cyrus-codex-runner 0.2.74-cypack1546.0 → 0.2.76

package/dist/config/sandboxPolicy.js

@@ -7,15 +7,17 @@ function uniqueAbsolute(paths) {
 /**
  * Resolve the per-thread sandbox decision.
  *
- * - No `sandboxSettings` → `workspace-mode` (the coarse Codex mode with broad
- *   reads — unchanged default behavior).
- * - `sandboxSettings` present → a granular permission `profile` that restricts
+ * - Explicit read-only/full-access modes or no `sandboxSettings` use the
+ *   corresponding native Codex mode.
+ * - Workspace-write with `sandboxSettings` uses a granular `profile` that restricts
  *   reads to an allow-list (worktree + platform defaults + explicit reads) and
  *   writes to the worktree + explicit writable roots.
  */
 export function resolveCodexSandbox(input) {
     const { mode, workingDirectory, writableRoots, networkAccess } = input;
-    if (!input.sandboxSettings) {
+    // Explicit native modes take precedence over generated filesystem profiles.
+    // A root-writable profile still applies OS sandbox restrictions on macOS.
+    if (!input.sandboxSettings || mode !== "workspace-write") {
         return {
             kind: "workspace-mode",
             mode,
@@ -32,20 +34,14 @@ export function resolveCodexSandbox(input) {
     const writableAbs = uniqueAbsolute([...writableRoots, ...allowWrite]).filter((p) => p !== cwd);
     // Readable-only roots: explicit reads not already writable / the worktree.
     const readableAbs = uniqueAbsolute(allowRead).filter((p) => p !== cwd && !writableAbs.includes(p));
-    // Danger-full-access keeps broad access; read-only forbids writes; the
-    // default (workspace-write) makes the worktree writable.
-    const dangerFull = mode === "danger-full-access";
-    const workspaceAccess = mode === "read-only" ? "read" : "write";
-    const filesystem = dangerFull
-        ? { ":root": "write" }
-        : {
-            ":minimal": "read",
-            ":workspace_roots": workspaceAccess,
-            ":tmpdir": "write",
-            ":slash_tmp": "write",
-            ...Object.fromEntries(writableAbs.map((p) => [p, "write"])),
-            ...Object.fromEntries(readableAbs.map((p) => [p, "read"])),
-        };
+    const filesystem = {
+        ":minimal": "read",
+        ":workspace_roots": "write",
+        ":tmpdir": "write",
+        ":slash_tmp": "write",
+        ...Object.fromEntries(writableAbs.map((p) => [p, "write"])),
+        ...Object.fromEntries(readableAbs.map((p) => [p, "read"])),
+    };
     return {
         kind: "profile",
         profileId: CYRUS_SANDBOX_PROFILE_ID,

package/dist/config/sandboxPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxPolicy.js","sourceRoot":"","sources":["../../src/config/sandboxPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAgCxD,SAAS,cAAc,CAAC,KAAe;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAEvE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI;YACJ,aAAa,EAAE,cAAc,CAAC;gBAC7B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,aAAa;aAChB,CAAC;YACF,aAAa;SACb,CAAC;IACH,CAAC;IAED,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC;IAC7B,iFAAiF;IACjF,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAChB,CAAC;IACF,2EAA2E;IAC3E,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,MAAM,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5C,CAAC;IAEF,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,UAAU,GAAG,IAAI,KAAK,oBAAoB,CAAC;IACjD,MAAM,eAAe,GACpB,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAEzC,MAAM,UAAU,GAA0C,UAAU;QACnE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE;QACtB,CAAC,CAAC;YACA,UAAU,EAAE,MAAM;YAClB,kBAAkB,EAAE,eAAe;YACnC,SAAS,EAAE,OAAO;YAClB,YAAY,EAAE,OAAO;YACrB,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAgB,CAAC,CAAC,CAAC;YACpE,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAe,CAAC,CAAC,CAAC;SACnE,CAAC;IAEJ,OAAO;QACN,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,wBAAwB;QACnC,UAAU;QACV,aAAa;KACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"sandboxPolicy.js","sourceRoot":"","sources":["../../src/config/sandboxPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAgCxD,SAAS,cAAc,CAAC,KAAe;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAEvE,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1D,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI;YACJ,aAAa,EAAE,cAAc,CAAC;gBAC7B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,aAAa;aAChB,CAAC;YACF,aAAa;SACb,CAAC;IACH,CAAC;IAED,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC;IAC7B,iFAAiF;IACjF,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAChB,CAAC;IACF,2EAA2E;IAC3E,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,MAAM,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5C,CAAC;IAEF,MAAM,UAAU,GAA0C;QACzD,UAAU,EAAE,MAAM;QAClB,kBAAkB,EAAE,OAAO;QAC3B,SAAS,EAAE,OAAO;QAClB,YAAY,EAAE,OAAO;QACrB,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAgB,CAAC,CAAC,CAAC;QACpE,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAe,CAAC,CAAC,CAAC;KACnE,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,wBAAwB;QACnC,UAAU;QACV,aAAa;KACb,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,3 @@
-export { translateAppServerItem } from "./backend/appServerEvents.js";
-export { CodexLoginBroker } from "./backend/CodexLoginBroker.js";
-export { type ContainedCodexConfig, ContainedCodexProcess, type ContainedModelRequest, type ContainedModelResponse, } from "./backend/ContainedCodexProcess.js";
 export type { NormalizedCodexEvent, NormalizedCodexItem, } from "./backend/types.js";
 export { CodexEventMapper, type MapperContext } from "./CodexEventMapper.js";
 export { CodexRunner } from "./CodexRunner.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACX,oBAAoB,EACpB,mBAAmB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GAChB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,oBAAoB,EACpB,mBAAmB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EACX,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GAChB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,6 +1,3 @@
-export { translateAppServerItem } from "./backend/appServerEvents.js";
-export { CodexLoginBroker } from "./backend/CodexLoginBroker.js";
-export { ContainedCodexProcess, } from "./backend/ContainedCodexProcess.js";
 export { CodexEventMapper } from "./CodexEventMapper.js";
 export { CodexRunner } from "./CodexRunner.js";
 export { SimpleCodexRunner } from "./SimpleCodexRunner.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAEN,qBAAqB,GAGrB,MAAM,oCAAoC,CAAC;AAK5C,OAAO,EAAE,gBAAgB,EAAsB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAsB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/types.d.ts

@@ -18,8 +18,6 @@ export interface CodexRunnerConfig extends AgentRunnerConfig {
      * Defaults to process `CODEX_HOME`, then `~/.codex`.
      */
     codexHome?: string;
-    /** Own a separate normal app-server process whose shutdown can be awaited. */
-    dedicatedProcess?: boolean;
     /**
      * Override Codex reasoning effort.
      * If omitted, CodexRunner applies a safe default for known model constraints.
@@ -45,6 +43,12 @@ export interface CodexRunnerConfig extends AgentRunnerConfig {
      * coarse default mode. Paths must be absolute.
      */
     sandboxSettings?: CyrusSandboxFilesystem;
+    /**
+     * Extra absolute paths made writable on top of the worktree (operator
+     * whitelist, e.g. `~/.supabase`). Applied in both the default
+     * workspace-write mode and the granular `sandboxSettings` profile.
+     */
+    writableRoots?: string[];
 }
 /**
  * Session metadata for CodexRunner.

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,MAAM,gBAAgB,GACzB,MAAM,GACN,MAAM,GACN,OAAO,GACP,gBAAgB,EAAE,GAClB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC3D,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,kDAAkD;IAClD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,qDAAqD;IACrD,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACzD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;CAC3C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,MAAM,gBAAgB,GACzB,MAAM,GACN,MAAM,GACN,OAAO,GACP,gBAAgB,EAAE,GAClB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC3D,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,kDAAkD;IAClD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,qDAAqD;IACrD,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACzD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,IAAI,CAAC;CAC3C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyrus-codex-runner",
-  "version": "0.2.74-cypack1546.0",
+  "version": "0.2.76",
   "description": "Codex CLI process wrapper for Cyrus",
   "repository": {
     "type": "git",
@@ -16,24 +16,17 @@
   "dependencies": {
     "@openai/codex": "^0.159.2",
     "@openai/codex-sdk": "^0.159.2",
-    "cyrus-core": "0.2.74-cypack1546.0",
-    "cyrus-simple-agent-runner": "0.2.74-cypack1546.0"
+    "cyrus-core": "0.2.76",
+    "cyrus-simple-agent-runner": "0.2.76"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
   "publishConfig": {
     "access": "public"
   },
-  "cyrusTestRelease": {
-    "schemaVersion": 1,
-    "repository": "https://github.com/cyrusagents/cyrus",
-    "sourceSha": "6d5226710c1b0fa2f30d88f0077c6af1518e72e0",
-    "version": "0.2.74-cypack1546.0",
-    "channel": "test-cypack1546"
-  },
   "scripts": {
     "build": "tsgo",
     "dev": "tsgo --watch",

package/dist/backend/CodexLoginBroker.d.ts

@@ -1,20 +0,0 @@
-import type { ContainedModelRequest, ContainedModelResponse } from "./ContainedCodexProcess.js";
-/** Supervisor-only broker for the existing local Codex ChatGPT login. Never
- * exports auth to container env/files, MCP, checkpoints or log/error payloads. */
-export declare class CodexLoginBroker {
-    private readonly home;
-    private accountId?;
-    private refreshing?;
-    constructor(home?: string);
-    private login;
-    readiness(): Promise<string | null>;
-    private refresh;
-    respond(request: ContainedModelRequest, context: {
-        model: string;
-        scopeKey: string;
-        toolNames: readonly string[];
-        authorize: () => Promise<void>;
-        latency?: (stage: "provider.headers" | "provider.body" | "credential.read" | "credential.refresh") => (failed?: boolean) => void;
-    }, signal: AbortSignal): Promise<ContainedModelResponse>;
-}
-//# sourceMappingURL=CodexLoginBroker.d.ts.map

package/dist/backend/CodexLoginBroker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CodexLoginBroker.d.ts","sourceRoot":"","sources":["../../src/backend/CodexLoginBroker.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACX,qBAAqB,EACrB,sBAAsB,EACtB,MAAM,4BAA4B,CAAC;AAOpC;kFACkF;AAClF,qBAAa,gBAAgB;IAI3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHtB,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,YACkB,IAAI,GAAE,MACG,EAG1B;YACa,KAAK;IAoCb,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxC;YACa,OAAO;IAwCf,OAAO,CACZ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CACT,KAAK,EACF,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,oBAAoB,KACnB,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;KAChC,EACD,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,sBAAsB,CAAC,CA+JjC;CACD"}

package/dist/backend/CodexLoginBroker.js

@@ -1,252 +0,0 @@
-import { constants } from "node:fs";
-import { open } from "node:fs/promises";
-import { homedir } from "node:os";
-import { isAbsolute, join } from "node:path";
-import { AppServerClient } from "./appServerClient.js";
-import { resolveCodexAppServerLaunch } from "./codexBinary.js";
-/** Supervisor-only broker for the existing local Codex ChatGPT login. Never
- * exports auth to container env/files, MCP, checkpoints or log/error payloads. */
-export class CodexLoginBroker {
-    home;
-    accountId;
-    refreshing;
-    constructor(home = process.env.CODEX_HOME ||
-        join(homedir(), ".codex")) {
-        this.home = home;
-        if (!isAbsolute(home))
-            throw new Error("Codex auth home must be absolute");
-    }
-    async login() {
-        const file = await open(join(this.home, "auth.json"), constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const stat = await file.stat();
-            if (!stat.isFile() ||
-                stat.uid !== process.getuid?.() ||
-                stat.mode & 0o077 ||
-                stat.size > 131072)
-                throw Error();
-            const auth = JSON.parse(await file.readFile("utf8"));
-            if (auth.OPENAI_API_KEY ||
-                !auth.tokens ||
-                typeof auth.tokens.access_token !== "string" ||
-                !auth.tokens.access_token ||
-                typeof auth.tokens.account_id !== "string" ||
-                !auth.tokens.account_id ||
-                /[\r\n\0]/.test(auth.tokens.access_token + auth.tokens.account_id))
-                throw Error();
-            if (this.accountId && this.accountId !== auth.tokens.account_id)
-                throw Error();
-            this.accountId = auth.tokens.account_id;
-            return {
-                accessToken: auth.tokens.access_token,
-                accountId: auth.tokens.account_id,
-            };
-        }
-        finally {
-            await file.close();
-        }
-    }
-    async readiness() {
-        try {
-            await this.login();
-            return null;
-        }
-        catch {
-            return "Existing private Codex ChatGPT login is unavailable or changed";
-        }
-    }
-    async refresh() {
-        if (this.refreshing)
-            return this.refreshing;
-        const launch = resolveCodexAppServerLaunch();
-        const client = new AppServerClient({
-            binaryPath: launch.command,
-            args: launch.args,
-            env: {
-                HOME: homedir(),
-                CODEX_HOME: this.home,
-                PATH: "/usr/local/bin:/usr/bin:/bin",
-            },
-            logger: { warn() { }, error() { } },
-            requestTimeoutMs: 15000,
-            maxOutputBytes: 1000000,
-        });
-        client.on("error", () => { });
-        // This trusted auth-only process never starts a thread/turn, registers tools,
-        // or enters agent context. Native Codex owns refresh persistence/locking.
-        client.setServerRequestHandler(() => {
-            throw new Error("Auth-only request rejected");
-        });
-        const work = (async () => {
-            try {
-                client.start();
-                await client.request("initialize", {
-                    clientInfo: { name: "cyrus-codex-auth", version: "1" },
-                });
-                await client.request("account/read", { refreshToken: true });
-                await this.login();
-            }
-            finally {
-                await client.close();
-            }
-        })();
-        this.refreshing = work;
-        try {
-            await work;
-        }
-        finally {
-            this.refreshing = undefined;
-        }
-    }
-    async respond(request, context, signal) {
-        const measured = async (stage, work) => {
-            const end = context.latency?.(stage);
-            try {
-                const value = await work();
-                end?.();
-                return value;
-            }
-            catch (error) {
-                end?.(true);
-                throw error;
-            }
-        };
-        try {
-            signal.throwIfAborted();
-            // Validate the bounded request synchronously before the single pre-send
-            // authority check below. No credentials, provider access or response
-            // release occurs here; a second remote check around this pure validation
-            // only adds another round trip to every model request.
-            if (Buffer.byteLength(request.body) > 2000000)
-                throw Error();
-            const body = JSON.parse(request.body);
-            const allowed = new Set([
-                "model",
-                "instructions",
-                "input",
-                "tools",
-                "tool_choice",
-                "parallel_tool_calls",
-                "reasoning",
-                "store",
-                "stream",
-                "include",
-                "prompt_cache_key",
-                "text",
-                "client_metadata",
-            ]);
-            if (!body ||
-                typeof body !== "object" ||
-                Array.isArray(body) ||
-                Object.keys(body).some((k) => !allowed.has(k)) ||
-                body.model !== context.model ||
-                body.store !== false ||
-                body.stream !== true ||
-                !Array.isArray(body.input) ||
-                !Array.isArray(body.tools))
-                throw Error();
-            if (body.tools.some((tool) => !tool ||
-                !["function", "custom"].includes(tool.type) ||
-                ![
-                    ...context.toolNames,
-                    "apply_patch",
-                    "view_image",
-                    "request_user_input",
-                ].includes(tool.name)))
-                throw Error();
-            // Codex supplies these local built-ins even when shell/network tools are
-            // disabled. They are compatibility input, not scoped capabilities: the
-            // provider must see only the supervisor-admitted dynamic tool catalog.
-            body.tools = body.tools.filter((tool) => context.toolNames.includes(tool.name));
-            // No remotely resolved files/images or prior response IDs. Every request
-            // supplies its own admitted conversation; provider cache key is scope-bound.
-            const visit = (value, depth = 0) => {
-                if (depth > 32)
-                    throw Error();
-                if (Array.isArray(value)) {
-                    for (const item of value)
-                        visit(item, depth + 1);
-                }
-                else if (value && typeof value === "object") {
-                    const v = value;
-                    if ([
-                        "input_image",
-                        "input_file",
-                        "item_reference",
-                        "input_audio",
-                        "input_video",
-                        "file_search",
-                        "web_search",
-                        "web_search_preview",
-                        "computer",
-                    ].includes(String(v.type)))
-                        throw Error();
-                    for (const item of Object.values(v))
-                        visit(item, depth + 1);
-                }
-            };
-            visit(body.input);
-            body.prompt_cache_key = context.scopeKey;
-            const send = async () => {
-                await context.authorize();
-                signal.throwIfAborted();
-                const login = await measured("credential.read", () => this.login());
-                return measured("provider.headers", () => fetch("https://chatgpt.com/backend-api/codex/responses", {
-                    method: "POST",
-                    redirect: "error",
-                    signal: AbortSignal.any([signal, AbortSignal.timeout(60000)]),
-                    headers: {
-                        "Content-Type": "application/json",
-                        Authorization: `Bearer ${login.accessToken}`,
-                        "ChatGPT-Account-ID": login.accountId,
-                        originator: "codex_cli_rs",
-                    },
-                    body: JSON.stringify(body),
-                }));
-            };
-            let response = await send();
-            if (response.status === 401) {
-                await response.body?.cancel();
-                await context.authorize();
-                await measured("credential.refresh", () => this.refresh());
-                signal.throwIfAborted();
-                response = await send();
-            }
-            if (!response.ok || !response.body) {
-                await response.body?.cancel();
-                throw Error();
-            }
-            const reader = response.body.getReader();
-            const chunks = [];
-            let size = 0;
-            await measured("provider.body", async () => {
-                try {
-                    for (;;) {
-                        const next = await reader.read();
-                        if (next.done)
-                            break;
-                        size += next.value.byteLength;
-                        if (size > 4000000)
-                            throw Error();
-                        chunks.push(next.value);
-                    }
-                }
-                finally {
-                    await reader.cancel().catch(() => { });
-                    reader.releaseLock();
-                }
-            });
-            await context.authorize();
-            signal.throwIfAborted();
-            return {
-                status: 200,
-                contentType: "text/event-stream",
-                body: Buffer.concat(chunks).toString("base64"),
-            };
-        }
-        catch {
-            throw new Error("Contained Codex model connection denied or interrupted");
-        }
-    }
-}
-//# sourceMappingURL=CodexLoginBroker.js.map

package/dist/backend/CodexLoginBroker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CodexLoginBroker.js","sourceRoot":"","sources":["../../src/backend/CodexLoginBroker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAKvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAM/D;kFACkF;AAClF,MAAM,OAAO,gBAAgB;IAIV,IAAI;IAHd,SAAS,CAAU;IACnB,UAAU,CAAiB;IACnC,YACkB,IAAI,GAAW,OAAO,CAAC,GAAG,CAAC,UAAU;QACrD,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;oBADT,IAAI;QAGrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IACO,KAAK,CAAC,KAAK;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAC5B,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CACzC,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IACC,CAAC,IAAI,CAAC,MAAM,EAAE;gBACd,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;gBAC/B,IAAI,CAAC,IAAI,GAAG,KAAK;gBACjB,IAAI,CAAC,IAAI,GAAG,MAAM;gBAElB,MAAM,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,IACC,IAAI,CAAC,cAAc;gBACnB,CAAC,IAAI,CAAC,MAAM;gBACZ,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;gBAC5C,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;gBACzB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;gBACvB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAElE,MAAM,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;gBAC9D,MAAM,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YACxC,OAAO;gBACN,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACrC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACjC,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACF,CAAC;IACD,KAAK,CAAC,SAAS;QACd,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,gEAAgE,CAAC;QACzE,CAAC;IACF,CAAC;IACO,KAAK,CAAC,OAAO;QACpB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE;gBACJ,IAAI,EAAE,OAAO,EAAE;gBACf,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,IAAI,EAAE,8BAA8B;aACpC;YACD,MAAM,EAAE,EAAE,IAAI,KAAI,CAAC,EAAE,KAAK,KAAI,CAAC,EAAE;YACjC,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7B,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,CAAC,uBAAuB,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,CAAC;gBACJ,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;oBAClC,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;iBACtD,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;oBAAS,CAAC;gBACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC;QACZ,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,KAAK,CAAC,OAAO,CACZ,OAA8B,EAC9B,OAYC,EACD,MAAmB;QAEnB,MAAM,QAAQ,GAAG,KAAK,EACrB,KAIuB,EACvB,IAAsB,EACT,EAAE;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC3B,GAAG,EAAE,EAAE,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACZ,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,wEAAwE;YACxE,qEAAqE;YACrE,yEAAyE;YACzE,uDAAuD;YACvD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO;gBAAE,MAAM,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;gBACvB,OAAO;gBACP,cAAc;gBACd,OAAO;gBACP,OAAO;gBACP,aAAa;gBACb,qBAAqB;gBACrB,WAAW;gBACX,OAAO;gBACP,QAAQ;gBACR,SAAS;gBACT,kBAAkB;gBAClB,MAAM;gBACN,iBAAiB;aACjB,CAAC,CAAC;YACH,IACC,CAAC,IAAI;gBACL,OAAO,IAAI,KAAK,QAAQ;gBACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;gBAC5B,IAAI,CAAC,KAAK,KAAK,KAAK;gBACpB,IAAI,CAAC,MAAM,KAAK,IAAI;gBACpB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAE1B,MAAM,KAAK,EAAE,CAAC;YACf,IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CACd,CAAC,IAAS,EAAE,EAAE,CACb,CAAC,IAAI;gBACL,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3C,CAAC;oBACA,GAAG,OAAO,CAAC,SAAS;oBACpB,aAAa;oBACb,YAAY;oBACZ,oBAAoB;iBACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACtB;gBAED,MAAM,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAsB,EAAE,EAAE,CACzD,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;YACF,yEAAyE;YACzE,6EAA6E;YAC7E,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAQ,EAAE;gBACjD,IAAI,KAAK,GAAG,EAAE;oBAAE,MAAM,KAAK,EAAE,CAAC;gBAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;wBAAE,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClD,CAAC;qBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC/C,MAAM,CAAC,GAAG,KAAgC,CAAC;oBAC3C,IACC;wBACC,aAAa;wBACb,YAAY;wBACZ,gBAAgB;wBAChB,aAAa;wBACb,aAAa;wBACb,aAAa;wBACb,YAAY;wBACZ,oBAAoB;wBACpB,UAAU;qBACV,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBAE1B,MAAM,KAAK,EAAE,CAAC;oBACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;wBAAE,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACF,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;gBACvB,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACpE,OAAO,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACxC,KAAK,CAAC,iDAAiD,EAAE;oBACxD,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC7D,OAAO,EAAE;wBACR,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;wBAC5C,oBAAoB,EAAE,KAAK,CAAC,SAAS;wBACrC,UAAU,EAAE,cAAc;qBAC1B;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC1B,CAAC,CACF,CAAC;YACH,CAAC,CAAC;YACF,IAAI,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,KAAK,EAAE,CAAC;YACf,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,QAAQ,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1C,IAAI,CAAC;oBACJ,SAAS,CAAC;wBACT,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjC,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC9B,IAAI,IAAI,GAAG,OAAO;4BAAE,MAAM,KAAK,EAAE,CAAC;wBAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,CAAC;gBACF,CAAC;wBAAS,CAAC;oBACV,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACtC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,mBAAmB;gBAChC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC3E,CAAC;IACF,CAAC;CACD"}

package/dist/backend/ContainedCodexProcess.d.ts

@@ -1,48 +0,0 @@
-export interface ContainedCodexConfig {
-    dockerPath: string;
-    dockerHost: string;
-    /** Preloaded, reviewed image containing node and /usr/local/bin/codex. */
-    image: string;
-}
-export interface ContainedModelRequest {
-    body: string;
-}
-export interface ContainedModelResponse {
-    status: number;
-    contentType: string;
-    body: string;
-}
-/** Dedicated process, empty home, no mounts/network/credentials; never uses the
- * ordinary shared app-server pool. Container data is untrusted at the bridge. */
-export declare class ContainedCodexProcess {
-    private readonly config;
-    private readonly name;
-    private client?;
-    private stopped;
-    private started;
-    private initialized;
-    private closing?;
-    private readonly requests;
-    constructor(config: ContainedCodexConfig);
-    private command;
-    start(options: {
-        signal: AbortSignal;
-        model: (request: ContainedModelRequest, signal: AbortSignal) => Promise<ContainedModelResponse>;
-        notification: (method: string, params: unknown) => void;
-        request: (method: string, params: unknown) => Promise<unknown>;
-        exit?: () => void;
-    }): Promise<void>;
-    request<T = unknown>(method: string, params: unknown): Promise<T>;
-    /** Native rollout only; no auth/config/database files or host filesystem access. */
-    snapshot(threadId: string): Promise<{
-        threadId: string;
-        rollout: string;
-    }>;
-    private validateSnapshot;
-    restore(snapshot: {
-        threadId: string;
-        rollout: string;
-    }): Promise<string>;
-    close(): Promise<void>;
-}
-//# sourceMappingURL=ContainedCodexProcess.d.ts.map

package/dist/backend/ContainedCodexProcess.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContainedCodexProcess.d.ts","sourceRoot":"","sources":["../../src/backend/ContainedCodexProcess.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;CACd;AACD,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACb;AAiDD;iFACiF;AACjF,qBAAa,qBAAqB;IAQrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,MAAM,CAAC,CAAkB;IACjC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAC,CAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,YAA6B,MAAM,EAAE,oBAAoB,EASxD;IACD,OAAO,CAAC,OAAO;IA+BT,KAAK,CAAC,OAAO,EAAE;QACpB,MAAM,EAAE,WAAW,CAAC;QACpB,KAAK,EAAE,CACN,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,WAAW,KACf,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACrC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;QACxD,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0GhB;IACD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAIhE;IACD,oFAAoF;IAC9E,QAAQ,CACb,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAgChD;IACD,OAAO,CAAC,gBAAgB;IAqBlB,OAAO,CAAC,QAAQ,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;IACD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA+CrB;CACD"}