mtech-ai-local-runner 0.1.8 → 0.1.9

package/dist/src/adapters/codex/adapter.js

@@ -0,0 +1,170 @@
+import { requireSecurityRequirements } from '../../safety/security-requirements.js';
+import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
+import { requireJobSecurity } from '../../safety/job-security-policy.js';
+import { CODEX_UNSUPPORTED_DIAGNOSTIC } from "./compatibility.js";
+import { buildCodexInvocation } from "./config-builder.js";
+import { compileCodexPrompt, CODEX_REPORT_SCHEMA } from "./prompt-compiler.js";
+import { CodexStreamParser } from "./stream-parser.js";
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Codex task package is invalid");
+    return value;
+}
+export class CodexAdapter {
+    options;
+    handle;
+    tools;
+    started = false;
+    receipt;
+    securityReceipt() { return this.receipt ? structuredClone(this.receipt) : undefined; }
+    cancelled = false;
+    parser = new CodexStreamParser();
+    startupAbort = new AbortController();
+    securityPolicy;
+    constructor(options) {
+        this.options = options;
+    }
+    async start(ctx) {
+        if (this.started || this.cancelled || ctx.resumeSessionId)
+            throw new Error("Codex requires one fresh approved launch");
+        this.started = true;
+        if (!await this.options.verifyCompatibility())
+            throw new Error(CODEX_UNSUPPORTED_DIAGNOSTIC);
+        this.assertNotCancelled();
+        if (!this.options.startVerifiedSession)
+            throw new Error("CODEX_PRE_MODEL_UNAVAILABLE");
+        const approved = object(ctx.approvedTaskPackage);
+        const pkg = object(ctx.taskPackage);
+        const execution = object(pkg.execution);
+        const source = object(approved.repository);
+        const repositories = pkg.repositories;
+        const repository = object(Array.isArray(repositories) ? repositories[0] : undefined);
+        if (approved.runtime_adapter !== "codex_cli" || approved.runtime_adapter_version !== "1"
+            || approved.resolved_provider !== "openai" || !ctx.resolvedModelId
+            || approved.resolved_model_id !== ctx.resolvedModelId
+            || !/^[a-f0-9]{40}$/.test(String(source.base_commit_sha))
+            || source.base_commit_sha !== repository.base_commit_sha
+            || execution.mode !== "employee_ai_work_session" || execution.runtime_adapter !== "codex_cli"
+            || execution.limits_mode !== "unbounded")
+            throw new Error("Codex launch model, revision or execution policy differs from approval");
+        const admission = { adapterId: 'codex_cli', adapterVersion: '1', jobId: this.options.jobId, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), generation: ctx.generation };
+        if (!ctx.securityBinding)
+            throw new Error('SECURITY_REQUIREMENTS_REJECTED');
+        try {
+            this.securityPolicy = this.options.prepareSecurity ? await this.options.prepareSecurity(ctx) : this.options.securityPolicy;
+            this.assertNotCancelled();
+        }
+        catch (error) {
+            await this.cancel();
+            throw error;
+        }
+        const deferred = this.options.deferSupportedSecurity === true;
+        const assertAdmission = () => { if (!this.securityPolicy && deferred)
+            this.securityPolicy = this.options.securityPolicy; if (!Number.isSafeInteger(admission.generation) || Number(admission.generation) < 1)
+            throw new Error('JOB_SECURITY_REJECTED'); requireJobSecurity(this.securityPolicy, admission); requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: "codex_cli", adapterVersion: "1", requirementsSha256: this.securityPolicy.pin.requirementsSha256 }); };
+        try {
+            if (deferred) {
+                const r = requireSecurityRequirements(ctx.approvedTaskPackage?.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' });
+                if (r.security_mode !== 'supported_cli_policy_v1' || this.securityPolicy || !Number.isSafeInteger(ctx.generation) || Number(ctx.generation) < 1 || Object.values(ctx.securityBinding).some(v => !/^[a-f0-9]{64}$/.test(v)))
+                    throw new Error('SECURITY_REQUIREMENTS_REJECTED');
+            }
+            else {
+                assertAdmission();
+                this.receipt = createJobSecurityReceipt(this.securityPolicy, { jobId: this.options.jobId, generation: ctx.generation, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
+            }
+        }
+        catch (error) {
+            await this.cancel();
+            throw error;
+        }
+        try {
+            const prompt = compileCodexPrompt(pkg, this.options.jobId);
+            this.tools = this.options.createTools(pkg, approved);
+            const endpoint = await this.tools.start();
+            this.assertNotCancelled();
+            const schemaPath = await this.options.writeSchema(CODEX_REPORT_SCHEMA);
+            this.assertNotCancelled();
+            const invocation = buildCodexInvocation({ modelId: ctx.resolvedModelId,
+                worktreeRoot: this.options.cwd ?? this.options.worktreeRoot, sourceRoot: this.options.worktreeRoot, schemaPath, endpoint, env: this.options.env, scratch: this.options.scratch });
+            if (!deferred)
+                assertAdmission();
+            const handle = await this.options.startVerifiedSession(invocation, prompt, this.startupAbort.signal, assertAdmission);
+            try {
+                assertAdmission();
+            }
+            catch (error) {
+                this.tools.revoke();
+                handle.kill('SIGKILL');
+                throw error;
+            }
+            // Cancellation may race with a transport returning its newly created handle.
+            if (this.cancelled) {
+                handle.kill("SIGKILL");
+                this.assertNotCancelled();
+            }
+            this.handle = handle;
+            if (deferred)
+                this.receipt = createJobSecurityReceipt(this.securityPolicy, { jobId: this.options.jobId, generation: ctx.generation, modelId: ctx.resolvedModelId, sourceSha: String(source.base_commit_sha), ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
+        }
+        catch {
+            const wasCancelled = this.cancelled;
+            await this.cancel();
+            throw new Error(wasCancelled ? "Codex launch cancelled during startup" : "Codex job setup failed before execution could be confirmed");
+        }
+    }
+    async *events() {
+        if (!this.handle)
+            throw new Error("Codex has not started");
+        try {
+            for await (const line of this.handle.stdout) {
+                if (this.cancelled)
+                    return;
+                const events = this.parser.parse(line);
+                for (const event of events) {
+                    if (["completed", "failed", "scope_conflict", "blocked"].includes(event.eventType)) {
+                        await this.cancel();
+                        yield event;
+                        return;
+                    }
+                    yield event;
+                }
+            }
+            for (const event of this.parser.end())
+                yield event;
+        }
+        finally {
+            await this.cancel();
+        }
+    }
+    async cancel() {
+        this.cancelled = true;
+        try {
+            this.options.revokeSecurity?.();
+        }
+        finally {
+            try {
+                this.tools?.revoke();
+            }
+            finally {
+                this.startupAbort.abort();
+                try {
+                    this.handle?.kill("SIGKILL");
+                }
+                finally {
+                    await this.tools?.close();
+                }
+            }
+        }
+    }
+    assertNotCancelled() {
+        if (this.cancelled)
+            throw new Error("Codex launch cancelled during startup");
+    }
+    async command(command) {
+        if (["cancel", "pause", "request_replan"].includes(command.command))
+            return this.cancel();
+        if (command.command === "request_checkpoint")
+            return;
+        throw new Error("Codex cannot resume or change an active approved launch");
+    }
+}

package/dist/src/adapters/codex/app-server-events.js

@@ -0,0 +1,84 @@
+import { record } from './stdio-rpc.js';
+/** Only provider completion/evidence events cross the runner boundary. */
+export class CodexAppServerEvents {
+    threadId;
+    turnId;
+    usage;
+    stopped = false;
+    constructor(threadId, turnId) {
+        this.threadId = threadId;
+        this.turnId = turnId;
+    }
+    map(message) {
+        if (this.stopped)
+            return [];
+        const method = message.method;
+        if (method === 'error')
+            return [{ type: 'turn.failed' }];
+        const params = record(message.params ?? {});
+        const relevant = method === 'turn/completed' || method === 'turn/started' || method === 'thread/tokenUsage/updated' || method === 'item/started' || method === 'item/completed';
+        if (relevant) {
+            const turn = method === 'turn/completed' || method === 'turn/started' ? record(params.turn).id : params.turnId;
+            if (params.threadId !== this.threadId || turn !== this.turnId) {
+                this.stopped = true;
+                return [{ type: 'turn.failed' }];
+            }
+        }
+        if (method === 'thread/tokenUsage/updated') {
+            const last = record(record(params.tokenUsage).last);
+            this.usage = { input_tokens: last.inputTokens, cached_input_tokens: last.cachedInputTokens, output_tokens: last.outputTokens };
+            return [];
+        }
+        if (method === 'turn/completed') {
+            this.stopped = true;
+            if (record(params.turn).status !== 'completed')
+                return [{ type: 'turn.failed' }];
+            return [{ type: 'turn.completed', ...(this.usage ? { usage: this.usage, usage_source: 'codex_app_server.thread/tokenUsage/updated' } : {}) }];
+        }
+        if (method === 'item/started' || method === 'item/completed') {
+            const item = record(params.item);
+            const forbidden = { commandExecution: 'command_execution', fileChange: 'file_change', webSearch: 'web_search' };
+            if (typeof item.type === 'string' && forbidden[item.type])
+                return [{ type: 'item.started', item: { type: forbidden[item.type] } }];
+            if (method === 'item/completed' && item.type === 'agentMessage' && item.phase !== 'commentary') {
+                return [{ type: 'item.completed', item: { type: 'agent_message', text: item.text } }];
+            }
+        }
+        return [];
+    }
+}
+/** Bounded normalized-event buffer; no raw protocol/credentials are retained. */
+export class CodexEventQueue {
+    lines = [];
+    bytes = 0;
+    done = false;
+    wake;
+    push(event) {
+        if (this.done)
+            return;
+        const line = JSON.stringify(event);
+        if (line.length > 256_000 || this.lines.length >= 128 || this.bytes + line.length > 1_000_000) {
+            this.lines = [JSON.stringify({ type: 'turn.failed' })];
+            this.bytes = this.lines[0].length;
+            this.done = true;
+            this.wake?.();
+            return;
+        }
+        this.lines.push(line);
+        this.bytes += line.length;
+        this.wake?.();
+    }
+    end() { this.done = true; this.wake?.(); }
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            while (this.lines.length) {
+                const line = this.lines.shift();
+                this.bytes -= line.length;
+                yield line;
+            }
+            if (this.done)
+                return;
+            await new Promise(resolve => { this.wake = resolve; });
+        }
+    }
+}

package/dist/src/adapters/codex/compatibility.js

@@ -0,0 +1,45 @@
+/** Candidate controls observed against the installed CLI using a loopback fixture.
+ * These are invocation inputs, not a certificate of compatibility. In particular,
+ * model metadata can still advertise apply_patch: an explicit deny profile and
+ * native-tool regression checks are required in addition to these switches.
+ */
+export const CODEX_ISOLATION_EXEC_FLAGS = Object.freeze([
+    "--ignore-user-config", "--ignore-rules", "--ephemeral", "--strict-config", "--json",
+]);
+export const CODEX_ISOLATION_CONFIG_OVERRIDES = Object.freeze([
+    "analytics.enabled=false",
+    "project_doc_max_bytes=0",
+    'web_search="disabled"',
+    "features.shell_tool=false",
+    "features.multi_agent=false",
+    "features.hooks=false",
+    "features.apps=false",
+    "features.plugins=false",
+    "features.view_image=false",
+    "features.goals=false",
+    "features.browser_use=false",
+    "features.computer_use=false",
+    "features.in_app_browser=false",
+    "features.image_generation=false",
+    "features.workspace_dependencies=false",
+    "features.remote_plugin=false",
+    "features.skill_search=false",
+    "features.skill_mcp_dependency_install=false",
+    "features.skip_host_skill_discovery=true",
+]);
+export const CODEX_UNSUPPORTED_DIAGNOSTIC = "Codex CLI isolation is unverified; this adapter is unsupported and cannot execute jobs.";
+/**
+ * Admission is intentionally closed for every currently observed CLI version.
+ * Help flags, protocol schemas and sandbox subprocess fixtures do not establish
+ * native file-tool enforcement, isolated config loading, or bridge failure safety.
+ * Observations are not certificates: accepting caller-supplied booleans or hashes
+ * here would let an adapter self-attest to the authorization boundary it must meet.
+ * A supported path requires a reviewed verifier for all design controls, pinned to
+ * the actual binary, effective configuration and managed requirements. None exists.
+ */
+export function inspectCodexCompatibility(_observation = {}) {
+    return {
+        status: "unsupported", available: false, executable: false,
+        capabilities: [], reason: CODEX_UNSUPPORTED_DIAGNOSTIC,
+    };
+}

package/dist/src/adapters/codex/config-builder.js

@@ -0,0 +1,40 @@
+import { isAbsolute } from "node:path";
+import { CODEX_ISOLATION_EXEC_FLAGS, CODEX_ISOLATION_CONFIG_OVERRIDES } from "./compatibility.js";
+import { codexControlDenials } from './scratch.js';
+/** Candidate invocation; execution still requires independent compatibility admission. */
+export function buildCodexInvocation(input) {
+    if (!input.modelId.trim() || /[\r\n\0]/.test(input.modelId)
+        || !isAbsolute(input.worktreeRoot) || input.sourceRoot !== undefined && !isAbsolute(input.sourceRoot) || !isAbsolute(input.schemaPath)
+        || !input.env.HOME || !isAbsolute(input.env.HOME))
+        throw new Error("Codex requires an exact model and absolute job/control/home paths");
+    const endpoint = new URL(input.endpoint.url);
+    if (endpoint.protocol !== "http:" || endpoint.hostname !== "127.0.0.1" || !endpoint.port
+        || endpoint.pathname !== "/mcp" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash
+        || !input.endpoint.token || /[\r\n\0]/.test(input.endpoint.token))
+        throw new Error("Codex requires the authenticated job loopback endpoint");
+    const deniedFiles = codexControlDenials({ home: input.env.HOME, codexHome: input.env.CODEX_HOME, cwd: input.worktreeRoot, sourceRoot: input.sourceRoot, schemaPath: input.schemaPath, scratch: input.scratch }).map(file => `${JSON.stringify(file)}="deny"`).join(',');
+    const overrides = [
+        ...CODEX_ISOLATION_CONFIG_OVERRIDES,
+        ...(input.scratch ? [`log_dir=${JSON.stringify(input.scratch.logDir)}`, `sqlite_home=${JSON.stringify(input.scratch.sqliteHome)}`] : []),
+        'forced_login_method="chatgpt"', 'model_provider="openai"', 'approval_policy="never"',
+        'shell_environment_policy.inherit="none"',
+        'default_permissions="local_job"',
+        `permissions.local_job.filesystem={":minimal"="read",${deniedFiles}}`,
+        "permissions.local_job.network.enabled=false",
+        // Only this job server is preauthorized: every operation is checked by Runner policy.
+        `mcp_servers={ai_local={url=${JSON.stringify(endpoint.toString())},bearer_token_env_var="AI_GATEWAY_JOB_MCP_TOKEN",required=true,default_tools_approval_mode="approve",enabled_tools=["local_read","local_search","local_edit","local_test"]}}`,
+    ];
+    const env = { HOME: input.env.HOME, AI_GATEWAY_JOB_MCP_TOKEN: input.endpoint.token };
+    for (const key of ["PATH", "USER", "LOGNAME", "LANG", "LC_ALL", "TMPDIR", "CODEX_HOME"]) {
+        if (input.env[key] !== undefined)
+            env[key] = input.env[key];
+    }
+    if (input.scratch)
+        env.TMPDIR = input.scratch.tmpDir;
+    return {
+        args: ["--no-daemon", "exec", ...CODEX_ISOLATION_EXEC_FLAGS,
+            ...overrides.flatMap((setting) => ["-c", setting]),
+            "--model", input.modelId, "-C", input.worktreeRoot, "--output-schema", input.schemaPath, "-"],
+        env,
+    };
+}

package/dist/src/adapters/codex/host-admission.js

@@ -0,0 +1,3 @@
+import { diagnoseCliHostAdmission } from '../../safety/cli-host-admission.js';
+/** Compatibility wrapper; all CLIs share the same closed release admission. */
+export const diagnoseCodexHostAdmission = (binary, env) => diagnoseCliHostAdmission('codex_cli', binary, env);

package/dist/src/adapters/codex/inspection-rpc.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+const rejected = () => new Error('CODEX_INSPECTION_REJECTED');
+function exact(value, keys) {
+    return !!value && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).sort().join(',') === [...keys].sort().join(',');
+}
+const text = (value) => typeof value === 'string' && !!value && value.length <= 256 && !/[\r\n\0]/.test(value);
+/** No-model diagnostics only. This allowlist is not an isolation certificate or
+ * an authentication interface. The wrapped owned transport is never exposed. */
+export class CodexInspectionRpc {
+    rpc;
+    #closed = false;
+    constructor(rpc) {
+        this.rpc = rpc;
+    }
+    async request(method, params) {
+        let allowed = false;
+        if (method === 'initialize' && exact(params, ['clientInfo', 'capabilities'])) {
+            const client = params.clientInfo, cap = params.capabilities;
+            allowed = exact(client, ['name', 'version']) && text(client.name) && text(client.version)
+                && exact(cap, ['experimentalApi']) && cap.experimentalApi === true;
+        }
+        else if (method === 'config/read' && exact(params, ['includeLayers', 'cwd'])) {
+            allowed = params.includeLayers === true && typeof params.cwd === 'string' && path.isAbsolute(params.cwd) && !/[\r\n\0]/.test(params.cwd);
+        }
+        else if (method === 'configRequirements/read')
+            allowed = exact(params, []);
+        else if (method === 'account/read')
+            allowed = exact(params, ['refreshToken']) && params.refreshToken === false;
+        if (this.#closed || !allowed)
+            throw rejected();
+        try {
+            return await this.rpc.request(method, structuredClone(params));
+        }
+        catch {
+            throw rejected();
+        }
+    }
+    initialized() { if (this.#closed)
+        throw rejected(); try {
+        this.rpc.notify('initialized');
+    }
+    catch {
+        throw rejected();
+    } }
+    close() { if (this.#closed)
+        return; this.#closed = true; this.rpc.close(); }
+}

package/dist/src/adapters/codex/job-rpc.js

@@ -0,0 +1,189 @@
+import { isDeepStrictEqual } from 'node:util';
+import { CODEX_REPORT_SCHEMA } from './prompt-compiler.js';
+const rejected = () => new Error('CODEX_JOB_RPC_REJECTED');
+const exact = (value, keys) => !!value && typeof value === 'object' && !Array.isArray(value)
+    && isDeepStrictEqual(Object.keys(value).sort(), [...keys].sort());
+const text = (v) => typeof v === 'string' && v.length > 0 && !/[\r\n\0]/.test(v);
+/** Reject non-JSON authority before copying it; never invoke caller getters. */
+function dataOnly(value, depth = 0, budget = { left: 10_000 }) {
+    if (--budget.left < 0 || depth > 32)
+        return false;
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (!value || typeof value !== 'object')
+        return false;
+    const array = Array.isArray(value);
+    if (!array && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+        return false;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (array && Object.keys(value).length !== value.length)
+        return false;
+    return Reflect.ownKeys(descriptors).every(key => {
+        if (typeof key !== 'string')
+            return false;
+        if (array && key === 'length')
+            return true;
+        const d = descriptors[key];
+        return d.enumerable === true && Object.hasOwn(d, 'value') && (!array || /^(0|[1-9]\d*)$/.test(key))
+            && dataOnly(d.value, depth + 1, budget);
+    });
+}
+/** Limits our owned control channel, not all vendor capabilities or account I/O.
+ * No caller receives the raw transport from this object. */
+export class CodexJobRpc {
+    rpc;
+    #phase = 'new';
+    #threadId;
+    #cleanupFailed = false;
+    #requestPending = false;
+    #listeners = new Set();
+    #startup;
+    #schema = structuredClone(CODEX_REPORT_SCHEMA);
+    constructor(rpc, pin) {
+        this.rpc = rpc;
+        this.#startup = { cwd: pin.cwd, model: pin.model, modelProvider: pin.provider, ephemeral: true, approvalPolicy: 'never', permissions: 'local_job', allowProviderModelFallback: false, environments: [] };
+        rpc.onNotification(message => {
+            if (this.#phase === 'closed')
+                return;
+            const method = message.method;
+            if (typeof method !== 'string' || method.startsWith('thread/environment/') || method === 'thread/settings/updated') {
+                this.deny();
+                return;
+            }
+            for (const listener of this.#listeners) {
+                try {
+                    listener(message);
+                }
+                catch {
+                    this.deny();
+                    return;
+                }
+            }
+        });
+    }
+    async request(method, params, timeoutMs) {
+        try {
+            if (this.#phase === 'closed' || this.#requestPending || !dataOnly(params))
+                throw rejected();
+            this.#requestPending = true;
+            const args = structuredClone(params);
+            if (method !== 'turn/start' && timeoutMs !== undefined && (typeof timeoutMs !== 'number' || !Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 30_000))
+                throw rejected();
+            if (method === 'initialize') {
+                if (this.#phase !== 'new' || !isDeepStrictEqual(args, { clientInfo: { name: 'ai_gateway_local_codex', version: '1' }, capabilities: { experimentalApi: true } }))
+                    throw rejected();
+                this.#phase = 'initializing';
+            }
+            else if (method === 'config/read') {
+                if (!this.inspectable() || !isDeepStrictEqual(args, { includeLayers: true, cwd: this.#startup.cwd }))
+                    throw rejected();
+            }
+            else if (method === 'configRequirements/read') {
+                if (!this.inspectable() || !exact(args, []))
+                    throw rejected();
+            }
+            else if (method === 'thread/start') {
+                if (this.#phase !== 'preparing' || !isDeepStrictEqual(args, this.#startup))
+                    throw rejected();
+                this.#phase = 'startingThread';
+            }
+            else if (method === 'mcpServerStatus/list') {
+                if (this.#phase !== 'ready' || !isDeepStrictEqual(args, { threadId: this.#threadId, limit: 100, detail: 'full' }))
+                    throw rejected();
+            }
+            else if (method === 'turn/start') {
+                if (this.#phase !== 'ready' || timeoutMs !== null || !exact(args, ['threadId', 'input', 'outputSchema']) || args.threadId !== this.#threadId
+                    || !isDeepStrictEqual(args.outputSchema, this.#schema) || !Array.isArray(args.input) || args.input.length !== 1)
+                    throw rejected();
+                const item = args.input[0];
+                if (!exact(item, ['type', 'text', 'text_elements']) || item.type !== 'text' || typeof item.text !== 'string' || !item.text || item.text.includes('\0')
+                    || !isDeepStrictEqual(item.text_elements, []))
+                    throw rejected();
+                this.#phase = 'startingTurn';
+            }
+            else
+                throw rejected();
+            const result = await this.rpc.request(method, args, timeoutMs);
+            // A concurrent violation, close or environment notification cannot revive the channel.
+            if (this.isClosed())
+                throw rejected();
+            if (method === 'initialize')
+                this.#phase = 'initialized';
+            if (method === 'thread/start') {
+                if (!result || typeof result !== 'object' || Array.isArray(result))
+                    throw rejected();
+                const thread = result.thread;
+                if (!thread || typeof thread !== 'object' || Array.isArray(thread))
+                    throw rejected();
+                const t = thread;
+                if (!text(t.id) || !isDeepStrictEqual(t.environments, []))
+                    throw rejected();
+                this.#threadId = t.id;
+                this.#phase = 'ready';
+            }
+            if (method === 'turn/start')
+                this.#phase = 'running';
+            return result;
+        }
+        catch {
+            this.deny();
+            throw rejected();
+        }
+        finally {
+            this.#requestPending = false;
+        }
+    }
+    notify(method, params) {
+        if (this.#phase !== 'initialized' || method !== 'initialized' || params !== undefined) {
+            this.deny();
+            throw rejected();
+        }
+        this.#phase = 'preparing';
+        try {
+            this.rpc.notify('initialized');
+        }
+        catch {
+            this.deny();
+            throw rejected();
+        }
+    }
+    onNotification(listener) {
+        if (this.#phase === 'closed')
+            throw rejected();
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
+    close() {
+        if (this.#phase === 'closed')
+            return;
+        this.#phase = 'closed';
+        try {
+            this.rpc.close();
+            if (this.rpc.cleanupConfirmed?.() === false)
+                this.#cleanupFailed = true;
+        }
+        catch {
+            this.#cleanupFailed = true;
+        }
+        finally {
+            this.#listeners.clear();
+        }
+    }
+    cleanupConfirmed() { return !this.#cleanupFailed; }
+    isClosed() { return this.#phase === 'closed'; }
+    inspectable() { return this.#phase === 'preparing' || this.#phase === 'ready'; }
+    deny() {
+        if (this.#phase === 'closed')
+            return;
+        const listeners = [...this.#listeners];
+        this.close();
+        for (const listener of listeners) {
+            try {
+                listener({ method: 'error', params: { code: 'CODEX_JOB_RPC_REJECTED' } });
+            }
+            catch { /* Fixed errors only. */ }
+        }
+    }
+}