@aria_asi/cli 0.2.36 → 0.2.37

package/dist/runtime/codex-bridge.mjs

@@ -7,6 +7,7 @@ import { delimiter, dirname, resolve } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { evaluateSkillGate, formatSkillGateBlock } from './hooks/lib/skill-autoload-gate.mjs';
+import { resolveAriaAuthToken } from './auth-token.mjs';
 
 const require = createRequire(import.meta.url);
 const { WebSocketServer, WebSocket } = require('ws');
@@ -96,15 +97,7 @@ function makeEvidenceRef(kind, value, metadata = {}) {
 }
 
 function readRuntimeToken() {
-  const envToken = process.env.ARIA_HARNESS_TOKEN || process.env.ARIA_API_KEY || process.env.OPENAI_API_KEY || process.env.ARIA_MASTER_TOKEN;
-  if (envToken) return envToken;
-  const ownerTokenPath = `${HOME}/.aria/owner-token`;
-  if (existsSync(ownerTokenPath)) {
-    try {
-      return readFileSync(ownerTokenPath, 'utf8').trim();
-    } catch {}
-  }
-  return '';
+  return resolveAriaAuthToken({ baseUrl: RUNTIME_BASE_URL }).token;
 }
 
 function runtimeHeaders() {
@@ -143,10 +136,11 @@ function ensureTurnState(threadId, turnId) {
       userText: '',
       preReceiptId: null,
       agentText: '',
-        bufferedAgentNotifications: [],
-        firstAgentItemId: null,
-        traceId: `trace_${randomUUID()}`,
-      };
+      bufferedAgentNotifications: [],
+      firstAgentItemId: null,
+      preRecorded: false,
+      traceId: `trace_${randomUUID()}`,
+    };
     turnState.set(key, state);
   }
   return state;
@@ -176,6 +170,180 @@ function extractInputText(input) {
   return parts.join('\n\n').trim();
 }
 
+function inferThreadId(params = {}) {
+  return params.threadId || params.thread_id || params.turn?.threadId || params.turn?.thread_id || params.item?.threadId || params.item?.thread_id || null;
+}
+
+function inferTurnId(params = {}) {
+  return params.turnId || params.turn_id || params.turn?.id || params.item?.turnId || params.item?.turn_id || null;
+}
+
+function inferItemId(params = {}) {
+  return params.itemId || params.item_id || params.item?.id || null;
+}
+
+function collectKnownText(value, out = [], depth = 0) {
+  if (depth > 8 || value == null) return out;
+  if (typeof value === 'string') {
+    if (value.trim()) out.push(value);
+    return out;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectKnownText(item, out, depth + 1);
+    return out;
+  }
+  if (typeof value !== 'object') return out;
+
+  const textKeys = ['delta', 'text', 'rawContent', 'raw_content', 'outputText', 'output_text'];
+  for (const key of textKeys) {
+    if (typeof value[key] === 'string' && value[key].trim()) out.push(value[key]);
+  }
+  const containerKeys = ['content', 'message', 'fragments', 'parts', 'summary'];
+  for (const key of containerKeys) {
+    if (value[key] != null) collectKnownText(value[key], out, depth + 1);
+  }
+  return out;
+}
+
+function isAgentMessageItem(item = {}) {
+  const role = String(item.role || '').toLowerCase();
+  const type = String(item.type || item.kind || '').replace(/[\s-]/g, '_').toLowerCase();
+  return role === 'assistant' || type === 'agent_message' || type === 'agentmessage' || type === 'assistant_message';
+}
+
+function extractAssistantTextFromTurn(turn = {}) {
+  const items = Array.isArray(turn?.items) ? turn.items : [];
+  return items
+    .filter((item) => item && typeof item === 'object' && isAgentMessageItem(item))
+    .map((item) => (typeof item.text === 'string' ? item.text : collectKnownText(item).join('')))
+    .filter((text) => typeof text === 'string' && text.trim())
+    .join('\n\n');
+}
+
+function extractAssistantTextFromDownstream(message) {
+  const method = String(message?.method || '');
+  const params = message?.params || {};
+  if (method === 'item/agentMessage/delta') {
+    return typeof params.delta === 'string' ? params.delta : '';
+  }
+  if (/agentMessage|agent_message|assistantMessage|assistant_message/i.test(method)) {
+    return collectKnownText(params).join('');
+  }
+  if ((method === 'item/completed' || method === 'item.completed') && isAgentMessageItem(params.item || params)) {
+    return collectKnownText(params.item || params).join('');
+  }
+  return '';
+}
+
+function extractCompletionText(notification) {
+  const params = notification?.params || {};
+  const turnText = extractAssistantTextFromTurn(params.turn);
+  if (turnText) return turnText;
+  return collectKnownText(params.lastAgentMessage || params.last_agent_message || params.output || params.response || '').join('');
+}
+
+function isAssistantOutputNotification(message) {
+  const method = String(message?.method || '');
+  const params = message?.params || {};
+  if (method === 'item/agentMessage/delta') return typeof params.delta === 'string';
+  if ((method === 'item/completed' || method === 'item.completed') && isAgentMessageItem(params.item || params)) return true;
+  return /agentMessage|agent_message|assistantMessage|assistant_message/i.test(method);
+}
+
+function mergeAssistantText(state, text) {
+  const next = typeof text === 'string' ? text : '';
+  if (!next.trim()) return false;
+  const current = String(state.agentText || '');
+  if (!current) {
+    state.agentText = next;
+    return true;
+  }
+  if (current === next || current.includes(next)) return false;
+  if (next.includes(current)) {
+    state.agentText = next;
+    return true;
+  }
+  state.agentText = `${current}\n\n${next}`;
+  return true;
+}
+
+function rememberAssistantNotification(state, message) {
+  const method = String(message?.method || '');
+  const text = extractAssistantTextFromDownstream(message);
+  if (method === 'item/agentMessage/delta' && typeof text === 'string') {
+    state.agentText += text;
+  } else {
+    mergeAssistantText(state, text);
+  }
+
+  const itemId = inferItemId(message?.params || {});
+  if (!state.firstAgentItemId && itemId) state.firstAgentItemId = itemId;
+  state.bufferedAgentNotifications.push(message);
+}
+
+function scrubAssistantText(value, replacement, originalText, depth = 0) {
+  if (depth > 10 || value == null) return value;
+  if (typeof value === 'string') {
+    if (!value.trim()) return value;
+    const original = String(originalText || '').trim();
+    if (original && (value === original || value.trim() === original)) return replacement;
+    if (original && value.includes(original)) return value.split(original).join(replacement);
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((item) => scrubAssistantText(item, replacement, originalText, depth + 1));
+  if (typeof value !== 'object') return value;
+  const cloned = { ...value };
+  for (const [key, entry] of Object.entries(cloned)) {
+    if (/^(?:delta|text|rawContent|raw_content|outputText|output_text|lastAgentMessage|last_agent_message|response|output)$/i.test(key)) {
+      cloned[key] = scrubAssistantText(entry, replacement, originalText, depth + 1);
+    } else if (entry && typeof entry === 'object') {
+      cloned[key] = scrubAssistantText(entry, replacement, originalText, depth + 1);
+    }
+  }
+  return cloned;
+}
+
+function buildBlockedCompletionNotification(notification, refusalText, originalText) {
+  const blocked = scrubAssistantText(notification, refusalText, originalText);
+  const params = blocked.params || {};
+  const existingTurn = params.turn && typeof params.turn === 'object' ? params.turn : {};
+  const existingError = existingTurn.error && typeof existingTurn.error === 'object' ? existingTurn.error : {};
+  const turnId = existingTurn.id || params.turnId || params.turn_id || null;
+  blocked.params = {
+    ...params,
+    ariaBlocked: true,
+    ariaBlockReason: refusalText,
+    turn: {
+      ...existingTurn,
+      ...(turnId ? { id: turnId } : {}),
+      status: 'failed',
+      error: {
+        ...existingError,
+        message: refusalText,
+      },
+    },
+  };
+  return blocked;
+}
+
+function safeSendJson(socket, message, label) {
+  if (socket.readyState !== WebSocket.OPEN) {
+    log(`skip send ${label || 'message'} because socket state=${socket.readyState}`);
+    return false;
+  }
+  socket.send(JSON.stringify(message));
+  return true;
+}
+
+function safeSendRaw(socket, payload, label) {
+  if (socket.readyState !== WebSocket.OPEN) {
+    log(`skip send ${label || 'raw message'} because socket state=${socket.readyState}`);
+    return false;
+  }
+  socket.send(payload);
+  return true;
+}
+
 function deriveActionFromCommand(command = '') {
   const text = String(command || '').trim();
   if (!text) return 'write';
@@ -207,6 +375,18 @@ async function validateTurnText(threadId, turnId) {
   if (!text) {
     return { ok: false, reason: 'No assistant text exists for this turn yet. Codex must emit readable cognition before action.' };
   }
+  const coach = await recordCoachPhaseForTurn(threadId, turnId, 'post_generation', {
+    text,
+    evidenceRefs: [makeEvidenceRef('assistant_output', text, { threadId, turnId, traceId: state.traceId })],
+    metadata: { requireCognitionBlock: true },
+  });
+  if (coach?.permitted === false) {
+    return {
+      ok: false,
+      reason: coach.clientMessage || 'Coach Kernel held this Codex output before release.',
+      result: { coach },
+    };
+  }
   const skillGate = evaluateSkillGate({
     sessionId: `codex:${threadId}:${turnId}`,
     surface: 'codex-bridge-output',
@@ -232,6 +412,13 @@ async function validateTurnText(threadId, turnId) {
       traceId: state.traceId,
     },
   });
+  await recordCoachPhaseForTurn(threadId, turnId, 'pre_output', {
+    text,
+    validation: result?.validation || null,
+    layer3: result?.layer3 || null,
+    evidenceRefs: [makeEvidenceRef('runtime_validation', result, { threadId, turnId, traceId: state.traceId })],
+    metadata: { validation_passed: result?.validation?.passed !== false, layer3_pass: result?.layer3?.pass !== false },
+  });
   const pass = result?.pass === true && result?.validation?.passed !== false;
   return pass
     ? { ok: true, result }
@@ -244,6 +431,20 @@ async function validateTurnText(threadId, turnId) {
 
 async function checkActionAgainstRuntime(action, target, threadId, turnId, metadata = {}) {
   const state = ensureTurnState(threadId, turnId);
+  const coach = await recordCoachPhaseForTurn(threadId, turnId, 'pre_tool', {
+    text: target,
+    action,
+    target,
+    evidenceRefs: [makeEvidenceRef('codex_tool_request', { action, target, metadata }, { threadId, turnId, traceId: state.traceId })],
+    metadata: { ...metadata, requireVerify: metadata.requireVerify === true },
+  });
+  if (coach?.permitted === false) {
+    return {
+      ok: false,
+      reason: coach.clientMessage || `Coach Kernel denied ${action} before tool approval`,
+      result: { coach },
+    };
+  }
   const skillGate = evaluateSkillGate({
     sessionId: `codex:${threadId}:${turnId}`,
     surface: 'codex-bridge-action',
@@ -276,9 +477,46 @@ async function checkActionAgainstRuntime(action, target, threadId, turnId, metad
   return { ok: true, result };
 }
 
+async function recordCoachPhaseForTurn(threadId, turnId, phase, patch = {}) {
+  const state = ensureTurnState(threadId, turnId);
+  try {
+    return await postRuntime('/coach/phase', {
+      phase,
+      requestId: state.traceId,
+      sessionId: `codex:${threadId}:${turnId}`,
+      surface: 'codex-bridge',
+      lane: 'codex_bridge',
+      text: typeof patch.text === 'string' ? patch.text : state.userText || state.agentText || '',
+      action: patch.action || '',
+      target: patch.target || '',
+      evidenceRefs: Array.isArray(patch.evidenceRefs) ? patch.evidenceRefs : [],
+      validation: patch.validation || null,
+      layer3: patch.layer3 || null,
+      metadata: {
+        threadId,
+        turnId,
+        traceId: state.traceId,
+        bridge: 'codex',
+        ...(patch.metadata && typeof patch.metadata === 'object' ? patch.metadata : {}),
+      },
+    });
+  } catch (error) {
+    log(`warn coach/${phase} thread=${threadId} turn=${turnId} error="${error instanceof Error ? error.message : String(error)}"`);
+    return null;
+  }
+}
+
 async function recordMizanPre(threadId, turnId) {
   const state = ensureTurnState(threadId, turnId);
   try {
+    await recordCoachPhaseForTurn(threadId, turnId, 'pre_turn', {
+      text: state.userText || 'codex turn start',
+      evidenceRefs: [makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId })],
+    });
+    await recordCoachPhaseForTurn(threadId, turnId, 'pre_cognition', {
+      text: state.userText || 'codex pre-cognition',
+      evidenceRefs: [makeEvidenceRef('codex_pre_cognition_request', state.userText, { threadId, turnId, traceId: state.traceId })],
+    });
     const result = await postRuntime('/mizan/pre', {
       sessionId: `codex:${threadId}:${turnId}`,
       packetRequest: {
@@ -299,11 +537,25 @@ async function recordMizanPre(threadId, turnId) {
       },
     });
     state.preReceiptId = result?.receipt?.receiptId || null;
+    await recordCoachPhaseForTurn(threadId, turnId, 'post_cognition', {
+      text: state.userText || 'codex post-cognition',
+      evidenceRefs: [
+        makeEvidenceRef('mizan_pre_receipt', result?.receipt || null, { threadId, turnId, traceId: state.traceId }),
+      ],
+      metadata: { pre_receipt_id: state.preReceiptId },
+    });
   } catch (error) {
     log(`warn mizan/pre thread=${threadId} turn=${turnId} error="${error instanceof Error ? error.message : String(error)}"`);
   }
 }
 
+async function recordMizanPreOnce(threadId, turnId) {
+  const state = ensureTurnState(threadId, turnId);
+  if (state.preRecorded) return;
+  state.preRecorded = true;
+  await recordMizanPre(threadId, turnId);
+}
+
 async function recordMizanPost(threadId, turnId, pass, summary) {
   const state = ensureTurnState(threadId, turnId);
   try {
@@ -326,6 +578,11 @@ async function recordMizanPost(threadId, turnId, pass, summary) {
         traceId: state.traceId,
       },
     });
+    await recordCoachPhaseForTurn(threadId, turnId, 'claim_or_release', {
+      text: state.agentText || summary,
+      evidenceRefs: [makeEvidenceRef('codex_release_decision', { pass, summary }, { threadId, turnId, traceId: state.traceId })],
+      metadata: { validated_output: pass, summary, pre_receipt_id: state.preReceiptId },
+    });
   } catch (error) {
     log(`warn mizan/post thread=${threadId} turn=${turnId} error="${error instanceof Error ? error.message : String(error)}"`);
   }
@@ -359,6 +616,39 @@ function makeGuardianWarning(threadId, message) {
   };
 }
 
+function normalizeBridgeIssue(issue) {
+  const raw = String(issue || '').replace(/\s+/g, ' ').trim();
+  if (!raw) return '';
+  if (/No <cognition>/i.test(raw)) return 'missing readable cognition block';
+  if (/missing\s+<applied_cognition>/i.test(raw)) return 'missing applied cognition contract';
+  if (/qualitative_drift/i.test(raw)) return 'qualitative drift language needs a measurable predicate';
+  if (/premature_task_closeout|feedback_no_premature_task_closeout|done\|complete\|completed\|ready\|verified\|fixed/i.test(raw)) {
+    return 'completion/readiness claim conflicts with unresolved blocker state';
+  }
+  if (/\(\?:/.test(raw)) return 'doctrine matcher triggered; re-author with the named doctrine and concrete evidence';
+  return raw.slice(0, 600);
+}
+
+function formatCodexRecoveryBlock(surface, reason, issues = []) {
+  const blockers = Array.from(new Set([reason, ...issues].map(normalizeBridgeIssue).filter(Boolean)));
+  return [
+    'ARIA CODEX RECOVERY CONTRACT',
+    `surface: ${surface}`,
+    'status: output held for re-authoring',
+    '',
+    'Observed blockers:',
+    ...(blockers.length ? blockers.map((item) => `- ${item}`) : ['- Aria validation failed.']),
+    '',
+    'Recovery contract:',
+    '1. Do not retry the same blocked text.',
+    '2. Re-author the answer from the original user request, not from this block report.',
+    '3. Include <cognition> and <applied_cognition> when the answer is non-trivial.',
+    '4. Use bounded status language when evidence is missing; do not use completion/readiness claims without proof.',
+    '5. Name a measurable verification predicate, or explicitly state that verification has not run.',
+    '6. Re-submit the corrected answer; if the same blocker repeats twice, escalate with this full recovery contract.',
+  ].join('\n');
+}
+
 async function handleApprovalRequest(upstream, downstream, message) {
   const { id, method, params = {} } = message;
   const threadId = params.threadId || params.conversationId || 'unknown-thread';
@@ -366,8 +656,8 @@ async function handleApprovalRequest(upstream, downstream, message) {
   const validation = await validateTurnText(threadId, turnId);
 
   if (!validation.ok) {
-    const reason = `Aria runtime blocked action before tool approval: ${validation.reason}`;
-    upstream.send(JSON.stringify(makeGuardianWarning(threadId, reason)));
+    const reason = formatCodexRecoveryBlock('codex-bridge-approval', validation.reason);
+    safeSendJson(upstream, makeGuardianWarning(threadId, reason), 'approval warning');
     const declineResult =
       method === 'item/commandExecution/requestApproval'
         ? { decision: 'decline' }
@@ -378,7 +668,7 @@ async function handleApprovalRequest(upstream, downstream, message) {
             : method === 'execCommandApproval'
               ? { decision: 'denied' }
               : { decision: 'denied' };
-    downstream.send(JSON.stringify({ id, result: declineResult }));
+    safeSendJson(downstream, { id, result: declineResult }, 'approval decline');
     log(`deny approval method=${method} thread=${threadId} turn=${turnId} reason="${validation.reason}"`);
     return true;
   }
@@ -397,23 +687,23 @@ async function handleApprovalRequest(upstream, downstream, message) {
       requireVerify: action === 'delete' || action === 'deploy',
     });
     if (!actionCheck.ok) {
-      const reason = `Aria runtime denied ${action}: ${actionCheck.reason}`;
-      upstream.send(JSON.stringify(makeGuardianWarning(threadId, reason)));
-      downstream.send(JSON.stringify({
+      const reason = formatCodexRecoveryBlock('codex-bridge-command', actionCheck.reason || `Aria denied ${action}`);
+      safeSendJson(upstream, makeGuardianWarning(threadId, reason), 'command denial warning');
+      safeSendJson(downstream, {
         id,
         result: method === 'item/commandExecution/requestApproval'
           ? { decision: 'decline' }
           : { decision: 'denied' },
-      }));
+      }, 'command denial');
       log(`deny command method=${method} action=${action} thread=${threadId} turn=${turnId} reason="${actionCheck.reason}"`);
       return true;
     }
-    downstream.send(JSON.stringify({
+    safeSendJson(downstream, {
       id,
       result: method === 'item/commandExecution/requestApproval'
         ? { decision: 'accept' }
         : { decision: 'approved' },
-    }));
+    }, 'command approval');
     log(`allow command method=${method} action=${action} thread=${threadId} turn=${turnId}`);
     return true;
   }
@@ -423,23 +713,23 @@ async function handleApprovalRequest(upstream, downstream, message) {
     const files = [params.path, params.filePath, params.grantRoot].filter((value) => typeof value === 'string' && value.trim());
     const actionCheck = await checkActionAgainstRuntime('write', String(target), threadId, turnId, { files });
     if (!actionCheck.ok) {
-      const reason = `Aria runtime denied file change: ${actionCheck.reason}`;
-      upstream.send(JSON.stringify(makeGuardianWarning(threadId, reason)));
-      downstream.send(JSON.stringify({
+      const reason = formatCodexRecoveryBlock('codex-bridge-file-change', actionCheck.reason || 'file change denied');
+      safeSendJson(upstream, makeGuardianWarning(threadId, reason), 'file-change denial warning');
+      safeSendJson(downstream, {
         id,
         result: method === 'item/fileChange/requestApproval'
           ? { decision: 'decline' }
           : { decision: 'denied' },
-      }));
+      }, 'file-change denial');
       log(`deny file-change method=${method} thread=${threadId} turn=${turnId} reason="${actionCheck.reason}"`);
       return true;
     }
-    downstream.send(JSON.stringify({
+    safeSendJson(downstream, {
       id,
       result: method === 'item/fileChange/requestApproval'
         ? { decision: 'accept' }
         : { decision: 'approved' },
-    }));
+    }, 'file-change approval');
     log(`allow file-change method=${method} thread=${threadId} turn=${turnId}`);
     return true;
   }
@@ -455,9 +745,9 @@ async function handleApprovalRequest(upstream, downstream, message) {
       : [];
     const actionCheck = await checkActionAgainstRuntime('write', target, threadId, turnId, { files });
     if (!actionCheck.ok) {
-      const reason = `Aria runtime denied permissions request: ${actionCheck.reason}`;
-      upstream.send(JSON.stringify(makeGuardianWarning(threadId, reason)));
-      downstream.send(JSON.stringify({
+      const reason = formatCodexRecoveryBlock('codex-bridge-permissions', actionCheck.reason || 'permissions request denied');
+      safeSendJson(upstream, makeGuardianWarning(threadId, reason), 'permissions denial warning');
+      safeSendJson(downstream, {
         id,
         result: {
           permissions: {
@@ -471,7 +761,7 @@ async function handleApprovalRequest(upstream, downstream, message) {
           scope: 'turn',
           strictAutoReview: true,
         },
-      }));
+      }, 'permissions denial');
       log(`deny permissions thread=${threadId} turn=${turnId} reason="${actionCheck.reason}"`);
       return true;
     }
@@ -481,16 +771,22 @@ async function handleApprovalRequest(upstream, downstream, message) {
 }
 
 async function releaseTurnOutput(upstream, notification) {
-  const threadId = notification?.params?.threadId;
-  const turnId = notification?.params?.turn?.id || notification?.params?.turnId;
+  const params = notification?.params || {};
+  const threadId = inferThreadId(params);
+  const turnId = inferTurnId(params);
   if (!threadId || !turnId) {
-    upstream.send(JSON.stringify(notification));
+    safeSendJson(upstream, notification, 'turn completion without ids');
     return;
   }
 
   const state = ensureTurnState(threadId, turnId);
-  if (state.bufferedAgentNotifications.length === 0) {
-    upstream.send(JSON.stringify(notification));
+  const completionText = extractCompletionText(notification);
+  mergeAssistantText(state, completionText);
+
+  const turnStatus = String(params.turn?.status || params.status || '').toLowerCase();
+  const hasAssistantText = String(state.agentText || '').trim().length > 0;
+  if (!hasAssistantText && turnStatus && turnStatus !== 'completed') {
+    safeSendJson(upstream, notification, 'non-completed turn without assistant output');
     turnState.delete(`${threadId}:${turnId}`);
     return;
   }
@@ -498,29 +794,32 @@ async function releaseTurnOutput(upstream, notification) {
   const validation = await validateTurnText(threadId, turnId);
   if (validation.ok) {
     for (const buffered of state.bufferedAgentNotifications) {
-      upstream.send(JSON.stringify(buffered));
+      safeSendJson(upstream, buffered, 'validated assistant notification');
     }
     await recordMizanPost(threadId, turnId, true, 'codex turn validated and released');
+    safeSendJson(upstream, notification, 'validated turn completion');
     log(`release turn thread=${threadId} turn=${turnId} chars=${state.agentText.length}`);
   } else {
-    const refusalText = `Aria runtime blocked final output for this Codex turn.\n\n${validation.reason}`;
-    if (state.firstAgentItemId) {
-      upstream.send(JSON.stringify({
-        method: 'item/agentMessage/delta',
-        params: {
-          threadId,
-          turnId,
-          itemId: state.firstAgentItemId,
-          delta: refusalText,
-        },
-      }));
-    }
-    upstream.send(JSON.stringify(makeGuardianWarning(threadId, refusalText)));
+    const refusalText = formatCodexRecoveryBlock('codex-bridge-output', validation.reason);
+    safeSendJson(upstream, {
+      method: 'item/agentMessage/delta',
+      params: {
+        threadId,
+        turnId,
+        itemId: state.firstAgentItemId || 'aria-blocked-output',
+        delta: refusalText,
+      },
+    }, 'blocked assistant replacement');
+    safeSendJson(upstream, makeGuardianWarning(threadId, refusalText), 'blocked turn warning');
     await recordMizanPost(threadId, turnId, false, validation.reason);
+    safeSendJson(
+      upstream,
+      buildBlockedCompletionNotification(notification, refusalText, state.agentText || completionText),
+      'blocked turn completion'
+    );
     log(`block turn thread=${threadId} turn=${turnId} reason="${validation.reason}"`);
   }
 
-  upstream.send(JSON.stringify(notification));
   turnState.delete(`${threadId}:${turnId}`);
 }
 
@@ -607,6 +906,65 @@ async function startBridge() {
   wss.on('connection', async (upstream) => {
     await ensureDownstreamReady();
     const downstream = new WebSocket(DOWNSTREAM_URL);
+    const pendingDownstreamMessages = [];
+    const pendingTurnStarts = new Map();
+
+    function rememberTurnStart(message) {
+      const params = message?.params || {};
+      const threadId = params.threadId;
+      if (!threadId || message?.id == null) return;
+      pendingTurnStarts.set(String(message.id), {
+        threadId,
+        userText: extractInputText(params.input),
+      });
+    }
+
+    function takePendingTurnStart(threadId) {
+      for (const [requestId, pending] of pendingTurnStarts.entries()) {
+        if (pending.threadId === threadId) {
+          pendingTurnStarts.delete(requestId);
+          return pending;
+        }
+      }
+      return null;
+    }
+
+    function hydrateTurnState(threadId, turnId, userText) {
+      const state = ensureTurnState(threadId, turnId);
+      if (!state.userText && userText) state.userText = userText;
+      void recordMizanPreOnce(threadId, turnId);
+      return state;
+    }
+
+    function hydrateTurnStartResponse(message) {
+      if (message?.id == null) return;
+      const pending = pendingTurnStarts.get(String(message.id));
+      if (!pending) return;
+      const result = message.result || {};
+      const turn = result.turn || result;
+      const turnId = turn?.id || result.turnId || result.turn_id;
+      if (!turnId) return;
+      pendingTurnStarts.delete(String(message.id));
+      hydrateTurnState(pending.threadId, turnId, pending.userText);
+    }
+
+    function sendDownstream(payload) {
+      if (downstream.readyState === WebSocket.OPEN) {
+        downstream.send(payload);
+        return;
+      }
+      if (downstream.readyState === WebSocket.CONNECTING) {
+        pendingDownstreamMessages.push(payload);
+        return;
+      }
+      log(`drop upstream message because downstream state=${downstream.readyState}`);
+    }
+
+    downstream.once('open', () => {
+      while (pendingDownstreamMessages.length > 0 && downstream.readyState === WebSocket.OPEN) {
+        downstream.send(pendingDownstreamMessages.shift());
+      }
+    });
 
     upstream.once('close', () => {
       try { downstream.close(); } catch {}
@@ -621,20 +979,18 @@ async function startBridge() {
       try {
         message = JSON.parse(raw);
       } catch {
-        downstream.send(raw);
+        sendDownstream(raw);
         return;
       }
 
       if (message?.method === 'turn/start' && message?.params?.threadId) {
-        const state = ensureTurnState(message.params.threadId, String(Date.now()));
-        state.userText = extractInputText(message.params.input);
+        rememberTurnStart(message);
         if (!message.params.approvalPolicy) {
           message.params.approvalPolicy = 'untrusted';
         }
-        void recordMizanPre(message.params.threadId, state.turnId);
       }
 
-      downstream.send(JSON.stringify(message));
+      sendDownstream(JSON.stringify(message));
     });
 
     downstream.on('message', async (data) => {
@@ -643,33 +999,47 @@ async function startBridge() {
       try {
         message = JSON.parse(raw);
       } catch {
-        upstream.send(raw);
+        safeSendRaw(upstream, raw, 'downstream raw message');
         return;
       }
 
+      if (message?.id != null && typeof message?.method !== 'string') {
+        hydrateTurnStartResponse(message);
+      }
+
       if (message?.id != null && typeof message?.method === 'string') {
         const intercepted = await handleApprovalRequest(upstream, downstream, message).catch((error) => {
           const threadId = message?.params?.threadId || 'unknown-thread';
           const reason = `Aria Codex bridge approval hook failed: ${error instanceof Error ? error.message : String(error)}`;
-          upstream.send(JSON.stringify(makeGuardianWarning(threadId, reason)));
+          safeSendJson(upstream, makeGuardianWarning(threadId, reason), 'approval hook failure warning');
           log(`error approval method=${message.method} reason="${reason}"`);
           return false;
         });
         if (intercepted) return;
       }
 
-      if (message?.method === 'item/agentMessage/delta') {
-        const { threadId, turnId, itemId, delta } = message.params || {};
-        if (threadId && turnId && typeof delta === 'string') {
+      if (isAssistantOutputNotification(message)) {
+        const params = message.params || {};
+        const threadId = inferThreadId(params);
+        const turnId = inferTurnId(params);
+        if (threadId && turnId) {
           const state = ensureTurnState(threadId, turnId);
-          state.agentText += delta;
-          state.bufferedAgentNotifications.push(message);
-          if (!state.firstAgentItemId && itemId) state.firstAgentItemId = itemId;
+          const pending = !state.userText ? takePendingTurnStart(threadId) : null;
+          if (pending?.userText) state.userText = pending.userText;
+          rememberAssistantNotification(state, message);
           return;
         }
       }
 
       if (message?.method === 'turn/completed') {
+        const params = message.params || {};
+        const threadId = inferThreadId(params);
+        const turnId = inferTurnId(params);
+        if (threadId && turnId) {
+          const state = ensureTurnState(threadId, turnId);
+          const pending = !state.userText ? takePendingTurnStart(threadId) : null;
+          if (pending?.userText) state.userText = pending.userText;
+        }
         await releaseTurnOutput(upstream, message);
         return;
       }
@@ -678,21 +1048,22 @@ async function startBridge() {
         const threadId = message?.params?.threadId;
         const turnId = message?.params?.turn?.id || message?.params?.turnId;
         if (threadId && turnId) {
+          const pending = takePendingTurnStart(threadId);
           const state = ensureTurnState(threadId, turnId);
           if (!state.userText) {
-            state.userText = message?.params?.turn?.input?.map?.((entry) => entry?.text).filter(Boolean).join('\n\n') || '';
+            state.userText = message?.params?.turn?.input?.map?.((entry) => entry?.text).filter(Boolean).join('\n\n') || pending?.userText || '';
           }
-          void recordMizanPre(threadId, turnId);
+          void recordMizanPreOnce(threadId, turnId);
         }
       }
 
-      upstream.send(JSON.stringify(message));
+      safeSendJson(upstream, message, 'downstream message');
     });
 
     downstream.on('error', (error) => {
       log(`downstream socket error ${error.message}`);
       try {
-        upstream.send(JSON.stringify(makeGuardianWarning('codex-bridge', `Codex downstream socket error: ${error.message}`)));
+        safeSendJson(upstream, makeGuardianWarning('codex-bridge', `Codex downstream socket error: ${error.message}`), 'downstream socket warning');
       } catch {}
     });
     upstream.on('error', (error) => log(`upstream socket error ${error.message}`));