sneakoscope 7.1.0 → 7.3.0

package/dist/core/remote/session-binding.js

@@ -0,0 +1,153 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { withFileLock } from '../locks/file-lock.js';
+import { REMOTE_CODEX_SESSION_BINDINGS_SCHEMA } from './types.js';
+const IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
+const THREAD_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
+export function remoteCodexSessionBindingsPath(projectRoot) {
+    return path.join(path.resolve(projectRoot), '.sneakoscope', 'remote', 'codex-session-bindings.json');
+}
+export class RemoteCodexSessionBindingStore {
+    file;
+    lockPath;
+    constructor(file) {
+        this.file = path.resolve(file);
+        this.lockPath = `${this.file}.lock`;
+    }
+    async list() {
+        const value = await readJson(this.file, {
+            schema: REMOTE_CODEX_SESSION_BINDINGS_SCHEMA,
+            bindings: []
+        });
+        if (value.schema !== REMOTE_CODEX_SESSION_BINDINGS_SCHEMA || !Array.isArray(value.bindings)) {
+            throw new Error('remote_codex_session_bindings_invalid');
+        }
+        return value.bindings.map(validateBinding);
+    }
+    async find(sessionId) {
+        return (await this.list()).find((binding) => binding.session_id === sessionId) ?? null;
+    }
+    async upsert(input) {
+        return withFileLock({ lockPath: this.lockPath, timeoutMs: 5_000, staleMs: 30_000 }, async () => {
+            const bindings = await this.list();
+            const index = bindings.findIndex((binding) => binding.session_id === input.session_id);
+            const current = index >= 0 ? bindings[index] : null;
+            const at = nowIso();
+            const next = validateBinding({
+                ...input,
+                created_at: input.created_at ?? current?.created_at ?? at,
+                updated_at: at
+            });
+            if (current && (current.machine_id !== next.machine_id
+                || current.project_id !== next.project_id
+                || path.resolve(current.project_root) !== path.resolve(next.project_root))) {
+                throw new Error('remote_codex_session_binding_scope_conflict');
+            }
+            if (index >= 0)
+                bindings[index] = next;
+            else
+                bindings.push(next);
+            await writeJsonAtomic(this.file, {
+                schema: REMOTE_CODEX_SESSION_BINDINGS_SCHEMA,
+                bindings
+            });
+            await fsp.chmod(this.file, 0o600).catch(() => undefined);
+            return next;
+        });
+    }
+    async updateTurn(sessionId, turnId, status) {
+        const current = await this.find(sessionId);
+        if (!current)
+            throw new Error(`remote_codex_session_binding_unknown:${sessionId}`);
+        if (!current.codex_thread_id)
+            throw new Error(`remote_codex_session_binding_thread_pending:${sessionId}`);
+        return this.recordTurn(sessionId, current.codex_thread_id, turnId, status);
+    }
+    async recordTurn(sessionId, codexThreadId, turnId, status) {
+        const current = await this.find(sessionId);
+        if (!current)
+            throw new Error(`remote_codex_session_binding_unknown:${sessionId}`);
+        return this.upsert({
+            ...current,
+            codex_thread_id: codexThreadId,
+            last_turn_id: turnId,
+            last_turn_status: status
+        });
+    }
+}
+export function remoteCodexBindingSessionRow(binding) {
+    const threadReady = Boolean(binding.codex_thread_id);
+    return {
+        session_id: binding.session_id,
+        mission_id: null,
+        route: 'telegram-codex',
+        phase: binding.last_turn_status === 'failed' ? 'BLOCKED' : 'READY',
+        generation: 1,
+        updated_at: binding.updated_at,
+        session_state: threadReady ? 'idle' : 'pending_first_turn',
+        codex_thread_id: binding.codex_thread_id,
+        codex_thread_state: threadReady ? 'ready' : 'pending_first_turn',
+        dedicated_telegram_thread: true
+    };
+}
+export async function readRemoteCodexBindingSnapshot(binding) {
+    const threadReady = Boolean(binding.codex_thread_id);
+    const branch = await import('../fsx.js').then(({ runProcess }) => runProcess('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: binding.project_root, timeoutMs: 5_000, maxOutputBytes: 8 * 1024 })).catch(() => null);
+    return {
+        schema: 'sks.remote-session-snapshot.v1',
+        machine_id: binding.machine_id,
+        project_id: binding.project_id,
+        session_id: binding.session_id,
+        mission_id: null,
+        route: 'telegram-codex',
+        phase: binding.last_turn_status === 'failed' ? 'BLOCKED' : 'READY',
+        generation: 1,
+        updated_at: binding.updated_at,
+        project: {
+            name: path.basename(binding.project_root),
+            branch: branch?.code === 0 ? String(branch.stdout || '').trim() || null : null
+        },
+        session_state: threadReady ? 'idle' : 'pending_first_turn',
+        execution_terminal: false,
+        completion_proof_status: 'not_applicable',
+        machine_gates_status: 'not_applicable',
+        machine_gates_pass: false,
+        trust_status: 'not_applicable',
+        completion_verified: false,
+        proof_paths: null,
+        codex_thread_id: binding.codex_thread_id,
+        codex_thread_state: threadReady ? 'ready' : 'pending_first_turn',
+        last_turn_id: binding.last_turn_id ?? null,
+        last_turn_status: binding.last_turn_status ?? null,
+        dedicated_telegram_thread: true
+    };
+}
+function validateBinding(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('remote_codex_session_binding_object_required');
+    if (!IDENTIFIER_RE.test(String(value.session_id || '')))
+        throw new Error('remote_codex_session_binding_session_id_invalid');
+    if (!IDENTIFIER_RE.test(String(value.machine_id || '')))
+        throw new Error('remote_codex_session_binding_machine_id_invalid');
+    if (!IDENTIFIER_RE.test(String(value.project_id || '')))
+        throw new Error('remote_codex_session_binding_project_id_invalid');
+    if (!path.isAbsolute(String(value.project_root || '')))
+        throw new Error('remote_codex_session_binding_project_root_invalid');
+    if (value.codex_thread_id !== null && !THREAD_ID_RE.test(String(value.codex_thread_id || ''))) {
+        throw new Error('remote_codex_session_binding_thread_id_invalid');
+    }
+    if (!Number.isFinite(Date.parse(String(value.created_at || ''))))
+        throw new Error('remote_codex_session_binding_created_at_invalid');
+    if (!Number.isFinite(Date.parse(String(value.updated_at || ''))))
+        throw new Error('remote_codex_session_binding_updated_at_invalid');
+    if (value.last_turn_id && !THREAD_ID_RE.test(value.last_turn_id))
+        throw new Error('remote_codex_session_binding_last_turn_id_invalid');
+    if (value.last_turn_status && !['completed', 'failed', 'interrupted'].includes(value.last_turn_status)) {
+        throw new Error('remote_codex_session_binding_last_turn_status_invalid');
+    }
+    return {
+        ...value,
+        project_root: path.resolve(value.project_root)
+    };
+}

package/dist/core/remote/session-index.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { readJson } from '../fsx.js';
 import { findRemoteMachine, isLexicallyWithinAllowedRoot } from './machine-registry.js';
 import { REMOTE_SESSION_INDEX_SCHEMA } from './types.js';
+import { asRecordOrNull as asRecord } from '../json/records.js';
 const IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
 export function remoteSessionIndexPath(projectRoot) {
     return path.join(path.resolve(projectRoot), '.sneakoscope', 'remote', 'session-index.json');
@@ -68,9 +69,6 @@ export function findRemoteSessionTarget(index, machineId, projectId) {
         throw new Error(`remote_session_target_unknown:${machineId}:${projectId}`);
     return target;
 }
-function asRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
-}
 function stringValue(value) {
     return typeof value === 'string' ? value.trim() : '';
 }

package/dist/core/remote/types.js

@@ -8,3 +8,4 @@ export const REMOTE_OWNER_PROOF_SCHEMA = 'sks.remote-owner-proof.v1';
 export const REMOTE_R2_APPROVAL_SCHEMA = 'sks.remote-r2-approval.v1';
 export const REMOTE_EVENT_SCHEMA = 'sks.remote-event.v1';
 export const REMOTE_SESSION_INDEX_SCHEMA = 'sks.remote-session-index.v1';
+export const REMOTE_CODEX_SESSION_BINDINGS_SCHEMA = 'sks.remote-codex-session-bindings.v1';

package/dist/core/remote/worker.js

@@ -1,16 +1,19 @@
+import crypto from 'node:crypto';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { createCodexAppServerV2Client } from '../codex-control/codex-app-server-v2-client.js';
 import { RemoteAuditLog, RemoteCommandLedger, RemoteEventJournal, remoteRuntimePaths } from './audit-idempotency.js';
 import { cancelOwnedSession, parseRemoteCancelPayload, RemoteOwnerProofError, RemoteOwnerProofStore } from './owner-proof.js';
 import { RemoteProtocolError, workerErrorResponse, workerSuccessResponse } from './protocol.js';
+import { RemoteCodexSessionBindingStore, readRemoteCodexBindingSnapshot, remoteCodexBindingSessionRow, remoteCodexSessionBindingsPath } from './session-binding.js';
 import { listRemoteSessionRows, readRemoteSessionView, readRemoteSessionSnapshot, remoteSessionGeneration, remoteSessionRecord } from './session-snapshot.js';
 import { REMOTE_COMMAND_RECEIPT_SCHEMA } from './types.js';
+import { asRecordOrNull as asRecord } from '../json/records.js';
 export class RemoteWorkerExecutionError extends Error {
     code;
     delivery;
     retryable;
-    constructor(code, delivery = 'acknowledged', retryable = false) {
+    constructor(code, delivery = 'not_dispatched', retryable = false) {
         super(code);
         this.code = code;
         this.delivery = delivery;
@@ -26,6 +29,7 @@ export class RemoteWorker {
     audit;
     events;
     owners;
+    bindings;
     codexClientFactory;
     inspectProcess;
     killProcess;
@@ -39,6 +43,7 @@ export class RemoteWorker {
         this.audit = options.audit ?? new RemoteAuditLog(paths.audit);
         this.events = options.events ?? new RemoteEventJournal(paths.events, { lockPath: paths.eventLock });
         this.owners = options.owners ?? new RemoteOwnerProofStore(paths.owners);
+        this.bindings = options.bindings ?? new RemoteCodexSessionBindingStore(remoteCodexSessionBindingsPath(this.root));
         this.codexClientFactory = options.codexClientFactory ?? defaultCodexClientFactory;
         this.inspectProcess = options.inspectProcess;
         this.killProcess = options.killProcess;
@@ -59,7 +64,22 @@ export class RemoteWorker {
             });
         }
         if (request.type === 'list_sessions') {
-            return workerSuccessResponse(request, { sessions: await listRemoteSessionRows(this.root) });
+            const [sessions, bindings] = await Promise.all([
+                listRemoteSessionRows(this.root),
+                this.bindings.list()
+            ]);
+            const bindingRows = [];
+            for (const binding of bindings) {
+                try {
+                    await this.assertCodexBinding(binding);
+                    bindingRows.push(remoteCodexBindingSessionRow(binding));
+                }
+                catch { }
+            }
+            const bindingIds = new Set(bindingRows.map((row) => String(row.session_id)));
+            return workerSuccessResponse(request, {
+                sessions: [...bindingRows, ...sessions.filter((row) => !bindingIds.has(String(row.session_id)))]
+            });
         }
         if (request.type === 'read_snapshot') {
             try {
@@ -158,7 +178,7 @@ export class RemoteWorker {
                 session_id: envelope.session_id,
                 kind: envelope.kind,
                 status: 'failed',
-                side_effect_applied: false,
+                side_effect_applied: executionError.delivery === 'not_dispatched' ? false : 'unknown',
                 completed_at: new Date(this.now()).toISOString(),
                 error: {
                     code: executionError.code,
@@ -204,20 +224,51 @@ export class RemoteWorker {
     }
     async executeCommand(envelope) {
         if (envelope.kind === 'read') {
-            const result = envelope.session_id
-                ? await readRemoteSessionView({
-                    root: this.root,
-                    machineId: this.machine.id,
-                    projectId: this.projectId,
-                    sessionId: envelope.session_id,
-                    view: String(envelope.payload.view ?? 'status')
-                })
-                : { sessions: await listRemoteSessionRows(this.root) };
+            const binding = envelope.session_id ? await this.bindings.find(envelope.session_id) : null;
+            let result;
+            if (binding) {
+                await this.assertCodexBinding(binding);
+                result = {
+                    ...(await readRemoteCodexBindingSnapshot(binding)),
+                    requested_view: String(envelope.payload.view ?? 'status')
+                };
+            }
+            else {
+                result = envelope.session_id
+                    ? await readRemoteSessionView({
+                        root: this.root,
+                        machineId: this.machine.id,
+                        projectId: this.projectId,
+                        sessionId: envelope.session_id,
+                        view: String(envelope.payload.view ?? 'status')
+                    })
+                    : { sessions: await listRemoteSessionRows(this.root) };
+            }
             return { result, sideEffectApplied: false };
         }
         const sessionId = envelope.session_id;
         if (!sessionId)
             throw new RemoteWorkerExecutionError('command_session_id_required');
+        const binding = await this.bindings.find(sessionId);
+        if (binding) {
+            await this.assertCodexBinding(binding);
+            if (envelope.kind === 'verify') {
+                return {
+                    result: { ...(await readRemoteCodexBindingSnapshot(binding)), requested_view: 'verify' },
+                    sideEffectApplied: false
+                };
+            }
+            if (envelope.kind === 'input') {
+                const text = String(envelope.payload.text ?? '').trim();
+                if (!text || Buffer.byteLength(text) > 16 * 1024)
+                    throw new RemoteWorkerExecutionError('input_text_invalid');
+                return {
+                    result: await this.runDedicatedCodexTurn(binding, text),
+                    sideEffectApplied: true
+                };
+            }
+            throw new RemoteWorkerExecutionError('dedicated_codex_cancel_unavailable');
+        }
         const session = await remoteSessionRecord(this.root, sessionId).catch((err) => {
             throw new RemoteWorkerExecutionError(errorMessage(err));
         });
@@ -249,8 +300,11 @@ export class RemoteWorker {
             });
             try {
                 await client.initialize();
+                if (!client.steerTurn)
+                    throw new Error('codex_turn_steer_unavailable');
                 await client.steerTurn({
                     threadId: owner.codex_thread_id,
+                    clientUserMessageId: crypto.randomUUID(),
                     expectedTurnId: owner.active_turn_id,
                     input: [{ type: 'text', text, text_elements: [] }]
                 });
@@ -292,6 +346,11 @@ export class RemoteWorker {
             throw new RemoteWorkerExecutionError('session_binding_generation_stale');
     }
     async prepareCancel(sessionId, commandId) {
+        const binding = await this.bindings.find(sessionId);
+        if (binding) {
+            await this.assertCodexBinding(binding);
+            throw new RemoteWorkerExecutionError('dedicated_codex_cancel_unavailable');
+        }
         const session = await remoteSessionRecord(this.root, sessionId).catch((err) => {
             throw new RemoteWorkerExecutionError(errorMessage(err));
         });
@@ -312,6 +371,11 @@ export class RemoteWorker {
         };
     }
     async readSnapshot(sessionId) {
+        const binding = await this.bindings.find(sessionId);
+        if (binding) {
+            await this.assertCodexBinding(binding);
+            return readRemoteCodexBindingSnapshot(binding);
+        }
         return readRemoteSessionSnapshot({
             root: this.root,
             machineId: this.machine.id,
@@ -319,9 +383,151 @@ export class RemoteWorker {
             sessionId
         });
     }
+    async assertCodexBinding(binding) {
+        if (binding.machine_id !== this.machine.id)
+            throw new RemoteWorkerExecutionError('session_binding_machine_mismatch');
+        if (binding.project_id !== this.projectId)
+            throw new RemoteWorkerExecutionError('session_binding_project_mismatch');
+        const [bindingRoot, workerRoot] = await Promise.all([
+            fsp.realpath(binding.project_root).catch(() => null),
+            fsp.realpath(this.root).catch(() => null)
+        ]);
+        if (!bindingRoot || !workerRoot || bindingRoot !== workerRoot) {
+            throw new RemoteWorkerExecutionError('session_binding_root_mismatch');
+        }
+    }
+    async runDedicatedCodexTurn(binding, text) {
+        const client = await this.codexClientFactory(this.root).catch(() => {
+            throw new RemoteWorkerExecutionError('codex_app_server_unavailable', 'not_dispatched', true);
+        });
+        const threadWasPersisted = Boolean(binding.codex_thread_id);
+        let threadId = binding.codex_thread_id;
+        let turnId = null;
+        try {
+            await client.initialize();
+            if (!client.resumeThread || !client.startTurn || !client.readThread || !client.waitForTurnCompletion) {
+                throw new RemoteWorkerExecutionError('codex_app_server_session_api_unavailable', 'not_dispatched', false);
+            }
+            if (threadId) {
+                try {
+                    const resumed = asRecord(await client.resumeThread({
+                        threadId,
+                        cwd: this.root,
+                        approvalPolicy: 'never',
+                        sandbox: 'workspace-write'
+                    }));
+                    const resumedThread = asRecord(resumed?.thread);
+                    if (String(resumedThread?.id ?? '') !== threadId)
+                        throw new Error('codex_thread_resume_mismatch');
+                    const status = asRecord(resumedThread?.status);
+                    const statusType = String(status?.type ?? '');
+                    if (statusType === 'active') {
+                        throw new RemoteWorkerExecutionError('codex_thread_busy', 'not_dispatched', true);
+                    }
+                    if (statusType !== 'idle') {
+                        throw new RemoteWorkerExecutionError('codex_thread_not_ready', 'not_dispatched', true);
+                    }
+                }
+                catch (err) {
+                    if (err instanceof RemoteWorkerExecutionError)
+                        throw err;
+                    const missingRollout = isMissingCodexRolloutError(err);
+                    if (binding.last_turn_id) {
+                        throw new RemoteWorkerExecutionError(missingRollout ? 'codex_thread_history_missing' : 'codex_thread_resume_failed', 'not_dispatched', !missingRollout);
+                    }
+                    if (!missingRollout) {
+                        throw new RemoteWorkerExecutionError('codex_thread_resume_failed', 'not_dispatched', true);
+                    }
+                    threadId = null;
+                }
+            }
+            if (!threadId) {
+                if (!client.startThread) {
+                    throw new RemoteWorkerExecutionError('codex_app_server_session_api_unavailable', 'not_dispatched', false);
+                }
+                const started = asRecord(await client.startThread({
+                    cwd: this.root,
+                    approvalPolicy: 'never',
+                    sandbox: 'workspace-write',
+                    threadSource: 'sks-telegram',
+                    baseInstructions: 'This is a dedicated private Telegram coding thread. Work only inside the configured project workspace, never expose secrets, and return a concise user-facing final response for each turn.'
+                }).catch(() => {
+                    throw new RemoteWorkerExecutionError('codex_thread_start_failed', 'not_dispatched', true);
+                }));
+                threadId = stringValue(asRecord(started?.thread)?.id);
+                if (!threadId)
+                    throw new Error('codex_thread_start_missing_id');
+            }
+            const started = asRecord(await client.startTurn({
+                threadId,
+                cwd: this.root,
+                approvalPolicy: 'never',
+                sandboxPolicy: {
+                    type: 'workspaceWrite',
+                    writableRoots: [this.root],
+                    networkAccess: false
+                },
+                clientUserMessageId: crypto.randomUUID(),
+                input: [{ type: 'text', text, text_elements: [] }]
+            }));
+            turnId = stringValue(asRecord(started?.turn)?.id);
+            if (!turnId)
+                throw new Error('codex_turn_id_missing');
+            await client.waitForTurnCompletion(threadId, turnId, 30 * 60_000);
+            const read = asRecord(await client.readThread(threadId, true));
+            const thread = asRecord(read?.thread);
+            if (String(thread?.id ?? '') !== threadId)
+                throw new Error('codex_thread_read_mismatch');
+            const turns = Array.isArray(thread?.turns) ? thread.turns.map(asRecord).filter(Boolean) : [];
+            const turn = turns.find((candidate) => String(candidate.id ?? '') === turnId);
+            if (!turn)
+                throw new Error('codex_completed_turn_missing');
+            const turnStatus = String(turn.status ?? '');
+            if (turnStatus !== 'completed') {
+                if (threadWasPersisted) {
+                    await this.bindings.recordTurn(binding.session_id, threadId, turnId, turnStatus === 'interrupted' ? 'interrupted' : 'failed');
+                }
+                throw new RemoteWorkerExecutionError('codex_turn_failed', 'acknowledged', false);
+            }
+            const items = Array.isArray(turn.items) ? turn.items.map(asRecord).filter(Boolean) : [];
+            const agentMessages = items
+                .filter((item) => item.type === 'agentMessage' && typeof item.text === 'string')
+                .map((item) => ({ phase: String(item.phase ?? ''), text: String(item.text).trim() }))
+                .filter((item) => Boolean(item.text));
+            const finalMessage = agentMessages
+                .filter((item) => item.phase === 'final_answer')
+                .map((item) => item.text)
+                .at(-1) ?? agentMessages
+                .map((item) => item.text)
+                .filter(Boolean)
+                .at(-1);
+            if (!finalMessage)
+                throw new Error('codex_final_agent_message_missing');
+            await this.bindings.recordTurn(binding.session_id, threadId, turnId, 'completed');
+            return {
+                accepted: true,
+                control: 'codex_app_server_v2',
+                thread_id: threadId,
+                turn_id: turnId,
+                turn_status: 'completed',
+                final_response: finalMessage.slice(0, 16_000)
+            };
+        }
+        catch (err) {
+            if (err instanceof RemoteWorkerExecutionError)
+                throw err;
+            if (threadWasPersisted && turnId && threadId) {
+                await this.bindings.recordTurn(binding.session_id, threadId, turnId, 'failed').catch(() => undefined);
+            }
+            throw new RemoteWorkerExecutionError(turnId ? 'codex_turn_failed' : 'input_delivery_unknown', turnId ? 'acknowledged' : 'unknown', false);
+        }
+        finally {
+            await client.close().catch(() => undefined);
+        }
+    }
 }
 async function defaultCodexClientFactory(cwd) {
-    const created = await createCodexAppServerV2Client({ cwd, requestedBy: 'remote-ssh-worker' });
+    const created = await createCodexAppServerV2Client({ cwd, requestedBy: 'remote-worker' });
     return created.client;
 }
 function normalizeExecutionError(err) {
@@ -331,7 +537,7 @@ function normalizeExecutionError(err) {
         return new RemoteWorkerExecutionError(err.code);
     if (err instanceof RemoteProtocolError)
         return new RemoteWorkerExecutionError(err.code);
-    return new RemoteWorkerExecutionError('remote_command_failed');
+    return new RemoteWorkerExecutionError('remote_command_failed', 'unknown');
 }
 function errorCode(err) {
     if (err instanceof RemoteWorkerExecutionError || err instanceof RemoteOwnerProofError || err instanceof RemoteProtocolError)
@@ -341,3 +547,11 @@ function errorCode(err) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+function stringValue(value) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    return text || null;
+}
+function isMissingCodexRolloutError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /no rollout found for thread id|thread(?:\/resume)?:? (?:thread )?(?:not found|not loaded)/i.test(message);
+}

package/dist/core/responses-stream.js

@@ -0,0 +1,151 @@
+export function parseResponsesSseEvents(text) {
+    const events = [];
+    for (const line of String(text || '').split(/\r?\n/)) {
+        if (!line.startsWith('data:'))
+            continue;
+        const data = line.slice('data:'.length).trim();
+        if (!data || data === '[DONE]')
+            continue;
+        try {
+            events.push(JSON.parse(data));
+        }
+        catch {
+        }
+    }
+    return events;
+}
+export function streamedOutputItems(events) {
+    const byId = new Map();
+    const anonymous = [];
+    for (const event of events) {
+        if (String(event?.type || '') !== 'response.output_item.done')
+            continue;
+        const item = event?.item;
+        if (!item || typeof item !== 'object')
+            continue;
+        const id = item.id ? String(item.id) : '';
+        if (id)
+            byId.set(id, item);
+        else
+            anonymous.push(item);
+    }
+    return [...byId.values(), ...anonymous];
+}
+export function findStreamedImageOutput(events) {
+    let partial = null;
+    let final = null;
+    for (const event of events) {
+        const type = String(event?.type || '');
+        const item = event?.item;
+        if (item && String(item.type || '') === 'image_generation_call') {
+            const b64 = b64Of(item.result) || b64Of(item.b64_json);
+            if (b64)
+                final = { id: item.id || event?.item_id || null, b64, partial: false };
+            continue;
+        }
+        if (/image_generation_call/.test(type)) {
+            const b64 = b64Of(event?.result) || b64Of(event?.b64_json);
+            if (b64) {
+                final = { id: event?.item_id || event?.id || null, b64, partial: false };
+                continue;
+            }
+            const partialB64 = b64Of(event?.partial_image_b64);
+            if (partialB64)
+                partial = { id: event?.item_id || null, b64: partialB64, partial: true };
+        }
+    }
+    return final || partial;
+}
+export function imageGenerationCallOutputs(payload) {
+    return (Array.isArray(payload?.output) ? payload.output : [])
+        .filter((output) => String(output?.type || '') === 'image_generation_call');
+}
+export function hasImageGenerationResult(payload) {
+    return imageGenerationCallOutputs(payload)
+        .some((output) => Boolean(b64Of(output?.result) || b64Of(output?.result?.b64_json) || b64Of(output?.b64_json)));
+}
+export function parseResponsesSsePayload(text) {
+    const events = parseResponsesSseEvents(text);
+    if (!events.length)
+        return null;
+    const eventTypes = events.map((event) => event?.type || null);
+    const failed = events.find((event) => event?.type === 'response.failed' || event?.response?.status === 'failed');
+    if (failed) {
+        return {
+            object: 'response.sse',
+            status: 'failed',
+            error: failed?.response?.error || failed?.error || { message: 'responses_sse_failed' },
+            events: eventTypes
+        };
+    }
+    const streamedImage = findStreamedImageOutput(events);
+    const recovered = recoveredOutput(streamedOutputItems(events), streamedImage);
+    const completed = [...events].reverse().find((event) => event?.type === 'response.completed' && event?.response);
+    if (completed?.response) {
+        const output = Array.isArray(completed.response.output) ? completed.response.output : [];
+        if (output.length) {
+            if (hasImageGenerationResult(completed.response) || !streamedImage)
+                return completed.response;
+            return {
+                ...completed.response,
+                output: [...output, streamedImageItem(streamedImage)],
+                image_output_recovered_from_stream: true,
+                image_output_partial_frame: streamedImage.partial
+            };
+        }
+        if (!recovered.length)
+            return completed.response;
+        return {
+            ...completed.response,
+            output: recovered,
+            output_recovered_from_stream: true,
+            ...(streamedImage
+                ? { image_output_recovered_from_stream: true, image_output_partial_frame: streamedImage.partial }
+                : {})
+        };
+    }
+    if (recovered.length) {
+        return {
+            object: 'response.sse',
+            status: 'completed',
+            output: recovered,
+            output_recovered_from_stream: true,
+            ...(streamedImage
+                ? { image_output_recovered_from_stream: true, image_output_partial_frame: streamedImage.partial }
+                : {}),
+            events: eventTypes
+        };
+    }
+    return { object: 'response.sse', status: 'unknown', events: eventTypes };
+}
+export function responsesOutputText(payload) {
+    const direct = typeof payload?.output_text === 'string' ? payload.output_text : '';
+    if (direct)
+        return direct;
+    const parts = [];
+    for (const output of Array.isArray(payload?.output) ? payload.output : []) {
+        for (const content of Array.isArray(output?.content) ? output.content : []) {
+            if (typeof content?.text === 'string' && content.text)
+                parts.push(content.text);
+        }
+    }
+    return parts.join('');
+}
+function recoveredOutput(items, streamedImage) {
+    const output = [...items];
+    const hasImage = output.some((item) => String(item?.type || '') === 'image_generation_call' && b64Of(item?.result));
+    if (streamedImage && !hasImage)
+        output.push(streamedImageItem(streamedImage));
+    return output;
+}
+function streamedImageItem(image) {
+    return {
+        id: image.id,
+        type: 'image_generation_call',
+        status: image.partial ? 'partial' : 'completed',
+        result: image.b64
+    };
+}
+function b64Of(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}

package/dist/core/routes/dollar-manifest-lite.js

@@ -1,5 +1,5 @@
 import { normalizeDollarSkillName, prefixKnownSksDollarReferences, sksPrefixedDollarCommand } from './dollar-prefix.js';
-const NARUTO_DESCRIPTION = '$Naruto is the lightweight Codex official subagent workflow and the default for non-trivial execution. The Sol Max parent dynamically scales useful independent children from a bounded two/four/six starting policy up to the safe capacity ceiling; max_threads is a cap, never a target. Capacity is the minimum of ready DAG width, disjoint ownership, verifier/tool capacity, reserved thread slots, and positive marginal usefulness. Child routing is fixed to Luna Max mechanical, Sol High implementation, Sol Max judgment, and Terra Medium long-context/Computer Use/Browser/ImageGen execution. Duplicate slices and overlapping writes are blocked; explicit --agents remains authoritative.';
+const NARUTO_DESCRIPTION = '$Naruto is the lightweight Codex official subagent workflow and the default for non-trivial execution. The Sol Max parent dynamically scales useful independent children from a bounded four/six/eight starting policy up to the safe capacity ceiling (default 12); max_threads is a cap, never a target. Healthy host CPU/memory/API budget may raise the automatic count toward that ceiling, and live pressure may shrink it. Capacity is the minimum of ready DAG width, disjoint ownership, verifier/tool capacity, reserved thread slots, and positive marginal usefulness. Child routing is fixed to Luna Max mechanical, Sol High implementation, Sol Max judgment, and Terra Medium long-context/Computer Use/Browser/ImageGen execution. Duplicate slices and overlapping writes are blocked; explicit --agents remains authoritative.';
 const COMPUTER_USE_DESCRIPTION = 'Maximum-speed Codex Computer Use lane for native macOS, desktop-app, OS-settings, and non-web visual tasks only. Browser, localhost, website, webapp, and web-based app verification must route through Codex Chrome Extension readiness first.';
 const DOLLAR_COMMANDS_LITE_BASE = [
     { command: '$DFix', route: 'fast direct fix', description: 'Tiny simple direct edits such as copy, labels, typos, wording, spacing, colors, or clearly scoped one-line changes. Bypasses the general SKS pipeline and runs an ultralight, no-record task-list path.' },