sneakoscope 6.1.0 → 6.2.0

package/dist/core/codex/codex-config-guard.js

@@ -1,4 +1,6 @@
 import path from 'node:path';
+import fsp from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
 import { appendJsonl, ensureDir, nowIso, readText, sha256, writeTextAtomic } from '../fsx.js';
 import { diffCodexAppUiSnapshots, snapshotCodexAppUiState } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from './codex-config-toml.js';
@@ -9,7 +11,7 @@ export async function writeCodexConfigGuarded(input) {
     const root = path.resolve(input.root || process.cwd());
     const cause = input.cause || 'codex-config';
     const before = input.before === undefined ? String(await readText(configPath, '')) : String(input.before || '');
-    if (isUnmanagedProjectCodexConfig(root, configPath, before)) {
+    if (isUnmanagedProjectCodexConfig(root, configPath, before) && input.ownershipVerified !== true) {
         const result = { ok: false, status: 'blocked_unmanaged_project_config', config_path: configPath, backup_path: null, changed: false };
         await recordCodexConfigGuard(root, input.reportPath, {
             cause,
@@ -38,10 +40,13 @@ export async function writeCodexConfigGuarded(input) {
         return result;
     }
     const beforeSnapshot = await snapshotForConfig(root, configPath).catch(() => null);
-    let next = ensureTrailingNewline(await input.mutate(before));
+    const normalizeText = input.preserveTextFormatting === true
+        ? (value) => String(value || '')
+        : ensureTrailingNewline;
+    let next = normalizeText(await input.mutate(before));
     if (input.removeTopLevelModeLocks === true)
         next = removeLegacyTopLevelCodexModeLocks(next);
-    const preserved = input.preserveFastUiKeys === false ? { text: ensureTrailingNewline(next), keys: [] } : mergeLostFastUiKeys(before, next);
+    const preserved = input.preserveFastUiKeys === false ? { text: normalizeText(next), keys: [] } : mergeLostFastUiKeys(before, next);
     next = preserved.text;
     if (input.removeTopLevelModeLocks === true)
         next = removeLegacyTopLevelCodexModeLocks(next);
@@ -63,8 +68,29 @@ export async function writeCodexConfigGuarded(input) {
         });
         return result;
     }
-    if (next === ensureTrailingNewline(before)) {
-        await writeTextAtomic(configPath, next, { mode: 0o600 });
+    const expectedBefore = normalizeText(before);
+    if (next === expectedBefore) {
+        if (input.verifyUnchangedBeforeWrite === true) {
+            const observed = await readConfigCommitSnapshot(configPath);
+            const expectedExists = input.expectedBeforeExists ?? true;
+            if (!configCommitSnapshotMatches(observed, expectedExists, before)) {
+                return recordConcurrentConfigChange({
+                    root,
+                    reportPath: input.reportPath,
+                    cause,
+                    configPath,
+                    before,
+                    expectedExists,
+                    observed,
+                    backupPath: null,
+                    repairedKeys: preserved.keys,
+                    forbiddenTopLevel
+                });
+            }
+        }
+        else {
+            await writeTextAtomic(configPath, next, { mode: 0o600 });
+        }
         const result = { ok: true, status: 'present', config_path: configPath, backup_path: null, changed: false, repaired_keys: preserved.keys, forbidden_top_level: forbiddenTopLevel };
         if (preserved.keys.length || forbiddenTopLevel.length) {
             await recordCodexConfigGuard(root, input.reportPath, {
@@ -79,9 +105,37 @@ export async function writeCodexConfigGuarded(input) {
         }
         return result;
     }
-    const backupPath = before.trim() ? await backupCodexConfig(configPath, before, input.backupTag || cause) : null;
-    await ensureDir(path.dirname(configPath));
-    await writeTextAtomic(configPath, next, { mode: 0o600 });
+    let backupPath = null;
+    if (input.verifyUnchangedBeforeWrite === true) {
+        const expectedExists = input.expectedBeforeExists ?? true;
+        const commit = await commitCodexConfigIfUnchanged({
+            configPath,
+            before,
+            next,
+            expectedExists,
+            backupTag: input.backupTag || cause
+        });
+        if (!commit.ok) {
+            return recordConcurrentConfigChange({
+                root,
+                reportPath: input.reportPath,
+                cause,
+                configPath,
+                before,
+                expectedExists,
+                observed: commit.observed,
+                backupPath: commit.backupPath,
+                repairedKeys: preserved.keys,
+                forbiddenTopLevel
+            });
+        }
+        backupPath = commit.backupPath;
+    }
+    else {
+        backupPath = before.trim() ? await backupCodexConfig(configPath, before, input.backupTag || cause) : null;
+        await ensureDir(path.dirname(configPath));
+        await writeTextAtomic(configPath, next, { mode: 0o600 });
+    }
     const afterSnapshot = await snapshotForConfig(root, configPath).catch(() => null);
     const diff = beforeSnapshot && afterSnapshot ? diffCodexAppUiSnapshots(beforeSnapshot, afterSnapshot) : null;
     const result = {
@@ -115,6 +169,123 @@ export async function writeCodexConfigGuarded(input) {
     });
     return { ...result, report_path: reportPath };
 }
+function configCommitSnapshotMatches(observed, expectedExists, expectedText) {
+    return observed.ok
+        && observed.exists === expectedExists
+        && sha256(observed.text) === sha256(expectedText);
+}
+async function recordConcurrentConfigChange(input) {
+    const result = {
+        ok: false,
+        status: 'concurrent_change_detected',
+        config_path: input.configPath,
+        backup_path: input.backupPath,
+        changed: false,
+        repaired_keys: input.repairedKeys,
+        forbidden_top_level: input.forbiddenTopLevel
+    };
+    await recordCodexConfigGuard(input.root, input.reportPath, {
+        cause: input.cause,
+        config_path: input.configPath,
+        ok: false,
+        status: result.status,
+        expected_exists: input.expectedExists,
+        observed_exists: input.observed.exists,
+        expected_sha256: sha256(input.before),
+        observed_sha256: input.observed.ok ? sha256(input.observed.text) : null,
+        observed_status: input.observed.status,
+        backup_path: input.backupPath,
+        changed: false
+    });
+    return result;
+}
+async function commitCodexConfigIfUnchanged(input) {
+    await ensureDir(path.dirname(input.configPath));
+    const token = `${Date.now().toString(36)}-${process.pid}-${randomBytes(6).toString('hex')}`;
+    const candidatePath = `${input.configPath}.sks-commit-${token}.tmp`;
+    let backupPath = null;
+    try {
+        await writeTextAtomic(candidatePath, input.next, { mode: 0o600 });
+        const observed = await readConfigCommitSnapshot(input.configPath);
+        if (!configCommitSnapshotMatches(observed, input.expectedExists, input.before)) {
+            return { ok: false, backupPath, observed };
+        }
+        if (input.expectedExists) {
+            backupPath = `${input.configPath}.sks-${safeBackupTag(input.backupTag)}-${token}.bak`;
+            try {
+                await fsp.rename(input.configPath, backupPath);
+            }
+            catch {
+                return { ok: false, backupPath: null, observed: await readConfigCommitSnapshot(input.configPath) };
+            }
+            const claimed = await readConfigCommitSnapshot(backupPath);
+            if (!configCommitSnapshotMatches(claimed, true, input.before)) {
+                await restoreClaimedConfigIfAbsent(backupPath, input.configPath, claimed);
+                return { ok: false, backupPath, observed: claimed };
+            }
+            try {
+                await fsp.chmod(backupPath, 0o600);
+                const now = new Date();
+                await fsp.utimes(backupPath, now, now);
+            }
+            catch {
+                await restoreClaimedConfigIfAbsent(backupPath, input.configPath, claimed);
+                return { ok: false, backupPath, observed: await readConfigCommitSnapshot(input.configPath) };
+            }
+            const afterClaim = await readConfigCommitSnapshot(input.configPath);
+            if (!afterClaim.ok || afterClaim.exists) {
+                if (!afterClaim.exists)
+                    await restoreClaimedConfigIfAbsent(backupPath, input.configPath, claimed);
+                return { ok: false, backupPath, observed: await readConfigCommitSnapshot(input.configPath) };
+            }
+        }
+        try {
+            await fsp.link(candidatePath, input.configPath);
+        }
+        catch {
+            if (backupPath) {
+                const claimed = await readConfigCommitSnapshot(backupPath);
+                await restoreClaimedConfigIfAbsent(backupPath, input.configPath, claimed);
+            }
+            return { ok: false, backupPath, observed: await readConfigCommitSnapshot(input.configPath) };
+        }
+        await fsp.chmod(input.configPath, 0o600).catch(() => undefined);
+        await cleanupCodexConfigBackups(input.configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
+        return { ok: true, backupPath };
+    }
+    finally {
+        await fsp.rm(candidatePath, { force: true }).catch(() => undefined);
+    }
+}
+async function restoreClaimedConfigIfAbsent(backupPath, configPath, claimed) {
+    if (!claimed.ok || !claimed.exists || claimed.status !== 'regular')
+        return;
+    await fsp.link(backupPath, configPath).catch(() => undefined);
+}
+function safeBackupTag(value) {
+    return String(value || 'codex-config').replace(/[^A-Za-z0-9_.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 96) || 'codex-config';
+}
+async function readConfigCommitSnapshot(configPath) {
+    let stat;
+    try {
+        stat = await fsp.lstat(configPath);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return { ok: true, exists: false, text: '', status: 'missing' };
+        return { ok: false, exists: false, text: '', status: 'read_failed' };
+    }
+    if (stat.isSymbolicLink())
+        return { ok: false, exists: true, text: '', status: 'symlink' };
+    if (!stat.isFile())
+        return { ok: false, exists: true, text: '', status: 'non_regular' };
+    try {
+        return { ok: true, exists: true, text: await fsp.readFile(configPath, 'utf8'), status: 'regular' };
+    }
+    catch {
+        return { ok: false, exists: true, text: '', status: 'read_failed' };
+    }
+}
 export function extractTomlTable(text, tableName) {
     const source = String(text || '');
     const header = `[${tableName}]`;
@@ -146,7 +317,12 @@ export function isProjectCodexConfig(root, configPath) {
     return path.resolve(configPath) === path.resolve(root, '.codex', 'config.toml');
 }
 export function hasSksManagedCodexConfigMarker(text) {
-    return /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker|multi_agent)/i.test(String(text || ''));
+    const source = String(text || '');
+    return /^\s*#\s*SKS-MANAGED-CODEX-CONFIG\b/im.test(source)
+        || /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker|multi_agent)/i.test(source)
+        || /^\s*model_provider\s*=\s*["']codex-lb["']\s*(?:#.*)?$/mi.test(source)
+        || /^\s*default_profile\s*=\s*["']sks-fast-high["']\s*(?:#.*)?$/mi.test(source)
+        || /^\s*\[(?:user\.fast_mode|model_providers\.(?:"codex-lb"|codex-lb)|profiles\.(?:"sks-fast-high"|sks-fast-high))\]\s*(?:#.*)?$/mi.test(source);
 }
 export function isUnmanagedProjectCodexConfig(root, configPath, text) {
     return isProjectCodexConfig(root, configPath)

package/dist/core/codex/codex-config-readability.js

@@ -50,16 +50,29 @@ export async function inspectCodexConfigReadability(rootInput = process.cwd(), o
             }
             add({ name: 'config_symlink', ok: !isSymlink || symlinkDetail.allowed === true, detail: symlinkDetail });
         }
-        if (process.platform === 'darwin') {
-            add(await commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root));
-            const acl = checks.find((check) => check.name === 'macos_acl_ls_le');
+        const readChecksPromise = Promise.all([
+            nodeReadCheck(configPath),
+            childReadCheck(configPath, root),
+            codexCliConfigLoadCheck(root, configPath, opts)
+        ]);
+        // These are independent read-only metadata probes. Running them serially
+        // multiplied a single TCC/ACL timeout by three on the MAD launch path.
+        const macChecksPromise = process.platform === 'darwin'
+            ? Promise.all([
+                commandCheck('macos_acl_ls_le', 'ls', ['-le', configPath], root),
+                commandCheck('macos_flags_ls_lO', 'ls', ['-lO', configPath], root),
+                commandCheck('macos_xattr', 'xattr', ['-l', configPath], root, { allowExitCodes: [0, 1] })
+            ])
+            : Promise.resolve(null);
+        const [[nodeRead, childRead, codexLoad], macChecks] = await Promise.all([readChecksPromise, macChecksPromise]);
+        if (macChecks) {
+            const [acl, flags, xattrs] = macChecks;
+            add(acl);
             if (/\bdeny\b.*\b(read|readattr|readextattr|readsecurity|search)\b/i.test(String(acl?.detail?.stdout || '')))
                 blockers.add('acl_denied');
-            const flags = await commandCheck('macos_flags_ls_lO', 'ls', ['-lO', configPath], root);
             add(flags);
             if (/\b(uchg|schg|restricted)\b/.test(String(flags.detail?.stdout || '')))
                 blockers.add('flags_locked');
-            const xattrs = await commandCheck('macos_xattr', 'xattr', ['-l', configPath], root, { allowExitCodes: [0, 1] });
             add(xattrs);
             add({ name: 'macos_quarantine_xattr', ok: !/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')), detail: { present: /com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')) } });
             if (/com\.apple\.quarantine/.test(String(xattrs.detail?.stdout || '')))
@@ -68,9 +81,9 @@ export async function inspectCodexConfigReadability(rootInput = process.cwd(), o
         else {
             add({ name: 'macos_metadata', ok: true, status: 'skipped_non_macos' });
         }
-        add(await nodeReadCheck(configPath));
-        add(await childReadCheck(configPath, root));
-        add(await codexCliConfigLoadCheck(root, configPath, opts));
+        add(nodeRead);
+        add(childRead);
+        add(codexLoad);
     }
     else {
         add({ name: 'config_file_checks', ok: true, status: 'skipped_config_missing', detail: { config_path: configPath } });

package/dist/core/codex/codex-config-toml.js

@@ -52,9 +52,8 @@ export async function cleanupCodexConfigBackups(configPath, opts = {}) {
     const now = Date.now();
     const groups = new Map();
     for (const file of entries) {
-        if (!file.startsWith(`${base}.`))
-            continue;
-        if (!/(?:^|[.-])(?:sks-|bak-|struct-bak-)|\.bak$/.test(file))
+        const tag = ownedBackupTag(base, file);
+        if (!tag)
             continue;
         const abs = path.join(dir, file);
         let stat;
@@ -66,7 +65,6 @@ export async function cleanupCodexConfigBackups(configPath, opts = {}) {
         }
         if (!stat.isFile())
             continue;
-        const tag = backupTag(base, file);
         const group = groups.get(tag) || [];
         group.push({ file, abs, mtimeMs: stat.mtimeMs });
         groups.set(tag, group);
@@ -87,16 +85,21 @@ export async function cleanupCodexConfigBackups(configPath, opts = {}) {
     }
     return { cleaned: removed.length, files: removed };
 }
-function backupTag(base, file) {
+function ownedBackupTag(base, file) {
+    if (!file.startsWith(`${base}.`))
+        return null;
     const suffix = file.slice(`${base}.`.length);
-    const sks = suffix.match(/^sks-([^-]+)-/);
-    if (sks?.[1])
-        return `sks-${sks[1]}`;
-    if (suffix.startsWith('struct-bak-'))
+    if (/^sks-[A-Za-z0-9_.-]+\.bak$/.test(suffix)) {
+        const group = suffix.match(/^sks-([^-]+)-/)?.[1] || suffix.slice('sks-'.length, -'.bak'.length);
+        return `sks-${group}`;
+    }
+    if (/^struct-bak-[A-Za-z0-9_.-]+$/.test(suffix))
         return 'struct-bak';
-    if (suffix.startsWith('bak-'))
+    if (/^bak-[A-Za-z0-9_.-]+$/.test(suffix))
         return 'bak';
-    return 'misc';
+    if (/^codex-app-ui-repair-[A-Za-z0-9_.-]+\.bak$/.test(suffix))
+        return 'codex-app-ui-repair';
+    return null;
 }
 function messageOf(err) {
     return err instanceof Error ? err.message : String(err);

package/dist/core/codex/codex-project-config-policy.js

@@ -2,7 +2,7 @@ import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { ensureDir, nowIso, readText, writeJsonAtomic } from '../fsx.js';
-import { writeCodexConfigGuarded } from './codex-config-guard.js';
+import { hasSksManagedCodexConfigMarker, writeCodexConfigGuarded } from './codex-config-guard.js';
 import { cleanupCodexConfigBackups } from './codex-config-toml.js';
 export const CODEX_PROJECT_CONFIG_POLICY_SCHEMA = 'sks.codex-project-config-policy.v1';
 const MACHINE_LOCAL_TOP_LEVEL_KEYS = new Set([
@@ -95,7 +95,7 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
             await writeJsonAtomic(reportPath, { ...report, report_path: reportPath });
         return report;
     }
-    if (opts.apply && isCodexConfigToml(configPath) && !hasSksManagedCodexMarker(String(original))) {
+    if (opts.apply && isCodexConfigToml(configPath) && !hasSksManagedCodexConfigMarker(String(original))) {
         const report = {
             schema: CODEX_PROJECT_CONFIG_POLICY_SCHEMA,
             generated_at: nowIso(),
@@ -208,7 +208,7 @@ export async function repairCodexConfigStructure(configPathInput, opts = {}) {
     if (original === null) {
         return { config_path: configPath, ok: true, status: 'config_missing', changed: false, applied: false, hoisted_keys: [], backup_path: null };
     }
-    if (opts.apply && isCodexConfigToml(configPath) && !hasSksManagedCodexMarker(String(original))) {
+    if (opts.apply && isCodexConfigToml(configPath) && !hasSksManagedCodexConfigMarker(String(original))) {
         return {
             config_path: configPath,
             ok: false,
@@ -249,9 +249,6 @@ export async function repairCodexConfigStructure(configPathInput, opts = {}) {
 function isCodexConfigToml(file) {
     return path.basename(file) === 'config.toml' && path.basename(path.dirname(file)) === '.codex';
 }
-function hasSksManagedCodexMarker(text) {
-    return /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker|multi_agent)/i.test(text);
-}
 function hoistMisplacedMachineLocalKeys(text) {
     const blocks = tomlBlocks(text);
     const preamble = [];

package/dist/core/codex/codex-startup-config-postcheck.js

@@ -1,64 +1,64 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
-import { missingAgentConfigFiles } from './agent-config-file-repair.js';
-import { managedAgentRoleConfigForFile, managedAgentRoleConfigForRole } from '../agents/agent-role-config.js';
+import { inspectOfficialSubagentToml, installOfficialSubagentAgentConfigs, readOfficialSubagentConfig } from '../subagents/official-subagent-config.js';
 export async function postcheckCodexStartupConfig(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
     const text = await fs.readFile(configPath, 'utf8').catch(() => '');
-    const missing = await missingAgentConfigFiles(text);
-    const managedBlocks = managedAgentBlocks(text);
-    const unsupportedRoleFields = managedBlocks.some((block) => /^\s*message_role_prefix\s*=/m.test(block.text));
-    const relativePaths = managedBlocks
-        .map((block) => block.text.match(/^\s*config_file\s*=\s*"([^"]+)"/m)?.[1])
-        .filter((file) => Boolean(file && !path.isAbsolute(file)));
+    const configPresent = Boolean(text.trim());
+    const tomlValidation = inspectOfficialSubagentToml(text);
+    const officialConfig = await readOfficialSubagentConfig(root, {
+        ...(input.home ? { home: input.home } : {}),
+        ...(input.codexHome ? { codexHome: input.codexHome } : {}),
+        projectConfigPath: configPath
+    });
+    const rolePlan = await installOfficialSubagentAgentConfigs(root, { apply: false });
     const tomlSmoke = tomlSyntaxSmoke(text);
     const orphanChildTables = orphanMcpChildTables(text);
+    const blockers = [
+        ...(!configPresent ? ['project_official_subagent_config_missing'] : []),
+        ...(!tomlValidation.ok ? ['project_official_subagent_config_toml_parse_failed'] : []),
+        ...officialConfig.blockers.map((item) => `official_subagent_config:${item}`),
+        ...rolePlan.missing.map((file) => `missing_official_subagent_agent:${file}`),
+        ...rolePlan.stale.map((file) => `stale_official_subagent_agent:${file}`),
+        ...rolePlan.manual_blockers,
+        ...tomlSmoke.blockers,
+        ...orphanChildTables.map((table) => `orphan_mcp_child_table:${table}`)
+    ];
     const report = {
         schema: 'sks.codex-startup-config-postcheck.v1',
         generated_at: nowIso(),
-        ok: missing.length === 0 && relativePaths.length === 0 && !unsupportedRoleFields && tomlSmoke.ok && orphanChildTables.length === 0,
+        ok: blockers.length === 0,
         config_path: configPath,
-        missing_config_files: missing,
-        relative_config_files: relativePaths,
-        unsupported_managed_role_fields: unsupportedRoleFields,
+        missing_config_files: [],
+        relative_config_files: [],
+        unsupported_managed_role_fields: false,
+        official_subagent_config: {
+            max_threads: officialConfig.maxThreads,
+            max_depth: officialConfig.maxDepth,
+            job_max_runtime_seconds: officialConfig.jobMaxRuntimeSeconds,
+            interrupt_message: officialConfig.interruptMessage,
+            sources: officialConfig.sources,
+            warnings: officialConfig.warnings
+        },
+        official_subagent_agents: {
+            missing: rolePlan.missing,
+            stale: rolePlan.stale,
+            existing: rolePlan.existing,
+            preserved: rolePlan.preserved,
+            manual_blockers: rolePlan.manual_blockers
+        },
+        legacy_agent_tables_preserved: true,
         toml_syntax_smoke_ok: tomlSmoke.ok,
         orphan_mcp_child_tables: orphanChildTables,
-        blockers: [
-            ...missing.map((file) => `missing_agent_config_file:${file}`),
-            ...relativePaths.map((file) => `relative_agent_config_file:${file}`),
-            ...(unsupportedRoleFields ? ['unsupported_message_role_prefix_field'] : []),
-            ...tomlSmoke.blockers,
-            ...orphanChildTables.map((table) => `orphan_mcp_child_table:${table}`)
-        ]
+        blockers
     };
-    if (input.reportPath !== null)
+    if (input.reportPath !== null) {
         await writeJsonAtomic(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'codex-startup-config-postcheck.json'), report).catch(() => undefined);
+    }
     return report;
 }
-function managedAgentBlocks(text) {
-    const blocks = tomlBlocks(text);
-    return blocks.filter((block) => {
-        if (!block.header.startsWith('agents.'))
-            return false;
-        const role = block.header.slice('agents.'.length);
-        if (managedAgentRoleConfigForRole(role))
-            return true;
-        const configFile = block.text.match(/^\s*config_file\s*=\s*"([^"]+)"/m)?.[1] || '';
-        return Boolean(configFile && managedAgentRoleConfigForFile(configFile));
-    });
-}
-function tomlBlocks(text) {
-    const source = String(text || '');
-    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
-    return matches.map((match, index) => {
-        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
-        const next = matches[index + 1];
-        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
-        return { header: String(match[2] || '').trim(), text: source.slice(start, end) };
-    });
-}
 function tomlSyntaxSmoke(text) {
     const blockers = [];
     for (const [index, line] of String(text || '').split(/\r?\n/).entries()) {
@@ -80,4 +80,14 @@ function orphanMcpChildTables(text) {
         return Boolean(match && !headers.has(`mcp_servers.${match[1]}`));
     });
 }
+function tomlBlocks(text) {
+    const source = String(text || '');
+    const matches = [...source.matchAll(/(^|\n)\s*\[([^\]]+)\]\s*(?:#.*)?(?:\n|$)/g)];
+    return matches.map((match, index) => {
+        const start = Number(match.index || 0) + (match[1] ? 1 : 0);
+        const next = matches[index + 1];
+        const end = next ? Number(next.index || 0) + (next[1] ? 1 : 0) : source.length;
+        return { header: String(match[2] || '').trim(), text: source.slice(start, end) };
+    });
+}
 //# sourceMappingURL=codex-startup-config-postcheck.js.map

package/dist/core/codex-adapter.js

@@ -3,6 +3,7 @@ import { runProcess } from './fsx.js';
 import { preserveCodexModelArgs } from './codex-model-guard.js';
 import { managedProxyEnvForChild } from './codex/managed-proxy-env.js';
 import { resolveCodexRuntime } from './codex-runtime/resolve-codex-runtime.js';
+import { codexLbRecoveryBlockedProcessResult, withCodexLbCliLaunchRecovery } from './codex-control/codex-lb-launch-recovery.js';
 export async function findCodexBinary() {
     const resolved = await resolveCodexRuntime({
         explicitPath: process.env.DCODEX_CODEX_BIN || null,
@@ -39,30 +40,42 @@ export function buildCodexExecArgs({ root, prompt, outputFile, json = true, prof
     args.push(prompt);
     return args;
 }
-export async function runCodexExec({ root, prompt, outputFile, json = true, profile = null, extraArgs = [], onStdout, onStderr, logDir = null, stdoutFile = null, stderrFile = null, maxBufferBytes = 256 * 1024, timeoutMs = null }) {
-    const bin = await findCodexBinary();
-    if (!bin) {
-        return {
-            code: 127,
-            stdout: '',
-            stderr: 'Codex CLI not found. Install @openai/codex or set SKS_CODEX_BIN.',
-            stdoutBytes: 0,
-            stderrBytes: 0,
-            truncated: false,
-            timedOut: false
-        };
-    }
+export async function runCodexExec({ root, recoveryRoot = root, prompt, outputFile, json = true, profile = null, extraArgs = [], onStdout, onStderr, logDir = null, stdoutFile = null, stderrFile = null, maxBufferBytes = 256 * 1024, timeoutMs = null, env = process.env, codexBin = null, findCodexBinaryImpl = findCodexBinary, runProcessImpl = runProcess, recoveryFetch = undefined, recoveryTimeoutMs = undefined }) {
     const args = buildCodexExecArgs({ root, prompt, outputFile, json, profile, extraArgs });
     const effectiveTimeoutMs = Number(timeoutMs || process.env.SKS_CODEX_TIMEOUT_MS || process.env.DCODEX_CODEX_TIMEOUT_MS || 30 * 60 * 1000);
-    return runProcess(bin, args, {
-        cwd: root,
-        env: managedProxyEnvForChild(process.env),
-        onStdout,
-        onStderr,
-        timeoutMs: effectiveTimeoutMs,
-        maxOutputBytes: maxBufferBytes,
-        stdoutFile: stdoutFile || (logDir ? path.join(logDir, 'codex.stdout.log') : undefined),
-        stderrFile: stderrFile || (logDir ? path.join(logDir, 'codex.stderr.log') : undefined)
+    const recoveryArgs = args.slice(1, -1);
+    const guarded = await withCodexLbCliLaunchRecovery({
+        root: recoveryRoot,
+        env,
+        cliArgs: recoveryArgs,
+        ...(typeof recoveryFetch === 'function' ? { fetchImpl: recoveryFetch } : {}),
+        ...(recoveryTimeoutMs === undefined ? {} : { timeoutMs: recoveryTimeoutMs })
+    }, async () => {
+        const bin = codexBin || await findCodexBinaryImpl();
+        if (!bin) {
+            return {
+                code: 127,
+                stdout: '',
+                stderr: 'Codex CLI not found. Install @openai/codex or set SKS_CODEX_BIN.',
+                stdoutBytes: 0,
+                stderrBytes: 0,
+                truncated: false,
+                timedOut: false
+            };
+        }
+        return runProcessImpl(bin, args, {
+            cwd: root,
+            env: { ...env, ...managedProxyEnvForChild(env) },
+            onStdout,
+            onStderr,
+            timeoutMs: effectiveTimeoutMs,
+            maxOutputBytes: maxBufferBytes,
+            stdoutFile: stdoutFile || (logDir ? path.join(logDir, 'codex.stdout.log') : undefined),
+            stderrFile: stderrFile || (logDir ? path.join(logDir, 'codex.stderr.log') : undefined)
+        });
     });
+    return guarded.launched
+        ? guarded.value
+        : codexLbRecoveryBlockedProcessResult(guarded.toolOutputRecovery);
 }
 //# sourceMappingURL=codex-adapter.js.map