viewable-one 0.0.0-stage → 0.12.2

package/lib/codexApps.mjs

@@ -0,0 +1,344 @@
+// USE MY COMPUTER'S APPS FOR CODEX (#481). Transport stays in its source;
+// only policy is overridden. The thread inventory is checked before a turn.
+import { codexRpc, startCodex } from "./codex-rpc.mjs";
+import { killTree } from "./kill.mjs";
+import { secretLike } from "./codexToolInputs.mjs";
+
+const unreadable = () => new Error("Couldn't read the apps set up in Codex, so this run did not start. Check your apps in Codex, then try again.");
+const unsupported = () => new Error("Codex couldn't check approval for every app on this computer, so this run did not start. Check your apps in Codex, then try again.");
+const offSources = ["-c", "features.plugins=false", "-c", "features.apps=false"];
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+// A server that started shows tools, resources or resource templates.
+const exposed = (status) => Object.keys(status.tools).length || status.resources?.length || status.resourceTemplates?.length;
+
+// Use the incumbent cross-platform kill primitive, with a bounded wait after
+// each signal. A blocked preflight must neither leak a child nor hang OFF or
+// drafts forever. No process-group kill: these children share our group.
+async function stopPreflight(child, gone, killGraceMs) {
+  const wait = async () => {
+    let timer;
+    try { return await Promise.race([gone.then(() => true), new Promise((resolve) => { timer = setTimeout(() => resolve(false), killGraceMs); })]); }
+    finally { clearTimeout(timer); }
+  };
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  for (const force of [false, true]) {
+    await killTree(child.pid, { force, signal: (_pid, signal) => child.kill(signal) }).catch(() => {});
+    if (await wait()) return;
+  }
+  child.stdin.destroy(); child.stdout.destroy(); child.stderr.destroy(); child.unref();
+  throw unreadable();
+}
+
+// CLI discovery expands plugin servers; it is not the config/read transport
+// table. Keep both views, with the same binary/cwd/args/env, for provenance.
+export async function listCodexServers({ bin = "codex", args, cwd, env = process.env, timeoutMs = 15_000, killGraceMs = 250 } = {}) {
+  const base = (args ?? ["app-server"]).filter((arg) => arg !== "app-server");
+  let child;
+  try { child = startCodex({ bin, args: [...base, "mcp", "list", "--json"], cwd, env }); } catch { throw unreadable(); }
+  const gone = new Promise((resolve) => child.once("close", resolve));
+  child.stderr.resume();
+  let timer;
+  try {
+    const list = await new Promise((resolve, reject) => {
+      let out = "";
+      timer = setTimeout(() => reject(unreadable()), timeoutMs);
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => { out += chunk; if (out.length > 2_000_000) reject(unreadable()); });
+      child.once("error", () => reject(unreadable()));
+      child.once("close", (code) => {
+        try { if (code !== 0) throw unreadable(); resolve(JSON.parse(out)); } catch { reject(unreadable()); }
+      });
+      child.stdin.end();
+    });
+    if (!Array.isArray(list) || list.some((server) => !object(server) || typeof server.name !== "string")) throw unreadable();
+    return list;
+  } finally { clearTimeout(timer); await stopPreflight(child, gone, killGraceMs); }
+}
+
+async function readAppsConfig(rpc, cwd) {
+  const config = (await rpc.request("config/read", { cwd }))?.config;
+  const servers = config?.mcp_servers === undefined ? {} : config.mcp_servers;
+  if (!object(config) || !object(servers)) throw unreadable();
+  for (const server of Object.values(servers)) {
+    if (!object(server) || (server.tools != null && !object(server.tools))) throw unreadable();
+  }
+  return { ...config, mcp_servers: servers };
+}
+
+async function readInventory(rpc, threadId) {
+  const inventory = [];
+  const cursors = new Set();
+  let cursor;
+  do {
+    const page = await rpc.request("mcpServerStatus/list", { ...(threadId ? { threadId } : {}), ...(cursor ? { cursor } : {}) });
+    if (!Array.isArray(page?.data)) throw unreadable();
+    for (const server of page.data) {
+      if (!object(server) || typeof server.name !== "string" || !object(server.tools)) throw unreadable();
+      if (inventory.some((entry) => entry.name === server.name)) throw unreadable();
+      inventory.push(server);
+    }
+    cursor = page.nextCursor;
+    if (cursor && (typeof cursor !== "string" || cursors.has(cursor))) throw unreadable();
+    cursors.add(cursor);
+  } while (cursor);
+  return inventory;
+}
+
+// The child is reaped before returning, on success and every refusal path.
+async function readCodexApps({ bin = "codex", args, cwd, env = process.env, timeoutMs = 15_000, killGraceMs = 250 } = {}, inventory = false) {
+  let child;
+  try { child = startCodex({ bin, args: args ?? ["app-server"], cwd, env }); } catch { throw unreadable(); }
+  child.stderr.resume();
+  const gone = new Promise((resolve) => child.once("close", resolve));
+  const rpc = codexRpc(child, { timeoutMs });
+  try {
+    await rpc.initialize();
+    return { config: await readAppsConfig(rpc, cwd), inventory: inventory ? await readInventory(rpc) : [] };
+  } catch { throw unreadable(); } finally { rpc.close(); await stopPreflight(child, gone, killGraceMs); }
+}
+
+// -c splits dotted paths literally, including quote characters (0.162.1).
+// Plugin IDs may contain @; literal tool names go inside TOML table values,
+// so a dotted app resource name cannot accidentally address another table.
+function policyArgs(prefix, tools) {
+  const names = [...new Set(tools)];
+  return ["-c", `${prefix}.default_tools_approval_mode="prompt"`,
+    ...(names.length ? ["-c", `${prefix}.tools={${names.map((name) => `${JSON.stringify(name)}={approval_mode="prompt"}`).join(",")}}`] : [])];
+}
+function pathPart(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_@-]+$/.test(value)) throw unsupported();
+  return value;
+}
+
+// Built-in app provenance comes from the app-server's own tool metadata,
+// never a server-name exception. Store only IDs/names, not link credentials.
+function appTools(status) {
+  const tools = Object.values(status.tools);
+  if (status.pluginId || status.httpOrigin !== "https://chatgpt.com" || !tools.length) throw unsupported();
+  return tools.map((tool) => {
+    const meta = tool?._meta;
+    if (typeof meta?._codex_apps?.contains_mcp_source !== "boolean" || typeof meta.resource_name !== "string" || !meta.resource_name) throw unsupported();
+    return { app: pathPart(meta.connector_id), tool: meta.resource_name };
+  });
+}
+
+// The name a person knows: their own server name, the plugin's name (its
+// server too when they differ), or ChatGPT apps for the built-in service.
+function notice(source, reason) {
+  if (source.kind === "apps") return `ChatGPT apps were turned off for this run because ${reason}.`;
+  const plugin = source.kind === "plugin" ? source.identity.split("@")[0] : source.name;
+  return `${plugin === source.name ? plugin : `${plugin} (${source.name})`} was turned off for this run because ${reason}.`;
+}
+
+// A source is never merely omitted from verification: apply its OFF policy
+// and check the resulting process before a turn. Unknown built-in provenance
+// can only be isolated at the built-in apps transport, as with the OFF switch.
+function disableSource(plan, source, reason) {
+  const affected = source.kind === "apps" ? plan.sources.filter((entry) => entry.kind === "apps") : [source];
+  for (const entry of affected) {
+    if (!entry.enabled) continue;
+    entry.enabled = false;
+    if (!plan.notices.includes(notice(entry, reason))) plan.notices.push(notice(entry, reason));
+  }
+  if (source.kind === "apps") plan.args.push("-c", "features.apps=false");
+  else if (source.kind === "configured") plan.args.push("-c", `mcp_servers.${pathPart(source.name)}.enabled=false`);
+  else plan.args.push("-c", `plugins.${pathPart(source.identity)}.mcp_servers.${pathPart(source.name)}.enabled=false`);
+}
+
+function sourceIsOff(config, source) {
+  if (source.kind === "configured") return config.mcp_servers[source.name]?.enabled === false;
+  if (source.kind === "apps") return config.features?.apps === false;
+  const plugin = config.plugins?.[source.identity];
+  return plugin?.enabled === false || plugin?.mcp_servers?.[source.name]?.enabled === false;
+}
+
+export async function prepareCodexApps(opts, { on, isDraft }) {
+  const allowed = on && !isDraft;
+  const sourceArgs = allowed ? [] : offSources;
+  const restricted = { ...opts, args: [...(opts.args ?? ["app-server"]), ...sourceArgs] };
+  // ON gets plugin identities from the effective app-server inventory and
+  // config. A separate CLI listing would start an unnecessary third process.
+  const listed = allowed ? [] : await listCodexServers(restricted);
+  const { config, inventory } = await readCodexApps(restricted, allowed);
+  const servers = config.mcp_servers;
+  if (!allowed && (config.features?.plugins !== false || config.features?.apps !== false)) throw unreadable();
+  if (listed.some((entry) => entry.enabled !== false && !Object.hasOwn(servers, entry.name))) throw unsupported();
+  const tools = Object.fromEntries(Object.entries(servers).map(([name, server]) => [name, Object.keys(server.tools ?? {})]));
+  const plan = {
+    args: [...sourceArgs, ...appsArgs(Object.entries(servers).map(([name, server]) => ({ ...server, name })), { on: allowed, isDraft, tools })],
+    sources: [], notices: [],
+  };
+  if (!allowed) return plan;
+  plan.args.push("-c", 'approvals_reviewer="user"');
+  const apps = new Map(Object.entries(config.apps ?? {}).filter(([id]) => id !== "_default").map(([id, app]) => [pathPart(id), new Set(Object.keys(app?.tools ?? {}))]));
+  for (const [name, server] of Object.entries(servers)) {
+    const status = inventory.find((entry) => entry.name === name && !entry.pluginId);
+    plan.sources.push({ name, kind: "configured", identity: "configured", enabled: server.enabled !== false, tools: Object.keys(status?.tools ?? {}) });
+  }
+  for (const status of inventory) {
+    const names = Object.keys(status.tools);
+    if (Object.hasOwn(servers, status.name) && !status.pluginId) continue;
+    const source = { name: status.name, kind: status.pluginId ? "plugin" : "apps", identity: status.pluginId ?? "apps", enabled: true, tools: names };
+    plan.sources.push(source);
+    if (status.pluginId) {
+      const plugin = pathPart(status.pluginId);
+      const server = pathPart(status.name);
+      source.enabled = config.plugins?.[plugin]?.enabled !== false && config.plugins?.[plugin]?.mcp_servers?.[server]?.enabled !== false;
+      if (Object.hasOwn(servers, status.name) || !exposed(status)) {
+        disableSource(plan, source, "Codex could not check the app after it started");
+      } else if (source.enabled) {
+        plan.args.push(...policyArgs(`plugins.${plugin}.mcp_servers.${server}`, [...names, ...Object.keys(config.plugins?.[plugin]?.mcp_servers?.[server]?.tools ?? {})]));
+      }
+    } else {
+      try {
+        for (const entry of appTools(status)) {
+          if (!apps.has(entry.app)) apps.set(entry.app, new Set());
+          apps.get(entry.app).add(entry.tool);
+        }
+      } catch { disableSource(plan, source, "Codex could not check where the app came from"); }
+    }
+  }
+  // Codex 0.162.1 names every server it can start in mcpServerStatus/list,
+  // a failed one with no tools, so a plugin with no entry there has no server
+  // (it holds only skills) and stays on. A server declared in config that
+  // Codex does not name did not start: turn just that server off.
+  for (const [plugin, policy] of Object.entries(config.plugins ?? {})) {
+    if (policy?.enabled === false) continue;
+    for (const [name, server] of Object.entries(policy?.mcp_servers ?? {})) {
+      if (server?.enabled === false || inventory.some((entry) => entry.name === name && entry.pluginId === plugin)) continue;
+      const source = { name, kind: "plugin", identity: plugin, enabled: true, tools: [] };
+      plan.sources.push(source);
+      disableSource(plan, source, "the app did not start");
+    }
+  }
+  // A disabled built-in transport disables every source it owns.
+  if (plan.sources.some((entry) => entry.kind === "apps" && !entry.enabled)) {
+    for (const source of plan.sources) if (source.kind === "apps" && source.enabled) disableSource(plan, source, "Codex could not check the app service");
+  }
+  plan.args.push(...policyArgs("apps._default", []), "-c", 'apps._default.approvals_reviewer="user"');
+  for (const [id, names] of apps) plan.args.push(...policyArgs(`apps.${id}`, [...names]), "-c", `apps.${id}.approvals_reviewer="user"`);
+  return plan;
+}
+
+// Return a stricter plan when one source cannot be verified. The caller must
+// reap this process and apply that plan to a new process before any model turn.
+// Ignored OFF overrides still refuse: an unverified source must never stay on.
+export async function verifyCodexApps(rpc, { cwd, threadId, on, isDraft, sources = [] }) {
+  const allowed = on && !isDraft;
+  try {
+    const config = await readAppsConfig(rpc, cwd);
+    if (!allowed && (config.features?.plugins !== false || config.features?.apps !== false)) throw unreadable();
+    if (allowed && config.approvals_reviewer !== "user") throw unsupported();
+    const prompt = (policy, names = []) => {
+      if (policy?.default_tools_approval_mode !== "prompt" ||
+          Object.values(policy.tools ?? {}).some((tool) => tool?.approval_mode !== "prompt") ||
+          names.some((name) => policy.tools?.[name]?.approval_mode !== "prompt")) throw unsupported();
+    };
+    const servers = config.mcp_servers;
+    const inventory = await readInventory(rpc, threadId);
+    const plan = { args: [], sources: structuredClone(sources), notices: [] };
+    // Check actual exposure, even for disabled sources and unexpected arrivals.
+    for (const status of inventory) {
+      const kind = status.pluginId ? "plugin" : Object.hasOwn(servers, status.name) ? "configured" : "apps";
+      const identity = status.pluginId ?? kind;
+      let source = plan.sources.find((entry) => entry.name === status.name && entry.kind === kind && entry.identity === identity);
+      if (!allowed) {
+        if (kind !== "configured" || (servers[status.name].enabled === false && exposed(status))) throw unreadable();
+        continue;
+      }
+      if (status.name === "glytch" && kind === "configured" && !isDraft) continue;
+      if (!source) {
+        source = { name: status.name, kind, identity, enabled: true, tools: Object.keys(status.tools) };
+        plan.sources.push(source);
+        disableSource(plan, source, "Codex could not check the app in this run");
+        continue;
+      }
+      if (!source.enabled) {
+        // This plan's new OFF settings take effect only in the retry process.
+        // Sources already disabled on entry must still prove they are off now.
+        const previous = sources.find((entry) => entry.name === source.name && entry.kind === kind && entry.identity === identity);
+        if (previous?.enabled !== false) continue;
+        if (!sourceIsOff(config, source) || exposed(status)) throw unsupported();
+        continue;
+      }
+      try {
+        if (kind === "configured") prompt(servers[status.name]);
+        else if (kind === "plugin") {
+          if (Object.hasOwn(servers, status.name)) throw unsupported();
+          prompt(config.plugins?.[identity]?.mcp_servers?.[status.name], Object.keys(status.tools));
+        } else {
+          prompt(config.apps?._default);
+          if (config.apps._default.approvals_reviewer !== "user") throw unsupported();
+          for (const entry of appTools(status)) {
+            const policy = config.apps?.[entry.app];
+            prompt(policy, [entry.tool]);
+            if (policy.approvals_reviewer !== "user") throw unsupported();
+          }
+        }
+        if (source.tools.some((name) => !Object.hasOwn(status.tools, name))) {
+          disableSource(plan, source, "Codex could not find all of its tools in this run");
+        }
+      } catch { disableSource(plan, source, "Codex could not check approval for the app"); }
+    }
+    for (const source of plan.sources) {
+      if (!source.enabled || (source.name === "glytch" && !isDraft)) continue;
+      const status = inventory.find((entry) => entry.name === source.name);
+      const kind = status?.pluginId ? "plugin" : status && Object.hasOwn(servers, status.name) ? "configured" : "apps";
+      const identity = status?.pluginId ?? kind;
+      if (!status || kind !== source.kind || identity !== source.identity) disableSource(plan, source, "Codex could not find the app in this run");
+    }
+    // Disabled entries may disappear entirely, but their config must prove OFF.
+    for (const source of sources.filter((entry) => !entry.enabled)) {
+      if (!sourceIsOff(config, source)) throw unsupported();
+    }
+    for (const [name, server] of Object.entries(servers)) {
+      if (server.enabled === false || (name === "glytch" && !isDraft)) continue;
+      if (!allowed) throw unreadable();
+      if (sources.some((entry) => entry.name === name) || plan.sources.some((entry) => entry.name === name && entry.kind === "configured")) continue;
+      // Added after discovery: check it like a late inventory entry.
+      try { prompt(server); } catch {
+        const source = { name, kind: "configured", identity: "configured", enabled: true, tools: [] };
+        plan.sources.push(source);
+        disableSource(plan, source, "Codex could not check approval for the app");
+      }
+    }
+    return plan;
+  } catch { throw allowed ? unsupported() : unreadable(); }
+}
+
+// What the switch adds to the app server's command line (#481). Off, and in
+// every draft: each server the person enabled is switched off for this run.
+// On: each one stays, but every tool call asks first ("prompt" asks even for
+// tools marked read-only), each tool the person saved an approval for
+// included. glytch is ours and is set by codexBoardArgs; a
+// draft switches it off too. Codex reads `mcp_servers.<name>` as a dotted
+// path only when the name is plain (a quoted name makes a new, broken
+// server), so any other server or tool name refuses the run.
+export function appsArgs(servers, { on, isDraft, tools = {} }) {
+  const args = [];
+  for (const server of servers) {
+    if (server.enabled === false) continue;
+    if (server.name === "glytch" && !isDraft) continue;
+    const saved = on && Object.hasOwn(tools, server.name) ? tools[server.name] : [];
+    const names = [server.name, ...saved];
+    const odd = names.find((name) => !/^[A-Za-z0-9_-]+$/.test(name));
+    if (odd !== undefined) {
+      throw new Error(`An app set up in Codex has a name this run can't switch off safely (${JSON.stringify(odd)}). Rename it in your Codex config, then try again.`);
+    }
+    // Codex 0.165 rejects policy-only CLI overrides for workspace-provided
+    // servers after account/read ("workspace requirements: invalid data").
+    // The same policy succeeds when its override table includes the endpoint.
+    // Reassert only the public endpoint; auth headers and tokens stay in their
+    // original source. Keep the same prompt/OFF policy below.
+    if (server.environment_id && typeof server.url === "string") {
+      let url;
+      try { url = new URL(server.url); } catch { throw unsupported(); }
+      if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || secretLike(server.url)) throw unsupported();
+      args.push("-c", `mcp_servers.${server.name}.url=${JSON.stringify(server.url)}`);
+    }
+    if (!on || isDraft) { args.push("-c", `mcp_servers.${server.name}.enabled=false`); continue; }
+    args.push("-c", `mcp_servers.${server.name}.default_tools_approval_mode="prompt"`);
+    for (const tool of saved) args.push("-c", `mcp_servers.${server.name}.tools.${tool}.approval_mode="prompt"`);
+  }
+  return args;
+}

package/lib/codexPlanWindow.mjs

@@ -0,0 +1,84 @@
+// The Codex plan window: what a ChatGPT subscription reports instead of
+// dollars (brief 46, Move 4, the addendum "dollars only where money is
+// metered"). codex-rs/app-server/README.md documents
+// `account/rateLimits/read` answering with a response whose `rateLimits`
+// (or `rateLimitsByLimitId.codex`) is a RateLimitSnapshot carrying
+// `primary` and `secondary` windows, each
+// roughly `{ usedPercent, windowDurationMins, resetsAt }` - checked against
+// the installed codex-cli this bridge already drives through codex-rpc.mjs
+// for `account/read` and `model/list`, so this is one more request on the
+// same connection rather than a new one.
+//
+// Field names are parsed defensively, never trusted verbatim: a version
+// skew that renames a field must read as "no window", not crash a run that
+// was only trying to ask a question before spending. An older Codex with no
+// such method answers with a JSON-RPC "method not found" error, which this
+// module treats exactly the same way - `readPlanWindow` never throws.
+//
+// READ, NEVER ENFORCED (#170, #338). The window is shown on the run's info
+// line and nothing else: a Codex run no longer stands down at a percentage.
+
+/** The sentence Codex's dollar line used to be, unconditionally - still the
+ *  fallback once a window could not be read at all. */
+export const CODEX_DOLLARS_UNAVAILABLE =
+  "Codex subscription usage: no dollar cost is reported.";
+
+const number = (n) => (typeof n === "number" && Number.isFinite(n) ? n : null);
+const text = (s) => (typeof s === "string" && s.trim() !== "" ? s : null);
+
+/** One window (`primary` or `secondary`) from whatever shape the server
+ *  answered with this version. Null when there is nothing usable in it - a
+ *  window this side cannot read is the same as no window at all, never a
+ *  thrown error a caller has to guard against. */
+function parseWindow(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const usedPercent = number(raw.usedPercent ?? raw.used_percent ?? raw.percentUsed ?? raw.percent_used);
+  if (usedPercent === null) return null;
+  const windowMinutes = number(
+    raw.windowDurationMins ?? raw.windowDurationMinutes ?? raw.window_duration_mins
+      ?? raw.windowMinutes ?? raw.window_minutes,
+  );
+  const reset = raw.resetsAt ?? raw.resets_at ?? raw.resetAt ?? raw.reset_at;
+  // The app-server protocol uses Unix seconds; presence uses an ISO date.
+  const date = typeof reset === "number" ? new Date(reset * 1000) : null;
+  const resetsAt = date ? (Number.isNaN(date.getTime()) ? null : date.toISOString()) : text(reset);
+  return { usedPercent, windowMinutes, resetsAt };
+}
+
+/** `account/rateLimits/read`, wrapped so an unsupported method (an older
+ *  Codex) or any other failure yields `{primary:null, secondary:null}`,
+ *  never a thrown error - a caller about to start a run reads "no window"
+ *  as "start it", not as a crash to propagate.
+ *
+ *  `session` is anything with a `.request(method, params)` - the object
+ *  `codexRpc()` (codex-rpc.mjs) returns. `log`, when given, is called once
+ *  with the raw response (or the failure), so an unexpected shape leaves a
+ *  debug trail instead of silently reading as "no window". */
+export async function readPlanWindow(session, { log } = {}) {
+  const readAt = new Date().toISOString();
+  try {
+    const raw = await session.request("account/rateLimits/read", {});
+    log?.(`[codex plan window] account/rateLimits/read -> ${JSON.stringify(raw)}`);
+    const snapshot = raw?.rateLimitsByLimitId?.codex ?? raw?.rateLimits ?? raw;
+    return { primary: parseWindow(snapshot?.primary), secondary: parseWindow(snapshot?.secondary), readAt };
+  } catch (error) {
+    log?.(`[codex plan window] account/rateLimits/read unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    return { primary: null, secondary: null, readAt };
+  }
+}
+
+/** Name the duration actually returned by Codex, including single-window
+ * accounts and newer durations that the bridge has not seen before. */
+function windowLabel(window) {
+  const minutes = number(window?.windowMinutes);
+  if (minutes === 10080) return "weekly";
+  if (minutes === null || minutes <= 0) return "reported";
+  return minutes % 60 === 0 ? `${minutes / 60}-hour` : `${minutes}-minute`;
+}
+
+export function planWindowInfoMessage(window) {
+  const readings = [window?.primary, window?.secondary].filter(Boolean);
+  if (readings.length === 0) return CODEX_DOLLARS_UNAVAILABLE;
+  return "Codex reports its plan window, not dollars: " + readings.map((reading) =>
+    `${windowLabel(reading)} at ${Math.round(reading.usedPercent)}%`).join(", ") + ".";
+}

package/lib/codexToolInputs.mjs

@@ -0,0 +1,139 @@
+// WHAT A CODEX TOOL APPROVAL SENDS, short, with secrets hidden (#608).
+// Codex puts the tool's arguments in the approval's `_meta.tool_params`. The
+// person approving a refund needs the amount; the hosted question must never
+// carry a credential.
+//
+// Text is shown by an ALLOW rule, not a list of things to block: a string is
+// shown only when it reads as plain text: at most 80 characters, made only of
+// letters, digits, spaces and . , - _ / ( ) # + @ ! ? $ € £, with no run of
+// 4 or more digits, no credential part in its letters (pass, pin, token,
+// key…, the same test names get), and neither secret-shaped nor opaque.
+// Anything else (a tab, a line break, any other punctuation) reads "hidden,
+// N characters". A body of any format (JSON, form, query, XML, multipart,
+// comma or tab separated) therefore never shows, whatever it names.
+// Booleans and null show as themselves; a number shows when it has at most
+// 3 digits before the point; nested values show as a count; an argument
+// named like a credential reads "hidden".
+//
+// The limit: an unlabelled password typed as free text ("hunter2") reads
+// as ordinary text and shows. Nothing in a value alone tells them apart.
+//
+// `_meta.tool_params_display` (Codex's own formatted copy) is not read: one
+// source of values keeps every value behind the same rule.
+
+// Forwarded prose must not carry a credential value: a labelled one in any
+// case ("Password: hunter2", "API_KEY=abc", "login code:", "code is 123456";
+// bare "code" is not a label, so "exit code: 1" is asked) or a token-shaped one.
+// A label may end a longer name ("access_token=") or a quoted JSON key
+// ('"password": "x"'). codex.mjs uses this for Codex's own message text.
+const labelledSecret = /(?<![a-z0-9])(?:password|passphrase|secret|token|api[ _-]?key|authorization|cookie)\b["']?\s*[:=]\s*\S+|\b(?:verification|one[ -]?time|login)\s+code\s*[:=]|\bcode\s+is\s+\d{4,}/i;
+const tokenShaped = /\b(?:sk|pk|rk)-[\w-]{12,}|\b(?:sk|pk|rk|whsec)_(?:live|test)_\w+|\bgh[pousr]_\w{20,}|\bgithub_pat_\w{20,}|\bxox[abprs]-[\w-]{10,}|\bAKIA[0-9A-Z]{16}\b|\beyJ[\w-]{10,}\.[\w-]{10,}|\b[Bb]earer\s+\S{8,}|-----BEGIN [A-Z ]*KEY-----|\/\/[^\s/:@]+:[^\s/@]+@|(?=[\w+=-]*\d)(?=[\w+=-]*[A-Za-z])[\w+=-]{40,}/;
+export const secretLike = (value) => labelledSecret.test(value) || tokenShaped.test(value);
+
+// A name or a text value that mentions a credential: lowercased, with
+// everything but letters stripped ("OTPCode" -> "otpcode", "passcode,482913"
+// -> "passcode"), then tested for these parts anywhere, so one-word names,
+// acronyms and run-together text are caught without splitting words. An
+// argument named this way is hidden whatever its value; a text value this
+// way is hidden itself. Over-matching ("shipping", "keyboard", "author",
+// "compass", "basic plan") only hides a value.
+const SECRET_PART = /pass|pin|otp|token|key|secret|auth|cookie|session|credential|signature|cvv|cvc|private|mfa|totp|pwd|cardnumber|onetime|verification|bearer|basic/;
+const nameLetters = (name) => name.toLowerCase().replace(/[^a-z]/g, "");
+const mentionsSecret = (text) => SECRET_PART.test(nameLetters(text));
+// A name with "code" in it hides a number, or 4 to 10 digits as text
+// (login_code, sms_code, PINCode; zip_code over-hides). country_code: "US"
+// still shows.
+const CODE_DIGITS = /^\d{4,10}$/;
+const codeValue = (name, value) => nameLetters(name).includes("code")
+  && (typeof value === "number" || (typeof value === "string" && CODE_DIGITS.test(value.replace(/[\s-]/g, ""))));
+// A run of mixed letters and digits (an id, a key, a hash), or a card-length
+// number. Shorter ids like a Stripe charge id stay readable.
+const opaque = (text) => /(?=[\w+/=-]*\d)(?=[\w+/=-]*[A-Za-z])[\w+/=-]{32,}|[\w+/=-]{64,}|(?:\d[ -]?){13,}/.test(text);
+// The only characters plain text may hold. Everything else (tabs, control
+// characters, = : ; quotes, brackets, %) can carry labelled or encoded data.
+const PLAIN_CHARS = /^[\p{L}\p{N} .,\-_/()#+@!?$€£]*$/u;
+// 4 or more digits in a row may be a code, a PIN or part of a card ("Your
+// verification code 482913"); "order 1182" over-hides.
+const DIGIT_RUN = /\d{4,}/;
+
+const MAX_INPUTS = 12;
+const MAX_VALUE = 80;
+const MAX_TEXT = 900;
+const HIDDEN = "hidden";
+const plainName = (name) => /^[\w .-]{1,40}$/.test(name) && !secretLike(name);
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const count = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+// Length is checked first, so the patterns only ever scan 80 characters.
+const plainText = (text) => text.length <= MAX_VALUE && PLAIN_CHARS.test(text) && !DIGIT_RUN.test(text) && !mentionsSecret(text)
+  && !secretLike(text) && !opaque(text);
+
+function valueText(value) {
+  if (value === null || typeof value === "boolean") return String(value);
+  // At most 3 digits before the point: 49.99 shows, a 4-digit PIN does not.
+  if (typeof value === "number") return Number.isFinite(value) && Math.abs(value) < 1000 ? String(value) : HIDDEN;
+  if (typeof value === "string") {
+    if (value.trim() === "") return "(empty)";
+    return plainText(value) ? value.trim() : `${HIDDEN}, ${count(value.length, "character", "characters")}`;
+  }
+  // Nested values are summarised by size, never opened: a secret one level
+  // down is not shown.
+  if (Array.isArray(value)) return count(value.length, "item", "items");
+  if (record(value)) return count(Object.keys(value).length, "field", "fields");
+  return HIDDEN;
+}
+
+/** The lines that list a tool approval's inputs, or "" when it has none.
+ * `params` is the elicitation's params; only `_meta.tool_params` is read. */
+export function toolInputsText(params) {
+  const inputs = params?._meta?.tool_params;
+  if (inputs === undefined || inputs === null) return "";
+  if (!record(inputs)) return `Details: ${valueText(inputs)}`;
+  const entries = Object.entries(inputs);
+  if (!entries.length) return "";
+  const lines = [];
+  let length = 0;
+  for (const [name, value] of entries.slice(0, MAX_INPUTS)) {
+    const line = !plainName(name) ? `(hidden name): ${HIDDEN}`
+      : `${name}: ${mentionsSecret(name) || codeValue(name, value) ? HIDDEN : valueText(value)}`;
+    if (length + line.length > MAX_TEXT) break;
+    lines.push(line);
+    length += line.length + 1;
+  }
+  const rest = entries.length - lines.length;
+  if (rest > 0) lines.push(`and ${rest} more`);
+  return `Details:\n${lines.join("\n")}`;
+}
+
+// Stripe sends amounts in the currency's smallest unit (4900 USD is $49.00,
+// 500 JPY is ¥500). The divisor is Stripe's, not Intl's: ISK and UGX have no
+// decimals in Intl but Stripe still sends them with two (500 ISK is ISK 5),
+// docs.stripe.com/currencies. Intl only draws the symbol. Without a currency
+// the decimals are unknown and the number stays as sent, said in words.
+const STRIPE_ZERO_DECIMAL = new Set(["BIF", "CLP", "DJF", "GNF", "JPY", "KMF", "KRW", "MGA", "PYG", "RWF", "VND", "VUV", "XAF", "XOF", "XPF"]);
+const STRIPE_THREE_DECIMAL = new Set(["BHD", "JOD", "KWD", "OMR", "TND"]);
+export function moneyText(amount, currency) {
+  if (typeof currency !== "string" || !/^[a-z]{3}$/i.test(currency)) return `${amount} in the payment's smallest unit (cents for USD)`;
+  const code = currency.toUpperCase();
+  const divisor = STRIPE_ZERO_DECIMAL.has(code) ? 1 : STRIPE_THREE_DECIMAL.has(code) ? 1000 : 100;
+  return new Intl.NumberFormat("en-US", { style: "currency", currency: code }).format(amount / divisor);
+}
+// A vendor's raw id ("pi_3MtwBwLkdIwHu7ix28a3tqPa", "cus_NffrFeUfNV2Hib"):
+// it names the record but no person knows it, so its row goes last.
+export const RAW_ID = /^[a-z]{2,6}_[A-Za-z0-9]{6,}$/;
+
+/** Approval-card rows, using the same secret filter as the computer asker.
+ * `tool` is the app's tool name; a Stripe amount reads "Refund" only on a
+ * refund tool (or when the tool is not known). */
+export function appInputsText(provider, inputs = {}, tool = "refund") {
+  if (!record(inputs)) return toolInputsText({ _meta: { tool_params: inputs } });
+  const labels = { team: "Team", title: "Title", description: "Description", priority: "Priority", page_id: "Page", page: "Page", parent: "Page", content: "Adds", markdown: "Adds", body: "Comment", owner: "Owner", repo: "Repository", issue_number: "Issue", pullNumber: "Pull request", customer: "Customer", payment_intent: "Payment", charge: "Payment", reason: "Reason", currency: "Currency", to: "To", subject: "Subject" };
+  const money = (name, value) => provider === "stripe" && name === "amount" && Number.isSafeInteger(value) && value >= 0 && value <= 99999999;
+  const rows = Object.entries(inputs).slice(0, MAX_INPUTS).flatMap(([name, value]) => {
+    if (money(name, value)) return [{ line: `${/refund/i.test(tool) ? "Refund" : "Amount"}: ${moneyText(value, inputs.currency)}` }];
+    // The currency is already in the amount.
+    if (provider === "stripe" && name === "currency" && money("amount", inputs.amount) && /^[a-z]{3}$/i.test(String(value))) return [];
+    const display = mentionsSecret(name) || codeValue(name, value) ? HIDDEN : valueText(value);
+    return [{ line: `${(Object.hasOwn(labels, name) ? labels[name] : undefined) ?? (plainName(name) ? name : "hidden name")}: ${display}`, id: RAW_ID.test(display) }];
+  });
+  return "Details:\n" + [...rows.filter((row) => !row.id), ...rows.filter((row) => row.id)].map((row) => row.line).join("\n");
+}

package/lib/codingChecks.mjs

@@ -0,0 +1,55 @@
+// Package checks share the run's deadline and Stop signal. They never install
+// dependencies. Only test/build are selected; npm owns their script semantics.
+import { readFile, access } from "node:fs/promises";
+import { join } from "node:path";
+import { runChild, devServerEnv } from "./child.mjs";
+
+export async function runCodingChecks({ cwd, env, deadline, stopCheck, platform, killGraceMs, onChunk }) {
+  let pkg;
+  let unreadable = false;
+  try { pkg = JSON.parse(await readFile(join(cwd, "package.json"), "utf8")); }
+  catch (error) { unreadable = error.code !== "ENOENT"; }
+  let installed = true;
+  if (Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies, ...pkg?.optionalDependencies }).length) {
+    try { await access(join(cwd, "node_modules")); } catch { installed = false; }
+  }
+  const checks = [];
+  const failures = [];
+  const logs = [];
+  let stopped = false;
+  for (const [script, kind] of [["test", "tests"], ["build", "build"]]) {
+    const entry = { kind, status: "skipped", failed: 0 };
+    const hasScript = typeof pkg?.scripts?.[script] === "string" && pkg.scripts[script].trim();
+    if (unreadable) entry.reason = "Could not read the folder's checks.";
+    else if (!hasScript) entry.reason = `This folder has no ${script === "test" ? "tests" : "build"} to run.`;
+    else if (!installed) entry.reason = "The folder's dependencies are not installed.";
+    else if (stopped || await stopCheck?.()) {
+      stopped = true;
+      entry.reason = "Stopped before this check finished.";
+    } else if (Date.now() >= deadline) {
+      Object.assign(entry, { status: "failed", failed: 1, reason: "Ran out of time before this check finished." });
+    } else {
+      const out = await runChild({
+        bin: "npm", args: ["run", script], cwd, env: { ...devServerEnv(env, platform), CI: "true" },
+        platform, maxMs: deadline - Date.now(), stopCheck, stopPollMs: 100,
+        killGraceMs, maxLogBytes: 12_000, onChunk, killProcessGroup: true,
+      });
+      logs.push(out.log ?? "");
+      if (out.stoppedByUser) {
+        stopped = true;
+        entry.reason = "Stopped before this check finished.";
+      } else if (out.timedOut) {
+        Object.assign(entry, { status: "failed", failed: 1, reason: "Ran out of time before this check finished." });
+      } else if (out.spawnError || ([127, 9009].includes(out.code) && /(?:command not found|: not found|is not recognized as an internal or external command)/i.test(out.log ?? ""))) {
+        entry.reason = "A tool needed for this check is not installed.";
+      } else if (out.ok) {
+        entry.status = "passed";
+      } else {
+        Object.assign(entry, { status: "failed", failed: 1, reason: `${script === "test" ? "Tests" : "The build"} did not pass.` });
+        failures.push(`npm run ${script}\n${out.log ?? ""}`);
+      }
+    }
+    checks.push(entry);
+  }
+  return { checks, failures, stopped, log: logs.join("\n") };
+}