onadit 0.0.1 → 1.0.0

package/dist/src/providers/codex-cli-runner.js

@@ -0,0 +1,745 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { findCodexModelRejection } from "../diagnostics/codex-preflight.js";
+import { markCodexModelRefused, resetCodexModelCacheForTests, resolveCodexModel, } from "./codex-cli-model.js";
+const SCHEMA_CACHE = new Map();
+let codexVersionPromise = null;
+let isolatedCodexHomePath = null;
+// mtime (ms) of the SOURCE auth.json at the moment we last copied it into the
+// isolated home. Drives the staleness re-copy in ensureIsolatedCodexHome.
+let isolatedCodexAuthSourceMtimeMs = null;
+let codexLaunchSpec = null;
+let runtimeTempDirPath = null;
+let runtimeCleanupRegistered = false;
+// Cached SUCCESS of the pre-send `codex exec` capability probe. Only success is
+// cached — see ensureCodexExecCompatible.
+let codexExecCompatible = false;
+let codexExecProbeOverride;
+const CODEX_EXECUTABLE_FALLBACK_DIRS = [
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+];
+/** Minimal schema for the model-availability probe. */
+const CODEX_MODEL_PROBE_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: ["ok"],
+    properties: { ok: { type: "boolean" } },
+};
+/**
+ * Does this model actually run under our isolated CODEX_HOME? A tiny real
+ * `codex exec` — true on a clean structured response, false when Codex refuses
+ * the model. Any other failure (auth, network, timeout) throws: it is not about
+ * the model, so trying the next one would only hide it. Injected into
+ * resolveCodexModel so the pick is verified rather than guessed.
+ */
+async function probeCodexModel(model) {
+    try {
+        await runCodexCliJson({
+            prompt: "User: ping.\n\nAssistant: Ready.\nReturn JSON {\"ok\": true} and nothing else.",
+            schema: CODEX_MODEL_PROBE_SCHEMA,
+            model,
+            timeoutMs: 60_000,
+        });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof CodexModelRejectedError) {
+            return false;
+        }
+        throw error;
+    }
+}
+/**
+ * The models this account can use, from `codex debug models`. Signed in, Codex
+ * refreshes the list from OpenAI (well under a second; no model call, no
+ * content), so a retired model is already gone from it. Injected into
+ * resolveCodexModel.
+ */
+async function listCodexCatalog() {
+    const { stdout } = await runCodexCommand(["debug", "models"], {
+        cwd: ensureRuntimeTempDir(),
+        timeoutMs: 30_000,
+    });
+    const models = JSON.parse(stdout).models;
+    if (!Array.isArray(models)) {
+        return [];
+    }
+    return models.filter((model) => typeof model === "object" &&
+        model !== null &&
+        typeof model.slug === "string");
+}
+/**
+ * `codex exec` options `runCodexCliJson` depends on. A `codex` whose
+ * `exec --help` does not advertise EVERY one of these is too old to run our
+ * contract — most importantly `--output-schema`, which Codex added after 0.39.
+ * We reject such a CLI BEFORE piping any captured conversation to it (mirrors
+ * the Claude runner's REQUIRED_CLAUDE_FLAGS pre-send probe).
+ */
+const REQUIRED_CODEX_EXEC_FLAGS = [
+    "--output-schema",
+    "--output-last-message",
+];
+/**
+ * Test seam: replace the spawn-based `exec --help` probe so callers can unit-
+ * test the "reject before sending content" behavior without spawning codex.
+ * Returns null when compatible, else a leak-free reason. Resets the success
+ * cache so the next call re-probes through the override.
+ */
+export function setCodexExecProbeForTests(fn) {
+    codexExecProbeOverride = fn;
+    codexExecCompatible = false;
+}
+/**
+ * Throw (with an actionable, leak-free message) when the `codex` CLI cannot run
+ * our `exec` contract, BEFORE any captured conversation is sent. Caches only
+ * success: a too-old CLI re-probes each call so an in-place upgrade is picked up
+ * without a daemon restart, and a transient `--help` hiccup does not freeze the
+ * daemon at "incompatible". A spawn/ENOENT from `--help` (binary missing)
+ * propagates as-is so it keeps its own `binary` classification.
+ */
+async function ensureCodexExecCompatible(cwd) {
+    if (codexExecCompatible)
+        return;
+    const reason = codexExecProbeOverride
+        ? await codexExecProbeOverride(cwd)
+        : await probeCodexExecCompatibility(cwd);
+    if (reason !== null) {
+        throw new Error(reason);
+    }
+    codexExecCompatible = true;
+}
+/**
+ * Structural probe: `codex exec --help` must advertise every
+ * REQUIRED_CODEX_EXEC_FLAG. No model call, no content, no auth — bounded by a
+ * short timeout. Returns null when compatible, else a leak-free reason naming
+ * the missing option(s). A failure to even run `--help` (e.g. spawn ENOENT)
+ * propagates so a missing binary keeps its `binary` classification rather than
+ * being mislabelled "too old".
+ */
+async function probeCodexExecCompatibility(cwd) {
+    const { stdout: help } = await runCodexCommand(["exec", "--help"], {
+        cwd,
+        timeoutMs: 15_000,
+    });
+    const missing = REQUIRED_CODEX_EXEC_FLAGS.filter((flag) => !help.includes(flag));
+    if (missing.length === 0) {
+        return null;
+    }
+    // This message is recorded verbatim as the run's `preflight_error`, and
+    // status/doctor attribute a failure to a worker partly by scanning that text.
+    // So it must name ONLY Codex — mentioning `claude_code` here (even as a
+    // helpful "switch worker" hint) would make a too-old-Codex failure look like a
+    // Claude failure and send the user to fix the wrong tool. The "switch to the
+    // Claude worker" remedy belongs in the doctor/status next-action copy, which
+    // is derived from the error CLASS at display time, not parsed back out of this
+    // string.
+    return ("Codex CLI is too old for Onadit capture — `codex exec` is missing required " +
+        `option(s): ${missing.join(", ")}. Upgrade Codex (e.g. brew upgrade codex, ` +
+        "or reinstall); Onadit retries automatically on its next pass.");
+}
+/** One bounded retry on timeout/termination — see runCodexCliJson. */
+const CODEX_TIMEOUT_RETRY_LIMIT = 1;
+const CODEX_TIMEOUT_RETRY_BACKOFF_MS = 500;
+/**
+ * Thrown ONLY when the runner's own timeout timer fires and kills the Codex
+ * CLI process (`code === null`, signal SIGTERM) — i.e. the "took too long"
+ * case. A signal termination we did NOT initiate (external SIGKILL, OOM,
+ * manual interrupt) is deliberately NOT this error; see `runCodexCommand`.
+ * Typed (and carrying `timeoutMs`/`signal`) so callers can apply a bounded
+ * retry to it specifically, and so the recorded message is diagnosable
+ * instead of the opaque "exit null".
+ */
+export class CodexCliTimeoutError extends Error {
+    timeoutMs;
+    signal;
+    constructor(timeoutMs, signal, detail = "") {
+        const signalPart = signal ? ` by ${signal}` : "";
+        super(`Codex CLI timed out after ${timeoutMs}ms (process terminated${signalPart})${detail}`);
+        this.name = "CodexCliTimeoutError";
+        this.timeoutMs = timeoutMs;
+        this.signal = signal;
+    }
+}
+/**
+ * Thrown when Codex exits refusing the pinned model — retired, or not on the
+ * account's plan ("The 'gpt-5.5' model is not supported when using Codex with
+ * a ChatGPT account."). Found in the FULL output before it is shortened, and
+ * named first in the message, so the recorded error always says it.
+ */
+export class CodexModelRejectedError extends Error {
+    model;
+    constructor(model, reason, exitCode) {
+        super(`Codex CLI failed (exit ${exitCode}) — Codex rejected the model "${model}": ${reason}`);
+        this.name = "CodexModelRejectedError";
+        this.model = model;
+    }
+}
+/** At most this many model switches inside one call — see runCodexCliJson. */
+const CODEX_MODEL_SWITCH_LIMIT = 3;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function runCodexCliJson(options) {
+    const cwd = options.cwd ?? process.cwd();
+    // Verify the `codex` CLI can actually run our `exec` contract BEFORE piping
+    // any captured conversation to it. A CLI predating `--output-schema` (≤0.39)
+    // would otherwise receive the full prompt and only then exit 2. The probe
+    // uses `codex exec --help` only — no content, no model call, no auth — and is
+    // cached process-wide on success. Mirrors the Claude runner's pre-send probe.
+    await ensureCodexExecCompatible(cwd);
+    const exec = {
+        prompt: options.prompt,
+        cwd,
+        schemaPath: ensureSchemaFile(options.schema),
+        timeoutMs: options.timeoutMs ?? 120_000,
+    };
+    // An explicit model (the probe) is run as asked — never swapped.
+    if (options.model !== undefined) {
+        return runCodexExec(exec, options.model);
+    }
+    // Pin an explicit model on every run. Never inherit codex's implicit
+    // default — that default changes between releases and silently broke every
+    // preflight when 0.125.0 moved it to a ChatGPT-plan-rejected model.
+    let model = await resolveCodexModel(probeCodexModel, listCodexCatalog);
+    // When Codex refuses the model (OpenAI retired it, or the plan lost it),
+    // record the refusal, pick another model and run again, instead of failing
+    // every capture until someone edits config.json. Bounded: the configured,
+    // source and persisted models are tried unprobed, so each can be refused once
+    // before resolution reaches the probed catalog.
+    for (let switches = 0;; switches++) {
+        try {
+            return await runCodexExec(exec, model);
+        }
+        catch (error) {
+            if (!(error instanceof CodexModelRejectedError) ||
+                switches >= CODEX_MODEL_SWITCH_LIMIT) {
+                throw error;
+            }
+            markCodexModelRefused(model);
+            model = await resolveCodexModel(probeCodexModel, listCodexCatalog);
+        }
+    }
+}
+async function runCodexExec(exec, model) {
+    // One bounded retry, and ONLY for timeout/termination (the old "exit null").
+    // Triage/preflight calls that get SIGTERM'd are overwhelmingly transient
+    // (cold start, brief contention), so a single retry recovers them inside the
+    // same run instead of deferring to the next hourly pass. We deliberately do
+    // NOT retry malformed JSON, empty output, spawn/ENOENT, or non-zero exits
+    // (auth/runtime/oversized) — those are not transient and retrying would only
+    // hide the real failure. (The ONE exception, handled a layer down in
+    // runCodexCommand: a spawn/ENOENT from a cached binary path that a `brew
+    // upgrade` invalidated mid-daemon gets a single re-resolve+retry. A
+    // genuinely-missing binary still ENOENTs on that retry and surfaces here
+    // unretried.) Raising the timeout is intentionally avoided: it raises cost
+    // and hang risk without addressing the transient-kill cause.
+    let lastTimeout = null;
+    for (let attempt = 0; attempt <= CODEX_TIMEOUT_RETRY_LIMIT; attempt++) {
+        const outputPath = path.join(ensureRuntimeTempDir(), `codex-cli-output-${process.pid}-${crypto.randomUUID()}.json`);
+        try {
+            const { stdout } = await runCodexCommand([
+                "exec",
+                "-",
+                "--sandbox",
+                "read-only",
+                "--color",
+                "never",
+                "--skip-git-repo-check",
+                "--model",
+                model,
+                "--output-schema",
+                exec.schemaPath,
+                "--output-last-message",
+                outputPath,
+            ], {
+                cwd: exec.cwd,
+                timeoutMs: exec.timeoutMs,
+                stdinText: exec.prompt,
+            });
+            const raw = fs.existsSync(outputPath)
+                ? fs.readFileSync(outputPath, "utf-8").trim()
+                : stdout.trim();
+            if (raw.length === 0) {
+                throw new Error("Codex CLI returned empty output");
+            }
+            try {
+                return {
+                    output: JSON.parse(raw),
+                    cliTag: await resolveCodexCliTag(exec.cwd),
+                    model,
+                };
+            }
+            catch (error) {
+                throw new Error(`Codex CLI returned malformed JSON: ${raw.slice(0, 500)}`, { cause: error });
+            }
+        }
+        catch (error) {
+            if (error instanceof CodexCliTimeoutError &&
+                attempt < CODEX_TIMEOUT_RETRY_LIMIT) {
+                lastTimeout = error;
+                await delay(CODEX_TIMEOUT_RETRY_BACKOFF_MS);
+                continue;
+            }
+            throw error;
+        }
+        finally {
+            fs.rmSync(outputPath, { force: true });
+        }
+    }
+    // Unreachable: the loop either returns or throws on the final attempt.
+    throw lastTimeout ?? new Error("Codex CLI failed after retries");
+}
+/**
+ * Cheap, synchronous "is the Codex CLI installed?" probe — resolves the
+ * `codex` executable on PATH (plus the Homebrew/usr-local fallbacks the
+ * runner already searches). Used to decide, per import, whether AI metadata
+ * extraction is available or whether to fall back to BasicMetadataExtractor.
+ * Detects install only, NOT auth — an installed-but-unauthenticated Codex
+ * still passes here and fails later at extraction time.
+ */
+export function isCodexCliAvailable() {
+    return resolveCodexExecutableForTests("codex") !== undefined;
+}
+export function resetCodexCliRunnerCacheForTests() {
+    SCHEMA_CACHE.clear();
+    codexVersionPromise = null;
+    codexLaunchSpec = null;
+    codexExecCompatible = false;
+    wrapperKeepsCodexHomeCache.clear();
+    resetCodexModelCacheForTests();
+    cleanupRuntimeTempArtifacts();
+}
+async function resolveCodexCliTag(cwd) {
+    if (codexVersionPromise === null) {
+        codexVersionPromise = runCodexCommand(["--version"], {
+            cwd,
+            timeoutMs: 15_000,
+        })
+            .then(({ stdout }) => stdout.trim() || "codex-cli")
+            .catch(() => "codex-cli");
+    }
+    return codexVersionPromise;
+}
+function ensureSchemaFile(schema) {
+    const json = JSON.stringify(schema);
+    const digest = crypto.createHash("sha256").update(json).digest("hex");
+    const cached = SCHEMA_CACHE.get(digest);
+    if (cached && fs.existsSync(cached)) {
+        return cached;
+    }
+    const schemaPath = path.join(ensureRuntimeTempDir(), `codex-cli-schema-${digest}.json`);
+    if (!fs.existsSync(schemaPath)) {
+        fs.writeFileSync(schemaPath, `${json}\n`, "utf-8");
+    }
+    SCHEMA_CACHE.set(digest, schemaPath);
+    return schemaPath;
+}
+/**
+ * A `spawn … ENOENT` means the resolved Codex binary is no longer at the
+ * cached path — almost always a `brew upgrade` deleting the version-stamped
+ * path a long-running daemon memoized before the upgrade. Clearing the
+ * launch-spec cache and re-resolving picks up the new binary (via the stable
+ * symlink), so a single retry recovers in-process without a daemon restart.
+ */
+function isCodexBinaryMissingError(error) {
+    return (error instanceof Error && /failed to start:.*\bENOENT\b/.test(error.message));
+}
+async function runCodexCommand(args, options) {
+    try {
+        return await runCodexCommandOnce(args, options);
+    }
+    catch (error) {
+        if (!isCodexBinaryMissingError(error)) {
+            throw error;
+        }
+        // Force re-resolution of the binary path, then retry exactly once.
+        codexLaunchSpec = null;
+        return runCodexCommandOnce(args, options);
+    }
+}
+async function runCodexCommandOnce(args, options) {
+    return new Promise((resolve, reject) => {
+        let stdinError = null;
+        let stdout = "";
+        let stderr = "";
+        // We own the timeout here rather than via spawn's `timeout` option so we
+        // can tell a timeout-kill apart from any OTHER signal termination — an
+        // external SIGKILL, an OOM kill, or a manual interrupt. Only the timeout
+        // path is retryable upstream; misclassifying an external kill as a timeout
+        // would retry a non-transient failure and bury its real cause. spawn's own
+        // `timeout` would kill the child from libuv WITHOUT flipping this flag, so
+        // it is deliberately not used.
+        let timedOut = false;
+        let child;
+        try {
+            child = spawnCodexProcess(args, {
+                cwd: options.cwd,
+                stdio: ["pipe", "pipe", "pipe"],
+                env: codexCliEnv(),
+            });
+        }
+        catch (error) {
+            reject(error);
+            return;
+        }
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+        }, options.timeoutMs);
+        timer.unref?.();
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(new Error(`Codex CLI failed to start: ${error.message}`));
+        });
+        child.stdout?.setEncoding("utf-8");
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr?.setEncoding("utf-8");
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        if (child.stdin) {
+            child.stdin.on("error", (error) => {
+                stdinError = error;
+            });
+            child.stdin.end(options.stdinText ?? "");
+        }
+        child.on("close", (code, signal) => {
+            clearTimeout(timer);
+            const summary = summarizeCodexOutput(stderr, stdout);
+            const detail = summary ? ` — ${summary}` : "";
+            if (code === null) {
+                // exit null = terminated by a signal, not a clean exit. If OUR timeout
+                // fired, it's the transient "took too long" case — typed + retryable,
+                // recorded as "timed out after Xms by SIGTERM" instead of the opaque
+                // "exit null". Any OTHER signal termination (external kill, OOM, manual
+                // interrupt) is NOT a timeout: surface it as-is so it is never retried.
+                if (timedOut) {
+                    reject(new CodexCliTimeoutError(options.timeoutMs, signal, detail));
+                    return;
+                }
+                reject(new Error(`Codex CLI was terminated by ${signal ?? "an unknown signal"} (not a timeout)${detail}`));
+                return;
+            }
+            if (code !== 0) {
+                // Look for a model refusal in the FULL output, before it is shortened:
+                // a burst of reconnect errors can push it out of the summary. Only a
+                // Codex ERROR line naming the pinned model counts, and not one that is
+                // part of the prompt Codex echoes back (a triaged conversation can
+                // quote an old refusal).
+                const model = pinnedModelArg(args);
+                const rejection = model
+                    ? findCodexModelRejection(`${stderr}\n${stdout}`, model, options.stdinText ?? "")
+                    : null;
+                if (model && rejection) {
+                    reject(new CodexModelRejectedError(model, rejection, code));
+                    return;
+                }
+                reject(new Error(`Codex CLI failed (exit ${code})${summary
+                    ? ` — ${summary}`
+                    : stdinError
+                        ? ` — stdin: ${stdinError.message}`
+                        : ""}`));
+                return;
+            }
+            if (stdinError && !isIgnorableStdinError(stdinError)) {
+                reject(new Error(`Codex CLI stdin failed: ${stdinError.message}`));
+                return;
+            }
+            resolve({ stdout, stderr });
+        });
+    });
+}
+/** Cap on the diagnostic summary written into preflight_error / thrown errors. */
+const CODEX_OUTPUT_SUMMARY_MAX = 2000;
+/**
+ * Summarise codex output for diagnosis. The old first-500-chars slice captured
+ * only the startup banner and hid the actual cause, which lands at the END of
+ * the stream (the failing model name, the exit reason). Instead keep the
+ * salient `ERROR` lines plus the tail. Short outputs are returned whole.
+ */
+export function summarizeCodexOutput(stderr, stdout) {
+    const raw = (stderr.trim() || stdout.trim()).trim();
+    if (raw.length <= CODEX_OUTPUT_SUMMARY_MAX) {
+        return raw;
+    }
+    const errorLines = raw
+        .split(/\r?\n/)
+        .filter((line) => line.includes("ERROR"))
+        .slice(-8)
+        .join("\n");
+    const tail = raw.slice(-1200);
+    const combined = errorLines ? `${errorLines}\n…\n${tail}` : `…${tail}`;
+    return combined.length <= CODEX_OUTPUT_SUMMARY_MAX
+        ? combined
+        : `…${combined.slice(-CODEX_OUTPUT_SUMMARY_MAX)}`;
+}
+/** The value after `--model` in a codex argv, if any. */
+function pinnedModelArg(args) {
+    const index = args.indexOf("--model");
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function isIgnorableStdinError(error) {
+    return ("code" in error &&
+        (error.code === "EPIPE" ||
+            error.code === "ECONNRESET" ||
+            error.code === "ERR_STREAM_DESTROYED"));
+}
+function spawnCodexProcess(args, options) {
+    const launchSpec = resolveCodexLaunchSpec();
+    const launchArgs = [...launchSpec.prefixArgs, ...args];
+    try {
+        return spawn(launchSpec.command, launchArgs, {
+            cwd: options.cwd,
+            stdio: options.stdio,
+            env: options.env,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof Error) ||
+            !error.message.includes("EBADF")) {
+            throw new Error(`Codex CLI failed to spawn (${formatLaunch(launchSpec.command, launchArgs)}): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const shellCommand = [launchSpec.command, ...launchArgs]
+            .map(quotePosixArg)
+            .join(" ");
+        try {
+            return spawn("/bin/sh", ["-lc", shellCommand], {
+                cwd: options.cwd,
+                stdio: options.stdio,
+                env: options.env,
+            });
+        }
+        catch (shellError) {
+            throw new Error(`Codex CLI failed to spawn directly and via shell (${formatLaunch(launchSpec.command, launchArgs)}): ${shellError instanceof Error ? shellError.message : String(shellError)}`);
+        }
+    }
+}
+function formatLaunch(command, args) {
+    return [command, ...args].map(quotePosixArg).join(" ");
+}
+function quotePosixArg(value) {
+    if (value.length === 0)
+        return "''";
+    return `'${value.replace(/'/g, `'\"'\"'`)}'`;
+}
+function codexCliEnv() {
+    return {
+        ...process.env,
+        CODEX_HOME: ensureIsolatedCodexHome(),
+    };
+}
+function resolveCodexLaunchSpec() {
+    if (codexLaunchSpec !== null) {
+        return codexLaunchSpec;
+    }
+    const executable = resolveCodexExecutableForTests("codex");
+    const stableLaunchPath = executable ?? "codex";
+    // Resolve the symlink target ONLY to *detect* a `.js` shim (an npm-style
+    // install whose bin entry points at JS we must run under node). We then
+    // launch via the STABLE path we found on PATH — e.g. the Homebrew symlink
+    // /opt/homebrew/bin/codex — NOT the realpath, for BOTH the binary and the
+    // `.js` case. Following the symlink to a version-stamped path (a Caskroom
+    // …/codex/0.125.0/… binary, or a versioned …/cli.js a global JS manager
+    // rotates) pins a location that an upgrade deletes out from under a
+    // long-running daemon, producing `spawn … ENOENT` on every probe until
+    // restart. The stable path survives upgrades because the package manager
+    // just repoints the symlink; node happily runs the script the symlink
+    // resolves to at spawn time.
+    const realExecutable = executable ? fs.realpathSync(executable) : "codex";
+    codexLaunchSpec = realExecutable.endsWith(".js")
+        ? { command: process.execPath, prefixArgs: [stableLaunchPath] }
+        : { command: stableLaunchPath, prefixArgs: [] };
+    return codexLaunchSpec;
+}
+export function resolveCodexExecutableForTests(name, pathEnv = process.env["PATH"], fallbackDirs = CODEX_EXECUTABLE_FALLBACK_DIRS, keepsCodexHome = wrapperKeepsCodexHome) {
+    const searchDirs = [
+        ...(pathEnv ? pathEnv.split(path.delimiter) : []),
+        ...fallbackDirs,
+    ];
+    const candidates = searchDirs
+        .filter((dir) => dir.length > 0)
+        .map((dir) => path.join(dir, name))
+        .filter((candidate) => fs.existsSync(candidate));
+    const hasRealBinary = candidates.some((candidate) => !isShellScriptWrapper(candidate));
+    for (const candidate of candidates) {
+        // A shell-script wrapper (account routing, proxy settings, a version
+        // manager) is used as before, unless it replaces the CODEX_HOME we set and
+        // a real binary is there to use instead. A wrapper that replaces it makes
+        // triage run with the user's MCP servers and hooks (their noise buried
+        // the real error on 2026-10-14) and saves every triage call in the user's
+        // Codex history, where the next capture picks it up as a conversation.
+        if (!isShellScriptWrapper(candidate) ||
+            !hasRealBinary ||
+            keepsCodexHome(candidate)) {
+            return candidate;
+        }
+    }
+    return candidates[0];
+}
+const wrapperKeepsCodexHomeCache = new Map();
+/**
+ * Does this wrapper leave our CODEX_HOME alone? Run `login status` with an
+ * empty CODEX_HOME: Codex itself, or a wrapper that passes it through, answers
+ * "Not logged in"; a wrapper that swaps in the user's own home answers "Logged
+ * in using …". Reads a file, no network, a few milliseconds. When the answer is
+ * unclear the wrapper is kept, as before this check existed. Cached per path.
+ */
+function wrapperKeepsCodexHome(wrapper) {
+    const cached = wrapperKeepsCodexHomeCache.get(wrapper);
+    if (cached !== undefined)
+        return cached;
+    let keeps = true;
+    let emptyHome;
+    try {
+        emptyHome = fs.mkdtempSync(path.join(ensureRuntimeTempDir(), "codex-home-check-"));
+        const result = spawnSync(wrapper, ["login", "status"], {
+            env: { ...process.env, CODEX_HOME: emptyHome },
+            encoding: "utf-8",
+            timeout: 10_000,
+        });
+        if (!result.error) {
+            keeps = !/logged in using/i.test(`${result.stdout ?? ""}\n${result.stderr ?? ""}`);
+        }
+    }
+    catch {
+        // Keep the wrapper.
+    }
+    finally {
+        if (emptyHome)
+            fs.rmSync(emptyHome, { recursive: true, force: true });
+    }
+    wrapperKeepsCodexHomeCache.set(wrapper, keeps);
+    return keeps;
+}
+/**
+ * A `codex` that is a shell script (`#!/bin/sh`, `#!/usr/bin/env bash`, …) is a
+ * wrapper around Codex, not Codex. A node `.js` entry point is not a shell
+ * script.
+ */
+function isShellScriptWrapper(file) {
+    let fd;
+    try {
+        fd = fs.openSync(file, "r");
+        const head = Buffer.alloc(128);
+        const bytesRead = fs.readSync(fd, head, 0, head.length, 0);
+        const firstLine = head.subarray(0, bytesRead).toString("utf-8").split("\n")[0] ?? "";
+        if (!firstLine.startsWith("#!"))
+            return false;
+        // `#!/bin/sh` → sh; `#!/usr/bin/env -S bash -e` → bash; `#!/usr/bin/env node` → node.
+        const [command = "", ...rest] = firstLine.slice(2).trim().split(/\s+/);
+        const interpreter = path.basename(command) === "env"
+            ? (rest.find((arg) => !arg.startsWith("-")) ?? "")
+            : path.basename(command);
+        return /^(sh|bash|zsh|dash|ksh)$/.test(path.basename(interpreter));
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/**
+ * Path to a private CODEX_HOME holding ONLY a copy of the operator's
+ * `auth.json` — so triage runs with the user's login but none of their
+ * config.toml / MCP / project state.
+ *
+ * The snapshot is REFRESHED when the source `~/.codex/auth.json` changes. The
+ * daemon runs capture in-process for its whole lifetime (a setInterval loop),
+ * so a one-time copy would pin whatever token was current at boot: a later
+ * host-side `codex login` (which rewrites the source with a rotated refresh
+ * token) would never reach the snapshot and every triage would 401 until a
+ * daemon restart. We compare the SOURCE file's mtime — not the temp copy's,
+ * which codex advances in place when it refreshes the access token — so a real
+ * re-login is picked up on the next capture while routine in-temp refreshes are
+ * ignored. The refreshed token is NEVER copied back to `~/.codex`: that would
+ * race a concurrent user `codex login`.
+ */
+function ensureIsolatedCodexHome() {
+    const sourceHome = resolveSourceCodexHome();
+    const authPath = path.join(sourceHome, "auth.json");
+    const sourceMtimeMs = statMtimeMsOrNull(authPath);
+    const existingHome = isolatedCodexHomePath !== null && fs.existsSync(isolatedCodexHomePath)
+        ? isolatedCodexHomePath
+        : null;
+    if (existingHome !== null && sourceMtimeMs === isolatedCodexAuthSourceMtimeMs) {
+        return existingHome;
+    }
+    const isolatedHome = existingHome ??
+        fs.mkdtempSync(path.join(ensureRuntimeTempDir(), "codex-cli-backfill-home-"));
+    if (fs.existsSync(authPath)) {
+        fs.copyFileSync(authPath, path.join(isolatedHome, "auth.json"));
+        isolatedCodexAuthSourceMtimeMs = sourceMtimeMs;
+    }
+    else {
+        // No source auth to copy. We deliberately KEEP any existing snapshot rather
+        // than delete it: a host `codex login` rewrites auth.json via atomic temp +
+        // rename, so a stat that lands mid-rename can momentarily see no file —
+        // deleting on that transient absence would nuke a perfectly good token and
+        // 401 the next run, the exact failure this whole mechanism exists to avoid.
+        // Known, accepted trade-off: a DELIBERATE `codex logout` (a lasting absence,
+        // not a transient one) won't propagate — Onadit keeps using the copied token
+        // until the server rejects it (handled by the auth preflight class) or the
+        // daemon restarts. Record null so a later reappearance re-copies.
+        isolatedCodexAuthSourceMtimeMs = null;
+    }
+    isolatedCodexHomePath = isolatedHome;
+    return isolatedHome;
+}
+function statMtimeMsOrNull(filePath) {
+    try {
+        return fs.statSync(filePath).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveSourceCodexHome() {
+    if (typeof process.env["CODEX_HOME"] === "string") {
+        return process.env["CODEX_HOME"];
+    }
+    return path.join(os.homedir(), ".codex");
+}
+function ensureRuntimeTempDir() {
+    if (runtimeTempDirPath && fs.existsSync(runtimeTempDirPath)) {
+        return runtimeTempDirPath;
+    }
+    const runtimeTempDir = fs.mkdtempSync(path.join(resolveWritableTempRoot(), "codex-cli-runner-"));
+    runtimeTempDirPath = runtimeTempDir;
+    if (!runtimeCleanupRegistered) {
+        runtimeCleanupRegistered = true;
+        process.once("exit", cleanupRuntimeTempArtifacts);
+    }
+    return runtimeTempDir;
+}
+function resolveWritableTempRoot() {
+    for (const candidate of [os.tmpdir(), "/tmp"]) {
+        if (!candidate || !fs.existsSync(candidate)) {
+            continue;
+        }
+        try {
+            fs.accessSync(candidate, fs.constants.R_OK | fs.constants.W_OK);
+            return candidate;
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error(`No writable temp directory available for Codex CLI runtime (TMPDIR=${process.env["TMPDIR"] ?? "<unset>"})`);
+}
+function cleanupRuntimeTempArtifacts() {
+    if (runtimeTempDirPath) {
+        fs.rmSync(runtimeTempDirPath, { recursive: true, force: true });
+        runtimeTempDirPath = null;
+    }
+    isolatedCodexHomePath = null;
+    isolatedCodexAuthSourceMtimeMs = null;
+}
+//# sourceMappingURL=codex-cli-runner.js.map