current platform. If an override is rejected, remove `--codex-path` or supply an executable whose `--version` output reports exactly `codex-cli 0.144.5`.
+- If login fails or times out, keep the terminal open, retry `serve`, and follow the browser or device-code prompt. Inspect only redacted structured logs before enabling debug output.
+- If a policy request is denied, choose a value permitted by the loaded managed requirements; the proxy will not silently weaken or substitute policy.
+- Use `--log-level debug` only for temporary diagnosis. Debug output is a sensitive-data opt-in and should not be attached to issues without review.
+
+## Uninstall and state cleanup
+
+An `npx` invocation does not create a global package installation. Remove an explicit global or project installation with:
+
+```sh
+npm uninstall --global codex-openai-proxy
+# Or, from a project that installed it locally:
+npm uninstall codex-openai-proxy
+```
+
+Uninstalling does not delete continuation mappings. By default they live under `~/.codex-openai-proxy`, with one directory per canonical `--root`. Stop every proxy using the target root before cleanup. Delete only that root's namespace if other roots must remain, or delete `~/.codex-openai-proxy` to remove all default proxy continuation state. If you supplied `--state-dir`, clean that directory instead. Removing a namespace permanently invalidates its `previous_response_id` values but does not remove Codex's own threads or ChatGPT login.
+
+The namespace name is the first 16 hexadecimal characters of the SHA-256 digest of the canonical absolute root. This command prints it without deleting anything:
+
+```sh
+node -e 'const c=require("node:crypto"),f=require("node:fs");const p=f.realpathSync(process.argv[1]);console.log(c.createHash("sha256").update(p).digest("hex").slice(0,16))' /absolute/path/to/project
+```
+
+Inspect `~/.codex-openai-proxy/<printed-namespace>` before deleting it.
+
+## Verification modes
+
+`npm ci && npm run check` is the deterministic offline gate. It regenerates the pinned protocol in a temporary tree for comparison, type-checks both Vitest configurations, and runs bounded property and compatibility tests. The required CI definition runs that gate on Node.js 20, 22, 24, and 26 on Linux and Node.js 24 on macOS and Windows. Coverage and its floors run only on the primary Linux Node.js 24 job and remain enabled by default for local `npm test`.
+
+`npm run test:package` builds one tarball, seeds an isolated npm cache from the exact Codex packages already installed by `npm ci`, installs that exact proxy tarball in npm offline mode with lifecycle scripts disabled, and invokes the generated npm bin shim against a local fake app-server. The smoke performs no registry request, login, or live model call; its only HTTP traffic is loopback test traffic. The default command cleans up the tarball. Release automation uses `npm run test:package -- --retain` and publishes the retained, tested file rather than rebuilding from the source directory.
+
+`npm run test:package -- --registry-install` is the separate networked packaging check. It uses an isolated empty cache to fetch the exact runtime and current-platform Codex packages, then runs the same tarball/bin-shim smoke. A dispatch-only three-operating-system workflow keeps this registry availability check outside required offline CI.
+
+`npm run test:live` is a separate opt-in compatibility check using the dedicated live configuration. It is serial, uses only `gpt-5.4-mini`, normally makes five model calls, and has a hard maximum of six. The manual online workflow additionally requires explicit environment authorization and a nonempty `CODEX_ACCESS_TOKEN`; headless execution never prints device-code URLs or codes. It is never a pull-request prerequisite.
+
+## Project documentation
+
+- [Repository guide](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/docs/development.md) explains the source layout, development commands, tests, and generated protocol files.
+- [Security model](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/docs/security.md) records the local threat model and audit decisions.
+- [Implementation plan](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/plans/README.md) tracks product decisions, completed stages, and remaining work.
+- [App-server protocol reference](https://github.com/CIVITAS-John/codex-app-server-to-proxy/blob/main/docs/codex-app-server.md) is the checked-in upstream protocol reference used during implementation.

package/dist/app-server/app-server.d.ts

@@ -0,0 +1,39 @@
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { JsonRpcTransport } from "./json-rpc.js";
+import type { Logger } from "../core/logger.js";
+import { type PolicyRequirements } from "../core/policy.js";
+/** Identifies this proxy to app-server during initialization. */
+export declare const CLIENT_NAME = "codex-openai-proxy";
+/** Version of this proxy package and app-server client. */
+export declare const CLIENT_VERSION: string;
+/** Exact Codex CLI version supported by this proxy build. */
+export declare const PINNED_CODEX_VERSION: string;
+/** Process command and argument prefix used to invoke Codex without a shell. */
+export interface CodexInvocation {
+    command: string;
+    prefixArgs: string[];
+}
+/** Resolves the package-owned Codex executable unless explicitly overridden. */
+export declare function resolveCodexExecutable(configuredPath: string): string;
+/** Resolves a cross-platform process invocation for package-owned or explicit Codex. */
+export declare function resolveCodexInvocation(configuredPath: string): CodexInvocation;
+/** Owns the initialized app-server process and its JSON-RPC transport. */
+export interface AppServer {
+    rpc: JsonRpcTransport;
+    requirements: PolicyRequirements;
+    child: ChildProcessWithoutNullStreams;
+    stop(): Promise<void>;
+}
+/** Configures app-server process startup and shutdown. */
+export interface StartAppServerOptions {
+    codexPath: string;
+    root: string;
+    startupTimeoutMs: number;
+    shutdownTimeoutMs: number;
+    log: Logger;
+    diagnosticLogging?: boolean;
+    spawnProcess?: typeof spawn;
+    signal?: AbortSignal;
+}
+/** Starts, verifies, and initializes an app-server child process. */
+export declare function startAppServer(options: StartAppServerOptions): Promise<AppServer>;

package/dist/app-server/app-server.js

@@ -0,0 +1,261 @@
+import { spawn, } from "node:child_process";
+import { once } from "node:events";
+import { JsonRpcTransport, RpcError } from "./json-rpc.js";
+import { parsePolicyRequirements, selectApprovalPolicy, selectApprovalsReviewer, UNRESTRICTED_POLICY_REQUIREMENTS, } from "../core/policy.js";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { redact } from "../core/redact.js";
+import { listenForAbort, withDeadline } from "../core/abort.js";
+/** Identifies this proxy to app-server during initialization. */
+export const CLIENT_NAME = "codex-openai-proxy";
+/** Version of this proxy package and app-server client. */
+export const CLIENT_VERSION = createRequire(import.meta.url)("../../package.json").version;
+/** Reads the exact runtime dependency used as the compatibility contract. */
+function codexPackageMetadata() {
+    const require = createRequire(import.meta.url);
+    const packageJsonPath = require.resolve("@openai/codex/package.json");
+    return {
+        packageJsonPath,
+        packageJson: require(packageJsonPath),
+    };
+}
+/** Exact Codex CLI version supported by this proxy build. */
+export const PINNED_CODEX_VERSION = codexPackageMetadata().packageJson.version;
+/** Resolves the package-owned Codex executable unless explicitly overridden. */
+export function resolveCodexExecutable(configuredPath) {
+    if (configuredPath !== "codex")
+        return configuredPath;
+    const { packageJsonPath, packageJson } = codexPackageMetadata();
+    const bin = typeof packageJson.bin === "string"
+        ? packageJson.bin
+        : packageJson.bin?.codex;
+    if (!bin)
+        throw new Error("@openai/codex does not declare a codex binary");
+    return resolve(dirname(packageJsonPath), bin);
+}
+/** Resolves a cross-platform process invocation for package-owned or explicit Codex. */
+export function resolveCodexInvocation(configuredPath) {
+    const executable = resolveCodexExecutable(configuredPath);
+    return configuredPath === "codex"
+        ? { command: process.execPath, prefixArgs: [executable] }
+        : { command: executable, prefixArgs: [] };
+}
+/** Starts, verifies, and initializes an app-server child process. */
+export async function startAppServer(options) {
+    const spawnProcess = options.spawnProcess ?? spawn;
+    const invocation = resolveCodexInvocation(options.codexPath);
+    await verifyCodex(invocation, options.root, options.startupTimeoutMs, spawnProcess, options.signal);
+    if (options.signal?.aborted)
+        throw abortReason(options.signal);
+    const child = spawnProcess(invocation.command, [...invocation.prefixArgs, "app-server"], {
+        cwd: options.root,
+        shell: false,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    await waitForSpawn(child, options.signal);
+    const rpc = new JsonRpcTransport(child.stdout, child.stdin);
+    let stopping;
+    const stop = () => (stopping ??= stopChild(child, rpc, options.shutdownTimeoutMs));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => {
+        options.log("warn", "app_server_stderr", {
+            message: "[REDACTED_DIAGNOSTIC]",
+        });
+        if (options.diagnosticLogging)
+            options.log("debug", "app_server_stderr_detail", {
+                message: redact(chunk, options.root).trim().slice(0, 2_000),
+            });
+    });
+    rpc.on("malformed", () => options.log("error", "app_server_malformed_output"));
+    rpc.on("request", (request) => failClosed(rpc, request, options.log));
+    child.once("exit", (code, signal) => {
+        rpc.close(new Error(`app-server exited (${code ?? signal ?? "unknown"})`));
+        options.log("error", "app_server_exited", { code, signal });
+    });
+    let requirements;
+    try {
+        await requestWithTimeout(rpc, "initialize", {
+            clientInfo: {
+                name: CLIENT_NAME,
+                title: "Codex OpenAI proxy",
+                version: CLIENT_VERSION,
+            },
+            capabilities: { experimentalApi: true },
+        }, options.startupTimeoutMs, options.signal);
+        rpc.notify("initialized");
+        requirements = await readConfigRequirements(rpc, options.startupTimeoutMs, options.signal);
+    }
+    catch (error) {
+        await stop();
+        throw error;
+    }
+    return {
+        rpc,
+        requirements,
+        child,
+        async stop() {
+            await stop();
+        },
+    };
+}
+/** Reads optional managed constraints without hiding malformed responses. */
+async function readConfigRequirements(rpc, timeoutMs, signal) {
+    let value;
+    try {
+        value = await requestWithTimeout(rpc, "configRequirements/read", undefined, timeoutMs, signal);
+    }
+    catch (error) {
+        if (error instanceof RpcError && error.rpcCode === -32601)
+            return UNRESTRICTED_POLICY_REQUIREMENTS;
+        throw error;
+    }
+    const requirements = parsePolicyRequirements(value);
+    // Managed requirements are fixed for the process lifetime, so an allowlist
+    // that permits no proxy-supported approval policy or reviewer is a deployment
+    // misconfiguration. Fail startup here rather than surfacing it as a per-request
+    // 400 that misleadingly blames the client's x_codex.
+    selectApprovalPolicy(requirements);
+    selectApprovalsReviewer(requirements);
+    return requirements;
+}
+/** Verifies that a configured executable matches the pinned contract version. */
+async function verifyCodex(invocation, cwd, timeoutMs, spawnProcess, externalSignal) {
+    if (externalSignal?.aborted)
+        throw abortReason(externalSignal);
+    const child = spawnProcess(invocation.command, [...invocation.prefixArgs, "--version"], {
+        cwd,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    await waitForSpawn(child, externalSignal);
+    const output = [];
+    child.stdout.on("data", (chunk) => output.push(chunk));
+    const timeoutReason = new Error("Codex version check timed out.");
+    await withDeadline(externalSignal, {
+        milliseconds: timeoutMs,
+        timeoutReason,
+        abortReason,
+    }, async (deadlineSignal) => {
+        const disposeAbort = listenForAbort(deadlineSignal, () => {
+            child.kill("SIGKILL");
+        });
+        try {
+            const [code, exitSignal] = await once(child, "exit");
+            // A parent cancellation wins even when it races the version deadline.
+            if (externalSignal?.aborted)
+                throw abortReason(externalSignal);
+            if (deadlineSignal.reason === timeoutReason && exitSignal === "SIGKILL")
+                throw timeoutReason;
+            if (code !== 0)
+                throw new Error("Codex version check failed.");
+            const value = Buffer.concat(output).toString("utf8").trim();
+            const match = /^codex-cli (\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(value);
+            if (!match)
+                throw new Error("The configured executable did not identify itself as Codex.");
+            if (match[1] !== PINNED_CODEX_VERSION)
+                throw new Error(`Unsupported Codex version ${match[1]}; expected ${PINNED_CODEX_VERSION}.`);
+        }
+        finally {
+            disposeAbort();
+        }
+    });
+}
+/** Bounds an initialization request with an abortable deadline. */
+async function requestWithTimeout(rpc, method, params, timeoutMs, externalSignal) {
+    return await withDeadline(externalSignal, {
+        milliseconds: timeoutMs,
+        timeoutReason: new Error(`${method} timed out.`),
+        abortReason,
+    }, async (deadlineSignal) => await rpc.request(method, params, deadlineSignal));
+}
+/** Gracefully stops app-server, escalating to SIGKILL after the deadline. */
+async function stopChild(child, rpc, timeoutMs) {
+    rpc.close(new Error("proxy shutting down"));
+    if (child.exitCode !== null || child.signalCode !== null)
+        return;
+    // Keep stdin open while signaling: on Linux, closing the pipe can make the
+    // child exit on EOF before its JavaScript SIGTERM handler is dispatched.
+    // Node closes the child's stdio automatically once the process exits.
+    child.kill("SIGTERM");
+    await withDeadline(undefined, {
+        milliseconds: timeoutMs,
+        timeoutReason: new Error("app-server shutdown timed out"),
+    }, async (deadlineSignal) => {
+        const disposeDeadline = listenForAbort(deadlineSignal, () => {
+            child.kill("SIGKILL");
+        });
+        try {
+            await once(child, "exit");
+        }
+        finally {
+            disposeDeadline();
+        }
+    });
+}
+/** Waits until a child either spawns successfully or reports an error. */
+async function waitForSpawn(child, signal) {
+    if (child.pid !== undefined)
+        return;
+    await new Promise((resolve, reject) => {
+        let disposeAbort = () => undefined;
+        const cleanup = () => {
+            child.off("spawn", onSpawn);
+            child.off("error", onError);
+            disposeAbort();
+        };
+        const onSpawn = () => {
+            cleanup();
+            resolve();
+        };
+        const onError = (error) => {
+            cleanup();
+            reject(error);
+        };
+        const onAbort = (abortedSignal) => {
+            cleanup();
+            child.kill("SIGKILL");
+            reject(abortReason(abortedSignal));
+        };
+        child.once("spawn", onSpawn);
+        child.once("error", onError);
+        disposeAbort = listenForAbort(signal, onAbort);
+    });
+}
+/** Returns a stable Error reason for lifecycle cancellation. */
+function abortReason(signal) {
+    return signal.reason instanceof Error
+        ? signal.reason
+        : new Error("app-server startup cancelled");
+}
+/** Method-specific result bodies for unsolicited app-server requests. */
+const FAIL_CLOSED_RESPONSES = new Map([
+    ["item/tool/requestUserInput", { answers: {} }],
+    ["mcpServer/elicitation/request", { action: "decline", content: null }],
+    ["item/commandExecution/requestApproval", { decision: "decline" }],
+    ["item/fileChange/requestApproval", { decision: "decline" }],
+    ["applyPatchApproval", { decision: "denied" }],
+    ["execCommandApproval", { decision: "denied" }],
+    [
+        "item/permissions/requestApproval",
+        // Omitting every requested permission is the protocol's explicit denial.
+        { permissions: {}, scope: "turn" },
+    ],
+]);
+/** Declines one unsolicited app-server request with its method-specific response. */
+function failClosed(rpc, request, log) {
+    if (request.method === "item/tool/call") {
+        // The continuation coordinator centrally routes this callback by thread.
+        return;
+    }
+    else {
+        const response = FAIL_CLOSED_RESPONSES.get(request.method);
+        if (response === undefined)
+            rpc.respondError(request.id, {
+                code: -32601,
+                message: "Unsupported server request",
+            });
+        else
+            rpc.respond(request.id, response);
+    }
+    log("warn", "app_server_request_declined", { method: request.method });
+}
+//# sourceMappingURL=app-server.js.map

package/dist/app-server/app-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-server.js","sourceRoot":"","sources":["../../src/app-server/app-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,GAGN,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAE/E,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,gCAAgC,GAEjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhE,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAOhD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,cAAc,GACzB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CACpD,CAAC,OAAO,CAAC;AAQV,6EAA6E;AAC7E,SAAS,oBAAoB;IAI3B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtE,OAAO;QACL,eAAe;QACf,WAAW,EAAE,OAAO,CAAC,eAAe,CAAyB;KAC9D,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;AAQ/E,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,IAAI,cAAc,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IACtD,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAChE,MAAM,GAAG,GACP,OAAO,WAAW,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,CAAC,WAAW,CAAC,GAAG;QACjB,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,sBAAsB,CACpC,cAAsB;IAEtB,MAAM,UAAU,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,cAAc,KAAK,OAAO;QAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC9C,CAAC;AAsBD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACnD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,WAAW,CACf,UAAU,EACV,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,gBAAgB,EACxB,YAAY,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,YAAY,CACxB,UAAU,CAAC,OAAO,EAClB,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,EACxC;QACE,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CACF,CAAC;IACF,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvC,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,iBAAiB;YAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE;gBAC/C,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aAC5D,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CACvB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,6BAA6B,CAAC,CACpD,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAsB,EAAE,EAAE,CAC3C,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CACtC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAClC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,IAAI,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,kBAAkB,CACtB,GAAG,EACH,YAAY,EACZ;YACE,UAAU,EAAE;gBACV,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,cAAc;aACxB;YACD,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;SACxC,EACD,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1B,YAAY,GAAG,MAAM,sBAAsB,CACzC,GAAG,EACH,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG;QACH,YAAY;QACZ,KAAK;QACL,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,sBAAsB,CACnC,GAAqB,EACrB,SAAiB,EACjB,MAAoB;IAEpB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,kBAAkB,CAC9B,GAAG,EACH,yBAAyB,EACzB,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,KAAK;YACvD,OAAO,gCAAgC,CAAC;QAC1C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,2EAA2E;IAC3E,8EAA8E;IAC9E,gFAAgF;IAChF,qDAAqD;IACrD,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,WAAW,CACxB,UAA2B,EAC3B,GAAW,EACX,SAAiB,EACjB,YAA0B,EAC1B,cAA4B;IAE5B,IAAI,cAAc,EAAE,OAAO;QAAE,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,YAAY,CACxB,UAAU,CAAC,OAAO,EAClB,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,EACvC;QACE,GAAG;QACH,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CACF,CAAC;IACF,MAAM,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAClE,MAAM,YAAY,CAChB,cAAc,EACd;QACE,YAAY,EAAE,SAAS;QACvB,aAAa;QACb,WAAW;KACZ,EACD,KAAK,EAAE,cAAc,EAAE,EAAE;QACvB,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE;YACvD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrD,sEAAsE;YACtE,IAAI,cAAc,EAAE,OAAO;gBAAE,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa,IAAI,UAAU,KAAK,SAAS;gBACrE,MAAM,aAAa,CAAC;YACtB,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,iDAAiD,CAAC,IAAI,CAClE,KAAK,CACN,CAAC;YACF,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;YACJ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBACnC,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,CAAC,CAAC,CAAC,cAAc,oBAAoB,GAAG,CAC3E,CAAC;QACN,CAAC;gBAAS,CAAC;YACT,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,kBAAkB,CAC/B,GAAqB,EACrB,MAAc,EACd,MAAe,EACf,SAAiB,EACjB,cAA4B;IAE5B,OAAO,MAAM,YAAY,CACvB,cAAc,EACd;QACE,YAAY,EAAE,SAAS;QACvB,aAAa,EAAE,IAAI,KAAK,CAAC,GAAG,MAAM,aAAa,CAAC;QAChD,WAAW;KACZ,EACD,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,SAAS,CACtB,KAAqC,EACrC,GAAqB,EACrB,SAAiB;IAEjB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IACjE,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,YAAY,CAChB,SAAS,EACT;QACE,YAAY,EAAE,SAAS;QACvB,aAAa,EAAE,IAAI,KAAK,CAAC,+BAA+B,CAAC;KAC1D,EACD,KAAK,EAAE,cAAc,EAAE,EAAE;QACvB,MAAM,eAAe,GAAG,cAAc,CAAC,cAAc,EAAE,GAAG,EAAE;YAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,eAAe,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CACzB,KAAmB,EACnB,MAAoB;IAEpB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO;IACpC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,YAAY,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;QACzC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,YAAY,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;YACrC,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,aAA0B,EAAQ,EAAE;YACnD,OAAO,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,YAAY,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK;QACnC,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAChD,CAAC;AAED,yEAAyE;AACzE,MAAM,qBAAqB,GAAiC,IAAI,GAAG,CAAC;IAClE,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/C;QACE,kCAAkC;QAClC,yEAAyE;QACzE,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;KACnC;CACF,CAAC,CAAC;AAEH,qFAAqF;AACrF,SAAS,UAAU,CACjB,GAAqB,EACrB,OAAsB,EACtB,GAAW;IAEX,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACxC,yEAAyE;QACzE,OAAO;IACT,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS;YACxB,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC3B,IAAI,EAAE,CAAC,KAAK;gBACZ,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;;YACA,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/app-server/auth.d.ts

@@ -0,0 +1,16 @@
+import type { JsonRpcTransport } from "./json-rpc.js";
+import type { Logger } from "../core/logger.js";
+/** Dependencies and policy inputs for authentication. */
+export interface AuthenticationOptions {
+    rpc: JsonRpcTransport;
+    log: Logger;
+    timeoutMs: number;
+    interactive: boolean;
+    terminal: (message: string) => void;
+    launch?: (url: string) => Promise<boolean>;
+    signal?: AbortSignal;
+}
+/** Ensures app-server has an authenticated OpenAI account. */
+export declare function ensureAuthenticated(options: AuthenticationOptions): Promise<void>;
+/** Opens a login URL with the platform browser without invoking a shell. */
+export declare function launchBrowser(url: string): Promise<boolean>;