Roll up integration into dev

crates/fkst-framework/src/main.rs

@@ -473,6 +473,7 @@ fn run_pipeline(
         RaiseAuthority::new(declared_produces),
         Some(roots.clone()),
         graph_json_authorized,
+        raised_auth_token.clone(),
     )?;
 
     let exit_code = match mlua_init::run_dept_with_require_roots(

crates/fkst-framework/src/mlua_init.rs

@@ -30,6 +30,7 @@ pub fn register_framework_sdk(
     raise_authority: RaiseAuthority,
     graph_roots: Option<PackageRoots>,
     graph_json_authorized: bool,
+    raised_auth_token: Option<String>,
 ) -> mlua::Result<()> {
     let config = ConfigContext::from_host_root(host_root).map_err(mlua::Error::external)?;
     crate::rate_pool::RatePoolRegistry::from_config(&config).map_err(mlua::Error::external)?;
@@ -43,7 +44,14 @@ pub fn register_framework_sdk(
     crate::sdk_git::register(lua, host_root, config.clone())?;
     crate::sdk_mark::register(lua, host_root)?;
     crate::sdk_cache::register(lua, host_root)?;
-    crate::sdk_codex::register(lua, host_root, config, dept)?;
+    crate::sdk_codex::register(
+        lua,
+        host_root,
+        config,
+        dept,
+        raise_buf.clone(),
+        raised_auth_token,
+    )?;
     crate::raise::register(lua, raise_buf, resolver, owner_namespace, raise_authority)?;
     Ok(())
 }
@@ -60,6 +68,7 @@ pub(crate) fn register_framework_sdk_with_runner(
     runner: Option<MockCommandState>,
     graph_roots: Option<PackageRoots>,
     graph_json_authorized: bool,
+    raised_auth_token: Option<String>,
 ) -> mlua::Result<()> {
     let config = ConfigContext::from_host_root(host_root).map_err(mlua::Error::external)?;
     crate::rate_pool::RatePoolRegistry::from_config(&config).map_err(mlua::Error::external)?;
@@ -73,7 +82,15 @@ pub(crate) fn register_framework_sdk_with_runner(
     crate::sdk_git::register_with_runner(lua, host_root, config.clone(), runner.clone())?;
     crate::sdk_mark::register(lua, host_root)?;
     crate::sdk_cache::register(lua, host_root)?;
-    crate::sdk_codex::register_with_runner(lua, host_root, config, dept, runner)?;
+    crate::sdk_codex::register_with_runner(
+        lua,
+        host_root,
+        config,
+        dept,
+        runner,
+        raise_buf.clone(),
+        raised_auth_token,
+    )?;
     crate::raise::register(lua, raise_buf, resolver, owner_namespace, raise_authority)?;
     Ok(())
 }

crates/fkst-framework/src/raise.rs

@@ -9,6 +9,7 @@ use mlua::{Lua, LuaSerdeExt, Result};
 use serde::Serialize;
 use serde_json::Value as JsonValue;
 use std::collections::BTreeSet;
+use std::io::Write;
 use std::sync::{Arc, Mutex};
 
 use crate::path_resolver::NameResolver;
@@ -64,6 +65,15 @@ impl RaiseBuffer {
 
     pub fn encoded_frame(&self) -> Option<String> {
         let entries = self.0.lock().unwrap().clone();
+        Self::encode_entries(entries)
+    }
+
+    pub(crate) fn drain_encoded_frame(&self) -> Option<String> {
+        let entries = self.0.lock().unwrap().drain(..).collect();
+        Self::encode_entries(entries)
+    }
+
+    fn encode_entries(entries: Vec<RaisedEntry>) -> Option<String> {
         if entries.is_empty() {
             return None;
         }
@@ -74,12 +84,21 @@ impl RaiseBuffer {
     pub fn emit_stdout(&self) {
         if let Some(b64) = self.encoded_frame() {
             println!("RAISED: {}", b64);
+            let _ = std::io::stdout().flush();
         }
     }
 
     pub(crate) fn emit_authenticated_stdout(&self, token: &str) {
         if let Some(b64) = self.encoded_frame() {
             println!("RAISED-AUTH: {token} {b64}");
+            let _ = std::io::stdout().flush();
+        }
+    }
+
+    pub(crate) fn drain_emit_authenticated_stdout(&self, token: &str) {
+        if let Some(b64) = self.drain_encoded_frame() {
+            println!("RAISED-AUTH: {token} {b64}");
+            let _ = std::io::stdout().flush();
         }
     }
 }
@@ -331,4 +350,14 @@ mod tests {
         // Just verify no panic; output goes to real stdout in tests so we can't capture cleanly.
         buf.emit_stdout();
     }
+
+    #[test]
+    fn drain_encoded_frame_removes_buffered_entries() {
+        let buf = RaiseBuffer::new();
+        buf.push("done".to_string(), serde_json::json!({"n": 1}));
+
+        assert!(buf.drain_encoded_frame().is_some());
+        assert!(buf.encoded_frame().is_none());
+        assert!(buf.snapshot().is_empty());
+    }
 }

crates/fkst-framework/src/sdk_codex.rs

@@ -27,6 +27,7 @@ use crate::config_registry::{ConfigContext, ConfigKey};
 use crate::external_command::{
     format_command, MockCommandInvocation, MockCommandPlan, MockCommandResult, MockCommandState,
 };
+use crate::raise::RaiseBuffer;
 use crate::runtime_context;
 
 pub(crate) const CODEX_PERMIT_SLOTS_ENV: &str = "FKST_CODEX_PERMIT_SLOTS";
@@ -306,8 +307,18 @@ pub fn register(
     host_root: &Path,
     config: ConfigContext,
     dept: Option<String>,
+    raise_buf: RaiseBuffer,
+    raised_auth_token: Option<String>,
 ) -> Result<()> {
-    register_with_runner(lua, host_root, config, dept, None)
+    register_with_runner(
+        lua,
+        host_root,
+        config,
+        dept,
+        None,
+        raise_buf,
+        raised_auth_token,
+    )
 }
 
 pub(crate) fn register_with_runner(
@@ -316,22 +327,28 @@ pub(crate) fn register_with_runner(
     config: ConfigContext,
     dept: Option<String>,
     runner: Option<MockCommandState>,
+    raise_buf: RaiseBuffer,
+    raised_auth_token: Option<String>,
 ) -> Result<()> {
     let owner_id = NEXT_PIPELINE_OWNER_ID.fetch_add(1, Ordering::Relaxed);
     let next_task_id = Arc::new(AtomicU64::new(1));
     let host_root = Arc::new(host_root.to_path_buf());
     let config = Arc::new(config);
     let dept = Arc::new(dept);
     let runner = Arc::new(runner);
+    let raised_auth_token = Arc::new(raised_auth_token);
 
     lua.globals().set("spawn_codex_sync", {
         let host_root = Arc::clone(&host_root);
         let config = Arc::clone(&config);
         let dept = Arc::clone(&dept);
         let runner = Arc::clone(&runner);
+        let raise_buf = raise_buf.clone();
+        let raised_auth_token = Arc::clone(&raised_auth_token);
         lua.create_function(move |lua, opts: Table| {
             crate::process_tree::ensure_supervisor_parent_alive()?;
             let request = codex_request_from_opts(opts, dept.as_deref().map(str::to_string));
+            flush_raises_before_sync_codex(&raise_buf, raised_auth_token.as_deref());
             run_codex_request(request, &host_root, &config, runner.as_ref().as_ref())?
                 .into_lua_table(lua)
         })?
@@ -381,6 +398,12 @@ pub(crate) fn register_with_runner(
     Ok(())
 }
 
+fn flush_raises_before_sync_codex(raise_buf: &RaiseBuffer, raised_auth_token: Option<&str>) {
+    if let Some(token) = raised_auth_token {
+        raise_buf.drain_emit_authenticated_stdout(token);
+    }
+}
+
 // the same input names an overall wall-clock timeout with a bounded default.
 fn codex_request_from_opts(opts: Table, runtime_dept: Option<String>) -> CodexRequest {
     let prompt: String = opts.get("prompt").unwrap_or_default();

crates/fkst-framework/src/self_test.rs

@@ -142,6 +142,7 @@ fn check_sdk_registration(host_root: &std::path::Path) -> Result<()> {
         crate::raise::RaiseAuthority::new(Default::default()),
         None,
         false,
+        None,
     )
     .context("register framework SDK")?;
     lua.load(