humanish 0.96.0 → 0.97.0

package/dist/restricted-codex-analysis.d.ts

@@ -0,0 +1,15 @@
+import { type RestrictedCodexSessionOptions } from "./restricted-codex-session.js";
+import type { RestrictedCodexAnalysisErrorCode, RestrictedCodexRequest, RestrictedCodexResult } from "./restricted-codex-policy.js";
+export { RESTRICTED_CODEX_ANALYSIS_IDENTITY, RESTRICTED_CODEX_ANALYSIS_MODELS } from "./restricted-codex-policy.js";
+export type { RestrictedCodexAnalysisErrorCode } from "./restricted-codex-policy.js";
+/** Structurally implements StudyAnalysisProvider without importing its API transport.
+ * Schema/evidence validation and transient-secret scrubbing remain in the engine. */
+export declare function createRestrictedCodexAnalysisProvider(options?: RestrictedCodexSessionOptions): (request: RestrictedCodexRequest) => Promise<RestrictedCodexResult>;
+/** Does not submit a model turn. Readiness is not a quota/access guarantee. */
+export declare function checkRestrictedCodexAnalysisReadiness(input?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}, options?: RestrictedCodexSessionOptions): Promise<{
+    ready: boolean;
+    errorCode: RestrictedCodexAnalysisErrorCode | null;
+}>;

package/dist/restricted-codex-analysis.js

@@ -0,0 +1,13 @@
+import { checkRestrictedCodexSessionReadiness, runRestrictedCodexSession } from "./restricted-codex-session.js";
+export { RESTRICTED_CODEX_ANALYSIS_IDENTITY, RESTRICTED_CODEX_ANALYSIS_MODELS } from "./restricted-codex-policy.js";
+/** Structurally implements StudyAnalysisProvider without importing its API transport.
+ * Schema/evidence validation and transient-secret scrubbing remain in the engine. */
+export function createRestrictedCodexAnalysisProvider(options = {}) {
+    return request => runRestrictedCodexSession(request, options);
+}
+/** Does not submit a model turn. Readiness is not a quota/access guarantee. */
+export async function checkRestrictedCodexAnalysisReadiness(input = {}, options = {}) {
+    const result = await checkRestrictedCodexSessionReadiness(input, options);
+    return { ready: result.status === "completed", errorCode: result.errorCode };
+}
+//# sourceMappingURL=restricted-codex-analysis.js.map

package/dist/restricted-codex-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restricted-codex-analysis.js","sourceRoot":"","sources":["../src/restricted-codex-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,yBAAyB,EAAsC,MAAM,+BAA+B,CAAC;AAEpJ,OAAO,EAAE,kCAAkC,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAGpH;qFACqF;AACrF,MAAM,UAAU,qCAAqC,CAAC,UAAyC,EAAE;IAE/F,OAAO,OAAO,CAAC,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,QAAsD,EAAE,EAClH,UAAyC,EAAE;IAC3C,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC/E,CAAC"}

package/dist/restricted-codex-policy.d.ts

@@ -0,0 +1,56 @@
+/** Versioned, deliberately narrow profile qualified with an account-backed vision turn.
+ * The CLI still advertises code-mode tools: disabling their host is the enforcement
+ * boundary. Feature names alone are not proof that a tool has been removed. */
+export declare const RESTRICTED_CODEX_ANALYSIS_IDENTITY: {
+    readonly provider: "codex";
+    readonly authMode: "chatgpt";
+    readonly modelProvider: "openai";
+    readonly cliVersion: "0.154.0";
+    readonly toolPolicy: "restricted-codex-v1";
+    readonly reasoningEffort: "low";
+};
+export declare const RESTRICTED_CODEX_ANALYSIS_MODELS: readonly ["gpt-6-astra"];
+export type RestrictedCodexAnalysisErrorCode = "invalid_request" | "cancelled" | "timeout" | "response_too_large" | "invalid_response" | "refusal" | "output_incomplete" | "codex_unavailable" | "codex_unsupported_version" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "codex_busy";
+export interface RestrictedCodexRequest {
+    model: string;
+    instructions: string;
+    evidence: string;
+    images: {
+        evidenceId: string;
+        dataUrl: string;
+    }[];
+    schema: Record<string, unknown>;
+    maxOutputTokens: number | null;
+    timeoutMs: number;
+    signal?: AbortSignal;
+}
+export interface RestrictedCodexUsage {
+    input: number;
+    output: number;
+    cachedInput?: number;
+    cacheWriteInput?: number;
+}
+export interface RestrictedCodexResult {
+    status: "completed" | "incomplete" | "refused" | "failed" | "cancelled" | "timed_out";
+    output: unknown;
+    usage: RestrictedCodexUsage | null;
+    usageComplete: boolean;
+    dispatched: boolean;
+    errorCode: RestrictedCodexAnalysisErrorCode | null;
+}
+export declare const CODEX_MAX_REQUEST_BYTES: number;
+export declare const CODEX_MAX_OUTPUT_BYTES: number;
+export declare const CODEX_MAX_STDOUT_BYTES: number;
+export declare const CODEX_MAX_EVENTS = 65536;
+export declare const CODEX_IMAGE: RegExp;
+export declare const codexRecord: (value: unknown) => Record<string, unknown>;
+export declare function restrictedCodexConfig(model: string): {
+    toml: string;
+    overrides: Record<string, unknown>;
+};
+/** Inspect before thread/start, which could otherwise start inherited integrations. */
+export declare function admitsRestrictedCodexConfig(raw: unknown, configPath: string, model: string): boolean;
+export declare function admitsRestrictedCodexThread(raw: unknown, model: string, cwd: string): boolean;
+export declare function restrictedCodexRequestError(request: RestrictedCodexRequest): RestrictedCodexAnalysisErrorCode | null;
+export declare function restrictedCodexUsage(raw: unknown): RestrictedCodexUsage | null;
+export declare function restrictedCodexFailure(errorCode: RestrictedCodexAnalysisErrorCode, dispatched?: boolean, usage?: RestrictedCodexUsage | null): RestrictedCodexResult;

package/dist/restricted-codex-policy.js

@@ -0,0 +1,151 @@
+/** Versioned, deliberately narrow profile qualified with an account-backed vision turn.
+ * The CLI still advertises code-mode tools: disabling their host is the enforcement
+ * boundary. Feature names alone are not proof that a tool has been removed. */
+export const RESTRICTED_CODEX_ANALYSIS_IDENTITY = {
+    provider: "codex", authMode: "chatgpt", modelProvider: "openai", cliVersion: "0.154.0",
+    toolPolicy: "restricted-codex-v1", reasoningEffort: "low"
+};
+export const RESTRICTED_CODEX_ANALYSIS_MODELS = ["gpt-6-astra"];
+export const CODEX_MAX_REQUEST_BYTES = 32 * 1024 * 1024;
+export const CODEX_MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
+export const CODEX_MAX_STDOUT_BYTES = 8 * 1024 * 1024;
+export const CODEX_MAX_EVENTS = 65_536;
+export const CODEX_IMAGE = /^data:image\/(png|jpeg|webp);base64,([A-Za-z0-9+/]+={0,2})$/;
+export const codexRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+const empty = (value) => value === null || value === undefined
+    || (typeof value === "object" && Object.keys(value).length === 0);
+const count = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 1e12;
+const disabledFeatures = ["apps", "plugins", "hooks", "shell_tool", "shell_snapshot", "view_image", "image_generation",
+    "skill_search", "skill_mcp_dependency_install", "multi_agent", "multi_agent_v2", "browser_use", "browser_use_external",
+    "computer_use", "memories", "external_agent_memory_import", "goals", "sleep_tool", "tool_suggest", "code_mode",
+    "code_mode_host", "code_mode_only", "default_mode_request_user_input", "unbounded_connection_retries",
+    "workspace_dependencies", "remote_plugin", "recommended_plugins", "in_app_local_automation"];
+export function restrictedCodexConfig(model) {
+    const overrides = {
+        model, model_provider: "openai", model_reasoning_effort: "low", approval_policy: "never", sandbox_mode: "read-only",
+        forced_login_method: "chatgpt", project_doc_max_bytes: 0, web_search: "disabled", "history.persistence": "none",
+        "analytics.enabled": false, "features.skip_host_skill_discovery": true, "skills.bundled.enabled": false,
+        "agents.enabled": false, "agents.max_threads": 1, "agents.max_depth": 1
+    };
+    for (const name of disabledFeatures)
+        overrides[`features.${name}`] = false;
+    const toml = `model = ${JSON.stringify(model)}
+model_provider = "openai"
+model_reasoning_effort = "low"
+approval_policy = "never"
+sandbox_mode = "read-only"
+forced_login_method = "chatgpt"
+project_doc_max_bytes = 0
+web_search = "disabled"
+[history]
+persistence = "none"
+[analytics]
+enabled = false
+[features]
+skip_host_skill_discovery = true
+${disabledFeatures.map(name => `${name} = false`).join("\n")}
+[skills.bundled]
+enabled = false
+[agents]
+enabled = false
+max_threads = 1
+max_depth = 1
+`;
+    return { toml, overrides };
+}
+/** Inspect before thread/start, which could otherwise start inherited integrations. */
+export function admitsRestrictedCodexConfig(raw, configPath, model) {
+    const root = codexRecord(raw), config = codexRecord(root.config), features = codexRecord(config.features);
+    if (!Array.isArray(root.layers) || root.layers.length === 0)
+        return false;
+    let ownLayer = false;
+    for (const rawLayer of root.layers) {
+        const layer = codexRecord(rawLayer), name = codexRecord(layer.name);
+        if (name.type === "user" && name.file === configPath && name.profile === null
+            && (layer.disabledReason === null || layer.disabledReason === undefined)) {
+            if (ownLayer)
+                return false;
+            ownLayer = true;
+        }
+        else if (name.type !== "system" || !empty(layer.config))
+            return false;
+    }
+    if (!ownLayer || config.model !== model || config.model_provider !== "openai" || config.model_reasoning_effort !== "low"
+        || config.forced_login_method !== "chatgpt" || config.sandbox_mode !== "read-only" || config.approval_policy !== "never"
+        || config.project_doc_max_bytes !== 0 || config.web_search !== "disabled" || features.skip_host_skill_discovery !== true
+        || codexRecord(config.history).persistence !== "none" || codexRecord(config.analytics).enabled !== false
+        || disabledFeatures.some(name => features[name] !== false))
+        return false;
+    const agents = codexRecord(config.agents), skills = codexRecord(config.skills);
+    if (agents.enabled !== false || agents.max_concurrent_threads_per_session !== 1 || agents.max_depth !== 1
+        || codexRecord(skills.bundled).enabled !== false || Object.keys(skills).some(key => key !== "bundled"))
+        return false;
+    for (const key of ["mcp_servers", "plugins", "hooks", "notify", "instructions", "developer_instructions", "permissions",
+        "profiles", "projects", "model_providers", "experimental_compact_prompt_file", "experimental_model_instructions_file", "model_instructions_file",
+        "model_catalog_json", "openai_base_url", "orchestrator", "experimental_thread_store", "experimental_thread_store_endpoint",
+        "experimental_realtime_ws_base_url", "experimental_realtime_webrtc_call_base_url", "forced_chatgpt_workspace_id",
+        "log_dir", "sqlite_home", "otel", "marketplaces", "js_repl_node_path", "js_repl_node_module_dirs", "responses_api_metadata",
+        "compact_prompt", "profile", "default_permissions", "auto_review", "apps", "browser_use", "computer_use", "desktop", "memories", "realtime"])
+        if (!empty(config[key]))
+            return false;
+    if (Object.values(codexRecord(config.shell_environment_policy)).some(value => !empty(value)))
+        return false;
+    return config.cli_auth_credentials_store === "file" && config.chatgpt_base_url === "https://chatgpt.com/backend-api/";
+}
+export function admitsRestrictedCodexThread(raw, model, cwd) {
+    const value = codexRecord(raw), thread = codexRecord(value.thread), sandbox = codexRecord(value.sandbox);
+    return typeof thread.id === "string" && thread.id.length > 0 && thread.id.length <= 200
+        && thread.ephemeral === true && thread.model === model && thread.modelProvider === "openai"
+        && thread.reasoningEffort === "low" && thread.cliVersion === RESTRICTED_CODEX_ANALYSIS_IDENTITY.cliVersion
+        && Array.isArray(thread.environments) && thread.environments.length === 0 && thread.path === null
+        && value.model === model && value.modelProvider === "openai" && value.reasoningEffort === "low"
+        && value.cwd === cwd && thread.cwd === cwd && value.approvalPolicy === "never"
+        && sandbox.type === "readOnly" && sandbox.networkAccess === false
+        && Array.isArray(value.instructionSources) && value.instructionSources.length === 0
+        && Array.isArray(value.runtimeWorkspaceRoots) && value.runtimeWorkspaceRoots.length === 0;
+}
+export function restrictedCodexRequestError(request) {
+    if (request.signal?.aborted)
+        return "cancelled";
+    if (!RESTRICTED_CODEX_ANALYSIS_MODELS.some(model => model === request.model))
+        return "codex_model_unavailable";
+    if (request.maxOutputTokens !== null || !Number.isSafeInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > 600_000
+        || typeof request.instructions !== "string" || typeof request.evidence !== "string" || !Array.isArray(request.images)
+        || request.images.length > 128 || !request.schema || typeof request.schema !== "object" || Array.isArray(request.schema))
+        return "invalid_request";
+    try {
+        if (new TextEncoder().encode(JSON.stringify({ instructions: request.instructions, evidence: request.evidence,
+            images: request.images, schema: request.schema })).byteLength > CODEX_MAX_REQUEST_BYTES)
+            return "invalid_request";
+        let imageBytes = 0;
+        for (const image of request.images) {
+            if (typeof image.evidenceId !== "string" || image.evidenceId.length === 0 || image.evidenceId.length > 300
+                || typeof image.dataUrl !== "string")
+                return "invalid_request";
+            const match = CODEX_IMAGE.exec(image.dataUrl);
+            if (!match)
+                return "invalid_request";
+            const decoded = atob(match[2]);
+            imageBytes += decoded.length;
+            if (btoa(decoded) !== match[2] || imageBytes > 20 * 1024 * 1024)
+                return "invalid_request";
+        }
+        return null;
+    }
+    catch {
+        return "invalid_request";
+    }
+}
+export function restrictedCodexUsage(raw) {
+    const total = codexRecord(codexRecord(raw).total);
+    const input = total.inputTokens, output = total.outputTokens, cachedInput = total.cachedInputTokens, cacheWriteInput = total.cacheWriteInputTokens;
+    if (!count(input) || !count(output) || !count(cachedInput) || !count(cacheWriteInput) || cachedInput + cacheWriteInput > input)
+        return null;
+    return { input, output, cachedInput, cacheWriteInput };
+}
+export function restrictedCodexFailure(errorCode, dispatched = false, usage = null) {
+    return { status: errorCode === "cancelled" ? "cancelled" : errorCode === "timeout" ? "timed_out"
+            : errorCode === "refusal" ? "refused" : errorCode === "output_incomplete" ? "incomplete" : "failed",
+        output: null, usage, usageComplete: false, dispatched, errorCode };
+}
+//# sourceMappingURL=restricted-codex-policy.js.map

package/dist/restricted-codex-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restricted-codex-policy.js","sourceRoot":"","sources":["../src/restricted-codex-policy.ts"],"names":[],"mappings":"AAAA;;+EAE+E;AAC/E,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS;IACtF,UAAU,EAAE,qBAAqB,EAAE,eAAe,EAAE,KAAK;CACjD,CAAC;AACX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,aAAa,CAAU,CAAC;AA6BzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,6DAA6D,CAAC;AAEzF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAA2B,EAAE,CACrE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,MAAM,KAAK,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;OAC3E,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AACpE,MAAM,KAAK,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,IAAK,KAAgB,IAAI,IAAI,CAAC;AAEtI,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB;IACpH,cAAc,EAAE,8BAA8B,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,sBAAsB;IACtH,cAAc,EAAE,UAAU,EAAE,8BAA8B,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;IAC9G,gBAAgB,EAAE,gBAAgB,EAAE,iCAAiC,EAAE,8BAA8B;IACrG,wBAAwB,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,CAAU,CAAC;AAExG,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,SAAS,GAA4B;QACzC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW;QACnH,mBAAmB,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM;QAC/G,mBAAmB,EAAE,KAAK,EAAE,oCAAoC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK;QACvG,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC;KACxE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,gBAAgB;QAAE,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;IAC3E,MAAM,IAAI,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;;;;;;;;;;;;;EAc7C,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;CAO3D,CAAC;IACA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CAAC,GAAY,EAAE,UAAkB,EAAE,KAAa;IACzF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;eACxE,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,CAAC;YAC3E,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,sBAAsB,KAAK,KAAK;WACnH,MAAM,CAAC,mBAAmB,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,WAAW,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO;WACrH,MAAM,CAAC,qBAAqB,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,QAAQ,CAAC,yBAAyB,KAAK,IAAI;WACrH,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,KAAK,KAAK;WACrG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,kCAAkC,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;WACpG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACvH,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,wBAAwB,EAAE,aAAa;QACrH,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,sCAAsC,EAAE,yBAAyB;QAChJ,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,2BAA2B,EAAE,oCAAoC;QAC1H,mCAAmC,EAAE,4CAA4C,EAAE,6BAA6B;QAChH,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,wBAAwB;QAC3H,gBAAgB,EAAE,SAAS,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC;QAC5I,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3G,OAAO,MAAM,CAAC,0BAA0B,KAAK,MAAM,IAAI,MAAM,CAAC,gBAAgB,KAAK,kCAAkC,CAAC;AACxH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY,EAAE,KAAa,EAAE,GAAW;IAClF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzG,OAAO,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,GAAG;WAClF,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ;WACxF,MAAM,CAAC,eAAe,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,KAAK,kCAAkC,CAAC,UAAU;WACvG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;WAC9F,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;WAC5F,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO;WAC3E,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;WAC9D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;WAChF,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAA+B;IACzE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC/G,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,OAAO;WACnI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;WAClH,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACrJ,IAAI,CAAC;QACH,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1G,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,uBAAuB;YAAE,OAAO,iBAAiB,CAAC;QACpH,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;mBACrG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,iBAAiB,CAAC;YACjE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBAAE,OAAO,iBAAiB,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YAChC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,iBAAiB,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,iBAAiB,CAAC;IAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,WAAW,GAAG,KAAK,CAAC,iBAAiB,EAAE,eAAe,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACnJ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,WAAW,GAAG,eAAe,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5I,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAA2C,EAAE,UAAU,GAAG,KAAK,EACpG,QAAqC,IAAI;IACzC,OAAO,EAAE,MAAM,EAAE,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW;YAC9F,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;QACrG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACrE,CAAC"}

package/dist/restricted-codex-session.d.ts

@@ -0,0 +1,19 @@
+import { type RestrictedCodexRequest, type RestrictedCodexResult } from "./restricted-codex-policy.js";
+import { type RestrictedCodexSpawn } from "./restricted-codex-transport.js";
+/** Internal host dependencies. None of these options is accepted from a study artifact. */
+export interface RestrictedCodexSessionOptions {
+    executable?: string;
+    authHome?: string;
+    env?: NodeJS.ProcessEnv;
+    tempRoot?: string;
+    platform?: NodeJS.Platform;
+    arch?: string;
+    spawnFn?: RestrictedCodexSpawn;
+}
+/** The gate covers all factories and readiness checks in this process. It does not
+ * promise to serialize unrelated Codex applications using the same host login. */
+export declare function runRestrictedCodexSession(request: RestrictedCodexRequest, options?: RestrictedCodexSessionOptions, readinessOnly?: boolean): Promise<RestrictedCodexResult>;
+export declare function checkRestrictedCodexSessionReadiness(input?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}, options?: RestrictedCodexSessionOptions): Promise<RestrictedCodexResult>;