yuurei 0.0.1

package/dist/runtime/codex/args.d.ts

@@ -0,0 +1,21 @@
+import type { ResolvedCell } from '../../cell/types.js';
+/**
+ * Builds the non-interactive CLI invocation for Codex. Kept isolated from
+ * the rest of the codebase so a future CLI flag change only touches this
+ * file (design doc §6.1: adapter-internal conventions must not leak).
+ *
+ * `-c` overrides always win over a config.toml value (verified against the
+ * real `codex` CLI). Forcing the credential store to `file` here, at the
+ * adapter boundary, closes an isolation bypass: a materialized profile's
+ * own `config.toml` could otherwise set `cli_auth_credentials_store =
+ * "keyring"` (or "auto", which prefers the keyring when available) and read
+ * or refresh the operator's real OS-keychain-backed credential — entirely
+ * outside the isolated CODEX_HOME, regardless of whether
+ * --bridge-codex-auth-file was ever passed. mcp_oauth_credentials_store
+ * defaults to "auto" for the same reason and gets the same override. This
+ * doesn't need to defend against a profile's own -p/--profile config layer,
+ * since this adapter never passes -p — only the single materialized
+ * config.toml is ever in play.
+ */
+export declare function buildCodexArgs(cell: ResolvedCell): string[];
+//# sourceMappingURL=args.d.ts.map

package/dist/runtime/codex/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../../src/runtime/codex/args.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CAe3D"}

package/dist/runtime/codex/args.js

@@ -0,0 +1,35 @@
+/**
+ * Builds the non-interactive CLI invocation for Codex. Kept isolated from
+ * the rest of the codebase so a future CLI flag change only touches this
+ * file (design doc §6.1: adapter-internal conventions must not leak).
+ *
+ * `-c` overrides always win over a config.toml value (verified against the
+ * real `codex` CLI). Forcing the credential store to `file` here, at the
+ * adapter boundary, closes an isolation bypass: a materialized profile's
+ * own `config.toml` could otherwise set `cli_auth_credentials_store =
+ * "keyring"` (or "auto", which prefers the keyring when available) and read
+ * or refresh the operator's real OS-keychain-backed credential — entirely
+ * outside the isolated CODEX_HOME, regardless of whether
+ * --bridge-codex-auth-file was ever passed. mcp_oauth_credentials_store
+ * defaults to "auto" for the same reason and gets the same override. This
+ * doesn't need to defend against a profile's own -p/--profile config layer,
+ * since this adapter never passes -p — only the single materialized
+ * config.toml is ever in play.
+ */
+export function buildCodexArgs(cell) {
+    const args = [
+        'exec',
+        '--json',
+        '--skip-git-repo-check',
+        '-c',
+        'cli_auth_credentials_store="file"',
+        '-c',
+        'mcp_oauth_credentials_store="file"',
+        cell.resolvedTask.content,
+    ];
+    if (cell.requestedModel) {
+        args.push('--model', cell.requestedModel);
+    }
+    return args;
+}
+//# sourceMappingURL=args.js.map

package/dist/runtime/codex/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../../src/runtime/codex/args.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,MAAM,IAAI,GAAG;QACX,MAAM;QACN,QAAQ;QACR,uBAAuB;QACvB,IAAI;QACJ,mCAAmC;QACnC,IAAI;QACJ,oCAAoC;QACpC,IAAI,CAAC,YAAY,CAAC,OAAO;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/codex/index.d.ts

@@ -0,0 +1,13 @@
+import type { IsolationContext } from '../../isolation/types.js';
+import type { ResolvedCell } from '../../cell/types.js';
+import type { NormalizationContext, NormalizedTraceFragment, PreparedRun, RegisterCredentialPath, Runtime, RuntimeDetection, RuntimeResult } from '../types.js';
+/** Remove Codex's benign non-interactive stdin notice from durable stderr logs. */
+export declare function stripCodexStdinNotice(stderr: string): string;
+export declare class CodexRuntime implements Runtime {
+    id(): string;
+    detect(): Promise<RuntimeDetection>;
+    prepare(cell: ResolvedCell, isolation: IsolationContext, registerCredentialPath: RegisterCredentialPath): Promise<PreparedRun>;
+    execute(run: PreparedRun, timeoutMs: number | null): Promise<RuntimeResult>;
+    normalize(result: RuntimeResult, context: NormalizationContext): Promise<NormalizedTraceFragment>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/codex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/codex/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACtB,OAAO,EACP,gBAAgB,EAChB,aAAa,EACd,MAAM,aAAa,CAAC;AAkBrB,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5D;AA0HD,qBAAa,YAAa,YAAW,OAAO;IAC1C,EAAE,IAAI,MAAM;IAIN,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkBnC,OAAO,CACX,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,gBAAgB,EAC3B,sBAAsB,EAAE,sBAAsB,GAC7C,OAAO,CAAC,WAAW,CAAC;IA6CjB,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IAkB3E,SAAS,CACb,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC;CA6EpC"}

package/dist/runtime/codex/index.js

@@ -0,0 +1,299 @@
+import { chmod, copyFile, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { configRootOf } from '../../isolation/config-root.js';
+import { EXIT_CODES, YuureiError } from '../../cli/exit-codes.js';
+import { detectViaVersionFlag, isVersionAtLeast } from '../detect.js';
+import { execCapture } from '../exec.js';
+import { isPathWithin, pathExists, writeFileTree } from '../../util/fs.js';
+import { assertNoReservedConfigPath } from '../reserved-paths.js';
+import { buildCodexArgs } from './args.js';
+import { codexConfigDir } from './paths.js';
+const RUNTIME_ID = 'codex';
+const COMMAND = 'codex';
+const MIN_SUPPORTED_VERSION = [0, 100, 0];
+/**
+ * Root-level `auth.json` is reserved for the opt-in bridged credential (see
+ * bridgeCodexAuthFile below). See `assertNoReservedConfigPath` for why this is
+ * enforced even when the bridge is disabled.
+ */
+const CODEX_RESERVED_CONFIG_PATHS = ['auth.json'];
+const CODEX_STDIN_NOTICE = 'Reading additional input from stdin...';
+/** Remove Codex's benign non-interactive stdin notice from durable stderr logs. */
+export function stripCodexStdinNotice(stderr) {
+    return stderr
+        .split('\n')
+        .filter((line) => line !== CODEX_STDIN_NOTICE && line !== `${CODEX_STDIN_NOTICE}\r`)
+        .join('\n');
+}
+/**
+ * Supported v0.3 method (design doc §9.2) for Codex: forward an explicitly-set
+ * API key from the parent environment, exactly mirroring how the Claude Code
+ * adapter forwards ANTHROPIC_API_KEY. Verified against the real `codex` CLI:
+ * `codex exec` authenticates from OPENAI_API_KEY in the environment with no
+ * ~/.codex/auth.json present at all, so this needs no file on disk and carries
+ * no rotation risk — an API key doesn't rotate mid-run the way an OAuth
+ * access/refresh token pair can. Returns the forwarded value (if any) so the
+ * pipeline can redact it from persisted logs.
+ */
+function bridgeCodexApiKey(env) {
+    const value = process.env['OPENAI_API_KEY'];
+    if (!value)
+        return [];
+    env['OPENAI_API_KEY'] = value;
+    return [value];
+}
+function wantsCodexAuthFileBridge(executionOptions) {
+    return executionOptions['bridgeCodexAuthFile'] === true;
+}
+/**
+ * Best-effort extraction of the actual secret values inside a bridged
+ * auth.json (the API-key field, plus the OAuth token triple when present —
+ * see the `auth_mode`/`tokens` shape Codex itself writes), so the pipeline
+ * can redact them from persisted logs by exact value rather than by a
+ * pattern that may not match an opaque token or JWT. Never throws: a file
+ * we just copied ourselves failing to re-parse is treated the same as
+ * finding nothing to redact, not as a reason to fail preparation.
+ */
+async function extractCodexAuthSecrets(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null)
+            return [];
+        const record = parsed;
+        const values = [];
+        const apiKey = record['OPENAI_API_KEY'];
+        if (typeof apiKey === 'string')
+            values.push(apiKey);
+        const tokens = record['tokens'];
+        if (typeof tokens === 'object' && tokens !== null) {
+            const tokenRecord = tokens;
+            for (const key of ['access_token', 'refresh_token', 'id_token']) {
+                const value = tokenRecord[key];
+                if (typeof value === 'string')
+                    values.push(value);
+            }
+        }
+        return values;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Experimental, opt-in method for reusing an interactive ChatGPT login: copy
+ * exactly ~/.codex/auth.json into the isolated CODEX_HOME at mode 0600. Not
+ * the supported v0.3 path — that's bridgeCodexApiKey above — because this
+ * file can carry a rotating OAuth token pair. If `codex exec` refreshes the
+ * token mid-run, only the isolated copy receives the new state; the real
+ * ~/.codex/auth.json stays stale, and the valid rotated copy is then deleted
+ * by the pipeline's credential scrub. Writing the rotated state back to the
+ * real file would fix that but violates principle 1 (never modify the
+ * user's existing global configuration), so this is left as a known,
+ * documented limitation rather than "fixed" by breaking that guarantee —
+ * callers who opt in accept it. Copies nothing else from the real ~/.codex;
+ * a copy rather than a symlink for the same reason (a symlink would let a
+ * token refresh write *through* to the real file).
+ *
+ * `destDir` is guaranteed to hold no `auth.json` before this runs
+ * (assertNoReservedConfigPath rejects a profile-supplied one earlier in
+ * prepare()), so on any failure below the dest is left absent, not stale —
+ * the run then runs genuinely unauthenticated rather than under a wrong or
+ * partial credential — UNLESS cleaning up a failed copy also fails (a
+ * double fault: e.g. copyFile succeeds but chmod then fails, and the
+ * catch-block's own rm() fails too). In that case the file at `dest` is
+ * left in an unknown state. prepare() already registered `dest` with the
+ * pipeline before this call, so the scrub retries the removal during
+ * cleanup; if that second removal also fails the pipeline reports the
+ * residual path via onWarning. This still throws (rather than silently
+ * returning as if nothing were bridged) because aborting prepare() is
+ * judged safer than launching Codex against a leftover, untracked
+ * credential file at a reserved path.
+ */
+async function bridgeCodexAuthFile(destDir) {
+    // homedir() follows process.env.HOME, so a test override of process.env.HOME
+    // reaches this lookup — matching how Level1Isolation.verify() locates the real home.
+    const realCodexHome = codexConfigDir(homedir());
+    const sourcePath = join(realCodexHome, 'auth.json');
+    const dest = join(destDir, 'auth.json');
+    // Graft from synthesis.md: guard against auth.json itself being a symlink that
+    // escapes ~/.codex (e.g. -> ~/.ssh/id_rsa). Non-fatal — return rather than throw.
+    if (!(await isPathWithin(realCodexHome, sourcePath)))
+        return [];
+    if (!(await pathExists(sourcePath)))
+        return [];
+    // Best-effort per §12.2: any I/O failure here (permission error, a source
+    // file removed between the checks above and the copy, a full disk) must
+    // not abort the run — it must leave the run unauthenticated, same as a
+    // missing source file. destDir already exists (prepare() creates it).
+    try {
+        await copyFile(sourcePath, dest);
+        await chmod(dest, 0o600);
+    }
+    catch (bridgeError) {
+        // Don't leave a partial copy (e.g. chmod failed after copyFile succeeded)
+        // sitting at the reserved path — absent is the only safe failure state.
+        try {
+            await rm(dest, { force: true });
+        }
+        catch (cleanupError) {
+            throw new YuureiError(`failed to bridge Codex credentials (${bridgeError instanceof Error ? bridgeError.message : String(bridgeError)}) and could not remove the partial copy left at ${dest}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, EXIT_CODES.ISOLATION_VERIFICATION_FAILED);
+        }
+        return [];
+    }
+    return extractCodexAuthSecrets(dest);
+}
+export class CodexRuntime {
+    id() {
+        return RUNTIME_ID;
+    }
+    async detect() {
+        const detection = await detectViaVersionFlag(COMMAND);
+        const authUsable = detection.installed && Boolean(process.env['OPENAI_API_KEY']);
+        return {
+            ...detection,
+            versionSupported: isVersionAtLeast(detection.version, MIN_SUPPORTED_VERSION),
+            authUsable,
+            ...(detection.installed && authUsable === false
+                ? {
+                    authGuidance: 'Export OPENAI_API_KEY in this shell and re-run `yuurei doctor`. ' +
+                        'A shell export applies only to that shell and its child processes; do not persist the key in a profile, task, or committed file. ' +
+                        'Verify the variable is set without printing its value: [ -n "$OPENAI_API_KEY" ] && echo present || echo absent',
+                }
+                : {}),
+        };
+    }
+    async prepare(cell, isolation, registerCredentialPath) {
+        const env = { ...isolation.env };
+        const configDir = codexConfigDir(configRootOf(isolation));
+        await mkdir(configDir, { recursive: true, mode: 0o700 });
+        // A profile must never be able to supply its own auth.json (§9.2) — reject
+        // it before anything is written, rather than relying on write order to
+        // paper over the collision (a bridge that no-ops or fails would otherwise
+        // let a profile-supplied credential silently survive).
+        assertNoReservedConfigPath(configDir, cell.resolvedProfile.content.configFiles, CODEX_RESERVED_CONFIG_PATHS);
+        await writeFileTree(configDir, cell.resolvedProfile.content.configFiles);
+        const credentialValuesToRedact = bridgeCodexApiKey(env);
+        if (wantsCodexAuthFileBridge(cell.executionOptions)) {
+            // Register the destination before the copy. A signal or throw between
+            // the write and prepare()'s return — or the documented double fault,
+            // where the adapter's own cleanup rm() fails — must still leave the file
+            // on the scrub list; the pipeline removes a registered path even on
+            // paths where no PreparedRun is ever returned (§9.2). Registering a path
+            // the copy never reaches is harmless: the scrub's rm has `force: true`.
+            registerCredentialPath(join(configDir, 'auth.json'));
+            const secretValues = await bridgeCodexAuthFile(configDir);
+            credentialValuesToRedact.push(...secretValues);
+        }
+        env['CODEX_HOME'] = configDir;
+        const detection = await this.detect();
+        return {
+            runtimeId: RUNTIME_ID,
+            command: COMMAND,
+            args: buildCodexArgs(cell),
+            env,
+            cwd: isolation.rootDir,
+            isolation,
+            cell,
+            runtimeVersion: detection.version,
+            credentialValuesToRedact,
+        };
+    }
+    async execute(run, timeoutMs) {
+        const result = await execCapture({
+            command: run.command,
+            args: run.args,
+            env: run.env,
+            cwd: run.cwd,
+            stdoutPath: join(run.isolation.rootDir, 'stdout.log'),
+            stderrPath: join(run.isolation.rootDir, 'stderr.log'),
+            ...(timeoutMs !== null ? { timeoutMs } : {}),
+        });
+        const stderr = await readFile(result.stderrPath, 'utf8');
+        const filteredStderr = stripCodexStdinNotice(stderr);
+        if (filteredStderr !== stderr) {
+            await writeFile(result.stderrPath, filteredStderr, 'utf8');
+        }
+        return result;
+    }
+    async normalize(result, context) {
+        const durationMs = new Date(result.finishedAt).getTime() - new Date(result.startedAt).getTime();
+        let usage = {};
+        const warnings = [];
+        try {
+            const stdout = await readFile(result.stdoutPath, 'utf8');
+            // Scan all lines to count every malformed line (including those after
+            // turn.completed) and to treat valid-JSON non-objects as malformed too.
+            let firstCompleted = null;
+            let malformedLineCount = 0;
+            for (const line of stdout.split('\n')) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                let event;
+                try {
+                    event = JSON.parse(trimmed);
+                }
+                catch {
+                    malformedLineCount++;
+                    continue;
+                }
+                if (typeof event !== 'object' || event === null) {
+                    // Valid JSON but not an object (null, string, number) — not a valid event
+                    malformedLineCount++;
+                    continue;
+                }
+                const obj = event;
+                if (obj['type'] === 'turn.completed' && firstCompleted === null) {
+                    firstCompleted = obj;
+                }
+            }
+            if (malformedLineCount > 0) {
+                warnings.push(`codex: ${malformedLineCount} unparseable JSONL line(s) skipped`);
+            }
+            if (firstCompleted !== null) {
+                const usageRaw = firstCompleted['usage'];
+                if (typeof usageRaw === 'object' && usageRaw !== null) {
+                    const u = usageRaw;
+                    const pick = (key) => {
+                        const v = u[key];
+                        return typeof v === 'number' ? v : null;
+                    };
+                    usage = {
+                        input_tokens: pick('input_tokens'),
+                        output_tokens: pick('output_tokens'),
+                        cached_input_tokens: pick('cached_input_tokens'),
+                        cache_write_input_tokens: pick('cache_write_input_tokens'),
+                        reasoning_output_tokens: pick('reasoning_output_tokens'),
+                    };
+                }
+                else {
+                    warnings.push('codex: turn.completed event had no usage field — usage unobserved');
+                }
+            }
+            else {
+                warnings.push('codex: no turn.completed event found in stdout — usage unobserved');
+            }
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'ENOENT') {
+                // Missing stdout is expected for killed/timed-out runs; warn only on normal exit
+                if (result.exitCode === 0 && result.signal === null && !result.timedOut) {
+                    warnings.push('codex: stdout absent after normal exit — usage unobserved');
+                }
+            }
+            else {
+                warnings.push(`codex: stdout unreadable (${err instanceof Error ? err.message : String(err)}) — usage unobserved`);
+            }
+        }
+        return {
+            runtime: { id: RUNTIME_ID, version: context.runtimeVersion },
+            model: { requested: '', resolved: null },
+            execution: { exitCode: result.exitCode, signal: result.signal, durationMs },
+            usage,
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/runtime/codex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/codex/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAUzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,UAAU,GAAG,OAAO,CAAC;AAC3B,MAAM,OAAO,GAAG,OAAO,CAAC;AACxB,MAAM,qBAAqB,GAA6B,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,CAAC,WAAW,CAAU,CAAC;AAC3D,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAEpE,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,GAAG,kBAAkB,IAAI,CAAC;SACnF,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,GAA2B;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAAC,gBAAyC;IACzE,OAAO,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,IAAI,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAiC,CAAC;QAEjD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,MAAiC,CAAC;YACtD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC;gBAChE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAe;IAChD,6EAA6E;IAC7E,qFAAqF;IACrF,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAExC,+EAA+E;IAC/E,kFAAkF;IAClF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CACnB,uCAAuC,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,mDAAmD,IAAI,KAAK,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EACxP,UAAU,CAAC,6BAA6B,CACzC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,EAAE;QACA,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjF,OAAO;YACL,GAAG,SAAS;YACZ,gBAAgB,EAAE,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;YAC5E,UAAU;YACV,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,KAAK,KAAK;gBAC7C,CAAC,CAAC;oBACE,YAAY,EACV,kEAAkE;wBAClE,mIAAmI;wBACnI,gHAAgH;iBACnH;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAkB,EAClB,SAA2B,EAC3B,sBAA8C;QAE9C,MAAM,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,0BAA0B,CACxB,SAAS,EACT,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EACxC,2BAA2B,CAC5B,CAAC;QACF,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAExD,IAAI,wBAAwB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpD,sEAAsE;YACtE,qEAAqE;YACrE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,wEAAwE;YACxE,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC1D,wBAAwB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QACjD,CAAC;QAED,GAAG,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;QAE9B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAEtC,OAAO;YACL,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC;YAC1B,GAAG;YACH,GAAG,EAAE,SAAS,CAAC,OAAO;YACtB,SAAS;YACT,IAAI;YACJ,cAAc,EAAE,SAAS,CAAC,OAAO;YACjC,wBAAwB;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAgB,EAAE,SAAwB;QACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;YACrD,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;YACrD,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAqB,EACrB,OAA6B;QAE7B,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAEhG,IAAI,KAAK,GAAkC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACzD,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,cAAc,GAAmC,IAAI,CAAC;YAC1D,IAAI,kBAAkB,GAAG,CAAC,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB,EAAE,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAChD,0EAA0E;oBAC1E,kBAAkB,EAAE,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,KAAgC,CAAC;gBAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,gBAAgB,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAChE,cAAc,GAAG,GAAG,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,UAAU,kBAAkB,oCAAoC,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtD,MAAM,CAAC,GAAG,QAAmC,CAAC;oBAC9C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE;wBAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;wBACjB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC1C,CAAC,CAAC;oBACF,KAAK,GAAG;wBACN,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;wBAClC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;wBACpC,mBAAmB,EAAE,IAAI,CAAC,qBAAqB,CAAC;wBAChD,wBAAwB,EAAE,IAAI,CAAC,0BAA0B,CAAC;wBAC1D,uBAAuB,EAAE,IAAI,CAAC,yBAAyB,CAAC;qBACzD,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,iFAAiF;gBACjF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACxE,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CACX,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5D,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxC,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE;YAC3E,KAAK;YACL,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/runtime/codex/paths.d.ts

@@ -0,0 +1,3 @@
+/** Codex's config root under a given HOME directory (real or isolated). */
+export declare function codexConfigDir(homeDir: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/runtime/codex/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/runtime/codex/paths.ts"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/runtime/codex/paths.js

@@ -0,0 +1,6 @@
+import { join } from 'node:path';
+/** Codex's config root under a given HOME directory (real or isolated). */
+export function codexConfigDir(homeDir) {
+    return join(homeDir, '.codex');
+}
+//# sourceMappingURL=paths.js.map

package/dist/runtime/codex/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/runtime/codex/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC"}

package/dist/runtime/detect.d.ts

@@ -0,0 +1,5 @@
+import type { RuntimeDetection } from './types.js';
+/** Runs `<command> <versionFlag>` and reports whether the CLI is installed. */
+export declare function detectViaVersionFlag(command: string, versionFlag?: string): Promise<RuntimeDetection>;
+export declare function isVersionAtLeast(version: string | null, minimum: [number, number, number]): boolean | null;
+//# sourceMappingURL=detect.d.ts.map

package/dist/runtime/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/runtime/detect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,+EAA+E;AAC/E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,WAAW,SAAc,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAmB3B;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,GAAG,IAAI,CAehB"}

package/dist/runtime/detect.js

@@ -0,0 +1,42 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+/** Runs `<command> <versionFlag>` and reports whether the CLI is installed. */
+export async function detectViaVersionFlag(command, versionFlag = '--version') {
+    try {
+        const { stdout } = await execFileAsync(command, [versionFlag]);
+        return {
+            installed: true,
+            version: stdout.trim() || null,
+            versionSupported: null,
+            executablePath: command,
+            authUsable: null,
+        };
+    }
+    catch {
+        return {
+            installed: false,
+            version: null,
+            versionSupported: null,
+            executablePath: null,
+            authUsable: null,
+        };
+    }
+}
+export function isVersionAtLeast(version, minimum) {
+    if (!version)
+        return null;
+    const matches = [...version.matchAll(/(\d+)\.(\d+)(?:\.(\d+))?/g)];
+    const match = matches.at(-1);
+    if (!match)
+        return null;
+    const actual = [
+        Number(match[1]),
+        Number(match[2]),
+        Number(match[3] ?? 0),
+    ];
+    return (actual[0] > minimum[0] ||
+        (actual[0] === minimum[0] &&
+            (actual[1] > minimum[1] || (actual[1] === minimum[1] && actual[2] >= minimum[2]))));
+}
+//# sourceMappingURL=detect.js.map

package/dist/runtime/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/runtime/detect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,WAAW,GAAG,WAAW;IAEzB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/D,OAAO;YACL,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI;YAC9B,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,OAAO;YACvB,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,OAAiC;IAEjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAA6B;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KACtB,CAAC;IACF,OAAO,CACL,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QACtB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;YACvB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACrF,CAAC;AACJ,CAAC"}

package/dist/runtime/exec.d.ts

@@ -0,0 +1,24 @@
+import type { RuntimeResult } from './types.js';
+export interface ExecOptions {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    cwd: string;
+    stdoutPath: string;
+    stderrPath: string;
+    timeoutMs?: number;
+    /** Test seam only. Overrides SIGKILL_GRACE_PERIOD_MS; production callers must omit it. */
+    killGracePeriodMsForTests?: number;
+}
+/**
+ * Node's setTimeout silently clamps any delay outside [1, 2^31-1] to 1ms
+ * (see the Node docs on timers) rather than erroring, so an out-of-range
+ * timeoutMs would fire almost immediately instead of behaving like "a very
+ * long timeout" — the opposite of what a caller passing e.g. `Infinity` or
+ * a 13-digit typo would expect. Rejected explicitly here rather than left
+ * to that silent clamp.
+ */
+export declare const MAX_TIMEOUT_MS = 2147483647;
+/** Spawns a process, captures stdout/stderr to files, and normalizes the result. */
+export declare function execCapture(options: ExecOptions): Promise<RuntimeResult>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/runtime/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/runtime/exec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAaD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,aAAgB,CAAC;AAE5C,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAyHxE"}

package/dist/runtime/exec.js

@@ -0,0 +1,132 @@
+import { spawn } from 'node:child_process';
+import { createWriteStream } from 'node:fs';
+import { finished } from 'node:stream/promises';
+/**
+ * How long to wait after SIGTERM before escalating to SIGKILL. A process
+ * that ignores SIGTERM (or is wedged in a syscall it can't be interrupted
+ * from) would otherwise leave the run hanging exactly as before a timeout
+ * was ever fired. Not configurable in v0.3 — a fixed grace period is
+ * simpler than a second timeout knob, and 10s is generous enough for
+ * normal cleanup (flushing buffers, closing files) without materially
+ * extending how long a stuck run blocks the caller.
+ */
+const SIGKILL_GRACE_PERIOD_MS = 10_000;
+/**
+ * Node's setTimeout silently clamps any delay outside [1, 2^31-1] to 1ms
+ * (see the Node docs on timers) rather than erroring, so an out-of-range
+ * timeoutMs would fire almost immediately instead of behaving like "a very
+ * long timeout" — the opposite of what a caller passing e.g. `Infinity` or
+ * a 13-digit typo would expect. Rejected explicitly here rather than left
+ * to that silent clamp.
+ */
+export const MAX_TIMEOUT_MS = 2_147_483_647;
+/** Spawns a process, captures stdout/stderr to files, and normalizes the result. */
+export function execCapture(options) {
+    if (options.timeoutMs !== undefined &&
+        !(Number.isFinite(options.timeoutMs) &&
+            options.timeoutMs > 0 &&
+            options.timeoutMs <= MAX_TIMEOUT_MS)) {
+        return Promise.reject(new RangeError(`timeoutMs must be a finite number between 1 and ${MAX_TIMEOUT_MS}, got ${options.timeoutMs}`));
+    }
+    return new Promise((resolvePromise, reject) => {
+        const startedAt = new Date().toISOString();
+        const stdoutStream = createWriteStream(options.stdoutPath);
+        const stderrStream = createWriteStream(options.stderrPath);
+        // Created — but not yet awaited — up front, before spawning: a bad
+        // path, EACCES, or a full disk can make either stream emit 'error'
+        // immediately, before the child even starts. finished() attaches its
+        // own listener as soon as it's called, so calling it here (rather than
+        // only later inside the 'close' handler) is what turns that into a
+        // handled rejection instead of an unhandled 'error' event, which Node
+        // treats as fatal and would crash the whole process.
+        const stdoutFinished = finished(stdoutStream);
+        const stderrFinished = finished(stderrStream);
+        const child = spawn(options.command, options.args, {
+            env: options.env,
+            cwd: options.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let timedOut = false;
+        let timeoutTimer = null;
+        let killTimer = null;
+        let settled = false;
+        const clearTimers = () => {
+            if (timeoutTimer)
+                clearTimeout(timeoutTimer);
+            if (killTimer)
+                clearTimeout(killTimer);
+        };
+        // Single place for anything that makes this run unrecoverable (spawn
+        // failure, either write stream erroring out): stop the timers, force
+        // the child to exit rather than leaving it running with nowhere for
+        // its output to go, tear down whichever stream didn't already error on
+        // its own, and reject exactly once — guarded so a second failure
+        // (e.g. both streams erroring, or 'error' racing a stream failure)
+        // can't double-kill or double-settle.
+        const failOnce = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimers();
+            child.kill('SIGKILL');
+            stdoutStream.destroy();
+            stderrStream.destroy();
+            reject(error);
+        };
+        stdoutFinished.catch(failOnce);
+        stderrFinished.catch(failOnce);
+        if (options.timeoutMs) {
+            timeoutTimer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGTERM');
+                // If the process ignores SIGTERM, force it after a grace period.
+                // Cleared in the exit/close handlers below if it exits sooner.
+                killTimer = setTimeout(() => {
+                    child.kill('SIGKILL');
+                }, options.killGracePeriodMsForTests ?? SIGKILL_GRACE_PERIOD_MS);
+            }, options.timeoutMs);
+        }
+        child.stdout.pipe(stdoutStream);
+        child.stderr.pipe(stderrStream);
+        child.on('error', failOnce);
+        // 'close' waits for the child's stdio streams to finish closing, which
+        // can lag behind the process actually exiting. Stopping the timers here
+        // on 'exit' — as soon as the OS reports the process is gone — instead
+        // of only on 'close' avoids sending a stale SIGTERM/SIGKILL to an
+        // already-dead process and marking a run that finished within budget
+        // as timed out just because 'close' arrived a beat late.
+        child.on('exit', () => {
+            clearTimers();
+        });
+        child.on('close', (exitCode, signal) => {
+            if (settled)
+                return;
+            clearTimers();
+            // 'close' only confirms the child's own stdio streams have ended —
+            // not that our destination write streams have flushed their buffered
+            // data to disk. pipe() calls .end() on them in response, but that
+            // completes asynchronously; resolving before it does can hand the
+            // caller a stdoutPath/stderrPath that's still being written to,
+            // producing a truncated read for a run that actually finished fine.
+            Promise.all([stdoutFinished, stderrFinished])
+                .then(() => {
+                if (settled)
+                    return;
+                settled = true;
+                resolvePromise({
+                    exitCode,
+                    signal,
+                    startedAt,
+                    finishedAt: new Date().toISOString(),
+                    stdoutPath: options.stdoutPath,
+                    stderrPath: options.stderrPath,
+                    timedOut,
+                });
+            })
+                .catch(() => {
+                // Already handled by failOnce via the per-stream .catch above.
+            });
+        });
+    });
+}
+//# sourceMappingURL=exec.js.map