vigiles 2.5.0 → 3.0.0

package/dist/{sandbox.d.ts → adapters/claude-code/sandbox.d.ts}

@@ -8,10 +8,16 @@ import { type ModelTurn, type ModelRequest } from "./mock-model.js";
  */
 export type SandboxMode = "auto" | "strict" | false;
 /**
- * Whether bubblewrap is available to confine untrusted code. **Linux only** —
- * bubblewrap is a Linux tool, so this is always `false` on macOS / Windows,
- * where confined execution isn't supported and untrusted code must instead be
- * run via `sandbox: false` (trusting the outer container) or skipped.
+ * Whether this environment can ACTUALLY confine untrusted code under bubblewrap.
+ * **Linux only.** Critically, `bwrap --version` succeeding is NOT enough: many CI
+ * runners and hardened hosts ship bubblewrap but disable the **unprivileged user
+ * namespaces** it depends on, so a real confined exec fails even though the binary
+ * is present. We probe that real capability — a throwaway `bwrap --unshare-all …
+ * true` — and cache it, so we never *claim* confinement we can't deliver.
+ * `decideSandbox` then correctly refuses untrusted code in such an environment
+ * (rather than running it in a "sandbox" that doesn't actually sandbox), and the
+ * sandbox-gated tests skip instead of failing. The result is cached because the
+ * probe spawns a process and the answer can't change within a run.
  */
 export declare function sandboxAvailable(): boolean;
 /**
@@ -59,8 +65,43 @@ export declare function bwrapArgs(opts: {
     home: string;
     path: string;
 }): string[];
+/**
+ * `--setenv K V` pairs to add back specific variables after `--clearenv` — e.g.
+ * a hook's configured env (the `GUARD=path` a plugin's command relies on), which
+ * `bwrapArgs`' `--clearenv` would otherwise drop. Pure, so it's unit-tested.
+ */
+export declare function setenvArgs(env: Record<string, string>): string[];
 /** Parse the in-sandbox mock's ndjson request log into {@link ModelRequest}s. */
 export declare function parseRequestLog(ndjson: string): ModelRequest[];
+/** A network egress attempt a confined hook made — recorded, then blocked. */
+export interface EgressAttempt {
+    readonly host: string;
+    readonly port: number;
+    /** ms epoch when the attempt was recorded. */
+    readonly ts: number;
+    /**
+     * Allowlist mode (`egress: { allow }`) only: whether this host was on the
+     * allowlist (and so reachable). Undefined for the `recordEgress` proxy, where
+     * every attempt is blocked.
+     */
+    readonly allowed?: boolean;
+    /** Allowlist mode: packets the nftables counter recorded for this host. */
+    readonly packets?: number;
+    /** Allowlist mode: bytes the nftables counter recorded for this host. */
+    readonly bytes?: number;
+}
+/**
+ * Parse the egress recorder's ndjson log into {@link EgressAttempt}s. Pure, so
+ * the record-shape and the malformed-line tolerance are unit-tested without a
+ * sandbox. A line missing host/port is skipped (a partially-flushed final line).
+ */
+export declare function parseEgressLog(ndjson: string): EgressAttempt[];
+/**
+ * The files in `after` that are new or changed vs `before` — i.e. what a confined
+ * run wrote to its work dir. Each tree maps a relative path to a content
+ * signature (size + mtime). Pure, so the diff is unit-tested without a sandbox.
+ */
+export declare function diffTrees(before: Readonly<Record<string, string>>, after: Readonly<Record<string, string>>): string[];
 /** The raw output of a sandboxed run: exit code, captured stdout, and requests. */
 export interface SandboxRunOut {
     readonly code: number;

package/dist/{sandbox.js → adapters/claude-code/sandbox.js}

@@ -4,7 +4,10 @@ exports.sandboxAvailable = sandboxAvailable;
 exports.specTrusted = specTrusted;
 exports.decideSandbox = decideSandbox;
 exports.bwrapArgs = bwrapArgs;
+exports.setenvArgs = setenvArgs;
 exports.parseRequestLog = parseRequestLog;
+exports.parseEgressLog = parseEgressLog;
+exports.diffTrees = diffTrees;
 exports.runSandboxed = runSandboxed;
 /**
  * vigiles — safe-by-default confinement for executing untrusted harness code.
@@ -32,18 +35,36 @@ const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const runtime_js_1 = require("./runtime.js");
+let cachedAvailable;
 /**
- * Whether bubblewrap is available to confine untrusted code. **Linux only** —
- * bubblewrap is a Linux tool, so this is always `false` on macOS / Windows,
- * where confined execution isn't supported and untrusted code must instead be
- * run via `sandbox: false` (trusting the outer container) or skipped.
+ * Whether this environment can ACTUALLY confine untrusted code under bubblewrap.
+ * **Linux only.** Critically, `bwrap --version` succeeding is NOT enough: many CI
+ * runners and hardened hosts ship bubblewrap but disable the **unprivileged user
+ * namespaces** it depends on, so a real confined exec fails even though the binary
+ * is present. We probe that real capability — a throwaway `bwrap --unshare-all …
+ * true` — and cache it, so we never *claim* confinement we can't deliver.
+ * `decideSandbox` then correctly refuses untrusted code in such an environment
+ * (rather than running it in a "sandbox" that doesn't actually sandbox), and the
+ * sandbox-gated tests skip instead of failing. The result is cached because the
+ * probe spawns a process and the answer can't change within a run.
  */
 function sandboxAvailable() {
+    if (cachedAvailable === undefined)
+        cachedAvailable = probeSandbox();
+    return cachedAvailable;
+}
+function probeSandbox() {
     /* v8 ignore next -- non-Linux has no bwrap; CI/coverage runs on Linux */
     if (process.platform !== "linux")
         return false;
     try {
-        return (0, node_child_process_1.spawnSync)("bwrap", ["--version"], { stdio: "ignore" }).status === 0;
+        // The capability that fails when user namespaces are disabled is the
+        // namespace creation itself (`--unshare-all`), so probe exactly that.
+        return ((0, node_child_process_1.spawnSync)("bwrap", ["--unshare-all", "--ro-bind", "/", "/", "true"], {
+            stdio: "ignore",
+            timeout: 10_000,
+        }).status === 0);
     }
     catch {
         /* v8 ignore next -- defensive: spawnSync only throws on a fork failure */
@@ -138,6 +159,17 @@ function bwrapArgs(opts) {
         "--new-session",
     ];
 }
+/**
+ * `--setenv K V` pairs to add back specific variables after `--clearenv` — e.g.
+ * a hook's configured env (the `GUARD=path` a plugin's command relies on), which
+ * `bwrapArgs`' `--clearenv` would otherwise drop. Pure, so it's unit-tested.
+ */
+function setenvArgs(env) {
+    const out = [];
+    for (const [k, v] of Object.entries(env))
+        out.push("--setenv", k, v);
+    return out;
+}
 /** Parse the in-sandbox mock's ndjson request log into {@link ModelRequest}s. */
 function parseRequestLog(ndjson) {
     const out = [];
@@ -153,6 +185,41 @@ function parseRequestLog(ndjson) {
     }
     return out;
 }
+/**
+ * Parse the egress recorder's ndjson log into {@link EgressAttempt}s. Pure, so
+ * the record-shape and the malformed-line tolerance are unit-tested without a
+ * sandbox. A line missing host/port is skipped (a partially-flushed final line).
+ */
+function parseEgressLog(ndjson) {
+    const out = [];
+    for (const line of ndjson.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const o = JSON.parse(line);
+            if (typeof o.host === "string" && typeof o.port === "number") {
+                out.push({ host: o.host, port: o.port, ts: Number(o.ts) || 0 });
+            }
+        }
+        catch {
+            /* a partially-written final line — skip */
+        }
+    }
+    return out;
+}
+/**
+ * The files in `after` that are new or changed vs `before` — i.e. what a confined
+ * run wrote to its work dir. Each tree maps a relative path to a content
+ * signature (size + mtime). Pure, so the diff is unit-tested without a sandbox.
+ */
+function diffTrees(before, after) {
+    const out = [];
+    for (const [path, sig] of Object.entries(after)) {
+        if (before[path] !== sig)
+            out.push(path);
+    }
+    return out.sort();
+}
 /**
  * Co-launch the scripted mock and `claude` inside ONE bubblewrap network
  * namespace: the mock serves on the sandbox's loopback (reachable), egress is
@@ -166,9 +233,10 @@ const WRAPPER = [
     "MOCKPID=$!",
     "i=0",
     'while [ ! -s "$VIG_PORT" ] && [ "$i" -lt 200 ]; do sleep 0.05; i=$((i+1)); done',
-    'export ANTHROPIC_BASE_URL="http://127.0.0.1:$(cat "$VIG_PORT")"',
-    "export ANTHROPIC_API_KEY=sk-vigiles-mock",
-    'claude "$@"',
+    // base-URL / API-key vars + the agent binary come from the runtime port.
+    `export ${runtime_js_1.claudeCodeRuntime.modelBaseUrlEnv}="http://127.0.0.1:$(cat "$VIG_PORT")"`,
+    `export ${runtime_js_1.claudeCodeRuntime.modelApiKeyEnv}=${runtime_js_1.claudeCodeRuntime.mockApiKey}`,
+    `${runtime_js_1.claudeCodeRuntime.agentBinary} "$@"`,
     "code=$?",
     'kill "$MOCKPID" 2>/dev/null',
     'exit "$code"',

package/dist/{skill-driver.d.ts → adapters/claude-code/skill-driver.d.ts}

@@ -13,7 +13,7 @@
  * is fed back into the generator). Gates are deterministic and reuse the gate
  * runtime. This module is the mechanics — fully testable without a live model.
  */
-import type { Gate } from "./spec.js";
+import type { Gate } from "../../core/spec.js";
 import { type GateOutcome } from "./skill-runtime.js";
 export type SkillEffect = {
     readonly kind: "act";

package/dist/adapters/codex/adapter.d.ts

@@ -0,0 +1,3 @@
+import type { HarnessAdapter } from "../../core/adapter.js";
+export declare const codexAdapter: HarnessAdapter;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapters/codex/adapter.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexAdapter = void 0;
+/**
+ * codexAdapter — the OpenAI Codex `HarnessAdapter`. Bundles the five Codex ports
+ * + a `detect`. SHIPPED: registered in `src/adapter-registry.ts` (the CLI
+ * auto-detects a `.codex/config.toml` or `AGENTS.md` repo) and exported as
+ * `vigiles/codex`. It passes `assertAdapterConformance`/`assertAdapterLoadsHooks`,
+ * drives the compiler + loader against real Codex fixtures (codex.test.ts), and
+ * its transport (`mock-model.ts`) is proven against the real `codex` binary.
+ *
+ * Caveat — pillar 1 (compile) is partial: the instruction/skill *renderers* still
+ * emit the Claude-Code shape until the format-axis renderers land
+ * (`research/code-adapter-architecture.md`). Pillar 2 (harness testing) is full.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const dialect_js_1 = require("./dialect.js");
+const layout_js_1 = require("./layout.js");
+const runtime_js_1 = require("./runtime.js");
+const hook_protocol_js_1 = require("./hook-protocol.js");
+const model_mock_js_1 = require("./model-mock.js");
+const driver_js_1 = require("./driver.js");
+exports.codexAdapter = {
+    name: "codex",
+    // Full convergence with Claude Code: mockable (Responses SSE) + shell hooks
+    // with veto (permissionDecision/exit 2). Both pillars, all tiers.
+    capabilities: {
+        referenceVerification: true,
+        harnessTesting: true,
+        shellHooks: true,
+    },
+    dialect: dialect_js_1.codexDialect,
+    layout: layout_js_1.codexLayout,
+    runtime: runtime_js_1.codexRuntime,
+    hookProtocol: hook_protocol_js_1.codexHookProtocol,
+    modelMock: model_mock_js_1.codexModelMock,
+    harnessTestDriver: driver_js_1.codexDriver,
+    detect(root) {
+        // A `.codex/config.toml` is a strong signal; a bare AGENTS.md is weak (many
+        // harnesses read it). (Unused while unregistered — kept for symmetry.)
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(root, ".codex", "config.toml")))
+            return 3;
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(root, layout_js_1.codexLayout.instructionFile)))
+            return 1;
+        return 0;
+    },
+};
+//# sourceMappingURL=adapter.js.map

package/dist/adapters/codex/dialect.d.ts

@@ -0,0 +1,10 @@
+/**
+ * codexDialect — EXPERIMENTAL, internal-only. A prototype `HarnessDialect` for
+ * OpenAI Codex, built from the mid-2026 research (research/harness-landscape.md)
+ * to validate that the format axis actually generalizes beyond Claude Code. NOT
+ * exported from `vigiles/*` and NOT registered in the adapter registry — it
+ * exists to be run through the conformance kit + real Codex-shaped fixtures.
+ */
+import type { HarnessDialect } from "../../core/dialect.js";
+export declare const codexDialect: HarnessDialect;
+//# sourceMappingURL=dialect.d.ts.map

package/dist/adapters/codex/dialect.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexDialect = void 0;
+exports.codexDialect = {
+    name: "codex",
+    // Codex model-facing tools (shell/exec, file edits, plan, web), + MCP tools.
+    builtinAgentTools: ["shell", "apply_patch", "update_plan", "web_search"],
+    // No documented "never available to a subagent" set yet — left empty.
+    neverAvailableTools: [],
+    mcpToolPattern: /^mcp__[a-z0-9_-]+__[a-z0-9_-]+$/i,
+    // Codex hooks (near-1:1 with Claude Code) + its extras.
+    hookEvents: [
+        "SessionStart",
+        "SubagentStart",
+        "SubagentStop",
+        "PreToolUse",
+        "PostToolUse",
+        "PermissionRequest",
+        "PreCompact",
+        "PostCompact",
+        "UserPromptSubmit",
+        "Stop",
+    ],
+    instructionTargets: ["AGENTS.md"],
+    pluginRootToken: "${PLUGIN_ROOT}",
+    // Codex SKILL.md frontmatter is name + description ONLY — the CC-only keys
+    // (disable-model-invocation, argument-hint, …) are not part of its format.
+    skillFrontmatter: "minimal",
+};
+//# sourceMappingURL=dialect.js.map

package/dist/adapters/codex/driver.d.ts

@@ -0,0 +1,20 @@
+import type { HarnessTestDriver, HarnessDriverContext, ParsedRun } from "../../core/harness-driver.js";
+/**
+ * The non-interactive `codex exec` argv. The mock-wiring `-c` flags
+ * (`ctx.mockArgs`, from `runtime.wireMock`) MUST follow `exec` — placed before
+ * `exec` they're parsed as global flags and ignored (codex falls back to the
+ * real OpenAI provider). `--ephemeral` +
+ * `--dangerously-bypass-approvals-and-sandbox` make it run unattended;
+ * `--skip-git-repo-check` lets it run in a bare temp dir; `--ignore-user-config`
+ * keeps the host's `~/.codex` out. The prompt is the trailing positional.
+ * Pure, so the arg shape is unit-tested.
+ */
+export declare function buildCodexArgs(ctx: HarnessDriverContext): string[];
+/**
+ * Extract the final assistant text from codex stdout. Codex `exec` prints the
+ * assistant message as plain text (no `--json` here); we return the trimmed
+ * stdout as the output. Pure, so it's unit-tested without spawning codex.
+ */
+export declare function parseCodexRun(stdout: string): ParsedRun;
+export declare const codexDriver: HarnessTestDriver;
+//# sourceMappingURL=driver.d.ts.map

package/dist/adapters/codex/driver.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexDriver = void 0;
+exports.buildCodexArgs = buildCodexArgs;
+exports.parseCodexRun = parseCodexRun;
+/**
+ * codexDriver — the Codex `HarnessTestDriver`. Lets the adapter-driven
+ * `runHarnessTest` drive real `codex exec` against the proven OpenAI-Responses
+ * mock (`startCodexMock`), keylessly, via the `wireMock` flag recipe in
+ * `runtime.ts`. The Codex-side analogue of `claudeCodeDriver`.
+ *
+ * Scope: pillar-2 deterministic harness testing of the *output* turn — codex's
+ * non-interactive `exec` runs the scripted mock to completion and the final
+ * assistant text lands in `parseRun().output`. Tool-call / hook stream parsing
+ * is left empty (the JSONL schema isn't worth fully parsing for the output
+ * check); a test that needs those uses Claude Code today.
+ */
+const node_child_process_1 = require("node:child_process");
+const runtime_js_1 = require("./runtime.js");
+const mock_model_js_1 = require("./mock-model.js");
+/**
+ * The non-interactive `codex exec` argv. The mock-wiring `-c` flags
+ * (`ctx.mockArgs`, from `runtime.wireMock`) MUST follow `exec` — placed before
+ * `exec` they're parsed as global flags and ignored (codex falls back to the
+ * real OpenAI provider). `--ephemeral` +
+ * `--dangerously-bypass-approvals-and-sandbox` make it run unattended;
+ * `--skip-git-repo-check` lets it run in a bare temp dir; `--ignore-user-config`
+ * keeps the host's `~/.codex` out. The prompt is the trailing positional.
+ * Pure, so the arg shape is unit-tested.
+ */
+function buildCodexArgs(ctx) {
+    return [
+        "exec",
+        "--ignore-user-config",
+        "--skip-git-repo-check",
+        "--ephemeral",
+        "--dangerously-bypass-approvals-and-sandbox",
+        ...ctx.mockArgs,
+        "-c",
+        'model="gpt-5-codex"',
+        ctx.prompt,
+    ];
+}
+/**
+ * Extract the final assistant text from codex stdout. Codex `exec` prints the
+ * assistant message as plain text (no `--json` here); we return the trimmed
+ * stdout as the output. Pure, so it's unit-tested without spawning codex.
+ */
+function parseCodexRun(stdout) {
+    return { toolCalls: [], hooks: [], output: stdout.trim() };
+}
+/* v8 ignore start -- spawns the real codex CLI; exercised by the gated
+   codex-backed suite, the pure helpers above carry the testable logic. */
+function codexAvailable() {
+    try {
+        return ((0, node_child_process_1.spawnSync)(runtime_js_1.codexRuntime.agentBinary, ["--version"], {
+            stdio: "ignore",
+        }).status === 0);
+    }
+    catch {
+        return false;
+    }
+}
+async function startCodexMockHandle(script) {
+    const mock = await (0, mock_model_js_1.startCodexMock)(script.map((t) => ({ text: t.text ?? "" })));
+    return {
+        url: mock.url,
+        get requests() {
+            // Codex requests carry only the flattened prompt; adapt to ModelRequest.
+            return mock.requests.map((r) => ({
+                system: "",
+                messages: [{ role: "user", text: r.prompt }],
+            }));
+        },
+        get count() {
+            return mock.requests.length;
+        },
+        close: () => mock.close(),
+    };
+}
+exports.codexDriver = {
+    runtime: runtime_js_1.codexRuntime,
+    buildArgs: buildCodexArgs,
+    startMock: startCodexMockHandle,
+    parseRun: parseCodexRun,
+    available: codexAvailable,
+};
+/* v8 ignore stop */
+//# sourceMappingURL=driver.js.map

package/dist/adapters/codex/hook-protocol.d.ts

@@ -0,0 +1,10 @@
+/**
+ * codexHookProtocol — EXPERIMENTAL, internal-only. Codex's hook wire protocol.
+ * Finding: it is essentially IDENTICAL to Claude Code's (exit 2 / `decision:block`
+ * / `permissionDecision:deny`) — the thin `HookProtocol` port was the right call.
+ * The genuine deltas are the env vars a hook receives + the TOML config format
+ * (the latter lives in PluginLayout.settingsFormat, not here).
+ */
+import type { HookProtocol } from "../../core/hook-protocol.js";
+export declare const codexHookProtocol: HookProtocol;
+//# sourceMappingURL=hook-protocol.d.ts.map

package/dist/adapters/codex/hook-protocol.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexHookProtocol = void 0;
+exports.codexHookProtocol = {
+    name: "codex",
+    blockExitCode: 2,
+    denyDecisionValues: ["block", "deny"],
+    eventEnvVars: [
+        "session_id",
+        "cwd",
+        "hook_event_name",
+        "model",
+        "turn_id",
+        "permission_mode",
+        "PLUGIN_ROOT",
+    ],
+};
+//# sourceMappingURL=hook-protocol.js.map

package/dist/adapters/codex/layout.d.ts

@@ -0,0 +1,16 @@
+/**
+ * codexLayout — EXPERIMENTAL, internal-only. A prototype `PluginLayout` for
+ * Codex: `.codex/` conventions, `config.toml` (TOML) hooks, `AGENTS.md`,
+ * `${PLUGIN_ROOT}`. Validates the layout port + the settings-format axis against
+ * real Codex shapes. NOT exported / NOT registered.
+ *
+ * Findings surfaced by writing it (see research/codex-prototype-findings.md):
+ * - Codex has no separate JSON *manifest* — `config.toml` carries everything; we
+ *   point `manifestPath` at it (its JSON parse simply fails → the loader falls
+ *   through to the TOML `settingsPath`). The manifest field is CC-JSON-shaped.
+ * - MCP detection (`mcpConfigFile`/`mcpManifestKey`) is JSON-shaped, so it won't
+ *   see Codex's `[mcp_servers]` TOML table — a known layout-port gap.
+ */
+import type { PluginLayout } from "../../core/layout.js";
+export declare const codexLayout: PluginLayout;
+//# sourceMappingURL=layout.d.ts.map

package/dist/adapters/codex/layout.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexLayout = void 0;
+exports.codexLayout = {
+    name: "codex",
+    manifestPath: ".codex/config.toml",
+    hooksConventionPath: ".codex/hooks.json",
+    settingsPath: ".codex/config.toml",
+    settingsFormat: "toml",
+    instructionFile: "AGENTS.md",
+    surfaceDirs: ["skills", "prompts"],
+    materializeRoot: ".codex",
+    pluginRootToken: "${PLUGIN_ROOT}",
+    mcpConfigFile: ".mcp.json",
+    mcpManifestKey: "mcp_servers",
+    intraRefDirs: ["skills", "prompts", "hooks"],
+};
+//# sourceMappingURL=layout.js.map

package/dist/adapters/codex/mock-model.d.ts

@@ -0,0 +1,52 @@
+/** One scripted assistant turn: the final text answer codex should emit. */
+export interface CodexTurn {
+    /** Final text answer for this turn. */
+    readonly text: string;
+}
+/**
+ * One `/v1/responses` request the mock received, parsed for assertions: the
+ * user's prompt (last `input` item with `role:"user"`), the requested model,
+ * and the declared function-tool names.
+ */
+export interface CodexRequest {
+    readonly prompt: string;
+    readonly model: string;
+    readonly toolNames: readonly string[];
+}
+export interface CodexMockHandle {
+    readonly url: string;
+    readonly port: number;
+    /** Every `/v1/responses` request the mock received, in order. */
+    readonly requests: readonly CodexRequest[];
+    close(): Promise<void>;
+}
+/**
+ * Render the PROVEN OpenAI-Responses SSE event sequence for a single assistant
+ * text message — `response.created` through `response.completed`. This exact
+ * sequence is confirmed to make real `codex` complete a turn. Pure and exported
+ * so the renderer is testable without the HTTP server.
+ */
+export declare function renderResponsesSSE(text: string, opts?: {
+    model?: string;
+}): string;
+/**
+ * Parse a Responses request body — the user's prompt (the LAST `input` item
+ * with `role:"user"`, joining its `content[].text`), the requested `model`, and
+ * the declared function-tool names. Tolerates malformed JSON (returns an empty
+ * prompt). Pure and exported so request capture is testable without the server.
+ */
+export declare function parseResponsesRequest(body: string): {
+    prompt: string;
+    model: string;
+    toolNames: string[];
+};
+/**
+ * Start the scripted Codex Responses mock on a free port. Each
+ * `POST /v1/responses` consumes the next scripted turn (the last turn repeats if
+ * codex asks for more); HEAD and any other path get `{}`. Resolves to a handle
+ * with the base `url`, the `port`, the recorded `requests`, and `close()`.
+ */
+export declare function startCodexMock(script: readonly CodexTurn[], opts?: {
+    onRequest?: (req: CodexRequest) => void;
+}): Promise<CodexMockHandle>;
+//# sourceMappingURL=mock-model.d.ts.map