onadit 0.0.1 → 0.1.0-beta.45

package/dist/src/providers/codex-cli-runner.js

@@ -0,0 +1,584 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { resetCodexModelCacheForTests, resolveCodexModel, } from "./codex-cli-model.js";
+const SCHEMA_CACHE = new Map();
+let codexVersionPromise = null;
+let isolatedCodexHomePath = null;
+// mtime (ms) of the SOURCE auth.json at the moment we last copied it into the
+// isolated home. Drives the staleness re-copy in ensureIsolatedCodexHome.
+let isolatedCodexAuthSourceMtimeMs = null;
+let codexLaunchSpec = null;
+let runtimeTempDirPath = null;
+let runtimeCleanupRegistered = false;
+// Cached SUCCESS of the pre-send `codex exec` capability probe. Only success is
+// cached — see ensureCodexExecCompatible.
+let codexExecCompatible = false;
+let codexExecProbeOverride;
+const CODEX_EXECUTABLE_FALLBACK_DIRS = [
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+];
+/** Minimal schema for the model-availability probe. */
+const CODEX_MODEL_PROBE_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: ["ok"],
+    properties: { ok: { type: "boolean" } },
+};
+/**
+ * Does this model actually run under our isolated CODEX_HOME? A tiny real
+ * `codex exec` — true on a clean structured response, false on any failure
+ * (unsupported model, auth, timeout). Injected into resolveCodexModel so the
+ * fallback is verified rather than guessed.
+ */
+async function probeCodexModel(model) {
+    try {
+        await runCodexCliJson({
+            prompt: "User: ping.\n\nAssistant: Ready.\nReturn JSON {\"ok\": true} and nothing else.",
+            schema: CODEX_MODEL_PROBE_SCHEMA,
+            model,
+            timeoutMs: 60_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `codex exec` options `runCodexCliJson` depends on. A `codex` whose
+ * `exec --help` does not advertise EVERY one of these is too old to run our
+ * contract — most importantly `--output-schema`, which Codex added after 0.39.
+ * We reject such a CLI BEFORE piping any captured conversation to it (mirrors
+ * the Claude runner's REQUIRED_CLAUDE_FLAGS pre-send probe).
+ */
+const REQUIRED_CODEX_EXEC_FLAGS = [
+    "--output-schema",
+    "--output-last-message",
+];
+/**
+ * Test seam: replace the spawn-based `exec --help` probe so callers can unit-
+ * test the "reject before sending content" behavior without spawning codex.
+ * Returns null when compatible, else a leak-free reason. Resets the success
+ * cache so the next call re-probes through the override.
+ */
+export function setCodexExecProbeForTests(fn) {
+    codexExecProbeOverride = fn;
+    codexExecCompatible = false;
+}
+/**
+ * Throw (with an actionable, leak-free message) when the `codex` CLI cannot run
+ * our `exec` contract, BEFORE any captured conversation is sent. Caches only
+ * success: a too-old CLI re-probes each call so an in-place upgrade is picked up
+ * without a daemon restart, and a transient `--help` hiccup does not freeze the
+ * daemon at "incompatible". A spawn/ENOENT from `--help` (binary missing)
+ * propagates as-is so it keeps its own `binary` classification.
+ */
+async function ensureCodexExecCompatible(cwd) {
+    if (codexExecCompatible)
+        return;
+    const reason = codexExecProbeOverride
+        ? await codexExecProbeOverride(cwd)
+        : await probeCodexExecCompatibility(cwd);
+    if (reason !== null) {
+        throw new Error(reason);
+    }
+    codexExecCompatible = true;
+}
+/**
+ * Structural probe: `codex exec --help` must advertise every
+ * REQUIRED_CODEX_EXEC_FLAG. No model call, no content, no auth — bounded by a
+ * short timeout. Returns null when compatible, else a leak-free reason naming
+ * the missing option(s). A failure to even run `--help` (e.g. spawn ENOENT)
+ * propagates so a missing binary keeps its `binary` classification rather than
+ * being mislabelled "too old".
+ */
+async function probeCodexExecCompatibility(cwd) {
+    const { stdout: help } = await runCodexCommand(["exec", "--help"], {
+        cwd,
+        timeoutMs: 15_000,
+    });
+    const missing = REQUIRED_CODEX_EXEC_FLAGS.filter((flag) => !help.includes(flag));
+    if (missing.length === 0) {
+        return null;
+    }
+    // This message is recorded verbatim as the run's `preflight_error`, and
+    // status/doctor attribute a failure to a worker partly by scanning that text.
+    // So it must name ONLY Codex — mentioning `claude_code` here (even as a
+    // helpful "switch worker" hint) would make a too-old-Codex failure look like a
+    // Claude failure and send the user to fix the wrong tool. The "switch to the
+    // Claude worker" remedy belongs in the doctor/status next-action copy, which
+    // is derived from the error CLASS at display time, not parsed back out of this
+    // string.
+    return ("Codex CLI is too old for Onadit capture — `codex exec` is missing required " +
+        `option(s): ${missing.join(", ")}. Upgrade Codex (e.g. brew upgrade codex, ` +
+        "or reinstall); Onadit retries automatically on its next pass.");
+}
+/** One bounded retry on timeout/termination — see runCodexCliJson. */
+const CODEX_TIMEOUT_RETRY_LIMIT = 1;
+const CODEX_TIMEOUT_RETRY_BACKOFF_MS = 500;
+/**
+ * Thrown ONLY when the runner's own timeout timer fires and kills the Codex
+ * CLI process (`code === null`, signal SIGTERM) — i.e. the "took too long"
+ * case. A signal termination we did NOT initiate (external SIGKILL, OOM,
+ * manual interrupt) is deliberately NOT this error; see `runCodexCommand`.
+ * Typed (and carrying `timeoutMs`/`signal`) so callers can apply a bounded
+ * retry to it specifically, and so the recorded message is diagnosable
+ * instead of the opaque "exit null".
+ */
+export class CodexCliTimeoutError extends Error {
+    timeoutMs;
+    signal;
+    constructor(timeoutMs, signal, detail = "") {
+        const signalPart = signal ? ` by ${signal}` : "";
+        super(`Codex CLI timed out after ${timeoutMs}ms (process terminated${signalPart})${detail}`);
+        this.name = "CodexCliTimeoutError";
+        this.timeoutMs = timeoutMs;
+        this.signal = signal;
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function runCodexCliJson(options) {
+    const cwd = options.cwd ?? process.cwd();
+    // Verify the `codex` CLI can actually run our `exec` contract BEFORE piping
+    // any captured conversation to it. A CLI predating `--output-schema` (≤0.39)
+    // would otherwise receive the full prompt and only then exit 2. The probe
+    // uses `codex exec --help` only — no content, no model call, no auth — and is
+    // cached process-wide on success. Mirrors the Claude runner's pre-send probe.
+    await ensureCodexExecCompatible(cwd);
+    const schemaPath = ensureSchemaFile(options.schema);
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    // Pin an explicit model on every run. Never inherit codex's implicit
+    // default — that default changes between releases and silently broke every
+    // preflight when 0.125.0 moved it to a ChatGPT-plan-rejected model.
+    const model = options.model ?? (await resolveCodexModel(probeCodexModel));
+    // One bounded retry, and ONLY for timeout/termination (the old "exit null").
+    // Triage/preflight calls that get SIGTERM'd are overwhelmingly transient
+    // (cold start, brief contention), so a single retry recovers them inside the
+    // same run instead of deferring to the next hourly pass. We deliberately do
+    // NOT retry malformed JSON, empty output, spawn/ENOENT, or non-zero exits
+    // (auth/runtime/oversized) — those are not transient and retrying would only
+    // hide the real failure. (The ONE exception, handled a layer down in
+    // runCodexCommand: a spawn/ENOENT from a cached binary path that a `brew
+    // upgrade` invalidated mid-daemon gets a single re-resolve+retry. A
+    // genuinely-missing binary still ENOENTs on that retry and surfaces here
+    // unretried.) Raising the timeout is intentionally avoided: it raises cost
+    // and hang risk without addressing the transient-kill cause.
+    let lastTimeout = null;
+    for (let attempt = 0; attempt <= CODEX_TIMEOUT_RETRY_LIMIT; attempt++) {
+        const outputPath = path.join(ensureRuntimeTempDir(), `codex-cli-output-${process.pid}-${crypto.randomUUID()}.json`);
+        try {
+            const { stdout } = await runCodexCommand([
+                "exec",
+                "-",
+                "--sandbox",
+                "read-only",
+                "--color",
+                "never",
+                "--skip-git-repo-check",
+                "--model",
+                model,
+                "--output-schema",
+                schemaPath,
+                "--output-last-message",
+                outputPath,
+            ], {
+                cwd,
+                timeoutMs,
+                stdinText: options.prompt,
+            });
+            const raw = fs.existsSync(outputPath)
+                ? fs.readFileSync(outputPath, "utf-8").trim()
+                : stdout.trim();
+            if (raw.length === 0) {
+                throw new Error("Codex CLI returned empty output");
+            }
+            try {
+                return {
+                    output: JSON.parse(raw),
+                    cliTag: await resolveCodexCliTag(cwd),
+                    model,
+                };
+            }
+            catch (error) {
+                throw new Error(`Codex CLI returned malformed JSON: ${raw.slice(0, 500)}`, { cause: error });
+            }
+        }
+        catch (error) {
+            if (error instanceof CodexCliTimeoutError &&
+                attempt < CODEX_TIMEOUT_RETRY_LIMIT) {
+                lastTimeout = error;
+                await delay(CODEX_TIMEOUT_RETRY_BACKOFF_MS);
+                continue;
+            }
+            throw error;
+        }
+        finally {
+            fs.rmSync(outputPath, { force: true });
+        }
+    }
+    // Unreachable: the loop either returns or throws on the final attempt.
+    throw lastTimeout ?? new Error("Codex CLI failed after retries");
+}
+/**
+ * Cheap, synchronous "is the Codex CLI installed?" probe — resolves the
+ * `codex` executable on PATH (plus the Homebrew/usr-local fallbacks the
+ * runner already searches). Used to decide, per import, whether AI metadata
+ * extraction is available or whether to fall back to BasicMetadataExtractor.
+ * Detects install only, NOT auth — an installed-but-unauthenticated Codex
+ * still passes here and fails later at extraction time.
+ */
+export function isCodexCliAvailable() {
+    return resolveCodexExecutableForTests("codex") !== undefined;
+}
+export function resetCodexCliRunnerCacheForTests() {
+    SCHEMA_CACHE.clear();
+    codexVersionPromise = null;
+    codexLaunchSpec = null;
+    codexExecCompatible = false;
+    resetCodexModelCacheForTests();
+    cleanupRuntimeTempArtifacts();
+}
+async function resolveCodexCliTag(cwd) {
+    if (codexVersionPromise === null) {
+        codexVersionPromise = runCodexCommand(["--version"], {
+            cwd,
+            timeoutMs: 15_000,
+        })
+            .then(({ stdout }) => stdout.trim() || "codex-cli")
+            .catch(() => "codex-cli");
+    }
+    return codexVersionPromise;
+}
+function ensureSchemaFile(schema) {
+    const json = JSON.stringify(schema);
+    const digest = crypto.createHash("sha256").update(json).digest("hex");
+    const cached = SCHEMA_CACHE.get(digest);
+    if (cached && fs.existsSync(cached)) {
+        return cached;
+    }
+    const schemaPath = path.join(ensureRuntimeTempDir(), `codex-cli-schema-${digest}.json`);
+    if (!fs.existsSync(schemaPath)) {
+        fs.writeFileSync(schemaPath, `${json}\n`, "utf-8");
+    }
+    SCHEMA_CACHE.set(digest, schemaPath);
+    return schemaPath;
+}
+/**
+ * A `spawn … ENOENT` means the resolved Codex binary is no longer at the
+ * cached path — almost always a `brew upgrade` deleting the version-stamped
+ * path a long-running daemon memoized before the upgrade. Clearing the
+ * launch-spec cache and re-resolving picks up the new binary (via the stable
+ * symlink), so a single retry recovers in-process without a daemon restart.
+ */
+function isCodexBinaryMissingError(error) {
+    return (error instanceof Error && /failed to start:.*\bENOENT\b/.test(error.message));
+}
+async function runCodexCommand(args, options) {
+    try {
+        return await runCodexCommandOnce(args, options);
+    }
+    catch (error) {
+        if (!isCodexBinaryMissingError(error)) {
+            throw error;
+        }
+        // Force re-resolution of the binary path, then retry exactly once.
+        codexLaunchSpec = null;
+        return runCodexCommandOnce(args, options);
+    }
+}
+async function runCodexCommandOnce(args, options) {
+    return new Promise((resolve, reject) => {
+        let stdinError = null;
+        let stdout = "";
+        let stderr = "";
+        // We own the timeout here rather than via spawn's `timeout` option so we
+        // can tell a timeout-kill apart from any OTHER signal termination — an
+        // external SIGKILL, an OOM kill, or a manual interrupt. Only the timeout
+        // path is retryable upstream; misclassifying an external kill as a timeout
+        // would retry a non-transient failure and bury its real cause. spawn's own
+        // `timeout` would kill the child from libuv WITHOUT flipping this flag, so
+        // it is deliberately not used.
+        let timedOut = false;
+        let child;
+        try {
+            child = spawnCodexProcess(args, {
+                cwd: options.cwd,
+                stdio: ["pipe", "pipe", "pipe"],
+                env: codexCliEnv(),
+            });
+        }
+        catch (error) {
+            reject(error);
+            return;
+        }
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+        }, options.timeoutMs);
+        timer.unref?.();
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(new Error(`Codex CLI failed to start: ${error.message}`));
+        });
+        child.stdout?.setEncoding("utf-8");
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr?.setEncoding("utf-8");
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        if (child.stdin) {
+            child.stdin.on("error", (error) => {
+                stdinError = error;
+            });
+            child.stdin.end(options.stdinText ?? "");
+        }
+        child.on("close", (code, signal) => {
+            clearTimeout(timer);
+            const summary = summarizeCodexOutput(stderr, stdout);
+            const detail = summary ? ` — ${summary}` : "";
+            if (code === null) {
+                // exit null = terminated by a signal, not a clean exit. If OUR timeout
+                // fired, it's the transient "took too long" case — typed + retryable,
+                // recorded as "timed out after Xms by SIGTERM" instead of the opaque
+                // "exit null". Any OTHER signal termination (external kill, OOM, manual
+                // interrupt) is NOT a timeout: surface it as-is so it is never retried.
+                if (timedOut) {
+                    reject(new CodexCliTimeoutError(options.timeoutMs, signal, detail));
+                    return;
+                }
+                reject(new Error(`Codex CLI was terminated by ${signal ?? "an unknown signal"} (not a timeout)${detail}`));
+                return;
+            }
+            if (code !== 0) {
+                reject(new Error(`Codex CLI failed (exit ${code})${summary
+                    ? ` — ${summary}`
+                    : stdinError
+                        ? ` — stdin: ${stdinError.message}`
+                        : ""}`));
+                return;
+            }
+            if (stdinError && !isIgnorableStdinError(stdinError)) {
+                reject(new Error(`Codex CLI stdin failed: ${stdinError.message}`));
+                return;
+            }
+            resolve({ stdout, stderr });
+        });
+    });
+}
+/** Cap on the diagnostic summary written into preflight_error / thrown errors. */
+const CODEX_OUTPUT_SUMMARY_MAX = 2000;
+/**
+ * Summarise codex output for diagnosis. The old first-500-chars slice captured
+ * only the startup banner and hid the actual cause, which lands at the END of
+ * the stream (the failing model name, the exit reason). Instead keep the
+ * salient `ERROR` lines plus the tail. Short outputs are returned whole.
+ */
+export function summarizeCodexOutput(stderr, stdout) {
+    const raw = (stderr.trim() || stdout.trim()).trim();
+    if (raw.length <= CODEX_OUTPUT_SUMMARY_MAX) {
+        return raw;
+    }
+    const errorLines = raw
+        .split(/\r?\n/)
+        .filter((line) => line.includes("ERROR"))
+        .slice(-8)
+        .join("\n");
+    const tail = raw.slice(-1200);
+    const combined = errorLines ? `${errorLines}\n…\n${tail}` : `…${tail}`;
+    return combined.length <= CODEX_OUTPUT_SUMMARY_MAX
+        ? combined
+        : `…${combined.slice(-CODEX_OUTPUT_SUMMARY_MAX)}`;
+}
+function isIgnorableStdinError(error) {
+    return ("code" in error &&
+        (error.code === "EPIPE" ||
+            error.code === "ECONNRESET" ||
+            error.code === "ERR_STREAM_DESTROYED"));
+}
+function spawnCodexProcess(args, options) {
+    const launchSpec = resolveCodexLaunchSpec();
+    const launchArgs = [...launchSpec.prefixArgs, ...args];
+    try {
+        return spawn(launchSpec.command, launchArgs, {
+            cwd: options.cwd,
+            stdio: options.stdio,
+            env: options.env,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof Error) ||
+            !error.message.includes("EBADF")) {
+            throw new Error(`Codex CLI failed to spawn (${formatLaunch(launchSpec.command, launchArgs)}): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const shellCommand = [launchSpec.command, ...launchArgs]
+            .map(quotePosixArg)
+            .join(" ");
+        try {
+            return spawn("/bin/sh", ["-lc", shellCommand], {
+                cwd: options.cwd,
+                stdio: options.stdio,
+                env: options.env,
+            });
+        }
+        catch (shellError) {
+            throw new Error(`Codex CLI failed to spawn directly and via shell (${formatLaunch(launchSpec.command, launchArgs)}): ${shellError instanceof Error ? shellError.message : String(shellError)}`);
+        }
+    }
+}
+function formatLaunch(command, args) {
+    return [command, ...args].map(quotePosixArg).join(" ");
+}
+function quotePosixArg(value) {
+    if (value.length === 0)
+        return "''";
+    return `'${value.replace(/'/g, `'\"'\"'`)}'`;
+}
+function codexCliEnv() {
+    return {
+        ...process.env,
+        CODEX_HOME: ensureIsolatedCodexHome(),
+    };
+}
+function resolveCodexLaunchSpec() {
+    if (codexLaunchSpec !== null) {
+        return codexLaunchSpec;
+    }
+    const executable = resolveCodexExecutableForTests("codex");
+    const stableLaunchPath = executable ?? "codex";
+    // Resolve the symlink target ONLY to *detect* a `.js` shim (an npm-style
+    // install whose bin entry points at JS we must run under node). We then
+    // launch via the STABLE path we found on PATH — e.g. the Homebrew symlink
+    // /opt/homebrew/bin/codex — NOT the realpath, for BOTH the binary and the
+    // `.js` case. Following the symlink to a version-stamped path (a Caskroom
+    // …/codex/0.125.0/… binary, or a versioned …/cli.js a global JS manager
+    // rotates) pins a location that an upgrade deletes out from under a
+    // long-running daemon, producing `spawn … ENOENT` on every probe until
+    // restart. The stable path survives upgrades because the package manager
+    // just repoints the symlink; node happily runs the script the symlink
+    // resolves to at spawn time.
+    const realExecutable = executable ? fs.realpathSync(executable) : "codex";
+    codexLaunchSpec = realExecutable.endsWith(".js")
+        ? { command: process.execPath, prefixArgs: [stableLaunchPath] }
+        : { command: stableLaunchPath, prefixArgs: [] };
+    return codexLaunchSpec;
+}
+export function resolveCodexExecutableForTests(name, pathEnv = process.env["PATH"], fallbackDirs = CODEX_EXECUTABLE_FALLBACK_DIRS) {
+    const searchDirs = [
+        ...(pathEnv ? pathEnv.split(path.delimiter) : []),
+        ...fallbackDirs,
+    ];
+    for (const dir of searchDirs) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, name);
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+/**
+ * Path to a private CODEX_HOME holding ONLY a copy of the operator's
+ * `auth.json` — so triage runs with the user's login but none of their
+ * config.toml / MCP / project state.
+ *
+ * The snapshot is REFRESHED when the source `~/.codex/auth.json` changes. The
+ * daemon runs capture in-process for its whole lifetime (a setInterval loop),
+ * so a one-time copy would pin whatever token was current at boot: a later
+ * host-side `codex login` (which rewrites the source with a rotated refresh
+ * token) would never reach the snapshot and every triage would 401 until a
+ * daemon restart. We compare the SOURCE file's mtime — not the temp copy's,
+ * which codex advances in place when it refreshes the access token — so a real
+ * re-login is picked up on the next capture while routine in-temp refreshes are
+ * ignored. The refreshed token is NEVER copied back to `~/.codex`: that would
+ * race a concurrent user `codex login`.
+ */
+function ensureIsolatedCodexHome() {
+    const sourceHome = resolveSourceCodexHome();
+    const authPath = path.join(sourceHome, "auth.json");
+    const sourceMtimeMs = statMtimeMsOrNull(authPath);
+    const existingHome = isolatedCodexHomePath !== null && fs.existsSync(isolatedCodexHomePath)
+        ? isolatedCodexHomePath
+        : null;
+    if (existingHome !== null && sourceMtimeMs === isolatedCodexAuthSourceMtimeMs) {
+        return existingHome;
+    }
+    const isolatedHome = existingHome ??
+        fs.mkdtempSync(path.join(ensureRuntimeTempDir(), "codex-cli-backfill-home-"));
+    if (fs.existsSync(authPath)) {
+        fs.copyFileSync(authPath, path.join(isolatedHome, "auth.json"));
+        isolatedCodexAuthSourceMtimeMs = sourceMtimeMs;
+    }
+    else {
+        // No source auth to copy. We deliberately KEEP any existing snapshot rather
+        // than delete it: a host `codex login` rewrites auth.json via atomic temp +
+        // rename, so a stat that lands mid-rename can momentarily see no file —
+        // deleting on that transient absence would nuke a perfectly good token and
+        // 401 the next run, the exact failure this whole mechanism exists to avoid.
+        // Known, accepted trade-off: a DELIBERATE `codex logout` (a lasting absence,
+        // not a transient one) won't propagate — Onadit keeps using the copied token
+        // until the server rejects it (handled by the auth preflight class) or the
+        // daemon restarts. Record null so a later reappearance re-copies.
+        isolatedCodexAuthSourceMtimeMs = null;
+    }
+    isolatedCodexHomePath = isolatedHome;
+    return isolatedHome;
+}
+function statMtimeMsOrNull(filePath) {
+    try {
+        return fs.statSync(filePath).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveSourceCodexHome() {
+    if (typeof process.env["CODEX_HOME"] === "string") {
+        return process.env["CODEX_HOME"];
+    }
+    return path.join(os.homedir(), ".codex");
+}
+function ensureRuntimeTempDir() {
+    if (runtimeTempDirPath && fs.existsSync(runtimeTempDirPath)) {
+        return runtimeTempDirPath;
+    }
+    const runtimeTempDir = fs.mkdtempSync(path.join(resolveWritableTempRoot(), "codex-cli-runner-"));
+    runtimeTempDirPath = runtimeTempDir;
+    if (!runtimeCleanupRegistered) {
+        runtimeCleanupRegistered = true;
+        process.once("exit", cleanupRuntimeTempArtifacts);
+    }
+    return runtimeTempDir;
+}
+function resolveWritableTempRoot() {
+    for (const candidate of [os.tmpdir(), "/tmp"]) {
+        if (!candidate || !fs.existsSync(candidate)) {
+            continue;
+        }
+        try {
+            fs.accessSync(candidate, fs.constants.R_OK | fs.constants.W_OK);
+            return candidate;
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error(`No writable temp directory available for Codex CLI runtime (TMPDIR=${process.env["TMPDIR"] ?? "<unset>"})`);
+}
+function cleanupRuntimeTempArtifacts() {
+    if (runtimeTempDirPath) {
+        fs.rmSync(runtimeTempDirPath, { recursive: true, force: true });
+        runtimeTempDirPath = null;
+    }
+    isolatedCodexHomePath = null;
+    isolatedCodexAuthSourceMtimeMs = null;
+}
+//# sourceMappingURL=codex-cli-runner.js.map

package/dist/src/providers/codex-cli-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-cli-runner.js","sourceRoot":"","sources":["../../../src/providers/codex-cli-runner.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC/C,IAAI,mBAAmB,GAA2B,IAAI,CAAC;AACvD,IAAI,qBAAqB,GAAkB,IAAI,CAAC;AAChD,8EAA8E;AAC9E,0EAA0E;AAC1E,IAAI,8BAA8B,GAAkB,IAAI,CAAC;AACzD,IAAI,eAAe,GAAqD,IAAI,CAAC;AAC7E,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAC7C,IAAI,wBAAwB,GAAG,KAAK,CAAC;AACrC,gFAAgF;AAChF,0CAA0C;AAC1C,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAChC,IAAI,sBAES,CAAC;AAEd,MAAM,8BAA8B,GAAG;IACrC,mBAAmB;IACnB,gBAAgB;CACR,CAAC;AAuBX,uDAAuD;AACvD,MAAM,wBAAwB,GAAG;IAC/B,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;CAC/B,CAAC;AAEX;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,eAAe,CAAC;YACpB,MAAM,EACJ,gFAAgF;YAClF,MAAM,EAAE,wBAAwB;YAChC,KAAK;YACL,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG;IAChC,iBAAiB;IACjB,uBAAuB;CACf,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,EAAyD;IAEzD,sBAAsB,GAAG,EAAE,CAAC;IAC5B,mBAAmB,GAAG,KAAK,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,yBAAyB,CAAC,GAAW;IAClD,IAAI,mBAAmB;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,sBAAsB;QACnC,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,2BAA2B,CAAC,GAAW;IACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;QACjE,GAAG;QACH,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,UAAU;IACV,OAAO,CACL,6EAA6E;QAC7E,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;QAC5E,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,SAAS,CAAS;IAClB,MAAM,CAAwB;IACvC,YAAY,SAAiB,EAAE,MAA6B,EAAE,MAAM,GAAG,EAAE;QACvE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,KAAK,CACH,6BAA6B,SAAS,yBAAyB,UAAU,IAAI,MAAM,EAAE,CACtF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2B;IAE3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAC/C,qEAAqE;IACrE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC;IAE1E,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,qEAAqE;IACrE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,yBAAyB,EAAE,OAAO,EAAE,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EAAE,EACtB,oBAAoB,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,OAAO,CAC9D,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CACtC;gBACE,MAAM;gBACN,GAAG;gBACH,WAAW;gBACX,WAAW;gBACX,SAAS;gBACT,OAAO;gBACP,uBAAuB;gBACvB,SAAS;gBACT,KAAK;gBACL,iBAAiB;gBACjB,UAAU;gBACV,uBAAuB;gBACvB,UAAU;aACX,EACD;gBACE,GAAG;gBACH,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,MAAM;aAC1B,CACF,CAAC;YAEF,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBACnC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;gBAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAElB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YAED,IAAI,CAAC;gBACH,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM;oBAC5B,MAAM,EAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC;oBACrC,KAAK;iBACN,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,oBAAoB;gBACrC,OAAO,GAAG,yBAAyB,EACnC,CAAC;gBACD,WAAW,GAAG,KAAK,CAAC;gBACpB,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,WAAW,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,8BAA8B,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,mBAAmB,GAAG,IAAI,CAAC;IAC3B,eAAe,GAAG,IAAI,CAAC;IACvB,mBAAmB,GAAG,KAAK,CAAC;IAC5B,4BAA4B,EAAE,CAAC;IAC/B,2BAA2B,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,mBAAmB,GAAG,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE;YACnD,GAAG;YACH,SAAS,EAAE,MAAM;SAClB,CAAC;aACC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC;aAClD,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA+B;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,oBAAoB,EAAE,EACtB,oBAAoB,MAAM,OAAO,CAClC,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,CACL,KAAK,YAAY,KAAK,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAc,EACd,OAIC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAc,EACd,OAIC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,UAAU,GAAiB,IAAI,CAAC;QACpC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,+BAA+B;QAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE;gBAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,GAAG,EAAE,WAAW,EAAE;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChC,UAAU,GAAG,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,uEAAuE;gBACvE,sEAAsE;gBACtE,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,KAAK,CACP,+BAA+B,MAAM,IAAI,mBAAmB,mBAAmB,MAAM,EAAE,CACxF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CACJ,IAAI,KAAK,CACP,0BAA0B,IAAI,IAC5B,OAAO;oBACL,CAAC,CAAC,MAAM,OAAO,EAAE;oBACjB,CAAC,CAAC,UAAU;wBACV,CAAC,CAAC,aAAa,UAAU,CAAC,OAAO,EAAE;wBACnC,CAAC,CAAC,EACR,EAAE,CACH,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,UAAU,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YAED,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,GAAG;SACnB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,CAAC,CAAC;SACT,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACvE,OAAO,QAAQ,CAAC,MAAM,IAAI,wBAAwB;QAChD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAY;IACzC,OAAO,CACL,MAAM,IAAI,KAAK;QACf,CACE,KAAK,CAAC,IAAI,KAAK,OAAO;YACtB,KAAK,CAAC,IAAI,KAAK,YAAY;YAC3B,KAAK,CAAC,IAAI,KAAK,sBAAsB,CACtC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAc,EACd,OAIC;IAED,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE;YAC3C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MACxE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;aACrD,GAAG,CAAC,aAAa,CAAC;aAClB,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;gBAC7C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,qDAAqD,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAC/F,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACtE,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAc;IACnD,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,GAAG,OAAO,CAAC,GAAG;QACd,UAAU,EAAE,uBAAuB,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,UAAU,IAAI,OAAO,CAAC;IAC/C,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE;QAC/D,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAClD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,IAAY,EACZ,UAA8B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EACjD,eAAkC,8BAA8B;IAEhE,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,YAAY;KAChB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB;IAC9B,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAElD,MAAM,YAAY,GAChB,qBAAqB,KAAK,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACpE,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC9E,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAChB,YAAY;QACZ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAEhF,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;QAChE,8BAA8B,GAAG,aAAa,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,kEAAkE;QAClE,8BAA8B,GAAG,IAAI,CAAC;IACxC,CAAC;IAED,qBAAqB,GAAG,YAAY,CAAC;IACrC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,CAAC,WAAW,CACnC,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,mBAAmB,CAAC,CAC1D,CAAC;IACF,kBAAkB,GAAG,cAAc,CAAC;IAEpC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,IAAI,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,uBAAuB;IAC9B,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,sEAAsE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,GAAG,CAC5G,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,kBAAkB,EAAE,CAAC;QACvB,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,kBAAkB,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,qBAAqB,GAAG,IAAI,CAAC;IAC7B,8BAA8B,GAAG,IAAI,CAAC;AACxC,CAAC"}

package/dist/src/providers/codex-input-limit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Codex CLI input-size ceiling and the truncation helper every caller uses to
+ * stay under it. Shared by the triage provider and the metadata extractor —
+ * both assemble a prompt from a full conversation transcript and pipe it to
+ * `codex exec` via stdin, so both can otherwise exceed Codex's cap.
+ *
+ * TWO ceilings bind, and the budget must clear BOTH:
+ *  1. The CLI parser: `turn/start` rejects any prompt over 1,048,576 chars
+ *     with `input_too_large` (code -32602) and exits 1.
+ *  2. The MODEL context window. Observed live 2026-07-06: a transcript capped
+ *     just under 1 MiB passed the parser and then failed the run with "Codex
+ *     ran out of room in the model's context window" — dense agent-log text
+ *     runs ~3 bytes/token, so ~1 MiB ≈ ~350k tokens, over every pinned
+ *     model's context. A budget that only respects ceiling 1 re-jams capture
+ *     on ceiling 2.
+ *
+ * 256 KiB ≈ ≤ ~90k tokens even for dense text — inside any plausible model
+ * context with room for the instruction prefix and the model's output, and
+ * still ~20× the OpenAI triage provider's long-proven 12k-char sample.
+ *
+ * We enforce the cap against the prompt's UTF-8 *byte* length, not JS string
+ * `.length` (UTF-16 code units): UTF-8 byte length ≥ character count for
+ * every string, so a byte budget is conservative whichever unit the parser
+ * counts, and non-ASCII transcripts (CJK, emoji) can't blow past a char-based
+ * slice.
+ */
+export declare const CODEX_MAX_INPUT_BYTES = 262144;
+/**
+ * Headroom kept below the ceiling for the truncation marker and Codex's own
+ * environment-context framing only. It does NOT cover the caller's fixed prompt
+ * overhead — every caller must subtract its own instruction prefix and wrapper
+ * bytes from `CODEX_MAX_INPUT_BYTES` on top of this margin (a caller that leaned
+ * on the margin instead would break the moment its prefix exceeds 8 KB).
+ */
+export declare const CODEX_INPUT_SAFETY_MARGIN = 8192;
+/**
+ * Head+tail truncation bounded by UTF-8 byte length, with an inline marker.
+ * Cuts are snapped to the nearest character boundary so we never emit a partial
+ * multi-byte sequence. In bytes rather than JS string length so non-ASCII
+ * content stays under the cap.
+ */
+export declare function truncateToBytes(content: string, maxBytes: number, marker?: string): string;
+//# sourceMappingURL=codex-input-limit.d.ts.map

package/dist/src/providers/codex-input-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-input-limit.d.ts","sourceRoot":"","sources":["../../../src/providers/codex-input-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,SAA8D,GACnE,MAAM,CAIR"}