mtech-ai-local-runner 0.1.8 → 0.1.9

package/dist/src/adapters/codex/native-policy.js

@@ -0,0 +1,112 @@
+import { createHash } from 'node:crypto';
+import { record } from './stdio-rpc.js';
+import { CODEX_ISOLATION_CONFIG_OVERRIDES } from './compatibility.js';
+import { localToolInventory } from '../../safety/local-tool-server.js';
+import { codexControlDenials } from './scratch.js';
+export const canonical = (value) => JSON.stringify(normalize(value));
+function normalize(value) {
+    if (Array.isArray(value))
+        return value.map(normalize);
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== null && v !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => [k, normalize(v)]));
+    return value;
+}
+export const fingerprint = (value) => createHash('sha256').update(canonical(value)).digest('hex');
+export function reject() { throw new Error('CODEX_NATIVE_POLICY_REJECTED'); }
+export function validateNativeConfig(value, requirements, pin) {
+    const result = record(value), c = record(result.config);
+    // Unknown effective fields/features may introduce another execution surface.
+    // A future CLI must be reviewed rather than silently extending this profile.
+    const allowed = ['model', 'model_provider', 'approval_policy', 'default_permissions', 'forced_login_method', 'project_doc_max_bytes', 'web_search', 'shell_environment_policy', 'features', 'permissions', 'model_providers', 'mcp_servers', 'log_dir', 'sqlite_home', 'analytics', 'hooks', 'notify', 'instructions', 'developer_instructions', 'model_instructions_file', 'experimental_compact_prompt_file', 'openai_base_url', 'experimental_thread_store_endpoint', 'plugins', 'chatgpt_base_url'];
+    if (Object.keys(c).some(key => !allowed.includes(key)) || JSON.stringify(Object.keys(record(c.shell_environment_policy))) !== JSON.stringify(['inherit'])
+        || canonical(c.shell_environment_policy) !== canonical({ inherit: 'none' }))
+        reject();
+    if (c.analytics !== undefined && c.analytics !== null && canonical(c.analytics) !== canonical({ enabled: false }))
+        reject();
+    if (!Array.isArray(result.layers) || !result.layers.length)
+        reject();
+    let flags = 0;
+    for (const layerValue of result.layers) {
+        const layer = record(layerValue), name = record(layer.name);
+        if (!['sessionFlags', 'user', 'system', 'project', 'mdm'].includes(String(name.type)))
+            reject();
+        if (name.type === 'sessionFlags')
+            flags++;
+        if (name.type !== 'sessionFlags' && Object.keys(record(layer.config)).length > 0)
+            reject();
+    }
+    if (flags !== 1)
+        reject();
+    const req = record(requirements).requirements;
+    if (req !== null) {
+        for (const [key, v] of Object.entries(record(req))) {
+            if (v === null)
+                continue;
+            if (key === 'allowedLoginMethods' && canonical(v) === canonical([pin.loginMethod]))
+                continue;
+            if (key === 'allowedApprovalPolicies' && Array.isArray(v) && v.includes('never'))
+                continue;
+            // Unknown managed constraints, hooks and profile definitions are not admitted.
+            reject();
+        }
+    }
+    if (c.model !== pin.model || c.model_provider !== pin.provider || c.approval_policy !== 'never'
+        || c.default_permissions !== 'local_job' || c.forced_login_method !== pin.loginMethod
+        || c.project_doc_max_bytes !== 0 || c.web_search !== 'disabled'
+        || record(c.shell_environment_policy).inherit !== 'none')
+        reject();
+    if (pin.scratch && (c.log_dir !== pin.scratch.logDir || c.sqlite_home !== pin.scratch.sqliteHome))
+        reject();
+    for (const key of ['hooks', 'notify', 'instructions', 'developer_instructions', 'model_instructions_file', 'experimental_compact_prompt_file', 'openai_base_url', 'experimental_thread_store_endpoint']) {
+        if (c[key] !== null && c[key] !== undefined && c[key] !== '' && canonical(c[key]) !== '[]')
+            reject();
+    }
+    // Disabled discovery does not authorize an explicit plugin configuration.
+    if (c.plugins !== null && c.plugins !== undefined && canonical(c.plugins) !== '{}')
+        reject();
+    if (c.chatgpt_base_url !== null && c.chatgpt_base_url !== undefined && c.chatgpt_base_url !== 'https://chatgpt.com/backend-api/')
+        reject();
+    const features = record(c.features);
+    const expectedFeatures = Object.fromEntries(CODEX_ISOLATION_CONFIG_OVERRIDES.filter(s => s.startsWith('features.')).map(s => { const [k, v] = s.split('='); return [k.slice(9), JSON.parse(v)]; }));
+    if (JSON.stringify(Object.keys(features).sort()) !== JSON.stringify(Object.keys(expectedFeatures).sort()) || canonical(features) !== canonical(expectedFeatures))
+        reject();
+    for (const setting of CODEX_ISOLATION_CONFIG_OVERRIDES.filter(s => s.startsWith('features.'))) {
+        const [name, v] = setting.split('=');
+        if (features[name.slice(9)] !== JSON.parse(v))
+            reject();
+    }
+    const profile = { filesystem: { ':minimal': 'read', ...Object.fromEntries(codexControlDenials(pin).map(file => [file, 'deny'])) }, network: { enabled: false } };
+    if (canonical(c.permissions) !== canonical({ local_job: profile }))
+        reject();
+    if (canonical(c.model_providers) !== canonical(pin.providerConfig))
+        reject();
+    const servers = record(c.mcp_servers);
+    if (Object.keys(servers).length !== 1)
+        reject();
+    const server = record(servers.ai_local);
+    if (server.url !== pin.endpoint || server.bearer_token_env_var !== 'AI_GATEWAY_JOB_MCP_TOKEN'
+        || server.required !== true || server.enabled !== true || server.default_tools_approval_mode !== 'approve'
+        || canonical([...(server.enabled_tools ?? [])].sort()) !== canonical(localToolInventory().map(t => t.name).sort()))
+        reject();
+    for (const k of Object.keys(server))
+        if (!['url', 'bearer_token_env_var', 'environment_id', 'enabled', 'required', 'tool_timeout_sec', 'default_tools_approval_mode', 'enabled_tools'].includes(k))
+            reject();
+    return fingerprint({ config: c, requirements: req });
+}
+export function validateNativeTools(value, pin) {
+    const response = record(value);
+    if (response.nextCursor !== null || !Array.isArray(response.data) || response.data.length !== 1)
+        reject();
+    const server = record(response.data[0]);
+    if (server.name !== 'ai_local' || server.runtimeStatus !== 'connected' || server.authStatus !== 'bearerToken'
+        || server.httpOrigin !== new URL(pin.endpoint).origin || server.pluginId !== null || server.toolsError !== null
+        || canonical(server.resources) !== '[]' || canonical(server.resourceTemplates) !== '[]')
+        reject();
+    const tools = record(server.tools), expected = localToolInventory();
+    if (Object.keys(tools).length !== expected.length)
+        reject();
+    for (const tool of expected)
+        if (canonical(tools[tool.name]) !== canonical(tool))
+            reject();
+    return fingerprint(expected);
+}

package/dist/src/adapters/codex/native-proof.js

@@ -0,0 +1,14 @@
+const proofs = new WeakMap();
+/** Called by the owned native transport after its actual validators succeed.
+ * In-process trusted code only; never a JSON or model-visible issuance API. */
+export function issueCodexNativeProof(data, active) {
+    const proof = Object.freeze({});
+    proofs.set(proof, { data: Object.freeze({ ...data, expected: Object.freeze({ ...data.expected }) }), active });
+    return proof;
+}
+export function requireCodexNativeProof(proof) {
+    const entry = proof && typeof proof === 'object' ? proofs.get(proof) : undefined;
+    if (!entry || !entry.active())
+        throw new Error('CODEX_NATIVE_PROOF_REJECTED');
+    return entry.data;
+}

package/dist/src/adapters/codex/native-session.js

@@ -0,0 +1,375 @@
+import { issueCodexNativeProof } from './native-proof.js';
+import { lstat } from 'node:fs/promises';
+import path from 'node:path';
+import { CodexStdioRpc, record } from './stdio-rpc.js';
+import { CodexAppServerEvents, CodexEventQueue } from './app-server-events.js';
+import { CodexJobRpc } from './job-rpc.js';
+import { requireSupportedCodexPolicy } from './supported-admission.js';
+import { fingerprint, validateNativeConfig, validateNativeTools, reject } from './native-policy.js';
+import { startCodexAfterPreflight } from './pre-model-gate.js';
+import { localToolInventory } from '../../safety/local-tool-server.js';
+import { CODEX_REPORT_SCHEMA } from './prompt-compiler.js';
+import { codexControlDenials } from './scratch.js';
+export async function assertCodexSourceIsolation(home, cwd, codexHome = path.join(home, '.codex')) {
+    const denied = ['/etc/codex/rules', path.join(codexHome, 'config.toml'), path.join(codexHome, 'rules'), path.join(codexHome, 'AGENTS.md')];
+    let parent = cwd;
+    while (true) {
+        const candidate = path.join(parent, '.codex');
+        if (path.resolve(candidate) !== path.resolve(codexHome))
+            denied.push(candidate);
+        const next = path.dirname(parent);
+        if (next === parent)
+            break;
+        parent = next;
+    }
+    for (const entry of denied) {
+        try {
+            await lstat(entry);
+            reject();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+/** Dedicated thread; the model is never given this RPC client. */
+export class CodexNativeSession {
+    pin;
+    sourceCheck;
+    assertAdmission;
+    identity;
+    closed = false;
+    used = false;
+    unsafe = false;
+    cleanupFailed = false;
+    activeTurnId;
+    managedPolicySha256;
+    nativeProof;
+    snapshot;
+    threadId;
+    preparing;
+    queue = new CodexEventQueue();
+    mapper;
+    armed = false;
+    pendingEvents = [];
+    pendingBytes = 0;
+    rpc;
+    supported;
+    constructor(rpc, pin, sourceCheck, assertAdmission = () => { }, supported, identity) {
+        this.pin = pin;
+        this.sourceCheck = sourceCheck;
+        this.assertAdmission = assertAdmission;
+        this.identity = identity;
+        this.supported = supported ? { policy: supported.policy, binding: Object.freeze(structuredClone(supported.binding)) } : undefined;
+        this.rpc = new CodexJobRpc(rpc, pin);
+        this.rpc.onNotification(message => {
+            if (this.closed)
+                return;
+            const method = String(message.method);
+            if (method === 'warning') {
+                const text = record(message.params).message;
+                if (typeof text === 'string' && text.startsWith('Under-development features enabled: skip_host_skill_discovery.'))
+                    return;
+                this.fail();
+                return;
+            }
+            if (method === 'configWarning' || method === 'error' || method.startsWith('config/') || method === 'skills/changed') {
+                this.fail();
+                return;
+            }
+            if (method === 'turn/started' && this.armed) {
+                const p = record(message.params), turn = record(p.turn);
+                if (p.threadId !== this.threadId || typeof turn.id !== 'string' || !turn.id || this.activeTurnId && this.activeTurnId !== turn.id) {
+                    this.fail();
+                    return;
+                }
+                this.activeTurnId = turn.id;
+            }
+            const relevant = method === 'turn/started' || method === 'turn/completed' || method === 'thread/tokenUsage/updated' || method === 'item/started' || method === 'item/completed';
+            if (!relevant)
+                return;
+            if (!this.armed) {
+                this.fail();
+                return;
+            }
+            if (!this.mapper) {
+                const bytes = JSON.stringify(message).length;
+                if (this.pendingEvents.length >= 128 || this.pendingBytes + bytes > 1_000_000) {
+                    this.fail();
+                    return;
+                }
+                this.pendingBytes += bytes;
+                this.pendingEvents.push(message);
+                return;
+            }
+            this.consume(message);
+        });
+    }
+    inspect() {
+        if (this.closed)
+            return Promise.reject(new Error('CODEX_NATIVE_CLOSED'));
+        return this.preparing ??= this.prepare();
+    }
+    async policy() {
+        const config = await this.rpc.request('config/read', { includeLayers: true, cwd: this.pin.cwd });
+        const req = await this.rpc.request('configRequirements/read', {});
+        const hash = validateNativeConfig(config, req, this.pin);
+        this.managedPolicySha256 = fingerprint(record(req).requirements);
+        return hash;
+    }
+    async inventory() {
+        return validateNativeTools(await this.rpc.request('mcpServerStatus/list', { threadId: this.threadId, limit: 100, detail: 'full' }), this.pin);
+    }
+    async prepare() {
+        try {
+            await this.sourceCheck();
+            await this.rpc.request('initialize', { clientInfo: { name: 'ai_gateway_local_codex', version: '1' }, capabilities: { experimentalApi: true } });
+            this.rpc.notify('initialized');
+            const before = await this.policy(); // Before any thread startup hooks/tools.
+            if (this.unsafe || this.closed)
+                reject();
+            const value = record(await this.rpc.request('thread/start', { cwd: this.pin.cwd, model: this.pin.model, modelProvider: this.pin.provider,
+                ephemeral: true, approvalPolicy: 'never', permissions: 'local_job', allowProviderModelFallback: false, environments: [] }));
+            const thread = record(value.thread), profile = record(value.activePermissionProfile), sandbox = record(value.sandbox);
+            if (typeof thread.id !== 'string' || !thread.id || thread.ephemeral !== true || value.cwd !== this.pin.cwd
+                || value.model !== this.pin.model || value.modelProvider !== this.pin.provider || value.approvalPolicy !== 'never'
+                || profile.id !== 'local_job' || profile.extends !== null || sandbox.type !== 'readOnly' || sandbox.networkAccess !== false
+                || !Array.isArray(value.instructionSources) || value.instructionSources.length !== 0)
+                reject();
+            this.threadId = thread.id;
+            const tools = await this.inventory();
+            const after = await this.policy();
+            if (before !== after || this.unsafe || this.closed)
+                reject();
+            // config/read resolves disk state, not a native atomic policy binding.
+            // Matching snapshots cannot certify policy immutability through turn/start.
+            this.snapshot = { model: this.pin.model, provider: 'openai', cwd: this.pin.cwd, approvalPolicy: 'never', permissionProfile: 'local_job',
+                configFingerprint: after, nativeToolsIsolated: false, policyStable: false, rpcBoundary: 'owned_exact_rpc_v1', environments: [], warnings: [], servers: [{ name: 'ai_local', endpoint: this.pin.endpoint, status: 'ready', authenticated: true,
+                        tools: localToolInventory().map(t => t.name), toolSchemaFingerprint: tools }] };
+            return structuredClone(this.snapshot);
+        }
+        catch {
+            await this.close();
+            throw new Error('CODEX_NATIVE_PREFLIGHT_REJECTED');
+        }
+    }
+    proof() {
+        if (!this.identity || !this.snapshot || !this.threadId || !this.managedPolicySha256 || this.closed || this.unsafe)
+            reject();
+        return this.nativeProof ??= issueCodexNativeProof({ ...this.identity, expected: { model: this.pin.model, provider: this.pin.provider, cwd: this.pin.cwd, endpoint: this.pin.endpoint, configFingerprint: this.snapshot.configFingerprint, toolSchemaFingerprint: this.snapshot.servers[0].toolSchemaFingerprint }, managedPolicySha256: this.managedPolicySha256,
+            close: () => { void this.close(); }, binding: () => !this.closed && !this.unsafe && this.armed && this.activeTurnId ? { threadId: this.threadId, turnId: this.activeTurnId } : null }, () => !this.closed && !this.unsafe);
+    }
+    async startTurn(prompt, signal) {
+        if (this.used || this.closed || !this.snapshot || !this.threadId)
+            reject();
+        this.used = true;
+        const aborted = () => { void this.close(); };
+        signal?.addEventListener('abort', aborted, { once: true });
+        try {
+            if (signal?.aborted)
+                reject();
+            await this.sourceCheck();
+            const config = await this.policy(), tools = await this.inventory();
+            if (signal?.aborted || this.closed || this.unsafe || config !== this.snapshot.configFingerprint
+                || tools !== this.snapshot.servers[0].toolSchemaFingerprint)
+                reject();
+            this.queue.push({ type: 'thread.started' });
+            // No policy/model/provider/cwd overrides here; use only the inspected thread.
+            this.assertAdmission();
+            if (this.supported)
+                requireSupportedCodexPolicy(this.supported.policy, { model: this.pin.model, provider: this.pin.provider, cwd: this.pin.cwd,
+                    configFingerprint: config, toolSchemaFingerprint: tools, endpoint: this.pin.endpoint }, this.supported.binding, this);
+            this.armed = true;
+            const reply = record(await this.rpc.request('turn/start', { threadId: this.threadId, input: [{ type: 'text', text: prompt, text_elements: [] }], outputSchema: CODEX_REPORT_SCHEMA }, null));
+            if (signal?.aborted || this.closed || this.unsafe)
+                reject();
+            const turnId = record(reply.turn).id;
+            if (typeof turnId !== 'string' || !turnId || this.activeTurnId && this.activeTurnId !== turnId)
+                reject();
+            this.activeTurnId = turnId;
+            this.mapper = new CodexAppServerEvents(this.threadId, turnId);
+            for (const event of this.pendingEvents)
+                this.consume(event);
+            this.pendingEvents = [];
+            this.pendingBytes = 0;
+            if (this.unsafe || this.closed)
+                reject();
+            return { stdin: { write: () => { throw new Error('CODEX_STDIN_CLOSED'); }, end: () => { } }, stdout: this.queue,
+                kill: () => { void this.close(); if (this.cleanupFailed)
+                    throw new Error('CODEX_CLEANUP_UNCONFIRMED'); }, once: () => { } };
+        }
+        catch {
+            await this.close();
+            throw new Error('CODEX_NATIVE_TURN_REJECTED');
+        }
+        finally {
+            signal?.removeEventListener('abort', aborted);
+        }
+    }
+    consume(message) {
+        for (const event of this.mapper.map(message)) {
+            this.queue.push(event);
+            if (event.type === 'turn.failed') {
+                this.fail();
+                return;
+            }
+            if (event.type === 'turn.completed')
+                this.queue.end();
+        }
+    }
+    fail() { this.unsafe = true; this.queue.push({ type: 'turn.failed' }); this.queue.end(); void this.close(); }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        try {
+            this.rpc.close();
+            if (this.rpc.cleanupConfirmed?.() === false)
+                this.cleanupFailed = true;
+        }
+        catch {
+            this.cleanupFailed = true;
+        }
+        finally {
+            this.queue.end();
+        }
+    }
+}
+/** Host-generated exec invocation supplies settings; only its flags are adapted.
+ * Source isolation is checked rather than claiming unsupported ignore flags. */
+export function buildNativeInvocation(invocation, options) {
+    // Revalidate at the final transport boundary, independently of the builder.
+    // No ambient provider key, proxy, loader or runtime-control variable is accepted.
+    const environmentKeys = ['HOME', 'PATH', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'TMPDIR', 'CODEX_HOME', 'AI_GATEWAY_JOB_MCP_TOKEN'];
+    const environment = invocation.env;
+    if (Object.keys(environment).some(k => !environmentKeys.includes(k))
+        || Object.values(environment).some(v => typeof v !== 'string' || /[\r\n\0]/.test(v))
+        || environment.HOME !== options.home || !path.isAbsolute(options.home)
+        || !environment.AI_GATEWAY_JOB_MCP_TOKEN || /[\x00-\x20\x7f]/.test(environment.AI_GATEWAY_JOB_MCP_TOKEN)
+        || ['CODEX_HOME', 'TMPDIR'].some(k => environment[k] !== undefined && !path.isAbsolute(environment[k]))
+        || environment.PATH !== undefined && environment.PATH.split(path.delimiter).some(p => !path.isAbsolute(p)))
+        throw new Error('CODEX_NATIVE_ENV_REJECTED');
+    const args = ['app-server', '--stdio', '--strict-config'];
+    let endpoint;
+    for (let i = 0; i < invocation.args.length; i++)
+        if (invocation.args[i] === '-c') {
+            const setting = invocation.args[++i];
+            args.push('-c', options.testTransport ? setting.replace('forced_login_method="chatgpt"', 'forced_login_method="api"').replace('model_provider="openai"', 'model_provider="offline_fixture"') : setting);
+            if (setting.startsWith('mcp_servers=')) {
+                // This field is emitted by buildCodexInvocation; validate the parsed URL again below.
+                const match = setting.match(/url=("(?:[^"\\]|\\.)*")/);
+                if (match)
+                    endpoint = JSON.parse(match[1]);
+            }
+        }
+    const index = invocation.args.indexOf('--model');
+    const model = index >= 0 ? invocation.args[index + 1] : undefined;
+    if (!model?.trim() || /[\r\n\0]/.test(model) || !endpoint)
+        reject();
+    const url = new URL(endpoint);
+    if (url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || !url.port || url.pathname !== '/mcp'
+        || url.username || url.password || url.search || url.hash)
+        reject();
+    args.push('-c', 'model=' + JSON.stringify(model));
+    const env = { ...invocation.env };
+    if (options.scratch) {
+        codexControlDenials({ home: options.home, codexHome: env.CODEX_HOME, cwd: options.cwd, sourceRoot: options.sourceRoot, schemaPath: options.schemaPath, scratch: options.scratch });
+        if (env.HOME !== options.home || env.TMPDIR !== options.scratch.tmpDir
+            || !args.includes('log_dir=' + JSON.stringify(options.scratch.logDir))
+            || !args.includes('sqlite_home=' + JSON.stringify(options.scratch.sqliteHome)))
+            reject();
+    }
+    if (options.testTransport) {
+        env.CODEX_HOME = options.testTransport.codexHome;
+        const add = (key, value) => {
+            if (value && typeof value === 'object' && !Array.isArray(value)) {
+                for (const [child, item] of Object.entries(value))
+                    add(key + '.' + child, item);
+            }
+            else
+                args.push('-c', key + '=' + JSON.stringify(value));
+        };
+        for (const [key, value] of Object.entries(options.testTransport.extraSettings))
+            add(key, value);
+        // Required dummy key is local fixture input, never inherited from the shell.
+        env.CODEX_OFFLINE_PROVIDER_KEY = 'synthetic-not-a-real-credential';
+    }
+    const pin = { ...(options.sourceRoot !== undefined ? { sourceRoot: options.sourceRoot } : {}), model, provider: options.testTransport ? 'offline_fixture' : 'openai', cwd: options.cwd, home: options.home, schemaPath: options.schemaPath, endpoint,
+        ...(env.CODEX_HOME ? { codexHome: env.CODEX_HOME } : {}), ...(options.scratch ? { scratch: { ...options.scratch } } : {}),
+        loginMethod: options.testTransport?.loginMethod ?? 'chatgpt', providerConfig: options.testTransport?.providerConfig ?? {} };
+    return { args, env, pin };
+}
+export async function startNativeCodexSession(options, invocation, prompt, signal, assertAdmission = () => { }) {
+    if ([options.supportedAdmission, options.prepareSupportedAdmission, options.prepareProductionAdmission].filter(Boolean).length > 1 || !!options.beforeSpawn !== !!options.prepareProductionAdmission)
+        throw new Error('CODEX_SUPPORTED_AUTHORITY_CONFLICT');
+    const preparationDeadline = Date.now() + 30_000;
+    let supported = options.supportedAdmission ? { policy: options.supportedAdmission.policy, binding: Object.freeze(structuredClone(options.supportedAdmission.binding)) } : undefined;
+    const native = buildNativeInvocation(invocation, options);
+    const sourceCheck = () => assertCodexSourceIsolation(options.home, options.cwd, native.env.CODEX_HOME || undefined);
+    let earlyTimer;
+    let earlyAbort;
+    let earlyStopped = false;
+    try {
+        const stopped = new Promise((_, rejectEarly) => { earlyAbort = () => { earlyStopped = true; rejectEarly(new Error('CODEX_NATIVE_PREPARATION_STOPPED')); }; signal.addEventListener('abort', earlyAbort, { once: true }); earlyTimer = setTimeout(earlyAbort, Math.max(1, preparationDeadline - Date.now())); });
+        const preparation = (async () => { await sourceCheck(); if (earlyStopped || signal.aborted)
+            reject(); if (options.beforeSpawn)
+            await options.beforeSpawn();
+        else
+            assertAdmission(); })();
+        await Promise.race([preparation, stopped]);
+        if (earlyStopped || signal.aborted || Date.now() >= preparationDeadline)
+            reject();
+    }
+    finally {
+        if (earlyTimer)
+            clearTimeout(earlyTimer);
+        if (earlyAbort)
+            signal.removeEventListener('abort', earlyAbort);
+    }
+    const process = options.processHost.spawn(options.binary, native.args, { cwd: options.cwd, env: native.env });
+    let inspectedExpectation;
+    const session = new CodexNativeSession(new CodexStdioRpc(process), native.pin, sourceCheck, () => { assertAdmission(); if (supported) {
+        if (!inspectedExpectation)
+            reject();
+        requireSupportedCodexPolicy(supported.policy, inspectedExpectation, supported.binding, session);
+    } }, supported, { binaryPath: options.binary, sourceRoot: options.sourceRoot ?? options.cwd, home: options.home, codexHome: native.env.CODEX_HOME ?? path.join(options.home, '.codex') });
+    let rejectStopped;
+    let preparationStopped = false;
+    const aborted = () => { preparationStopped = true; supported?.policy.revoke(); void session.close(); rejectStopped?.(new Error('CODEX_NATIVE_CANCELLED')); };
+    signal.addEventListener('abort', aborted, { once: true });
+    let timer;
+    try {
+        const stopped = new Promise((_, reject) => { rejectStopped = reject; timer = setTimeout(aborted, Math.max(1, preparationDeadline - Date.now())); });
+        // Preparation deadline only; no deadline on a retained, admitted model turn.
+        const observed = await Promise.race([session.inspect(), stopped]);
+        const expected = { model: native.pin.model, provider: 'openai', cwd: options.cwd, endpoint: native.pin.endpoint, configFingerprint: observed.configFingerprint, toolSchemaFingerprint: fingerprint(localToolInventory()) };
+        inspectedExpectation = Object.freeze({ ...expected });
+        if (options.prepareSupportedAdmission || options.prepareProductionAdmission) {
+            const preparation = (options.prepareProductionAdmission ? options.prepareProductionAdmission(session.proof()) : options.prepareSupportedAdmission(inspectedExpectation)).then(context => {
+                if (signal.aborted || preparationStopped) {
+                    context.policy.revoke();
+                    reject();
+                }
+                supported = { policy: context.policy, binding: Object.freeze(structuredClone(context.binding)) };
+                return supported;
+            });
+            await Promise.race([preparation, stopped]);
+        }
+        if (timer)
+            clearTimeout(timer);
+        rejectStopped = undefined;
+        return await startCodexAfterPreflight(session, { model: native.pin.model, provider: 'openai', cwd: options.cwd, endpoint: native.pin.endpoint,
+            configFingerprint: observed.configFingerprint, toolSchemaFingerprint: fingerprint(localToolInventory()) }, prompt, signal, options.onAssessment, supported);
+    }
+    catch {
+        supported?.policy.revoke();
+        await session.close();
+        throw new Error('CODEX_NATIVE_ADMISSION_REJECTED');
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        signal.removeEventListener('abort', aborted);
+    }
+}

package/dist/src/adapters/codex/plugin.js

@@ -0,0 +1,26 @@
+import { CodexAdapter } from './adapter.js';
+import { CODEX_UNSUPPORTED_DIAGNOSTIC } from './compatibility.js';
+import { CLAUDE_CAPABILITIES } from '../discovery.js';
+export class CodexPlugin {
+    deps;
+    id = 'codex_cli';
+    version = '1';
+    capabilities = [...CLAUDE_CAPABILITIES];
+    constructor(deps) {
+        this.deps = deps;
+    }
+    probe() { return this.deps.probe(); }
+    async create(input) {
+        const pinned = await this.probe();
+        const usable = (probe) => probe.available && probe.authenticated && !!probe.executableVersion
+            && this.capabilities.every(capability => probe.capabilities.includes(capability));
+        if (!usable(pinned))
+            throw new Error(CODEX_UNSUPPORTED_DIAGNOSTIC);
+        const options = this.deps.options(input);
+        // Keep job-owned live policy/cwd/scratch accessors through staged admission.
+        return new CodexAdapter(Object.defineProperties({ verifyCompatibility: async () => {
+                const current = await this.probe();
+                return usable(current) && current.executableVersion === pinned.executableVersion;
+            } }, Object.getOwnPropertyDescriptors(options)));
+    }
+}

package/dist/src/adapters/codex/pre-model-gate.js

@@ -0,0 +1,112 @@
+import { isAbsolute } from 'node:path';
+import { requireSupportedCodexPolicy } from './supported-admission.js';
+const REJECTED = 'CODEX_PRE_MODEL_REJECTED';
+const usedSessions = new WeakSet();
+const REQUIRED_TOOLS = ['local_edit', 'local_read', 'local_search', 'local_test'];
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+/** Bounded, value-free diagnostics for ALL candidate prerequisites. This is not
+ * native release certification: only trusted retained observations may reach it,
+ * and matching snapshots cannot establish the two enforcement proof fields. */
+export function assessCodexPreModel(actual, expected, supported) {
+    try {
+        if (!expected || typeof expected.model !== 'string' || !expected.model.trim() || /[\r\n\0]/.test(expected.model)
+            || expected.provider !== 'openai' || !isAbsolute(expected.cwd)
+            || !/^[a-f0-9]{64}$/.test(expected.configFingerprint)
+            || !/^[a-f0-9]{64}$/.test(expected.toolSchemaFingerprint))
+            return { ready: false, reasonCodes: ['INVALID_EXPECTATION'] };
+        const endpoint = new URL(expected.endpoint);
+        if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' || !endpoint.port
+            || endpoint.pathname !== '/mcp' || endpoint.username || endpoint.password || endpoint.search || endpoint.hash)
+            return { ready: false, reasonCodes: ['INVALID_EXPECTATION'] };
+    }
+    catch {
+        return { ready: false, reasonCodes: ['INVALID_EXPECTATION'] };
+    }
+    if (!object(actual))
+        return { ready: false, reasonCodes: ['MALFORMED_OBSERVATION'] };
+    const reasonCodes = [];
+    const require = (ok, code) => { if (!ok)
+        reasonCodes.push(code); };
+    require(actual.model === expected.model && actual.provider === expected.provider && actual.cwd === expected.cwd, 'RUNTIME_IDENTITY_MISMATCH');
+    require(actual.configFingerprint === expected.configFingerprint, 'CONFIG_FINGERPRINT_MISMATCH');
+    require(actual.approvalPolicy === 'never', 'APPROVAL_POLICY_MISMATCH');
+    require(actual.permissionProfile === 'local_job', 'PERMISSION_PROFILE_MISMATCH');
+    if (supported) {
+        try {
+            requireSupportedCodexPolicy(supported.policy, expected, supported.binding);
+        }
+        catch {
+            reasonCodes.push('SUPPORTED_POLICY_AUTHORITY_UNVERIFIED');
+        }
+        require(actual.rpcBoundary === 'owned_exact_rpc_v1', 'RPC_BOUNDARY_UNVERIFIED');
+        require(Array.isArray(actual.environments) && actual.environments.length === 0, 'ENVIRONMENT_REATTACHMENT_UNVERIFIED');
+    }
+    else {
+        require(actual.nativeToolsIsolated === true, 'NATIVE_TOOLS_UNVERIFIED');
+        require(actual.policyStable === true, 'POLICY_STABILITY_UNVERIFIED');
+    }
+    require(Array.isArray(actual.warnings) && actual.warnings.length === 0, 'NATIVE_WARNING');
+    if (!Array.isArray(actual.servers) || actual.servers.length !== 1 || !object(actual.servers[0]))
+        reasonCodes.push('MCP_INVENTORY_MISMATCH');
+    else {
+        const server = actual.servers[0];
+        require(server.name === 'ai_local' && server.endpoint === expected.endpoint, 'MCP_ENDPOINT_MISMATCH');
+        require(server.authenticated === true, 'MCP_AUTHENTICATION_UNVERIFIED');
+        require(server.status === 'ready', 'MCP_NOT_READY');
+        require(server.toolSchemaFingerprint === expected.toolSchemaFingerprint, 'MCP_SCHEMA_MISMATCH');
+        require(Array.isArray(server.tools) && server.tools.every(tool => typeof tool === 'string')
+            && JSON.stringify([...server.tools].sort()) === JSON.stringify(REQUIRED_TOOLS), 'MCP_TOOLS_MISMATCH');
+    }
+    return { ready: reasonCodes.length === 0, reasonCodes };
+}
+/** No model/turn is sent on inspection failure, fallback, incomplete inventory,
+ * cancellation or replay. Retains the same session; never returns a reusable
+ * "approved" boolean for a later independent process. */
+export async function startCodexAfterPreflight(session, expected, prompt, signal, onAssessment, supported) {
+    // A replay must not close an already-running valid session.
+    if (usedSessions.has(session))
+        throw new Error(REJECTED);
+    usedSessions.add(session);
+    const frozen = Object.freeze({ ...expected });
+    let supportedPin;
+    try {
+        if (supported) {
+            supportedPin = { policy: supported.policy, binding: Object.freeze(structuredClone(supported.binding)) };
+            requireSupportedCodexPolicy(supportedPin.policy, frozen, supportedPin.binding, session);
+        }
+        if (signal?.aborted)
+            throw new Error(REJECTED);
+        let abort;
+        let timer;
+        let observation;
+        try {
+            const stopped = new Promise((_, reject) => {
+                abort = () => reject(new Error(REJECTED));
+                signal?.addEventListener('abort', abort, { once: true });
+                // Preparation bound only. There is no timeout on an admitted model turn.
+                timer = setTimeout(abort, 30_000);
+            });
+            observation = await Promise.race([session.inspect(), stopped]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (abort)
+                signal?.removeEventListener('abort', abort);
+        }
+        const assessment = assessCodexPreModel(observation, frozen, supportedPin);
+        onAssessment?.(structuredClone(assessment));
+        if (signal?.aborted || !assessment.ready)
+            throw new Error(REJECTED);
+        if (supportedPin)
+            requireSupportedCodexPolicy(supportedPin.policy, frozen, supportedPin.binding, session);
+        return await session.startTurn(prompt, signal);
+    }
+    catch {
+        try {
+            await session.close();
+        }
+        catch { /* Keep diagnostics fixed and secret-free. */ }
+        throw new Error(REJECTED);
+    }
+}

package/dist/src/adapters/codex/prompt-compiler.js

@@ -0,0 +1,13 @@
+import { compilePrompt as compileBrief } from "../prompt-compiler.js";
+export function compileCodexPrompt(taskPackage, label) {
+    return `${compileBrief(taskPackage, { workItemLabel: label })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. If required work cannot proceed, return the structured blocked report.`;
+}
+export const CODEX_REPORT_SCHEMA = {
+    type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],
+    properties: {
+        status: { type: "string", enum: ["completed", "blocked"] },
+        report: { type: "string", minLength: 1, maxLength: 2000 },
+        evidence: { type: "array", maxItems: 20, items: { type: "string", minLength: 1, maxLength: 500 } },
+        pending_work: { type: "array", maxItems: 20, items: { type: "string", minLength: 1, maxLength: 500 } },
+    },
+};