codex-orchestrator 0.1.48 → 0.1.50

package/dist/src/setup/skill-runtime-v2-preparation.js

@@ -0,0 +1,304 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFile, readdir, readlink, realpath, } from 'node:fs/promises';
+import { hostname } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { verifyBridgeRuntimeManifest, } from '../bridge-runtime.js';
+import { writeDurableAtomicFile } from '../fs/durable-atomic-file.js';
+import { GhCliIssueAdapter } from '../github/gh-issue-adapter.js';
+import { readRunnerConfig, rereadRunnerConfigUnderFence } from '../runner/command-utils.js';
+import { RunnerStateStore } from '../runner/local-state.js';
+import { acquireTargetActivityFence, readCurrentBootNonce, } from '../runner/target-activity-fence.js';
+const execFileAsync = promisify(execFile);
+export async function prepareSkillRuntimeV2(input, dependencies = {}) {
+    const targetRoot = await realpath(resolve(input.targetRoot));
+    const packageRoot = resolve(dependencies.packageRoot ?? defaultPackageRoot());
+    const config = await readRunnerConfig(targetRoot);
+    const bridge = await verifyBridgeRuntimeManifest(packageRoot);
+    const hostId = requireText(dependencies.hostId ?? hostname(), 'hostId');
+    const platform = dependencies.platform ?? process.platform;
+    const bootNonce = requireText(dependencies.bootNonce ?? await readCurrentBootNonce(platform), 'bootNonce');
+    const inspect = dependencies.inspectProcesses ?? (() => inspectBridgeProcesses({ platform }));
+    const lease = await acquireTargetActivityFence({
+        targetRoot,
+        stateDir: config.runner.stateDir,
+        mode: 'exclusive',
+        purpose: 'preparation',
+        hostId,
+        bootNonce,
+        pid: dependencies.pid,
+        isProcessAlive: dependencies.isProcessAlive,
+        now: dependencies.now,
+    });
+    try {
+        const fencedConfig = await rereadRunnerConfigUnderFence(targetRoot, config.runner.stateDir);
+        const issueAdapter = dependencies.issueAdapter
+            ?? new GhCliIssueAdapter(fencedConfig.github.owner, fencedConfig.github.repo);
+        const matchingProcesses = await findMatchingDaemonProcesses(await inspect(), targetRoot, bridge);
+        if (matchingProcesses.length > 0) {
+            throw new Error(`bridge-v1-daemon-active: matching daemon pid ${matchingProcesses[0]?.pid} is still running.`);
+        }
+        const store = new RunnerStateStore(targetRoot, fencedConfig);
+        const state = await store.load();
+        const runIds = state.runs.map((run) => run.sessionId).sort();
+        if (runIds.length > 0) {
+            throw new Error(`bridge-v1-local-state-active: nonterminal v1 runs ${runIds.join(', ')}.`);
+        }
+        await store.save(state);
+        const stateBytes = await readFile(store.statePath());
+        const queriedAt = (dependencies.now ?? new Date()).toISOString();
+        let runningIssues;
+        try {
+            runningIssues = await issueAdapter.listOpenIssuesWithAnyLabel([fencedConfig.github.labels.running.name]);
+        }
+        catch (error) {
+            throw new Error(`bridge-github-drain-unavailable: ${error instanceof Error ? error.message : 'GitHub read failed'}`);
+        }
+        const issueNumbers = runningIssues.map((issue) => issue.number).sort((left, right) => left - right);
+        if (issueNumbers.length > 0) {
+            throw new Error(`bridge-v1-github-claim-active: open running issues ${issueNumbers.join(', ')}.`);
+        }
+        const generation = {
+            version: 1,
+            canonicalTargetRoot: targetRoot,
+            preparedAt: (dependencies.now ?? new Date()).toISOString(),
+            hostId,
+            bootNonce,
+            bridgePackageVersion: bridge.packageVersion,
+            bridgePackageHash: bridge.packageHash,
+            activityFenceGeneration: lease.generation,
+            inspectedProcesses: matchingProcesses,
+            runnerState: {
+                path: store.statePath(),
+                sha256: createHash('sha256').update(stateBytes).digest('hex'),
+                nonterminalV1RunIds: [],
+            },
+            githubDrain: { queriedAt, runningIssueNumbers: [] },
+        };
+        const path = join(targetRoot, fencedConfig.runner.stateDir, 'skill-runtime-v2', 'prepared-generation.json');
+        await writeDurableAtomicFile(path, `${JSON.stringify(generation, null, 2)}\n`);
+        return { path, generation };
+    }
+    finally {
+        await lease.release();
+    }
+}
+export async function inspectBridgeProcesses(input = {}) {
+    const platform = input.platform ?? process.platform;
+    if (platform === 'linux')
+        return inspectLinuxProcesses(input);
+    if (platform === 'darwin')
+        return inspectDarwinProcesses(input);
+    throw new Error(`bridge-process-introspection-unsupported: platform ${platform} is not supported.`);
+}
+async function inspectLinuxProcesses(input) {
+    const procRoot = input.procRoot ?? '/proc';
+    let names;
+    try {
+        names = await readdir(procRoot);
+    }
+    catch (error) {
+        throw unsupported(`Linux procfs is unavailable: ${errorMessage(error)}`);
+    }
+    const processes = [];
+    for (const name of names.filter((entry) => /^\d+$/u.test(entry)).sort((left, right) => Number(left) - Number(right))) {
+        const pid = Number(name);
+        try {
+            const [status, statContent, cmdline, executable] = await Promise.all([
+                readFile(join(procRoot, name, 'status'), 'utf8'),
+                readFile(join(procRoot, name, 'stat'), 'utf8'),
+                readFile(join(procRoot, name, 'cmdline')),
+                input.readExecutable ? input.readExecutable(pid) : readlink(join(procRoot, name, 'exe')),
+            ]);
+            const uidMatch = status.match(/^Uid:\s+(\d+)/mu);
+            const close = statContent.lastIndexOf(')');
+            const fields = close >= 0 ? statContent.slice(close + 1).trim().split(/\s+/u) : [];
+            const startTime = fields[19];
+            const argv = cmdline.toString('utf8').split('\0').filter((part) => part.length > 0);
+            if (!uidMatch?.[1] || !startTime || argv.length === 0 || !executable.trim()) {
+                throw unsupported(`Linux process ${pid} identity is ambiguous.`);
+            }
+            processes.push({ pid, uid: Number(uidMatch[1]), startTime, executable: executable.trim(), argv });
+        }
+        catch (error) {
+            if (isCode(error, 'ENOENT'))
+                continue;
+            if (error instanceof Error && error.message.startsWith('bridge-process-introspection-unsupported:'))
+                throw error;
+            throw unsupported(`Linux process ${pid} cannot be inspected: ${errorMessage(error)}`);
+        }
+    }
+    return processes;
+}
+async function inspectDarwinProcesses(input) {
+    const run = input.runCommand ?? defaultRunCommand;
+    let pidOutput;
+    try {
+        pidOutput = await run('ps', ['-axo', 'pid=']);
+    }
+    catch (error) {
+        throw unsupported(`Darwin ps is unavailable: ${errorMessage(error)}`);
+    }
+    const pids = pidOutput.split(/\s+/u).filter(Boolean).map(Number).filter((pid) => Number.isSafeInteger(pid) && pid > 0);
+    const processes = [];
+    for (const pid of pids.sort((left, right) => left - right)) {
+        let identity;
+        try {
+            identity = await run('ps', ['-p', String(pid), '-o', 'uid=,lstart=,command=']);
+        }
+        catch {
+            continue;
+        }
+        try {
+            const match = identity.trim().match(/^(\d+)\s+(.{24})\s+(.+)$/u);
+            if (!match?.[1] || !match[2] || !match[3]) {
+                throw unsupported(`Darwin process ${pid} identity is ambiguous.`);
+            }
+            const rawCommand = match[3];
+            if (!mayBeOrchestratorDaemonCommand(rawCommand)) {
+                parseDarwinCommand(rawCommand);
+                continue;
+            }
+            const lsof = await run('lsof', ['-a', '-p', String(pid), '-d', 'txt', '-Fn']);
+            const executable = lsof.split(/\r?\n/u).find((line) => line.startsWith('n'))?.slice(1);
+            if (!executable)
+                throw unsupported(`Darwin process ${pid} executable identity is ambiguous.`);
+            throw unsupported(`Darwin process ${pid} is an orchestrator daemon, but ps does not preserve exact argv boundaries.`);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.startsWith('bridge-process-introspection-unsupported:'))
+                throw error;
+            throw unsupported(`Darwin process ${pid} cannot be inspected: ${errorMessage(error)}`);
+        }
+    }
+    return processes;
+}
+async function findMatchingDaemonProcesses(processes, canonicalTargetRoot, currentBridge) {
+    const matches = [];
+    for (const candidate of processes) {
+        if (!isOrchestratorDaemonArgv(candidate.argv))
+            continue;
+        const daemonIndex = candidate.argv.indexOf('daemon');
+        const targetIndexes = candidate.argv.flatMap((arg, index) => arg === '--target' ? [index] : []);
+        if (targetIndexes.length !== 1) {
+            throw new Error(`bridge-process-argv-ambiguous: daemon pid ${candidate.pid} has ambiguous --target arguments.`);
+        }
+        const targetArg = candidate.argv[targetIndexes[0] + 1];
+        if (!targetArg || !isAbsolute(targetArg)) {
+            throw new Error(`bridge-process-argv-ambiguous: daemon pid ${candidate.pid} target is not absolute.`);
+        }
+        let target;
+        try {
+            target = await realpath(targetArg);
+        }
+        catch {
+            throw new Error(`bridge-process-argv-ambiguous: daemon pid ${candidate.pid} target cannot be canonicalized.`);
+        }
+        if (target !== canonicalTargetRoot)
+            continue;
+        if (typeof process.getuid === 'function' && candidate.uid !== process.getuid()) {
+            throw new Error(`bridge-process-owner-mismatch: daemon pid ${candidate.pid} belongs to uid ${candidate.uid}.`);
+        }
+        const executable = await realpath(candidate.executable).catch(() => undefined);
+        const argvExecutable = candidate.argv[0] && isAbsolute(candidate.argv[0])
+            ? await realpath(candidate.argv[0]).catch(() => undefined)
+            : undefined;
+        if (!executable || !argvExecutable || executable !== argvExecutable) {
+            throw new Error(`bridge-process-executable-mismatch: daemon pid ${candidate.pid} executable identity is ambiguous.`);
+        }
+        const cliArg = candidate.argv.slice(0, daemonIndex).reverse().find((arg) => /(?:^|\/)cli\.js$/u.test(arg));
+        if (!cliArg || !isAbsolute(cliArg)) {
+            throw new Error(`bridge-process-argv-ambiguous: daemon pid ${candidate.pid} package CLI path is ambiguous.`);
+        }
+        const cliPath = await realpath(cliArg).catch(() => undefined);
+        if (!cliPath)
+            throw new Error(`bridge-process-argv-ambiguous: daemon pid ${candidate.pid} CLI path is unavailable.`);
+        const candidateRoot = resolve(dirname(cliPath), '../..');
+        let candidateBridge;
+        try {
+            candidateBridge = await verifyBridgeRuntimeManifest(candidateRoot);
+        }
+        catch (error) {
+            throw new Error(`bridge-package-generation-mismatch: daemon pid ${candidate.pid}: ${errorMessage(error)}`);
+        }
+        if (candidateBridge.packageVersion !== currentBridge.packageVersion
+            || candidateBridge.packageHash !== currentBridge.packageHash) {
+            throw new Error(`bridge-package-generation-mismatch: daemon pid ${candidate.pid} uses ${candidateBridge.packageHash}.`);
+        }
+        matches.push(candidate);
+    }
+    return matches.sort((left, right) => left.pid - right.pid);
+}
+function parseDarwinCommand(command) {
+    const args = [];
+    let current = '';
+    let quote;
+    let escaped = false;
+    for (const character of command) {
+        if (escaped) {
+            current += character;
+            escaped = false;
+        }
+        else if (character === '\\' && quote !== "'") {
+            escaped = true;
+        }
+        else if (quote) {
+            if (character === quote)
+                quote = undefined;
+            else
+                current += character;
+        }
+        else if (character === '"' || character === "'") {
+            quote = character;
+        }
+        else if (/\s/u.test(character)) {
+            if (current) {
+                args.push(current);
+                current = '';
+            }
+        }
+        else {
+            current += character;
+        }
+    }
+    if (escaped || quote)
+        throw unsupported('Darwin command argv quoting is ambiguous.');
+    if (current)
+        args.push(current);
+    if (args.length === 0)
+        throw unsupported('Darwin command argv is empty.');
+    return args;
+}
+function mayBeOrchestratorDaemonCommand(command) {
+    const cli = command.match(/codex-orchestrator|cli\.js/u);
+    if (!cli || cli.index === undefined)
+        return false;
+    return /(?:^|[^A-Za-z0-9_-])daemon(?:$|[^A-Za-z0-9_-])/u.test(command.slice(cli.index + cli[0].length));
+}
+function isOrchestratorDaemonArgv(argv) {
+    const cliIndex = argv.findIndex((arg) => /(?:^|\/)(?:codex-orchestrator|cli\.js)$/u.test(arg));
+    return cliIndex >= 0 && cliIndex <= 1 && argv[cliIndex + 1] === 'daemon';
+}
+async function defaultRunCommand(command, args) {
+    return (await execFileAsync(command, args)).stdout;
+}
+function defaultPackageRoot() {
+    return fileURLToPath(new URL('../../../', import.meta.url));
+}
+function unsupported(message) {
+    return new Error(`bridge-process-introspection-unsupported: ${message}`);
+}
+function requireText(value, field) {
+    if (value.trim().length === 0)
+        throw new Error(`Bridge preparation ${field} must be non-empty.`);
+    return value;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : 'unknown error';
+}
+function isCode(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+//# sourceMappingURL=skill-runtime-v2-preparation.js.map

package/dist/src/setup/skill-runtime-v2-preparation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-runtime-v2-preparation.js","sourceRoot":"","sources":["../../../src/setup/skill-runtime-v2-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAoD1C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC,EACjC,eAAkD,EAAE;IAEpD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,IAAI,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC3D,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,IAAI,MAAM,oBAAoB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,YAAY,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC;QAC7C,UAAU;QACV,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QAChC,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,aAAa;QACtB,MAAM;QACN,SAAS;QACT,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,GAAG,EAAE,YAAY,CAAC,GAAG;KACtB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5F,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY;eACzC,IAAI,iBAAiB,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,MAAM,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACjG,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,IAAI,aAAoF,CAAC;QACzF,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QACpG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,UAAU,GAAqC;YACnD,OAAO,EAAE,CAAC;YACV,mBAAmB,EAAE,UAAU;YAC/B,UAAU,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YAC1D,MAAM;YACN,SAAS;YACT,oBAAoB,EAAE,MAAM,CAAC,cAAc;YAC3C,iBAAiB,EAAE,MAAM,CAAC,WAAW;YACrC,uBAAuB,EAAE,KAAK,CAAC,UAAU;YACzC,kBAAkB,EAAE,iBAAiB;YACrC,WAAW,EAAE;gBACX,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE;gBACvB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,mBAAmB,EAAE,EAAE;aACxB;YACD,WAAW,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,EAAE;SACpD,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;QAC5G,MAAM,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,oBAAoB,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAAmC;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,gCAAgC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACzC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;aACzF,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC5E,MAAM,WAAW,CAAC,iBAAiB,GAAG,yBAAyB,CAAC,CAAC;YACnE,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,SAAS;YACtC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,2CAA2C,CAAC;gBAAE,MAAM,KAAK,CAAC;YACjH,MAAM,WAAW,CAAC,iBAAiB,GAAG,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAmC;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAClD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACvH,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QAC3D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,WAAW,CAAC,kBAAkB,GAAG,yBAAyB,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChD,kBAAkB,CAAC,UAAU,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU;gBAAE,MAAM,WAAW,CAAC,kBAAkB,GAAG,oCAAoC,CAAC,CAAC;YAC9F,MAAM,WAAW,CACf,kBAAkB,GAAG,6EAA6E,CACnG,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,2CAA2C,CAAC;gBAAE,MAAM,KAAK,CAAC;YACjH,MAAM,WAAW,CAAC,kBAAkB,GAAG,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,SAAkC,EAClC,mBAA2B,EAC3B,aAAsC;IAEtC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACxD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,GAAG,oCAAoC,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,GAAG,0BAA0B,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,GAAG,kCAAkC,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,MAAM,KAAK,mBAAmB;YAAE,SAAS;QAC7C,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,GAAG,mBAAmB,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/E,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,CAAC,GAAG,oCAAoC,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,GAAG,iCAAiC,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,GAAG,2BAA2B,CAAC,CAAC;QACrH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,eAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,2BAA2B,CAAC,aAAa,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,eAAe,CAAC,cAAc,KAAK,aAAa,CAAC,cAAc;eAC9D,eAAe,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,CAAC,GAAG,SAAS,eAAe,CAAC,WAAW,GAAG,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,SAAS,CAAC;YACrB,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,IAAI,SAAS,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;;gBACtC,OAAO,IAAI,SAAS,CAAC;QAC5B,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAClD,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK;QAAE,MAAM,WAAW,CAAC,2CAA2C,CAAC,CAAC;IACrF,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CAAC,OAAe;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAc;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,OAAO,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAc;IAC9D,OAAO,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,KAAK,CAAC,6CAA6C,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,qBAAqB,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1E,CAAC"}

package/docs/deep-dive.md

@@ -771,6 +771,33 @@ Each workflow points to either a package-owned fallback prompt or a compatible
 local skill/prompt copied during setup. This lets the package work out of the
 box while still allowing repositories to customize agent behavior.
 
+## Skill Runtime V2 Bridge Fence
+
+The bridge generation keeps the current prompt and `codex exec` behavior but
+adds a target-scoped activity fence around daemon lifetime, targeted run/claim,
+and setup. Shared daemon/run holders may coexist; preparation and setup require
+exclusive ownership. Ownership metadata uses canonical target identity plus
+host, boot nonce, PID, and release token, and its generation increases whenever
+new runner activity is admitted. A stale same-host holder is reclaimed only
+when PID/boot evidence proves that owner is gone; foreign or ambiguous owners
+block.
+
+`setup --prepare-skill-runtime-v2` verifies the installed
+`bridge-runtime.json`, inspects supported Darwin or Linux processes, requires
+an empty legacy runner-state union, and queries GitHub for every open issue with
+the configured running label while holding the exclusive fence. It then writes
+one fsynced canonical `prepared-generation.json` beneath the configured state
+directory. GitHub read failure, relative daemon targets, process identity
+ambiguity, active local state, or a package hash mismatch fail closed without
+publishing generation evidence.
+
+The bridge can read and preserve an empty state-v2 envelope while config remains
+v1, but it stores only legacy run records in that envelope. It does not perform
+the structural migration, change transport, or disable target workflow prompts.
+The structural phase must start later from an actually released bridge commit
+and must verify the canonical prepared generation and exact package hash before
+any config-v2 write.
+
 ## Config Surface
 
 The top-level config areas are:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-orchestrator",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "Reusable GitHub Issues runner for Codex.",
   "type": "module",
   "license": "MIT",
@@ -21,6 +21,7 @@
   },
   "files": [
     "dist/src",
+    "bridge-runtime.json",
     "prompts",
     "docs/deep-dive.md",
     "CHANGELOG.md",
@@ -46,7 +47,8 @@
     "test": "npm run build && node --test dist/test/*.test.js",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "smoke:live": "node scripts/live-smoke.mjs",
-    "prepack": "npm run build"
+    "bridge:manifest": "npm run build --silent && node scripts/generate-bridge-runtime.mjs",
+    "prepack": "npm run bridge:manifest"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",