mtech-ai-local-runner 0.1.8 → 0.1.11

package/dist/src/adapters/codex/account-sources.js

@@ -0,0 +1,113 @@
+import path from 'node:path';
+import { constants } from 'node:fs';
+import { lstat, open, readdir, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { parse } from 'smol-toml';
+function denied() { throw new Error('CODEX_ACCOUNT_SOURCE_REJECTED'); }
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+async function stat(file) { try {
+    return await lstat(file);
+}
+catch (e) {
+    if (e.code === 'ENOENT')
+        return null;
+    throw e;
+} }
+async function file(file) {
+    const s = await stat(file);
+    if (!s)
+        return null;
+    if (!s.isFile() || s.isSymbolicLink() || s.nlink !== 1 || s.size > 65_536)
+        denied();
+    const fd = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const actual = await fd.stat();
+        if (!actual.isFile() || actual.nlink !== 1 || actual.dev !== s.dev || actual.ino !== s.ino || actual.size > 65_536)
+            denied();
+        const bytes = Buffer.alloc(65_537);
+        let total = 0;
+        while (total < bytes.length) {
+            const { bytesRead } = await fd.read(bytes, total, bytes.length - total, total);
+            if (!bytesRead)
+                break;
+            total += bytesRead;
+        }
+        const after = await fd.stat(), named = await stat(file);
+        if (!named || !named.isFile() || named.isSymbolicLink() || named.nlink !== 1 || named.dev !== actual.dev || named.ino !== actual.ino
+            || after.nlink !== 1 || total > 65_536 || total !== actual.size || after.size !== actual.size || after.mtimeMs !== actual.mtimeMs || after.ctimeMs !== actual.ctimeMs)
+            denied();
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, total));
+    }
+    finally {
+        await fd.close();
+    }
+}
+function preferences(text) {
+    const v = text === null ? {} : parse(text), result = {};
+    for (const [key, value] of Object.entries(v)) {
+        // Every accepted leaf is replaced by the trusted generated -c overrides.
+        // Tables (hooks/features/MCP/providers/profiles), unknown fields and backend
+        // selection are deliberately not ambient inputs, even when disabled/empty.
+        if (key === 'project_doc_max_bytes') {
+            if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+                denied();
+            result[key] = value;
+            continue;
+        }
+        if (!['model', 'model_provider', 'approval_policy', 'default_permissions', 'forced_login_method', 'web_search'].includes(key)
+            || typeof value !== 'string' || !value || value.length > 256 || /[\r\n\0]/.test(value))
+            denied();
+        if (key === 'model_provider' && value !== 'openai' || key === 'forced_login_method' && value !== 'chatgpt')
+            denied();
+        if (key === 'approval_policy' && !['never', 'on-request', 'untrusted', 'on-failure'].includes(value))
+            denied();
+        if (key === 'web_search' && !['disabled', 'cached', 'live'].includes(value))
+            denied();
+        result[key] = value;
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(result).sort(([a], [b]) => a.localeCompare(b))));
+}
+export async function inspectCodexAccountSources(home, cwd, account = path.join(home, '.codex')) {
+    try {
+        if (![home, cwd, account].every(p => path.isAbsolute(p) && path.resolve(p) === p && !/[\r\n\0]/.test(p)))
+            denied();
+        const root = await stat(account);
+        if (root && (!root.isDirectory() || root.isSymbolicLink() || await realpath(account) !== account))
+            denied();
+        const blocked = ['/etc/codex/rules'];
+        let parent = cwd;
+        while (true) {
+            const candidate = path.join(parent, '.codex');
+            if (candidate !== account)
+                blocked.push(candidate);
+            const next = path.dirname(parent);
+            if (next === parent)
+                break;
+            parent = next;
+        }
+        for (const entry of blocked)
+            if (await stat(entry))
+                denied();
+        const configPath = path.join(account, 'config.toml'), raw = await file(configPath), userConfig = preferences(raw);
+        const instructions = await file(path.join(account, 'AGENTS.md'));
+        if (instructions !== null && instructions.trim() !== '')
+            denied();
+        const rulesPath = path.join(account, 'rules'), rules = await stat(rulesPath);
+        if (rules && (!rules.isDirectory() || rules.isSymbolicLink() || (await readdir(rulesPath)).length !== 0))
+            denied();
+        return Object.freeze({ version: 1, configPath, userConfig, fingerprint: digest(JSON.stringify({ account, config: raw === null ? null : digest(raw), instructions: instructions === null ? null : digest(instructions), rules: rules ? 'empty-directory' : null })) });
+    }
+    catch {
+        denied();
+    }
+}
+/** Retain one source snapshot; any later drift revokes preparation/turn startup. */
+export function codexAccountSourceGuard(home, cwd, account) {
+    let snapshot;
+    return async () => {
+        const current = await inspectCodexAccountSources(home, cwd, account);
+        if (snapshot && snapshot.fingerprint !== current.fingerprint)
+            denied();
+        return snapshot ??= (current);
+    };
+}

package/dist/src/adapters/codex/adapter.js

@@ -0,0 +1,217 @@
+import { CodexExecLaunchHost } from './exec-launch-host.js';
+import { requireSecurityRequirements } from '../../safety/security-requirements.js';
+import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
+import { requireJobSecurity } from '../../safety/job-security-policy.js';
+import { CODEX_UNSUPPORTED_DIAGNOSTIC } from "./compatibility.js";
+import { buildCodexInvocation } from "./config-builder.js";
+import { compileCodexPrompt, CODEX_REPORT_SCHEMA } from "./prompt-compiler.js";
+import { CodexStreamParser } from "./stream-parser.js";
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Codex task package is invalid");
+    return value;
+}
+export class CodexAdapter {
+    options;
+    handle;
+    tools;
+    started = false;
+    receipt;
+    terminalAudit;
+    securityReceipt() { return this.terminalAudit ? structuredClone(this.terminalAudit) : this.usingOfficialExec ? this.ownedExec?.receipt() : this.receipt ? structuredClone(this.receipt) : undefined; }
+    cancelled = false;
+    usingOfficialExec = false;
+    ownedExec;
+    parser = new CodexStreamParser();
+    startupAbort = new AbortController();
+    securityPolicy;
+    constructor(options) {
+        this.options = options;
+    }
+    async start(ctx) {
+        if (this.started || this.cancelled || ctx.resumeSessionId)
+            throw new Error("Codex requires one fresh approved launch");
+        this.started = true;
+        if (!await this.options.verifyCompatibility())
+            throw new Error(CODEX_UNSUPPORTED_DIAGNOSTIC);
+        this.assertNotCancelled();
+        const approved = object(ctx.approvedTaskPackage);
+        const transport = approved.runtime_transport;
+        if (transport !== undefined && transport !== 'retained_app_server') {
+            if (transport !== 'official_exec_v1')
+                throw new Error('CODEX_EXEC_TRANSPORT_UNAVAILABLE');
+            const host = this.options.officialExec ?? await this.options.createOfficialExec?.(ctx, this.startupAbort.signal);
+            if (!(host instanceof CodexExecLaunchHost))
+                throw new Error('CODEX_EXEC_TRANSPORT_UNAVAILABLE');
+            if (this.cancelled) {
+                await this.options.closeOfficialExec?.();
+                throw new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+            }
+            host.assertAvailableContext(ctx, this.options.jobId);
+            this.ownedExec = host;
+            this.usingOfficialExec = true;
+            try {
+                const prompt = compileCodexPrompt(object(ctx.taskPackage), this.options.jobId);
+                this.handle = await this.ownedExec.start(ctx, this.options.jobId, prompt, this.startupAbort.signal);
+                this.receipt = this.ownedExec.receipt();
+                this.assertNotCancelled();
+                return;
+            }
+            catch {
+                await this.cancel();
+                throw new Error('CODEX_EXEC_PREFLIGHT_REJECTED');
+            }
+        }
+        if (!this.options.startVerifiedSession)
+            throw new Error("CODEX_PRE_MODEL_UNAVAILABLE");
+        const pkg = object(ctx.taskPackage);
+        const execution = object(pkg.execution);
+        const source = object(approved.repository);
+        const repositories = pkg.repositories;
+        const repository = object(Array.isArray(repositories) ? repositories[0] : undefined);
+        if (approved.runtime_adapter !== "codex_cli" || approved.runtime_adapter_version !== "1"
+            || approved.resolved_provider !== "openai" || !ctx.resolvedModelId
+            || approved.resolved_model_id !== ctx.resolvedModelId
+            || !/^[a-f0-9]{40}$/.test(String(source.base_commit_sha))
+            || source.base_commit_sha !== repository.base_commit_sha
+            || execution.mode !== "employee_ai_work_session" || execution.runtime_adapter !== "codex_cli"
+            || execution.limits_mode !== "unbounded")
+            throw new Error("Codex launch model, revision or execution policy differs from approval");
+        const admission = { adapterId: 'codex_cli', adapterVersion: '1', jobId: this.options.jobId, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), generation: ctx.generation };
+        if (!ctx.securityBinding)
+            throw new Error('SECURITY_REQUIREMENTS_REJECTED');
+        try {
+            this.securityPolicy = this.options.prepareSecurity ? await this.options.prepareSecurity(ctx) : this.options.securityPolicy;
+            this.assertNotCancelled();
+        }
+        catch (error) {
+            await this.cancel();
+            throw error;
+        }
+        const deferred = this.options.deferSupportedSecurity === true;
+        const assertAdmission = () => { if (!this.securityPolicy && deferred)
+            this.securityPolicy = this.options.securityPolicy; if (!Number.isSafeInteger(admission.generation) || Number(admission.generation) < 1)
+            throw new Error('JOB_SECURITY_REJECTED'); requireJobSecurity(this.securityPolicy, admission); requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "codex_cli", adapterVersion: "1", requirementsSha256: this.securityPolicy.pin.requirementsSha256 }); };
+        try {
+            if (deferred) {
+                const r = requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' });
+                if (r.security_mode !== 'supported_cli_policy_v1' || this.securityPolicy || !Number.isSafeInteger(ctx.generation) || Number(ctx.generation) < 1 || Object.values(ctx.securityBinding).some(v => !/^[a-f0-9]{64}$/.test(v)))
+                    throw new Error('SECURITY_REQUIREMENTS_REJECTED');
+            }
+            else {
+                assertAdmission();
+                this.receipt = createJobSecurityReceipt(this.securityPolicy, { jobId: this.options.jobId, generation: ctx.generation, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
+            }
+        }
+        catch (error) {
+            await this.cancel();
+            throw error;
+        }
+        try {
+            const prompt = compileCodexPrompt(pkg, this.options.jobId);
+            this.tools = this.options.createTools(pkg, approved);
+            const endpoint = await this.tools.start();
+            this.assertNotCancelled();
+            const schemaPath = await this.options.writeSchema(CODEX_REPORT_SCHEMA);
+            this.assertNotCancelled();
+            const invocation = buildCodexInvocation({ modelId: ctx.resolvedModelId,
+                worktreeRoot: this.options.cwd ?? this.options.worktreeRoot, sourceRoot: this.options.worktreeRoot, schemaPath, endpoint, env: this.options.env, scratch: this.options.scratch });
+            if (!deferred)
+                assertAdmission();
+            const handle = await this.options.startVerifiedSession(invocation, prompt, this.startupAbort.signal, assertAdmission);
+            try {
+                assertAdmission();
+            }
+            catch (error) {
+                this.tools.revoke();
+                handle.kill('SIGKILL');
+                throw error;
+            }
+            // Cancellation may race with a transport returning its newly created handle.
+            if (this.cancelled) {
+                handle.kill("SIGKILL");
+                this.assertNotCancelled();
+            }
+            this.handle = handle;
+            if (deferred)
+                this.receipt = createJobSecurityReceipt(this.securityPolicy, { jobId: this.options.jobId, generation: ctx.generation, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
+        }
+        catch {
+            const wasCancelled = this.cancelled;
+            await this.cancel();
+            throw new Error(wasCancelled ? "Codex launch cancelled during startup" : "Codex job setup failed before execution could be confirmed");
+        }
+    }
+    async *events() {
+        if (!this.handle)
+            throw new Error("Codex has not started");
+        try {
+            for await (const line of this.handle.stdout) {
+                if (this.cancelled)
+                    return;
+                const events = this.parser.parse(line);
+                for (const event of events) {
+                    if (["completed", "failed", "scope_conflict", "blocked"].includes(event.eventType)) {
+                        if (event.eventType === 'completed' && this.usingOfficialExec) {
+                            const audit = this.ownedExec?.receipt();
+                            if (!audit) {
+                                await this.cancel();
+                                yield { eventType: 'failed', summary: 'Codex completion lacked its validated security audit' };
+                                return;
+                            }
+                            this.terminalAudit = structuredClone(audit);
+                        }
+                        await this.cancel();
+                        yield event;
+                        return;
+                    }
+                    yield event;
+                }
+            }
+            for (const event of this.parser.end())
+                yield event;
+        }
+        finally {
+            await this.cancel();
+        }
+    }
+    async cancel() {
+        this.cancelled = true;
+        try {
+            if (this.usingOfficialExec)
+                await this.ownedExec?.cancel();
+            this.options.revokeSecurity?.();
+        }
+        finally {
+            try {
+                this.tools?.revoke();
+            }
+            finally {
+                this.startupAbort.abort();
+                try {
+                    if (!this.usingOfficialExec)
+                        this.handle?.kill("SIGKILL");
+                }
+                finally {
+                    try {
+                        await this.tools?.close();
+                    }
+                    finally {
+                        await this.options.closeOfficialExec?.();
+                    }
+                }
+            }
+        }
+    }
+    assertNotCancelled() {
+        if (this.cancelled)
+            throw new Error("Codex launch cancelled during startup");
+    }
+    async command(command) {
+        if (["cancel", "pause", "request_replan"].includes(command.command))
+            return this.cancel();
+        if (command.command === "request_checkpoint")
+            return;
+        throw new Error("Codex cannot resume or change an active approved launch");
+    }
+}

package/dist/src/adapters/codex/app-server-events.js

@@ -0,0 +1,84 @@
+import { record } from './stdio-rpc.js';
+/** Only provider completion/evidence events cross the runner boundary. */
+export class CodexAppServerEvents {
+    threadId;
+    turnId;
+    usage;
+    stopped = false;
+    constructor(threadId, turnId) {
+        this.threadId = threadId;
+        this.turnId = turnId;
+    }
+    map(message) {
+        if (this.stopped)
+            return [];
+        const method = message.method;
+        if (method === 'error')
+            return [{ type: 'turn.failed' }];
+        const params = record(message.params ?? {});
+        const relevant = method === 'turn/completed' || method === 'turn/started' || method === 'thread/tokenUsage/updated' || method === 'item/started' || method === 'item/completed';
+        if (relevant) {
+            const turn = method === 'turn/completed' || method === 'turn/started' ? record(params.turn).id : params.turnId;
+            if (params.threadId !== this.threadId || turn !== this.turnId) {
+                this.stopped = true;
+                return [{ type: 'turn.failed' }];
+            }
+        }
+        if (method === 'thread/tokenUsage/updated') {
+            const last = record(record(params.tokenUsage).last);
+            this.usage = { input_tokens: last.inputTokens, cached_input_tokens: last.cachedInputTokens, output_tokens: last.outputTokens };
+            return [];
+        }
+        if (method === 'turn/completed') {
+            this.stopped = true;
+            if (record(params.turn).status !== 'completed')
+                return [{ type: 'turn.failed' }];
+            return [{ type: 'turn.completed', ...(this.usage ? { usage: this.usage, usage_source: 'codex_app_server.thread/tokenUsage/updated' } : {}) }];
+        }
+        if (method === 'item/started' || method === 'item/completed') {
+            const item = record(params.item);
+            const forbidden = { commandExecution: 'command_execution', fileChange: 'file_change', webSearch: 'web_search' };
+            if (typeof item.type === 'string' && forbidden[item.type])
+                return [{ type: 'item.started', item: { type: forbidden[item.type] } }];
+            if (method === 'item/completed' && item.type === 'agentMessage' && item.phase !== 'commentary') {
+                return [{ type: 'item.completed', item: { type: 'agent_message', text: item.text } }];
+            }
+        }
+        return [];
+    }
+}
+/** Bounded normalized-event buffer; no raw protocol/credentials are retained. */
+export class CodexEventQueue {
+    lines = [];
+    bytes = 0;
+    done = false;
+    wake;
+    push(event) {
+        if (this.done)
+            return;
+        const line = JSON.stringify(event);
+        if (line.length > 256_000 || this.lines.length >= 128 || this.bytes + line.length > 1_000_000) {
+            this.lines = [JSON.stringify({ type: 'turn.failed' })];
+            this.bytes = this.lines[0].length;
+            this.done = true;
+            this.wake?.();
+            return;
+        }
+        this.lines.push(line);
+        this.bytes += line.length;
+        this.wake?.();
+    }
+    end() { this.done = true; this.wake?.(); }
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            while (this.lines.length) {
+                const line = this.lines.shift();
+                this.bytes -= line.length;
+                yield line;
+            }
+            if (this.done)
+                return;
+            await new Promise(resolve => { this.wake = resolve; });
+        }
+    }
+}

package/dist/src/adapters/codex/compatibility.js

@@ -0,0 +1,45 @@
+/** Candidate controls observed against the installed CLI using a loopback fixture.
+ * These are invocation inputs, not a certificate of compatibility. In particular,
+ * model metadata can still advertise apply_patch: an explicit deny profile and
+ * native-tool regression checks are required in addition to these switches.
+ */
+export const CODEX_ISOLATION_EXEC_FLAGS = Object.freeze([
+    "--ignore-user-config", "--ignore-rules", "--ephemeral", "--strict-config", "--json",
+]);
+export const CODEX_ISOLATION_CONFIG_OVERRIDES = Object.freeze([
+    "analytics.enabled=false",
+    "project_doc_max_bytes=0",
+    'web_search="disabled"',
+    "features.shell_tool=false",
+    "features.multi_agent=false",
+    "features.hooks=false",
+    "features.apps=false",
+    "features.plugins=false",
+    "features.view_image=false",
+    "features.goals=false",
+    "features.browser_use=false",
+    "features.computer_use=false",
+    "features.in_app_browser=false",
+    "features.image_generation=false",
+    "features.workspace_dependencies=false",
+    "features.remote_plugin=false",
+    "features.skill_search=false",
+    "features.skill_mcp_dependency_install=false",
+    "features.skip_host_skill_discovery=true",
+]);
+export const CODEX_UNSUPPORTED_DIAGNOSTIC = "Codex CLI isolation is unverified; this adapter is unsupported and cannot execute jobs.";
+/**
+ * Admission is intentionally closed for every currently observed CLI version.
+ * Help flags, protocol schemas and sandbox subprocess fixtures do not establish
+ * native file-tool enforcement, isolated config loading, or bridge failure safety.
+ * Observations are not certificates: accepting caller-supplied booleans or hashes
+ * here would let an adapter self-attest to the authorization boundary it must meet.
+ * A supported path requires a reviewed verifier for all design controls, pinned to
+ * the actual binary, effective configuration and managed requirements. None exists.
+ */
+export function inspectCodexCompatibility(_observation = {}) {
+    return {
+        status: "unsupported", available: false, executable: false,
+        capabilities: [], reason: CODEX_UNSUPPORTED_DIAGNOSTIC,
+    };
+}

package/dist/src/adapters/codex/config-builder.js

@@ -0,0 +1,43 @@
+import { isAbsolute } from "node:path";
+import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES } from "./compatibility.js";
+import { codexControlDenials } from './scratch.js';
+/** Candidate invocation; execution still requires independent compatibility admission. */
+export function buildCodexInvocation(input) {
+    if (!input.modelId.trim() || /[\r\n\0]/.test(input.modelId)
+        || !isAbsolute(input.worktreeRoot) || input.sourceRoot !== undefined && !isAbsolute(input.sourceRoot) || !isAbsolute(input.schemaPath)
+        || !input.env.HOME || !isAbsolute(input.env.HOME))
+        throw new Error("Codex requires an exact model and absolute job/control/home paths");
+    const endpoint = new URL(input.endpoint.url);
+    if (endpoint.protocol !== "http:" || endpoint.hostname !== "127.0.0.1" || !endpoint.port
+        || endpoint.pathname !== "/mcp" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash
+        || !input.endpoint.token || /[\r\n\0]/.test(input.endpoint.token))
+        throw new Error("Codex requires the authenticated job loopback endpoint");
+    const deniedFiles = codexControlDenials({ home: input.env.HOME, codexHome: input.env.CODEX_HOME, cwd: input.worktreeRoot, sourceRoot: input.sourceRoot, schemaPath: input.schemaPath, scratch: input.scratch }).map(file => `${JSON.stringify(file)}="deny"`).join(',');
+    const overrides = [
+        ...CODEX_ISOLATION_CONFIG_OVERRIDES,
+        ...(input.scratch ? [`log_dir=${JSON.stringify(input.scratch.logDir)}`, `sqlite_home=${JSON.stringify(input.scratch.sqliteHome)}`] : []),
+        'forced_login_method="chatgpt"', 'model_provider="openai"', 'approval_policy="never"',
+        'shell_environment_policy.inherit="none"',
+        'default_permissions="local_job"',
+        `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
+        "permissions.local_job.network.enabled=false",
+        // Only this job server is preauthorized: every operation is checked by Runner policy.
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"]}}`,
+    ];
+    const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
+    for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {
+        if (input.env[key] !== undefined)
+            env[key] = input.env[key];
+    }
+    if (input.scratch)
+        env.TMPDIR = input.scratch.tmpDir;
+    return {
+        // The owned control cwd is deliberately outside Git. Runner separately verifies
+        // the approved source SHA and scope; this flag does not change permissions.
+        args: ["--no-daemon", "exec", ...CODEX_ISOLATION_EXEC_FLAGS,
+            ...(input.sourceRoot && input.sourceRoot !== input.worktreeRoot ? ["--skip-git-repo-check"] : []),
+            ...overrides.flatMap((setting) => ["-c", setting]),
+            "--model", input.modelId, "-C", input.worktreeRoot, "--output-schema", input.schemaPath, "-"],
+        env,
+    };
+}

package/dist/src/adapters/codex/exec-invocation.js

@@ -0,0 +1,62 @@
+import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
+import path from 'node:path';
+import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, globalInstructionProfile } from './global-instructions.js';
+import { randomBytes } from 'node:crypto';
+import { buildCodexInvocation } from './config-builder.js';
+import { securityRequirementsFingerprint as hash } from '../../safety/security-requirements.js';
+export const EXEC_TRANSPORT = 'official_exec_v1';
+export const EXEC_RELEASE_MODE = 'supported_cli_exec_release_policy_v2';
+export const EXEC_MODE = 'supported_cli_exec_policy_v1';
+export const isReleaseExecMode = (mode) => mode === EXEC_RELEASE_MODE || mode === UNMANAGED_EXEC_MODE;
+const plans = new WeakMap();
+const consumed = new WeakSet();
+const fail = () => new Error('CODEX_EXEC_PLAN_REJECTED');
+export function buildOfficialExecPlan(input) {
+    try {
+        const i = structuredClone(input.identity), inv = structuredClone(input.invocation);
+        if (input.policyMode !== undefined && !isReleaseExecMode(input.policyMode))
+            throw fail();
+        const keys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
+        if (JSON.stringify(Object.keys(i).sort()) !== JSON.stringify(keys.sort()) || !Number.isSafeInteger(i.generation) || i.generation < 1 || !/^[a-f0-9]{40}$/.test(i.sourceSha))
+            throw fail();
+        for (const [key, value] of Object.entries(i))
+            if (key !== 'generation' && (typeof value !== 'string' || !value || value.length > 256 || /[\r\n\0]/.test(value) || !['jobId', 'actorId', 'runnerId', 'sourceSha'].includes(key) && !/^[a-f0-9]{64}$/.test(value)))
+                throw fail();
+        if (!path.isAbsolute(input.binary) || /[\r\n\0]/.test(input.binary) || !['file', 'keyring', 'auto'].includes(input.credentialBackend) || !inv.scratch || !inv.sourceRoot)
+            throw fail();
+        const allowed = ['HOME', 'CODEX_HOME', 'PATH', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TMPDIR'];
+        if (Object.keys(inv.env).some(k => inv.env[k] !== undefined && (!allowed.includes(k) || typeof inv.env[k] !== 'string' || /[\r\n\0]/.test(inv.env[k]) || inv.env[k].length > 32768)) || inv.env.PATH?.split(path.delimiter).some(p => !path.isAbsolute(p)))
+            throw fail();
+        const cwd = path.resolve(inv.worktreeRoot), source = path.resolve(inv.sourceRoot);
+        if (cwd === source || cwd.startsWith(source + path.sep) || source.startsWith(cwd + path.sep))
+            throw fail();
+        const generated = buildCodexInvocation(inv), accountRoot = path.resolve(inv.env.CODEX_HOME ?? path.join(inv.env.HOME, '.codex'));
+        // Preserve the original backend explicitly; this is not proof of credentials.
+        generated.args.splice(generated.args.indexOf('--model'), 0, '-c', `cli_auth_credentials_store=${JSON.stringify(input.credentialBackend)}`);
+        const actual = isReleaseExecMode(input.policyMode) ? { binary: CODEX_GLOBAL_INSTRUCTION_WRAPPER, args: ['-p', globalInstructionProfile(accountRoot), input.binary, ...generated.args], env: generated.env } : { binary: input.binary, ...generated };
+        const executionNonce = randomBytes(32).toString('hex');
+        const plan = Object.freeze({ transport: EXEC_TRANSPORT, mode: input.policyMode ?? EXEC_MODE, executionNonce, identity: Object.freeze(i), modelId: inv.modelId, home: inv.env.HOME, accountRoot, credentialBackend: input.credentialBackend, binary: input.binary, cwd, endpoint: inv.endpoint.url, invocationFingerprint: hash({ ...actual }) });
+        plans.set(plan, structuredClone(actual));
+        return plan;
+    }
+    catch {
+        throw fail();
+    }
+}
+/** Opaque process-local plan; serializing a plan cannot recreate invocation authority. */
+export function requireOfficialExecPlan(plan) {
+    const p = plans.get(plan);
+    if (!p)
+        throw fail();
+    return structuredClone(p);
+}
+/** A plan authorizes one attempt across all host instances, including failed attempts. */
+export function claimOfficialExecPlan(plan) {
+    assertOfficialExecPlanAvailable(plan);
+    consumed.add(plan);
+}
+export function assertOfficialExecPlanAvailable(plan) {
+    requireOfficialExecPlan(plan);
+    if (consumed.has(plan))
+        throw fail();
+}