humanish 0.104.3 → 0.106.0

package/dist/actors/codex/restricted-transport.js

@@ -0,0 +1,335 @@
+import { StringDecoder } from "node:string_decoder";
+import { CODEX_MAX_EVENTS, CODEX_MAX_OUTPUT_BYTES, CODEX_MAX_STDOUT_BYTES, codexRecord, } from "./restricted-policy.js";
+/** No raw provider prose, stderr, path, or cause is attached to this error. */
+export class RestrictedCodexStop extends Error {
+    code;
+    detectedVersion;
+    /** `detectedVersion`: the release an unadmitted CLI reported, so a refusal can name it. */
+    constructor(code, detectedVersion) {
+        super(code);
+        this.code = code;
+        this.detectedVersion = detectedVersion;
+    }
+}
+export class RestrictedCodexDeadline {
+    timeoutMs;
+    signal;
+    deadlineAt;
+    code = null;
+    stopped;
+    rejectStopped;
+    timer;
+    paused = false;
+    onAbort = () => this.stop("cancelled");
+    constructor(timeoutMs, signal) {
+        this.timeoutMs = timeoutMs;
+        this.signal = signal;
+        this.deadlineAt = performance.now() + timeoutMs;
+        this.stopped = new Promise((_resolve, reject) => {
+            this.rejectStopped = reject;
+        });
+        void this.stopped.catch(() => undefined);
+        this.arm(timeoutMs);
+        signal?.addEventListener("abort", this.onAbort, { once: true });
+        if (signal?.aborted)
+            this.stop("cancelled");
+    }
+    stop(code) {
+        if (this.code !== null)
+            return;
+        this.code = code;
+        this.rejectStopped(new RestrictedCodexStop(code));
+    }
+    get expiresAt() {
+        return this.deadlineAt;
+    }
+    arm(ms) {
+        clearTimeout(this.timer);
+        this.timer = setTimeout(() => this.stop("timeout"), Math.max(1, ms));
+    }
+    /** Host tool execution is outside model time. A response starts a fresh inference slice. */
+    pause() {
+        this.check();
+        if (this.paused)
+            throw new RestrictedCodexStop("codex_protocol_error");
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.paused = true;
+    }
+    resume() {
+        if (!this.paused || this.code !== null)
+            return;
+        this.paused = false;
+        this.deadlineAt = performance.now() + this.timeoutMs;
+        this.arm(this.timeoutMs);
+    }
+    check() {
+        if (!this.paused && this.code === null && performance.now() >= this.deadlineAt)
+            this.stop("timeout");
+        if (this.code !== null)
+            throw new RestrictedCodexStop(this.code);
+    }
+    async wait(promise) {
+        this.check();
+        const result = await Promise.race([promise, this.stopped]);
+        this.check();
+        return result;
+    }
+    close() {
+        clearTimeout(this.timer);
+        this.signal?.removeEventListener("abort", this.onAbort);
+    }
+}
+// Codex processes that did not confirm closing. A session refuses new work while any remain.
+const unclosedChildren = new Set();
+export function retainUnclosedChild(closed) {
+    unclosedChildren.add(closed);
+    void closed.then(() => {
+        unclosedChildren.delete(closed);
+    });
+}
+export const hasUnclosedChildren = () => unclosedChildren.size > 0;
+export function ownCodexProcess(child) {
+    let closed = false, exited = false;
+    child.once("exit", () => {
+        exited = true;
+    });
+    const completion = new Promise((resolve) => {
+        child.once("close", () => {
+            closed = true;
+            resolve();
+        });
+    });
+    return { child, closed: completion, isClosed: () => closed, hasExited: () => exited };
+}
+async function settlesWithin(promise, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise.then(() => true, () => true),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(false), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Own only the directly spawned native process. Never signal a stored PID/PGID
+ * after exit; it can have been recycled. This is not a whole-process-tree lease. */
+function signalOwnedChild(owned, signal) {
+    if (owned.hasExited() || owned.isClosed())
+        return;
+    try {
+        owned.child.kill(signal);
+    }
+    catch {
+        /* Closing is still checked below. */
+    }
+}
+export async function closeOwnedCodexProcess(owned) {
+    owned.child.stdin.end();
+    signalOwnedChild(owned, "SIGTERM");
+    if (!owned.isClosed())
+        await settlesWithin(owned.closed, 1500);
+    signalOwnedChild(owned, "SIGKILL");
+    if (!owned.isClosed())
+        await settlesWithin(owned.closed, 1000);
+    const closed = owned.isClosed();
+    owned.child.stdin.destroy();
+    owned.child.stdout.destroy();
+    owned.child.stderr.destroy();
+    return closed;
+}
+export class RestrictedCodexTransport {
+    owned;
+    deadline;
+    frameLimit;
+    pending = new Map();
+    nextId = 0;
+    line = "";
+    decoder = new StringDecoder("utf8");
+    stdoutBytes = 0;
+    stderrBytes = 0;
+    eventCount = 0;
+    closing = false;
+    onNotification = () => undefined;
+    onRequest;
+    onRequestComplete;
+    constructor(owned, deadline, frameLimit = CODEX_MAX_OUTPUT_BYTES) {
+        this.owned = owned;
+        this.deadline = deadline;
+        this.frameLimit = frameLimit;
+        const child = owned.child;
+        child.on("error", () => this.fail("codex_process_failed"));
+        child.stdin.on("error", () => this.fail("codex_process_failed"));
+        child.on("close", () => this.fail("codex_process_failed"));
+        child.stdout.on("data", (chunk) => {
+            if ((!this.closing && this.deadline.code !== null) ||
+                (this.closing && this.pending.size === 0))
+                return;
+            this.stdoutBytes += chunk.length;
+            if (this.stdoutBytes >
+                Math.max(CODEX_MAX_STDOUT_BYTES, this.frameLimit * 2 + CODEX_MAX_OUTPUT_BYTES * 2)) {
+                this.fail("response_too_large");
+                return;
+            }
+            this.line += this.decoder.write(chunk);
+            if (Buffer.byteLength(this.line) > this.frameLimit) {
+                this.fail("response_too_large");
+                return;
+            }
+            while (this.line.includes("\n")) {
+                const split = this.line.indexOf("\n"), line = this.line.slice(0, split);
+                this.line = this.line.slice(split + 1);
+                if (line.length === 0) {
+                    this.fail("codex_protocol_error");
+                    return;
+                }
+                try {
+                    this.message(JSON.parse(line));
+                }
+                catch {
+                    this.fail("codex_protocol_error");
+                }
+                if (this.deadline.code !== null && !this.closing)
+                    return;
+            }
+        });
+        child.stderr.on("data", (chunk) => {
+            this.stderrBytes += chunk.length;
+            if (this.stderrBytes > CODEX_MAX_OUTPUT_BYTES)
+                this.fail("response_too_large");
+        });
+    }
+    /** A completed turn releases its deadline and wire budget, not its conversation. */
+    beginRequest(deadline, frameLimit) {
+        if (this.deadline.code !== null)
+            throw new RestrictedCodexStop(this.deadline.code);
+        if (this.closing || this.owned.isClosed() || this.pending.size)
+            throw new RestrictedCodexStop("codex_process_failed");
+        this.deadline = deadline;
+        this.frameLimit = frameLimit;
+        this.stdoutBytes = 0;
+        this.stderrBytes = 0;
+        this.eventCount = 0;
+    }
+    fail(code) {
+        if (!this.closing)
+            this.deadline.stop(code);
+        for (const pending of this.pending.values())
+            pending.reject(new RestrictedCodexStop(code));
+        this.pending.clear();
+    }
+    message(raw) {
+        const value = codexRecord(raw);
+        if (Object.keys(value).length === 0) {
+            this.fail("codex_protocol_error");
+            return;
+        }
+        if (value.id !== undefined && typeof value.method === "string") {
+            if (!this.onRequest || ++this.eventCount > CODEX_MAX_EVENTS) {
+                this.write({ id: value.id, error: { code: -32601, message: "Host request is disabled" } });
+                this.fail(this.eventCount > CODEX_MAX_EVENTS ? "response_too_large" : "codex_tool_call");
+                return;
+            }
+            const id = value.id;
+            void this.onRequest(value.method, codexRecord(value.params)).then((result) => {
+                try {
+                    if (this.closing || this.deadline.code !== null)
+                        return;
+                    this.write({ id, result });
+                    this.deadline.resume();
+                    this.stdoutBytes = 0;
+                    this.eventCount = 0;
+                    this.onRequestComplete?.();
+                }
+                catch {
+                    this.fail("codex_process_failed");
+                }
+            }, (error) => {
+                try {
+                    if (!this.closing && this.deadline.code === null)
+                        this.write({ id, error: { code: -32000, message: "Host request failed" } });
+                }
+                catch {
+                    /* The owned process is already failing. */
+                }
+                this.fail(error instanceof RestrictedCodexStop ? error.code : "codex_tool_call");
+            });
+            return;
+        }
+        if (typeof value.id === "number" && value.method === undefined) {
+            const pending = this.pending.get(value.id);
+            if (!pending) {
+                this.fail("codex_protocol_error");
+                return;
+            }
+            this.pending.delete(value.id);
+            if (value.error !== undefined)
+                pending.reject(new RestrictedCodexStop("codex_protocol_error"));
+            else if (value.result === null ||
+                typeof value.result !== "object" ||
+                Array.isArray(value.result))
+                pending.reject(new RestrictedCodexStop("codex_protocol_error"));
+            else
+                pending.resolve(codexRecord(value.result));
+            return;
+        }
+        if (typeof value.method !== "string" ||
+            value.id !== undefined ||
+            ++this.eventCount > CODEX_MAX_EVENTS) {
+            this.fail(this.eventCount > CODEX_MAX_EVENTS ? "response_too_large" : "codex_protocol_error");
+            return;
+        }
+        if (!this.closing)
+            this.onNotification(value.method, codexRecord(value.params));
+    }
+    write(value) {
+        if (this.owned.isClosed() || this.owned.child.stdin.destroyed)
+            throw new RestrictedCodexStop("codex_process_failed");
+        this.owned.child.stdin.write(`${JSON.stringify(value)}\n`);
+    }
+    notify(method, params) {
+        this.deadline.check();
+        this.write({ method, params });
+    }
+    request(method, params) {
+        const id = ++this.nextId;
+        const result = new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+            try {
+                this.write({ id, method, params });
+            }
+            catch {
+                this.pending.delete(id);
+                reject(new RestrictedCodexStop("codex_process_failed"));
+            }
+        });
+        void result.catch(() => undefined);
+        return { id, result };
+    }
+    async rpc(method, params) {
+        this.deadline.check();
+        const { id, result } = this.request(method, params);
+        const timer = setTimeout(() => this.deadline.stop("timeout"), Math.min(15_000, Math.max(1, this.deadline.expiresAt - performance.now())));
+        try {
+            return await this.deadline.wait(result);
+        }
+        finally {
+            clearTimeout(timer);
+            this.pending.delete(id);
+        }
+    }
+    async close(interrupt) {
+        this.closing = true;
+        if (interrupt && !this.owned.isClosed()) {
+            const { id, result } = this.request("turn/interrupt", interrupt);
+            await settlesWithin(result, 1000);
+            this.pending.delete(id);
+        }
+        this.fail("codex_process_failed");
+        return closeOwnedCodexProcess(this.owned);
+    }
+}

package/dist/actors/codex/restricted-turn.d.ts

@@ -0,0 +1,62 @@
+import { type RestrictedCodexResult, type RestrictedCodexUsage } from "./restricted-policy.js";
+import { type RestrictedCodexDeadline, type RestrictedCodexTransport } from "./restricted-transport.js";
+/** What a turn reads from and reports to its session. */
+export interface RestrictedCodexTurnContext {
+    readonly deadline: RestrictedCodexDeadline;
+    /** The session's thread, read when each event arrives. */
+    threadId(): string | undefined;
+    /** A participant session has one dynamic tool; an analyst has none. */
+    readonly participant: boolean;
+    /**
+     * The participant's tool, read at each use as the session's options hold it then, so a tool
+     * the host replaced mid-request is the one checked and called. Only read when participant.
+     */
+    tool(): {
+        name: string;
+        call(args: unknown): Promise<string>;
+    };
+    /** Thread usage when the request began; null once an earlier turn's usage was unknown. */
+    readonly usageBaseline: RestrictedCodexUsage | null;
+    /** Tool call ids already answered in this session. */
+    readonly toolCallIds: Set<string>;
+    /** This turn's usage so far, for the session's pending-usage getters. */
+    reportUsage(usage: RestrictedCodexUsage | undefined, inference: RestrictedCodexUsage[] | undefined): void;
+    /** The turn the session interrupts if it closes now. */
+    turnStarted(turnId: string): void;
+}
+/**
+ * Drain: every notification and tool request of one turn. Nothing is handled before `dispatched`;
+ * events that arrive before turn/start's reply wait until acknowledge() and are then checked in
+ * order. `finished` resolves only with a completed, validated final answer.
+ */
+export declare class RestrictedCodexTurn {
+    private readonly context;
+    dispatched: boolean;
+    usage: RestrictedCodexUsage | null;
+    latestUsage: RestrictedCodexUsage | null;
+    inferenceUsage: RestrictedCodexUsage[] | null;
+    readonly finished: Promise<RestrictedCodexResult>;
+    private turnId;
+    private earlyTurnId;
+    private completed;
+    private compacted;
+    private toolRequestPending;
+    private generatedDeltaBytes;
+    private outputItem;
+    private readonly early;
+    private readonly allowedRawItemTypes;
+    private resolveFinished;
+    private resolveTurnReady;
+    private readonly turnReady;
+    constructor(context: RestrictedCodexTurnContext);
+    /** turn/start's reply: records the turn id, then checks the events that arrived before it. */
+    acknowledge(returnedTurnId: unknown): void;
+    readonly onNotification: RestrictedCodexTransport["onNotification"];
+    readonly onRequest: NonNullable<RestrictedCodexTransport["onRequest"]>;
+    readonly onRequestComplete: () => void;
+    private handleTurnEvent;
+    private recordUsage;
+    /** The item allowlist, the participant's one dynamic tool and the final answer's shape. */
+    private admitsItem;
+    private complete;
+}

package/dist/actors/codex/restricted-turn.js

@@ -0,0 +1,284 @@
+// One restricted Codex request's turn: the notifications and tool requests the app-server sends
+// while the turn runs. Each is checked against the tool policy, the turn's identity and the output
+// limits, and any violation stops the request's deadline with a refusal code.
+import { CODEX_MAX_OUTPUT_BYTES, CODEX_MAX_REQUEST_BYTES, codexRecord, restrictedCodexUsage, toolPolicyViolation, } from "./restricted-policy.js";
+import { RestrictedCodexStop, } from "./restricted-transport.js";
+const rawCompactionTypes = ["compaction", "compaction_summary", "context_compaction"];
+const analystRawItemTypes = ["message", "reasoning", ...rawCompactionTypes];
+const participantRawItemTypes = [
+    ...analystRawItemTypes,
+    "custom_tool_call",
+    "custom_tool_call_output",
+    "function_call",
+    "function_call_output",
+];
+function hasScopedIdentity(method, params, threadId, turnId) {
+    if (method === "turn/started" || method === "turn/completed") {
+        const id = codexRecord(params.turn).id;
+        return (params.threadId === threadId &&
+            typeof id === "string" &&
+            id.length > 0 &&
+            id.length <= 200 &&
+            (turnId === undefined || id === turnId));
+    }
+    if (method.startsWith("item/") ||
+        method.startsWith("rawResponse") ||
+        method === "thread/tokenUsage/updated")
+        return (params.threadId === threadId &&
+            typeof params.turnId === "string" &&
+            params.turnId.length > 0 &&
+            (turnId === undefined || params.turnId === turnId));
+    return ((params.threadId === undefined || params.threadId === threadId) &&
+        (params.turnId === undefined || params.turnId === turnId));
+}
+function usageDelta(total, baseline) {
+    const delta = {
+        input: total.input - baseline.input,
+        output: total.output - baseline.output,
+        cachedInput: (total.cachedInput ?? 0) - (baseline.cachedInput ?? 0),
+        cacheWriteInput: (total.cacheWriteInput ?? 0) - (baseline.cacheWriteInput ?? 0),
+    };
+    return Object.values(delta).every((value) => Number.isSafeInteger(value) && value >= 0) &&
+        delta.cachedInput + delta.cacheWriteInput <= delta.input
+        ? delta
+        : null;
+}
+/**
+ * Drain: every notification and tool request of one turn. Nothing is handled before `dispatched`;
+ * events that arrive before turn/start's reply wait until acknowledge() and are then checked in
+ * order. `finished` resolves only with a completed, validated final answer.
+ */
+export class RestrictedCodexTurn {
+    context;
+    dispatched = false;
+    usage = null;
+    latestUsage = null;
+    inferenceUsage;
+    finished;
+    turnId;
+    earlyTurnId;
+    completed = false;
+    compacted = false;
+    toolRequestPending = false;
+    generatedDeltaBytes = 0;
+    outputItem;
+    early = [];
+    allowedRawItemTypes;
+    resolveFinished;
+    resolveTurnReady;
+    turnReady;
+    constructor(context) {
+        this.context = context;
+        this.inferenceUsage = context.participant ? [] : null;
+        this.allowedRawItemTypes = context.participant ? participantRawItemTypes : analystRawItemTypes;
+        this.finished = new Promise((resolve) => {
+            this.resolveFinished = resolve;
+        });
+        this.turnReady = new Promise((resolve) => {
+            this.resolveTurnReady = resolve;
+        });
+    }
+    /** turn/start's reply: records the turn id, then checks the events that arrived before it. */
+    acknowledge(returnedTurnId) {
+        if (typeof returnedTurnId !== "string" ||
+            returnedTurnId.length === 0 ||
+            returnedTurnId.length > 200 ||
+            (this.earlyTurnId !== undefined && this.earlyTurnId !== returnedTurnId))
+            throw new RestrictedCodexStop("codex_protocol_error");
+        this.turnId = returnedTurnId;
+        this.resolveTurnReady(returnedTurnId);
+        this.context.turnStarted(returnedTurnId);
+        for (const event of this.early)
+            this.handleTurnEvent(event.method, event.params);
+        this.early.length = 0;
+    }
+    onNotification = (method, params) => {
+        const { deadline } = this.context;
+        if (!this.dispatched)
+            return;
+        if (!hasScopedIdentity(method, params, this.context.threadId(), this.turnId ?? this.earlyTurnId)) {
+            deadline.stop("codex_protocol_error");
+            return;
+        }
+        if (method === "item/agentMessage/delta") {
+            if (typeof params.delta !== "string") {
+                deadline.stop("codex_protocol_error");
+                return;
+            }
+            this.generatedDeltaBytes += Buffer.byteLength(params.delta);
+            if (this.generatedDeltaBytes > CODEX_MAX_OUTPUT_BYTES) {
+                deadline.stop("response_too_large");
+                return;
+            }
+        }
+        // The single tool-policy check. Tool requests must fail even if the turn-start
+        // acknowledgment is lost, and every event reaches handleTurnEvent only from here, directly
+        // or through the early buffer, so no event skips it.
+        if (toolPolicyViolation(method, codexRecord(params.item), this.allowedRawItemTypes)) {
+            deadline.stop("codex_tool_call");
+            return;
+        }
+        if (method === "turn/started") {
+            const value = codexRecord(params.turn).id;
+            if (typeof value !== "string" ||
+                value.length === 0 ||
+                (this.earlyTurnId !== undefined && value !== this.earlyTurnId))
+                deadline.stop("codex_protocol_error");
+            else {
+                this.earlyTurnId = value;
+                this.context.turnStarted(value);
+            }
+        }
+        if (this.turnId === undefined)
+            this.early.push({ method, params });
+        else
+            this.handleTurnEvent(method, params);
+    };
+    onRequest = async (method, params) => {
+        const { deadline, participant, toolCallIds } = this.context;
+        const callId = params.callId;
+        if (!participant ||
+            method !== "item/tool/call" ||
+            params.threadId !== this.context.threadId() ||
+            typeof params.turnId !== "string" ||
+            params.turnId.length === 0 ||
+            params.turnId.length > 200 ||
+            params.namespace !== null ||
+            params.tool !== this.context.tool().name ||
+            typeof callId !== "string" ||
+            callId.length === 0 ||
+            callId.length > 200 ||
+            toolCallIds.has(callId) ||
+            this.toolRequestPending)
+            throw new RestrictedCodexStop("codex_tool_call");
+        // Mark the request outstanding before waiting for a same-chunk turn/start
+        // acknowledgment, so an early completion can never be accepted.
+        this.toolRequestPending = true;
+        const activeTurnId = this.turnId ?? this.earlyTurnId ?? (await deadline.wait(this.turnReady));
+        if (params.turnId !== activeTurnId)
+            throw new RestrictedCodexStop("codex_tool_call");
+        toolCallIds.add(callId);
+        deadline.pause();
+        const text = await deadline.wait(this.context.tool().call(params.arguments));
+        if (typeof text !== "string" || Buffer.byteLength(text) > CODEX_MAX_REQUEST_BYTES)
+            throw new RestrictedCodexStop("invalid_response");
+        try {
+            JSON.parse(text);
+        }
+        catch {
+            throw new RestrictedCodexStop("invalid_response");
+        }
+        return { success: true, contentItems: [{ type: "inputText", text }] };
+    };
+    onRequestComplete = () => {
+        this.toolRequestPending = false;
+    };
+    handleTurnEvent(method, params) {
+        const { deadline } = this.context;
+        if (!hasScopedIdentity(method, params, this.context.threadId(), this.turnId)) {
+            deadline.stop("codex_protocol_error");
+            return;
+        }
+        const item = codexRecord(params.item);
+        // CLI 0.154.0 thread totals omitted compaction requests; later releases were not re-measured.
+        // Retain known usage, but never label it complete when native compaction occurred.
+        if (method === "thread/compacted" ||
+            item.type === "contextCompaction" ||
+            rawCompactionTypes.includes(String(item.type)))
+            this.compacted = true;
+        // onNotification already applied toolPolicyViolation to this event.
+        if (method === "rawResponseItem/completed" &&
+            item.type === "message" &&
+            Array.isArray(item.content) &&
+            item.content.some((content) => codexRecord(content).type === "refusal"))
+            deadline.stop("refusal");
+        if (method === "thread/tokenUsage/updated")
+            this.recordUsage(params);
+        if ((method === "item/started" || method === "item/completed") &&
+            !this.admitsItem(method, item))
+            return;
+        if (method === "turn/completed")
+            this.complete(codexRecord(params.turn));
+    }
+    recordUsage(params) {
+        const baseline = this.context.usageBaseline;
+        const total = restrictedCodexUsage(params.tokenUsage);
+        // App-server reports cumulative thread usage. Receipts must charge only this turn.
+        this.usage = total && baseline ? usageDelta(total, baseline) : null;
+        if (this.inferenceUsage !== null) {
+            const inferenceDelta = total && (this.latestUsage ?? baseline)
+                ? usageDelta(total, (this.latestUsage ?? baseline))
+                : null;
+            if (!inferenceDelta)
+                this.inferenceUsage = null;
+            else if (Object.values(inferenceDelta).some((value) => value > 0))
+                this.inferenceUsage.push(inferenceDelta);
+        }
+        this.context.reportUsage(this.usage ?? undefined, this.inferenceUsage?.length ? this.inferenceUsage.map((item) => ({ ...item })) : undefined);
+        this.latestUsage = total;
+    }
+    /** The item allowlist, the participant's one dynamic tool and the final answer's shape. */
+    admitsItem(method, item) {
+        const { deadline, participant } = this.context;
+        const allowedItems = participant
+            ? ["userMessage", "agentMessage", "reasoning", "contextCompaction", "dynamicToolCall"]
+            : ["userMessage", "agentMessage", "reasoning", "contextCompaction"];
+        if (!allowedItems.includes(String(item.type))) {
+            deadline.stop("codex_tool_call");
+            return false;
+        }
+        if (item.type === "dynamicToolCall" &&
+            (item.tool !== (participant ? this.context.tool().name : undefined) ||
+                item.namespace !== null ||
+                (method === "item/started" && item.status !== "inProgress") ||
+                (method === "item/completed" && (item.status !== "completed" || item.success !== true)))) {
+            deadline.stop("codex_tool_call");
+            return false;
+        }
+        if (item.type === "agentMessage" &&
+            method === "item/completed" &&
+            item.phase !== "commentary") {
+            if (typeof item.id !== "string" ||
+                typeof item.text !== "string" ||
+                Buffer.byteLength(item.text) > CODEX_MAX_OUTPUT_BYTES ||
+                (item.phase !== null && item.phase !== "final_answer") ||
+                (item.delivery !== null && item.delivery !== undefined) ||
+                (this.outputItem && (this.outputItem.id !== item.id || this.outputItem.text !== item.text))) {
+                deadline.stop("invalid_response");
+                return false;
+            }
+            this.outputItem = { id: item.id, text: item.text };
+        }
+        return true;
+    }
+    complete(turn) {
+        const { deadline } = this.context;
+        if (turn.id !== this.turnId || this.completed || this.toolRequestPending) {
+            deadline.stop("codex_protocol_error");
+            return;
+        }
+        this.completed = true;
+        if (turn.status === "interrupted") {
+            deadline.stop("cancelled");
+            return;
+        }
+        if (turn.status !== "completed" || turn.error !== null || !this.outputItem) {
+            deadline.stop("invalid_response");
+            return;
+        }
+        try {
+            this.context.reportUsage(undefined, undefined);
+            this.resolveFinished({
+                status: "completed",
+                output: JSON.parse(this.outputItem.text),
+                usage: this.usage,
+                usageComplete: this.usage !== null && !this.compacted,
+                dispatched: true,
+                errorCode: null,
+            });
+        }
+        catch {
+            deadline.stop("invalid_response");
+        }
+    }
+}