@bolt-foundry/gambit 0.8.6-rc.6 → 0.8.6

package/esm/src/providers/codex.js

@@ -1,5 +1,8 @@
 import * as dntShim from "../../_dnt.shims.js";
 import * as path from "../../deps/jsr.io/@std/path/1.1.4/mod.js";
+import { loadDeck } from "@bolt-foundry/gambit-core";
+import { logCodexAppServerDebug } from "../codex_app_server_debug.js";
+import { ensureTempMcpDenoConfigSync } from "../mcp_deno_config.js";
 export const CODEX_PREFIX = "codex-cli/";
 const CODEX_THREAD_META_KEY = "codex.threadId";
 const BOT_ROOT_ENV = "GAMBIT_BOT_ROOT";
@@ -10,7 +13,13 @@ const CODEX_REASONING_SUMMARY_ENV = "GAMBIT_CODEX_REASONING_SUMMARY";
 const CODEX_VERBOSITY_ENV = "GAMBIT_CODEX_VERBOSITY";
 const CODEX_BIN_ENV = "GAMBIT_CODEX_BIN";
 const CODEX_SKIP_SANDBOX_CONFIG_ENV = "GAMBIT_CODEX_SKIP_SANDBOX_CONFIG";
+const CODEX_DANGEROUS_BYPASS_ENV = "GAMBIT_CODEX_DANGEROUSLY_BYPASS_APPROVALS_AND_SANDBOX";
+const MCP_DENO_BIN_ENV = "GAMBIT_MCP_DENO_BIN";
 const MCP_ROOT_DECK_PATH_ENV = "GAMBIT_MCP_ROOT_DECK_PATH";
+const EXTERNAL_TOOL_BRIDGE_ENV = "GAMBIT_EXTERNAL_TOOL_BRIDGE";
+const MCP_DEBUG_LOG_PATH_ENV = "GAMBIT_MCP_DEBUG_LOG_PATH";
+const DENO_DIR_ENV = "DENO_DIR";
+const DEBUG_MCP_ENV = "BOLT_FOUNDRY_DESKTOP_CHIEF_RUNTIME_DEBUG_MCP";
 const MCP_SERVER_PATH = (() => {
     try {
         const moduleUrl = new URL(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url);
@@ -22,6 +31,27 @@ const MCP_SERVER_PATH = (() => {
         return null;
     }
 })();
+const MCP_SERVER_DENO_CONFIG_PATH = (() => {
+    try {
+        return ensureTempMcpDenoConfigSync();
+    }
+    catch {
+        return null;
+    }
+})();
+const MCP_SERVER_DENO_LOCK_PATH = (() => {
+    try {
+        const moduleUrl = new URL(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url);
+        if (moduleUrl.protocol !== "file:")
+            return null;
+        const candidate = path.resolve(path.dirname(path.fromFileUrl(moduleUrl)), "../../deno.mcp.lock");
+        const stat = dntShim.Deno.statSync(candidate);
+        return stat.isFile ? candidate : null;
+    }
+    catch {
+        return null;
+    }
+})();
 const REASONING_EFFORT_VALUES = new Set([
     "none",
     "minimal",
@@ -36,11 +66,17 @@ const REASONING_SUMMARY_VALUES = new Set([
     "concise",
     "detailed",
 ]);
-const VERBOSITY_VALUES = new Set([
-    "low",
-    "medium",
-    "high",
-]);
+const VERBOSITY_VALUES = new Set(["low", "medium", "high"]);
+let codexHostAuthBridge = null;
+export function setCodexHostAuthBridgeForTests(bridge) {
+    codexHostAuthBridge = bridge;
+}
+function requireCodexHostAuthBridge() {
+    if (!codexHostAuthBridge) {
+        throw new Error("Codex host auth bridge is required for app-server external auth bootstrap.");
+    }
+    return codexHostAuthBridge;
+}
 function runCwd() {
     const botRoot = dntShim.Deno.env.get(BOT_ROOT_ENV);
     if (typeof botRoot === "string" && botRoot.trim().length > 0) {
@@ -48,6 +84,21 @@ function runCwd() {
     }
     return dntShim.Deno.cwd();
 }
+function codexDeckDir(deckPath) {
+    const trimmed = deckPath?.trim();
+    if (!trimmed)
+        return undefined;
+    return path.dirname(path.isAbsolute(trimmed) ? trimmed : path.resolve(runCwd(), trimmed));
+}
+function codexRunCwd(input) {
+    const explicitCwd = input.cwd?.trim();
+    if (explicitCwd)
+        return explicitCwd;
+    const deckDir = codexDeckDir(input.deckPath);
+    if (deckDir)
+        return deckDir;
+    return runCwd();
+}
 function shouldEnableMcpBridge() {
     const disableRaw = dntShim.Deno.env.get(CODEX_DISABLE_MCP_ENV);
     if (disableRaw && parseTruthy(disableRaw))
@@ -58,16 +109,51 @@ function shouldEnableMcpBridge() {
     const normalized = enableRaw.trim().toLowerCase();
     return normalized === "1" || normalized === "true" || normalized === "yes";
 }
+function shouldDebugMcpBridge() {
+    const raw = dntShim.Deno.env.get(DEBUG_MCP_ENV)?.trim().toLowerCase();
+    return raw === "1" || raw === "true" || raw === "yes";
+}
+function logCodexMcpDebug(event, details) {
+    if (!shouldDebugMcpBridge())
+        return;
+    globalThis.console.error("[gambit-codex-mcp]", event, details ?? {});
+}
+function codexMcpDebugLogPath(cwd) {
+    return path.join(cwd, ".boltfoundry", "runtime", "chief-runtime", "gambit-mcp-debug.log");
+}
+function mcpServerDenoBin() {
+    return dntShim.Deno.env.get(MCP_DENO_BIN_ENV)?.trim() || "deno";
+}
 function parseTruthy(value) {
     const normalized = value.trim().toLowerCase();
     if (!normalized)
         return false;
     return normalized === "1" || normalized === "true" || normalized === "yes";
 }
+function shouldDangerouslyBypassCodexApprovalsAndSandbox(params) {
+    const dangerousBypass = params?.gambitDangerouslyBypassApprovalsAndSandbox;
+    if (typeof dangerousBypass === "boolean")
+        return dangerousBypass;
+    const codex = asRecord(params?.codex);
+    const codexDangerousBypass = codex.dangerously_bypass_approvals_and_sandbox;
+    if (typeof codexDangerousBypass === "boolean") {
+        return codexDangerousBypass;
+    }
+    const envRaw = dntShim.Deno.env.get(CODEX_DANGEROUS_BYPASS_ENV);
+    return Boolean(envRaw && parseTruthy(envRaw));
+}
 function shouldSkipCodexSandboxConfig(params) {
+    if (shouldDangerouslyBypassCodexApprovalsAndSandbox(params)) {
+        return true;
+    }
     const yolo = params?.gambitYolo;
     if (typeof yolo === "boolean")
         return yolo;
+    const codex = asRecord(params?.codex);
+    const codexSkipSandboxConfig = codex.skip_sandbox_config;
+    if (typeof codexSkipSandboxConfig === "boolean") {
+        return codexSkipSandboxConfig;
+    }
     const envRaw = dntShim.Deno.env.get(CODEX_SKIP_SANDBOX_CONFIG_ENV);
     return Boolean(envRaw && parseTruthy(envRaw));
 }
@@ -77,9 +163,92 @@ function tomlString(value) {
 function tomlStringArray(values) {
     return `[${values.map(tomlString).join(",")}]`;
 }
+function tomlKeySegment(value) {
+    return /^[A-Za-z0-9_-]+$/.test(value) ? value : tomlString(value);
+}
+function tomlValue(value) {
+    if (typeof value === "string")
+        return tomlString(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new Error(`Invalid Codex config number: ${value}`);
+        }
+        return String(value);
+    }
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (value === null)
+        return "null";
+    if (Array.isArray(value)) {
+        return `[${value.map((entry) => tomlValue(entry)).join(", ")}]`;
+    }
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, entry]) => entry !== undefined)
+            .sort(([a], [b]) => a.localeCompare(b));
+        return `{ ${entries
+            .map(([key, entry]) => `${tomlKeySegment(key)} = ${tomlValue(entry)}`)
+            .join(", ")} }`;
+    }
+    throw new Error(`Unsupported Codex config value type: ${typeof value}.`);
+}
+function sanitizeCodexSpawnArgsForDebug(args) {
+    const sanitized = [...args];
+    for (let idx = 0; idx < sanitized.length; idx += 1) {
+        if (sanitized[idx] !== "-c")
+            continue;
+        const next = sanitized[idx + 1];
+        if (!next?.startsWith("developer_instructions="))
+            continue;
+        sanitized[idx + 1] = "developer_instructions=<redacted>";
+    }
+    return sanitized;
+}
+function extractCodexConfigValues(args, flag, prefix) {
+    const values = [];
+    for (let idx = 0; idx < args.length; idx += 1) {
+        if (args[idx] !== flag)
+            continue;
+        const value = args[idx + 1];
+        if (typeof value !== "string" || value.length === 0)
+            continue;
+        if (typeof prefix === "string" && !value.startsWith(prefix))
+            continue;
+        values.push(value);
+    }
+    return values;
+}
+function codexAdditionalConfigArgs(params) {
+    const codex = params?.codex;
+    if (!codex || typeof codex !== "object" || Array.isArray(codex))
+        return [];
+    const args = [];
+    const visit = (prefix, value) => {
+        if (value === undefined)
+            return;
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
+            for (const [key, entry] of entries) {
+                visit([...prefix, key], entry);
+            }
+            return;
+        }
+        const dottedKey = prefix.map(tomlKeySegment).join(".");
+        args.push("-c", `${dottedKey}=${tomlValue(value)}`);
+    };
+    for (const [key, value] of Object.entries(codex).sort(([a], [b]) => a.localeCompare(b))) {
+        visit([key], value);
+    }
+    return args;
+}
 function codexConfigArgs(input) {
     const args = [];
+    args.push(...codexAdditionalConfigArgs(input.params));
     args.push("-c", `approval_policy=${tomlString("never")}`);
+    const pathEnv = dntShim.Deno.env.get("PATH")?.trim();
+    if (pathEnv) {
+        args.push("-c", `shell_environment_policy.set.PATH=${tomlString(pathEnv)}`);
+    }
     if (!shouldSkipCodexSandboxConfig(input.params)) {
         args.push("-c", `sandbox_mode=${tomlString("workspace-write")}`);
         args.push("-c", `sandbox_workspace_write.writable_roots=${tomlStringArray([input.cwd])}`);
@@ -116,18 +285,212 @@ function codexConfigArgs(input) {
     if (typeof verbosity === "string" && verbosity.trim()) {
         args.push("-c", `model_verbosity=${tomlString(verbosity.trim())}`);
     }
+    if (typeof input.instructions === "string" && input.instructions.trim()) {
+        args.push("-c", `developer_instructions=${tomlString(input.instructions.trim())}`);
+    }
     if (shouldEnableMcpBridge() && MCP_SERVER_PATH) {
-        args.push("-c", `mcp_servers.gambit.command=${tomlString("deno")}`);
-        args.push("-c", `mcp_servers.gambit.args=${tomlStringArray(["run", "-A", MCP_SERVER_PATH])}`);
+        const debugLogPath = shouldDebugMcpBridge()
+            ? codexMcpDebugLogPath(input.cwd)
+            : null;
+        logCodexMcpDebug("configArgs:enableServer", {
+            cwd: input.cwd,
+            deckPath: input.deckPath?.trim() || null,
+            debugLogPath,
+            mcpServerCommand: mcpServerDenoBin(),
+            mcpServerConfigPath: MCP_SERVER_DENO_CONFIG_PATH,
+            mcpServerLockPath: MCP_SERVER_DENO_LOCK_PATH,
+            mcpServerPath: MCP_SERVER_PATH,
+        });
+        args.push("-c", `mcp_servers.gambit.command=${tomlString(mcpServerDenoBin())}`);
+        const mcpServerArgs = ["run", "-A", "--frozen"];
+        if (MCP_SERVER_DENO_LOCK_PATH) {
+            mcpServerArgs.push("--lock", MCP_SERVER_DENO_LOCK_PATH);
+        }
+        if (MCP_SERVER_DENO_CONFIG_PATH) {
+            mcpServerArgs.push("--config", MCP_SERVER_DENO_CONFIG_PATH);
+        }
+        mcpServerArgs.push(MCP_SERVER_PATH);
+        args.push("-c", `mcp_servers.gambit.args=${tomlStringArray(mcpServerArgs)}`);
         args.push("-c", `mcp_servers.gambit.cwd=${tomlString(input.cwd)}`);
         args.push("-c", `mcp_servers.gambit.env.GAMBIT_BOT_ROOT=${tomlString(input.cwd)}`);
+        const denoDir = dntShim.Deno.env.get(DENO_DIR_ENV)?.trim();
+        if (denoDir) {
+            args.push("-c", `mcp_servers.gambit.env.${DENO_DIR_ENV}=${tomlString(denoDir)}`);
+        }
+        const externalToolBridge = dntShim.Deno.env.get(EXTERNAL_TOOL_BRIDGE_ENV)?.trim();
+        if (externalToolBridge) {
+            args.push("-c", `mcp_servers.gambit.env.${EXTERNAL_TOOL_BRIDGE_ENV}=${tomlString(externalToolBridge)}`);
+        }
         const rootDeckPath = input.deckPath?.trim();
         if (rootDeckPath) {
             args.push("-c", `mcp_servers.gambit.env.${MCP_ROOT_DECK_PATH_ENV}=${tomlString(rootDeckPath)}`);
         }
+        if (debugLogPath) {
+            args.push("-c", `mcp_servers.gambit.env.${DEBUG_MCP_ENV}=${tomlString("1")}`);
+            args.push("-c", `mcp_servers.gambit.env.${MCP_DEBUG_LOG_PATH_ENV}=${tomlString(debugLogPath)}`);
+        }
         args.push("-c", "mcp_servers.gambit.enabled=true");
         args.push("-c", "mcp_servers.gambit.startup_timeout_sec=30");
         args.push("-c", "mcp_servers.gambit.tool_timeout_sec=30");
+        const sanitizedArgs = sanitizeCodexSpawnArgsForDebug(args);
+        logCodexMcpDebug("configArgs:final", {
+            cwd: input.cwd,
+            deckPath: input.deckPath?.trim() || null,
+            gambitConfigArgs: extractCodexConfigValues(sanitizedArgs, "-c", "mcp_servers.gambit."),
+            gambitGlobalConfigArgs: extractCodexConfigValues(codexGlobalConfigArgs(sanitizedArgs), "--config", "mcp_servers.gambit."),
+        });
+    }
+    return args;
+}
+async function prepareCodexMcpRootDeck(input) {
+    const rootDeckPath = input.deckPath?.trim();
+    if (!rootDeckPath || !shouldEnableMcpBridge()) {
+        logCodexMcpDebug("prepareRootDeck:skip", {
+            deckPath: rootDeckPath ?? null,
+            mcpEnabled: shouldEnableMcpBridge(),
+        });
+        return {};
+    }
+    const deck = await loadDeck(rootDeckPath);
+    if (deck.actionDecks.length === 0) {
+        logCodexMcpDebug("prepareRootDeck:reuseOriginal", {
+            actionCount: 0,
+            deckPath: rootDeckPath,
+            toolCount: deck.tools.length,
+            toolNames: deck.tools.map((tool) => tool.name),
+        });
+        return { deckPath: rootDeckPath };
+    }
+    const tempDir = await dntShim.Deno.makeTempDir({ prefix: "gambit-codex-mcp-root-" });
+    const tempDeckPath = path.join(tempDir, "PROMPT.md");
+    const frontmatter = [
+        "+++",
+        'label = "codex_mcp_tool_surface"',
+        "",
+    ];
+    for (const action of deck.actionDecks) {
+        frontmatter.push("[[actions]]");
+        frontmatter.push(`name = ${tomlString(action.name)}`);
+        frontmatter.push(`path = ${tomlString(action.path)}`);
+        if (typeof action.description === "string" && action.description.trim()) {
+            frontmatter.push(`description = ${tomlString(action.description.trim())}`);
+        }
+        frontmatter.push("");
+    }
+    for (const externalTool of deck.tools) {
+        frontmatter.push("[[tools]]");
+        frontmatter.push(`name = ${tomlString(externalTool.name)}`);
+        if (typeof externalTool.description === "string" &&
+            externalTool.description.trim()) {
+            frontmatter.push(`description = ${tomlString(externalTool.description.trim())}`);
+        }
+        frontmatter.push("");
+    }
+    frontmatter.push("+++", "", "Codex MCP tool surface.");
+    await dntShim.Deno.writeTextFile(tempDeckPath, frontmatter.join("\n"));
+    logCodexMcpDebug("prepareRootDeck:synthesized", {
+        actionCount: deck.actionDecks.length,
+        actionNames: deck.actionDecks.map((action) => action.name),
+        rootDeckPath,
+        synthesizedDeckPath: tempDeckPath,
+        toolCount: deck.tools.length,
+        toolNames: deck.tools.map((tool) => tool.name),
+    });
+    return {
+        deckPath: tempDeckPath,
+        cleanup: async () => {
+            await dntShim.Deno.remove(tempDir, { recursive: true }).catch(() => undefined);
+        },
+    };
+}
+function appServerThreadSandboxPolicy(input) {
+    if (shouldSkipCodexSandboxConfig(input.params)) {
+        return { type: "dangerFullAccess" };
+    }
+    return {
+        type: "workspaceWrite",
+        writableRoots: [input.cwd],
+    };
+}
+function appServerTurnSandboxPolicy(input) {
+    if (shouldSkipCodexSandboxConfig(input.params)) {
+        return { type: "dangerFullAccess" };
+    }
+    return {
+        type: "workspaceWrite",
+        writableRoots: [input.cwd],
+    };
+}
+async function appServerRequestResult(input) {
+    if (input.method.startsWith("mcp")) {
+        logCodexMcpDebug("appServer:request", {
+            method: input.method,
+            params: safeJsonObjectFromRecord(input.params),
+        });
+    }
+    if (input.method === "mcpServer/elicitation/request") {
+        const mode = typeof input.params.mode === "string" ? input.params.mode : "";
+        const requestedSchema = asRecord(input.params.requestedSchema);
+        const properties = asRecord(requestedSchema.properties);
+        if (mode === "form" && Object.keys(properties).length === 0) {
+            return {
+                result: {
+                    action: "accept",
+                    content: {},
+                },
+            };
+        }
+    }
+    if (input.method === "account/chatgptAuthTokens/refresh") {
+        const bridge = requireCodexHostAuthBridge();
+        const refreshed = await bridge.refreshAuthTokens({
+            previousAccountId: typeof input.params.previousAccountId === "string"
+                ? input.params.previousAccountId
+                : null,
+            reason: typeof input.params.reason === "string" && input.params.reason
+                ? input.params.reason
+                : "account/chatgptAuthTokens/refresh",
+        });
+        return {
+            result: {
+                accessToken: refreshed.accessToken,
+                chatgptAccountId: refreshed.chatgptAccountId,
+                chatgptPlanType: refreshed.chatgptPlanType,
+                type: "chatgptAuthTokens",
+            },
+        };
+    }
+    return {
+        error: {
+            code: -32601,
+            message: `Unsupported app-server request: ${input.method}`,
+        },
+    };
+}
+async function bootstrapCodexExternalAuth(input) {
+    if (!codexHostAuthBridge) {
+        return;
+    }
+    const bridge = codexHostAuthBridge;
+    const auth = await bridge.readAuthTokens({
+        reason: "account/login/start",
+    });
+    await input.request("account/login/start", {
+        accessToken: auth.accessToken,
+        chatgptAccountId: auth.chatgptAccountId,
+        chatgptPlanType: auth.chatgptPlanType,
+        type: "chatgptAuthTokens",
+    });
+}
+function codexGlobalConfigArgs(configArgs) {
+    const args = [];
+    for (let idx = 0; idx < configArgs.length; idx += 2) {
+        if (configArgs[idx] !== "-c")
+            continue;
+        const value = configArgs[idx + 1];
+        if (typeof value === "string" && value.length > 0) {
+            args.push("--config", value);
+        }
     }
     return args;
 }
@@ -165,34 +528,706 @@ function safeJsonObject(text) {
             return parsed;
         }
     }
-    catch {
-        // ignore parse failure
+    catch {
+        // ignore parse failure
+    }
+    return {};
+}
+function safeJsonObjectFromRecord(value) {
+    try {
+        return safeJsonObject(JSON.stringify(value));
+    }
+    catch {
+        return {};
+    }
+}
+function parseJsonValue(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function stringifyJsonValue(value) {
+    if (typeof value === "string")
+        return value;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function asRecord(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return {};
+}
+function codexResponseItemKey(item) {
+    const record = asRecord(item);
+    const id = typeof record.id === "string" ? record.id : "";
+    const callId = typeof record.call_id === "string" ? record.call_id : "";
+    if (id || callId) {
+        return `${item.type}:${id}:${callId}`;
+    }
+    return `${item.type}:${JSON.stringify(record)}`;
+}
+function isCodexRawResponseItemRenderable(item) {
+    return item.type !== "message" && item.type !== "reasoning" &&
+        item.type !== "function_call" && item.type !== "function_call_output";
+}
+function codexRawResponseItemRecord(value) {
+    const item = asRecord(value);
+    const type = typeof item.type === "string" ? item.type.trim() : "";
+    return type ? item : null;
+}
+function isProviderTraceEvent(event) {
+    return (event.type === "tool.call" || event.type === "tool.result") &&
+        typeof event.toolKind === "string";
+}
+function responseEventToJsonRecord(event) {
+    return safeJsonObject(JSON.stringify(event));
+}
+function responseEventToProviderTraceEvent(event) {
+    if (typeof event.toolKind !== "string")
+        return null;
+    if (event.type === "tool.call") {
+        if (typeof event.args === "undefined")
+            return null;
+        return {
+            type: "tool.call",
+            actionCallId: event.actionCallId,
+            name: event.name,
+            args: event.args,
+            toolKind: event.toolKind,
+            ...(typeof event.runId === "string" ? { runId: event.runId } : {}),
+            ...(typeof event.parentActionCallId === "string"
+                ? { parentActionCallId: event.parentActionCallId }
+                : {}),
+        };
+    }
+    if (typeof event.result === "undefined")
+        return null;
+    return {
+        type: "tool.result",
+        actionCallId: event.actionCallId,
+        name: event.name,
+        result: event.result,
+        toolKind: event.toolKind,
+        ...(typeof event.runId === "string" ? { runId: event.runId } : {}),
+        ...(typeof event.parentActionCallId === "string"
+            ? { parentActionCallId: event.parentActionCallId }
+            : {}),
+    };
+}
+function parseUsageBreakdown(value) {
+    const record = asRecord(value);
+    const inputTokens = record.inputTokens;
+    const outputTokens = record.outputTokens;
+    const totalTokens = record.totalTokens;
+    if (typeof inputTokens !== "number" || !Number.isFinite(inputTokens) ||
+        typeof outputTokens !== "number" || !Number.isFinite(outputTokens) ||
+        typeof totalTokens !== "number" || !Number.isFinite(totalTokens)) {
+        return undefined;
+    }
+    return {
+        promptTokens: inputTokens,
+        completionTokens: outputTokens,
+        totalTokens,
+    };
+}
+function normalizeAppServerToolStatus(status) {
+    if (typeof status !== "string")
+        return "";
+    if (status === "inProgress")
+        return "in_progress";
+    return status;
+}
+function appServerThreadItemToCodexItem(item) {
+    const type = typeof item.type === "string" ? item.type : "";
+    const id = typeof item.id === "string" ? item.id : "";
+    if (!type || !id)
+        return null;
+    if (type === "agentMessage") {
+        return {
+            id,
+            type: "agent_message",
+            text: typeof item.text === "string" ? item.text : "",
+        };
+    }
+    if (type === "reasoning") {
+        return {
+            id,
+            type: "reasoning",
+            summary: (Array.isArray(item.summary) ? item.summary : []),
+            content: (Array.isArray(item.content) ? item.content : []),
+        };
+    }
+    if (type === "mcpToolCall") {
+        return {
+            id,
+            type: "mcp_tool_call",
+            tool: typeof item.tool === "string" ? item.tool : "",
+            server: typeof item.server === "string" ? item.server : "",
+            status: normalizeAppServerToolStatus(item.status),
+            arguments: (item.arguments ?? {}),
+            result: (item.result ?? null),
+            error: (item.error ?? null),
+        };
+    }
+    if (type === "commandExecution") {
+        return {
+            id,
+            type: "command_execution",
+            command: (item.command ?? ""),
+            status: normalizeAppServerToolStatus(item.status),
+            aggregated_output: typeof item.aggregatedOutput === "string"
+                ? item.aggregatedOutput
+                : "",
+            exit_code: (item.exitCode ?? null),
+        };
+    }
+    if (type === "fileChange") {
+        return {
+            id,
+            type: "file_change",
+            status: normalizeAppServerToolStatus(item.status),
+            changes: (Array.isArray(item.changes) ? item.changes : []),
+        };
+    }
+    return null;
+}
+function appServerNotificationToCodexEvent(method, params) {
+    if (method === "rawResponseItem/completed") {
+        const item = codexRawResponseItemRecord(params.item);
+        if (!item)
+            return null;
+        return {
+            type: "raw.response_item.completed",
+            item: safeJsonObjectFromRecord(item),
+        };
+    }
+    if (method === "item/agentMessage/delta") {
+        return {
+            type: "item.delta",
+            item: {
+                id: typeof params.itemId === "string" ? params.itemId : "",
+                type: "agent_message",
+                text: typeof params.delta === "string" ? params.delta : "",
+            },
+        };
+    }
+    if (method === "item/reasoning/textDelta" ||
+        method === "item/reasoning/summaryTextDelta") {
+        return {
+            type: "item.delta",
+            item: {
+                id: typeof params.itemId === "string" ? params.itemId : "reasoning",
+                type: "reasoning",
+                text: typeof params.delta === "string" ? params.delta : "",
+            },
+        };
+    }
+    if (method === "item/commandExecution/outputDelta" ||
+        method === "item/fileChange/outputDelta") {
+        const itemType = method === "item/commandExecution/outputDelta"
+            ? "command_execution"
+            : "file_change";
+        return {
+            type: "item.delta",
+            item: {
+                id: typeof params.itemId === "string" ? params.itemId : "",
+                type: itemType,
+                status: "in_progress",
+                ...(itemType === "command_execution"
+                    ? {
+                        aggregated_output: typeof params.delta === "string"
+                            ? params.delta
+                            : "",
+                    }
+                    : { changes: [] }),
+            },
+        };
+    }
+    if (method === "item/mcpToolCall/progress") {
+        logCodexMcpDebug("appServer:item.mcpToolCall.progress", {
+            itemId: typeof params.itemId === "string" ? params.itemId : "",
+            message: typeof params.message === "string" ? params.message : "",
+        });
+        return {
+            type: "item.delta",
+            item: {
+                id: typeof params.itemId === "string" ? params.itemId : "",
+                type: "mcp_tool_call",
+                status: "in_progress",
+                result: typeof params.message === "string" ? params.message : "",
+            },
+        };
+    }
+    if (method === "item/started" || method === "item/completed") {
+        const item = asRecord(params.item);
+        const mapped = appServerThreadItemToCodexItem(item);
+        if (!mapped)
+            return null;
+        if (mapped.type === "mcp_tool_call") {
+            logCodexMcpDebug(`appServer:${method}`, {
+                itemId: mapped.id ?? "",
+                server: mapped.server ?? "",
+                tool: mapped.tool ?? "",
+                status: mapped.status ?? "",
+            });
+        }
+        return {
+            type: method === "item/started" ? "item.started" : "item.completed",
+            item: mapped,
+        };
+    }
+    return null;
+}
+async function defaultAppServerTurnRunner(input) {
+    const codexBin = dntShim.Deno.env.get(CODEX_BIN_ENV)?.trim() || "codex";
+    const dangerousBypass = shouldDangerouslyBypassCodexApprovalsAndSandbox(input.params);
+    const skipSandboxConfig = shouldSkipCodexSandboxConfig(input.params);
+    const spawnArgs = [
+        ...codexGlobalConfigArgs(codexConfigArgs({
+            cwd: input.cwd,
+            deckPath: input.deckPath,
+            params: input.params,
+            instructions: input.instructions,
+        })),
+        ...(dangerousBypass
+            ? ["--dangerously-bypass-approvals-and-sandbox"]
+            : skipSandboxConfig
+                ? ["--yolo"]
+                : []),
+        "app-server",
+    ];
+    logCodexMcpDebug("appServer:spawn", {
+        argv: [codexBin, ...sanitizeCodexSpawnArgsForDebug(spawnArgs)],
+        codexBin,
+        cwd: input.cwd,
+        dangerousBypass,
+        gambitConfigArgs: spawnArgs.filter((arg) => arg.includes("mcp_servers.gambit")),
+        skipSandboxConfig,
+    });
+    const child = new dntShim.Deno.Command(codexBin, {
+        args: spawnArgs,
+        cwd: input.cwd,
+        stdin: "piped",
+        stdout: "piped",
+        stderr: "piped",
+    }).spawn();
+    const abort = () => {
+        try {
+            child.kill("SIGTERM");
+        }
+        catch {
+            // ignore
+        }
+    };
+    if (input.signal?.aborted) {
+        abort();
+    }
+    else if (input.signal) {
+        input.signal.addEventListener("abort", abort, { once: true });
+    }
+    const encoder = new TextEncoder();
+    const stdoutReader = child.stdout.getReader();
+    const stderrReader = child.stderr.getReader();
+    const stdinWriter = child.stdin.getWriter();
+    let childExitStatus = null;
+    const pending = new Map();
+    const stderrChunks = [];
+    const assistantMessages = [];
+    const assistantIndexById = new Map();
+    const rawResponseItems = [];
+    const rawResponseItemKeys = new Set();
+    const turnState = { completed: false };
+    let nextRequestId = 1;
+    let cleanupError = null;
+    let output = null;
+    let childClosedError = null;
+    const appServerClosedError = () => {
+        if (childClosedError) {
+            return childClosedError;
+        }
+        const stderr = stderrChunks.join("").trim();
+        if (stderr) {
+            childClosedError = new Error(`codex app-server failed: ${stderr}`);
+            return childClosedError;
+        }
+        const detail = childExitStatus
+            ? childExitStatus.code === 0
+                ? "exited successfully"
+                : `exited with code ${childExitStatus.code}`
+            : "closed unexpectedly";
+        childClosedError = new Error(`Codex app-server exited before the request completed (${detail}).`);
+        return childClosedError;
+    };
+    let rejectChildClosed = null;
+    const childClosed = new Promise((_, reject) => {
+        rejectChildClosed = reject;
+    });
+    // Some request paths can fail before they start awaiting `childClosed`
+    // (for example, if writing to the child stdin fails immediately). Keep the
+    // shared shutdown promise locally handled so a later child exit does not
+    // surface as an unhandled rejection in those early-failure cases.
+    childClosed.catch(() => undefined);
+    const childStatus = child.status.then((status) => {
+        childExitStatus = status;
+        const error = appServerClosedError();
+        for (const pendingRequest of pending.values()) {
+            pendingRequest.reject(error);
+        }
+        pending.clear();
+        rejectChildClosed?.(error);
+        return status;
+    });
+    const writeMessage = async (message) => {
+        logCodexAppServerDebug("message:out", {
+            message,
+        });
+        await stdinWriter.write(encoder.encode(`${JSON.stringify(message)}\n`));
+    };
+    const request = (method, params) => {
+        const id = String(nextRequestId++);
+        const promise = new Promise((resolve, reject) => {
+            pending.set(id, { resolve, reject });
+        });
+        const requestPromise = promise.finally(() => {
+            pending.delete(id);
+        });
+        requestPromise.catch(() => undefined);
+        return Promise.race([writeMessage({ id, method, params }), childClosed])
+            .catch((error) => {
+            pending.delete(id);
+            throw error;
+        })
+            .then(() => Promise.race([requestPromise, childClosed]));
+    };
+    const readLoop = async () => {
+        const decoder = new TextDecoder();
+        let buffered = "";
+        while (true) {
+            const { value, done } = await stdoutReader.read();
+            if (done)
+                break;
+            buffered += decoder.decode(value, { stream: true });
+            const parts = buffered.split(/\r?\n/);
+            buffered = parts.pop() ?? "";
+            for (const line of parts) {
+                const trimmed = line.trim();
+                if (!trimmed.startsWith("{"))
+                    continue;
+                let parsed;
+                try {
+                    parsed = JSON.parse(trimmed);
+                }
+                catch (error) {
+                    logCodexAppServerDebug("message:in:parse_failed", {
+                        error: error instanceof Error ? error.message : String(error),
+                        lineLength: trimmed.length,
+                    });
+                    continue;
+                }
+                logCodexAppServerDebug("message:in", {
+                    message: parsed,
+                });
+                const method = typeof parsed.method === "string" ? parsed.method : "";
+                const params = asRecord(parsed.params);
+                if (method) {
+                    if (Object.prototype.hasOwnProperty.call(parsed, "id")) {
+                        const requestId = typeof parsed.id === "string" ||
+                            typeof parsed.id === "number" || parsed.id === null
+                            ? parsed.id
+                            : null;
+                        input.onStreamEvent?.({
+                            type: "app_server.request",
+                            requestId: requestId === null ? "null" : String(requestId),
+                            method,
+                            params: safeJsonObjectFromRecord(params),
+                        });
+                        const response = await appServerRequestResult({ method, params });
+                        logCodexAppServerDebug("message:host_response", {
+                            method,
+                            requestId,
+                            response,
+                        });
+                        await writeMessage({
+                            id: requestId,
+                            ...(response.result ? { result: response.result } : {}),
+                            ...(response.error ? { error: response.error } : {}),
+                        });
+                        continue;
+                    }
+                    const pseudoEvent = appServerNotificationToCodexEvent(method, params);
+                    if (pseudoEvent) {
+                        input.onStreamEvent?.(pseudoEvent);
+                    }
+                    if (method === "rawResponseItem/completed") {
+                        const rawItem = codexRawResponseItemRecord(params.item);
+                        if (!rawItem)
+                            continue;
+                        const item = safeJsonObjectFromRecord(rawItem);
+                        if (isCodexRawResponseItemRenderable(item)) {
+                            const key = codexResponseItemKey(item);
+                            if (!rawResponseItemKeys.has(key)) {
+                                rawResponseItemKeys.add(key);
+                                rawResponseItems.push(item);
+                            }
+                        }
+                    }
+                    else if (method === "item/completed") {
+                        const item = asRecord(params.item);
+                        if (item.type === "agentMessage" && typeof item.id === "string") {
+                            const entry = {
+                                itemId: item.id,
+                                text: typeof item.text === "string" ? item.text : "",
+                            };
+                            const existing = assistantIndexById.get(item.id);
+                            if (typeof existing === "number") {
+                                assistantMessages[existing] = entry;
+                            }
+                            else {
+                                assistantIndexById.set(item.id, assistantMessages.length);
+                                assistantMessages.push(entry);
+                            }
+                        }
+                    }
+                    else if (method === "thread/tokenUsage/updated") {
+                        if (typeof params.turnId === "string" &&
+                            (!turnState.id || params.turnId === turnState.id)) {
+                            turnState.usage = parseUsageBreakdown(asRecord(params.tokenUsage).last);
+                        }
+                    }
+                    else if (method === "turn/started") {
+                        const turn = asRecord(params.turn);
+                        if (typeof turn.id === "string") {
+                            turnState.id = turn.id;
+                        }
+                    }
+                    else if (method === "turn/completed") {
+                        const turn = asRecord(params.turn);
+                        if (typeof turn.id === "string") {
+                            turnState.id = turn.id;
+                        }
+                        if (turn.status === "failed") {
+                            const error = asRecord(turn.error);
+                            const message = typeof error.message === "string" && error.message
+                                ? error.message
+                                : "Codex app-server turn failed";
+                            turnState.error = new Error(message);
+                        }
+                        else if (turn.status === "interrupted") {
+                            turnState.error = new DOMException("Run canceled", "AbortError");
+                        }
+                        turnState.completed = true;
+                    }
+                    continue;
+                }
+                if (!Object.prototype.hasOwnProperty.call(parsed, "id"))
+                    continue;
+                const responseId = String(parsed.id);
+                const resolver = pending.get(responseId);
+                if (!resolver)
+                    continue;
+                pending.delete(responseId);
+                if (parsed.error) {
+                    const error = asRecord(parsed.error);
+                    logCodexAppServerDebug("message:in:error", {
+                        responseId,
+                        error,
+                    });
+                    const message = typeof error.message === "string" && error.message
+                        ? error.message
+                        : "Codex app-server request failed";
+                    resolver.reject(new Error(message));
+                    continue;
+                }
+                logCodexAppServerDebug("message:in:result", {
+                    responseId,
+                    result: parsed.result,
+                });
+                resolver.resolve(parsed.result);
+            }
+        }
+    };
+    const stderrLoop = (async () => {
+        const decoder = new TextDecoder();
+        let buffered = "";
+        while (true) {
+            const { value, done } = await stderrReader.read();
+            if (done)
+                break;
+            const chunk = decoder.decode(value, { stream: true });
+            stderrChunks.push(chunk);
+            buffered += chunk;
+            const lines = buffered.split(/\r?\n/);
+            buffered = lines.pop() ?? "";
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                logCodexAppServerDebug("stderr", {
+                    line: trimmed,
+                });
+            }
+        }
+        if (buffered.trim()) {
+            logCodexAppServerDebug("stderr", {
+                line: buffered.trim(),
+            });
+        }
+    })();
+    const stdoutLoop = readLoop();
+    try {
+        await request("initialize", {
+            clientInfo: {
+                name: "gambit",
+                title: "Gambit",
+                version: "0.0.0",
+            },
+            capabilities: {
+                experimentalApi: true,
+            },
+        });
+        await writeMessage({ method: "initialized", params: {} });
+        await bootstrapCodexExternalAuth({ request });
+        const model = normalizeCodexModel(input.model);
+        const threadResult = input.priorThreadId
+            ? await request("thread/resume", {
+                threadId: input.priorThreadId,
+                model: model && model !== "default" ? model : null,
+                cwd: input.cwd,
+                approvalPolicy: "never",
+                sandboxPolicy: appServerThreadSandboxPolicy({
+                    cwd: input.cwd,
+                    params: input.params,
+                }),
+                persistExtendedHistory: false,
+            })
+            : await request("thread/start", {
+                model: model && model !== "default" ? model : null,
+                cwd: input.cwd,
+                approvalPolicy: "never",
+                sandboxPolicy: appServerThreadSandboxPolicy({
+                    cwd: input.cwd,
+                    params: input.params,
+                }),
+                ephemeral: false,
+                experimentalRawEvents: true,
+                persistExtendedHistory: false,
+            });
+        const thread = asRecord(threadResult.thread);
+        const threadId = typeof thread.id === "string"
+            ? thread.id
+            : input.priorThreadId;
+        if (!threadId) {
+            throw new Error("Codex app-server did not return a thread id.");
+        }
+        const turnInput = input.prompt
+            ? [{ type: "text", text: input.prompt }]
+            : [];
+        await request("turn/start", {
+            threadId,
+            input: turnInput,
+            cwd: input.cwd,
+            approvalPolicy: "never",
+            sandboxPolicy: appServerTurnSandboxPolicy({
+                cwd: input.cwd,
+                params: input.params,
+            }),
+            model: model && model !== "default" ? model : null,
+        });
+        while (!turnState.completed) {
+            if (input.signal?.aborted) {
+                throw new DOMException("Run canceled", "AbortError");
+            }
+            if (childExitStatus) {
+                await Promise.allSettled([stdoutLoop, stderrLoop]);
+                if (!turnState.completed && !turnState.error) {
+                    turnState.error = appServerClosedError();
+                }
+                break;
+            }
+            let pollTimer;
+            await Promise.race([
+                childStatus.then(() => undefined),
+                new Promise((resolve) => {
+                    pollTimer = setTimeout(resolve, 10);
+                }),
+            ]);
+            if (pollTimer !== undefined) {
+                clearTimeout(pollTimer);
+            }
+        }
+        if (turnState.error)
+            throw turnState.error;
+        output = {
+            threadId,
+            assistantMessages,
+            rawResponseItems,
+            usage: turnState.usage,
+        };
+    }
+    finally {
+        for (const { reject } of pending.values()) {
+            reject(new Error("Codex app-server session closed"));
+        }
+        pending.clear();
+        try {
+            await stdinWriter.close();
+        }
+        catch {
+            // ignore
+        }
+        await Promise.allSettled([stdoutLoop, stderrLoop, childStatus]);
+        if (input.signal) {
+            input.signal.removeEventListener("abort", abort);
+        }
+        if (input.signal?.aborted ||
+            turnState.error instanceof DOMException &&
+                turnState.error.name === "AbortError") {
+            cleanupError = new DOMException("Run canceled", "AbortError");
+        }
+        else if (!turnState.completed && !turnState.error) {
+            cleanupError = appServerClosedError();
+        }
     }
-    return {};
-}
-function parseJsonValue(text) {
-    try {
-        return JSON.parse(text);
+    if (cleanupError) {
+        throw cleanupError;
     }
-    catch {
-        return text;
+    if (!output) {
+        throw new Error("Codex app-server turn runner completed without a result.");
     }
+    return output;
 }
-function stringifyJsonValue(value) {
-    if (typeof value === "string")
-        return value;
-    try {
-        return JSON.stringify(value);
+function codexToolResultForItem(itemType, record) {
+    if (itemType === "mcp_tool_call") {
+        return {
+            server: record.server ?? "",
+            status: record.status ?? "",
+            result: record.result ?? null,
+            error: record.error ?? null,
+        };
     }
-    catch {
-        return String(value);
+    if (itemType === "command_execution") {
+        return {
+            command: record.command ?? "",
+            status: record.status ?? "",
+            output: record.aggregated_output ?? "",
+            exit_code: record.exit_code ?? null,
+        };
     }
-}
-function asRecord(value) {
-    if (value && typeof value === "object" && !Array.isArray(value)) {
-        return value;
+    if (itemType === "file_change") {
+        return {
+            status: record.status ?? "",
+            changes: record.changes ?? [],
+        };
     }
-    return {};
+    return record ?? null;
 }
 function emitCodexToolEvents(input) {
     const payloadType = typeof input.event.type === "string"
@@ -264,47 +1299,28 @@ function emitCodexToolEvents(input) {
             },
         });
     }
-    if (input.emittedResults.has(callId))
-        return;
     if (!resolvedName)
         return;
     const isTerminal = payloadType === "item.completed" ||
         payloadType === "item.done";
-    if (!isTerminal)
+    const result = codexToolResultForItem(itemType, record);
+    const resultFingerprint = stringifyJsonValue(result);
+    const priorResultFingerprint = input.lastResultFingerprintByCallId.get(callId);
+    const shouldEmitProgressResult = payloadType !== "item.started" &&
+        resultFingerprint !== priorResultFingerprint;
+    if (shouldEmitProgressResult) {
+        input.lastResultFingerprintByCallId.set(callId, resultFingerprint);
+        input.emit({
+            type: "tool.result",
+            actionCallId: callId,
+            name: resolvedName,
+            result,
+            toolKind: "mcp_bridge",
+        });
+    }
+    if (!isTerminal || input.emittedTerminalResults.has(callId))
         return;
-    input.emittedResults.add(callId);
-    const result = (() => {
-        if (itemType === "mcp_tool_call") {
-            return {
-                server: record.server ?? "",
-                status: record.status ?? "",
-                result: record.result ?? null,
-                error: record.error ?? null,
-            };
-        }
-        if (itemType === "command_execution") {
-            return {
-                command: record.command ?? "",
-                status: record.status ?? "",
-                output: record.aggregated_output ?? "",
-                exit_code: record.exit_code ?? null,
-            };
-        }
-        if (itemType === "file_change") {
-            return {
-                status: record.status ?? "",
-                changes: record.changes ?? [],
-            };
-        }
-        return record ?? null;
-    })();
-    input.emit({
-        type: "tool.result",
-        actionCallId: callId,
-        name: resolvedName,
-        result,
-        toolKind: "mcp_bridge",
-    });
+    input.emittedTerminalResults.add(callId);
     input.emit({
         type: "response.output_item.done",
         output_index: outputIndex,
@@ -331,6 +1347,100 @@ function extractTextParts(value) {
     }
     return parts;
 }
+function extractCodexItemText(record) {
+    return typeof record.text === "string"
+        ? record.text
+        : extractTextParts(record.content).join("");
+}
+function requireCodexAssistantItemId(input) {
+    const itemId = typeof input.record.id === "string"
+        ? input.record.id.trim()
+        : "";
+    if (itemId)
+        return itemId;
+    throw new Error(`Codex ${input.payloadType} agent_message is missing required item.id.`);
+}
+function resolveCodexAssistantItemIdentity(input) {
+    const itemId = requireCodexAssistantItemId({
+        payloadType: input.payloadType,
+        record: input.record,
+    });
+    const existing = input.assistantState.assistantOutputIndexByItemId.get(itemId);
+    if (typeof existing === "number") {
+        return {
+            itemId,
+            outputIndex: existing,
+        };
+    }
+    const next = input.nextOutputIndexRef.value;
+    input.nextOutputIndexRef.value += 1;
+    input.assistantState.assistantOutputIndexByItemId.set(itemId, next);
+    return {
+        itemId,
+        outputIndex: next,
+    };
+}
+function emitCodexAssistantTextEvents(input) {
+    const payloadType = typeof input.event.type === "string"
+        ? input.event.type
+        : "";
+    if (!payloadType.startsWith("item."))
+        return;
+    const item = input.event.item;
+    if (!item || typeof item !== "object" || Array.isArray(item))
+        return;
+    const record = item;
+    if (record.type !== "agent_message")
+        return;
+    const { itemId, outputIndex } = resolveCodexAssistantItemIdentity({
+        payloadType,
+        record,
+        assistantState: input.assistantState,
+        nextOutputIndexRef: input.nextOutputIndexRef,
+    });
+    const text = extractCodexItemText(record);
+    if (!text)
+        return;
+    if (payloadType === "item.delta") {
+        input.assistantState.sawAssistantTextStream = true;
+        input.assistantState.streamedText += text;
+        input.emit({
+            type: "response.output_text.delta",
+            output_index: outputIndex,
+            delta: text,
+            item_id: itemId,
+        });
+        input.emitText?.(text);
+        return;
+    }
+    if (payloadType === "item.completed" || payloadType === "item.done") {
+        const hadPriorAssistantDelta = input.assistantState.sawAssistantTextStream;
+        input.assistantState.sawAssistantTextStream = true;
+        input.assistantState.streamedText = text;
+        input.emit({
+            type: "response.output_text.done",
+            output_index: outputIndex,
+            text,
+            item_id: itemId,
+        });
+        if (!input.assistantState.emittedTerminalAssistantItemIds.has(itemId)) {
+            input.assistantState.emittedTerminalAssistantItemIds.add(itemId);
+            input.emit({
+                type: "response.output_item.done",
+                output_index: outputIndex,
+                item: {
+                    type: "message",
+                    role: "assistant",
+                    id: itemId,
+                    content: [{ type: "output_text", text }],
+                },
+            });
+        }
+        if (!hadPriorAssistantDelta) {
+            input.emitText?.(text);
+        }
+    }
+}
 function emitCodexReasoningEvents(input) {
     const payloadType = typeof input.event.type === "string"
         ? input.event.type
@@ -418,6 +1528,38 @@ function emitCodexReasoningEvents(input) {
         }
     }
 }
+function emitCodexRawResponseItemEvents(input) {
+    if (input.event.type !== "raw.response_item.completed")
+        return;
+    const item = asRecord(input.event.item);
+    const type = typeof item.type === "string" ? item.type : "";
+    if (!type)
+        return;
+    const responseItem = safeJsonObjectFromRecord(item);
+    if (!isCodexRawResponseItemRenderable(responseItem))
+        return;
+    const itemKey = codexResponseItemKey(responseItem);
+    if (input.assistantState.emittedTerminalRawItemKeys.has(itemKey))
+        return;
+    const existing = input.assistantState.rawOutputIndexByItemKey.get(itemKey);
+    const outputIndex = typeof existing === "number" ? existing : (() => {
+        const next = input.nextOutputIndexRef.value;
+        input.nextOutputIndexRef.value += 1;
+        input.assistantState.rawOutputIndexByItemKey.set(itemKey, next);
+        return next;
+    })();
+    input.emit({
+        type: "response.output_item.added",
+        output_index: outputIndex,
+        item: responseItem,
+    });
+    input.emit({
+        type: "response.output_item.done",
+        output_index: outputIndex,
+        item: responseItem,
+    });
+    input.assistantState.emittedTerminalRawItemKeys.add(itemKey);
+}
 function responseItemsToChatMessages(items, instructions) {
     const messages = [];
     if (typeof instructions === "string" && instructions.trim().length > 0) {
@@ -472,19 +1614,100 @@ function responseItemsFromAssistantMessage(message) {
     }
     return output;
 }
+function responseItemsFromAssistantMessages(messages) {
+    return messages
+        .filter((message) => message.text.length > 0)
+        .map((message) => ({
+        type: "message",
+        role: "assistant",
+        content: [{ type: "output_text", text: message.text }],
+        ...(message.itemId ? { id: message.itemId } : {}),
+    }));
+}
+function codexResponseOutputLocator(item) {
+    if (item.type === "message" && item.role === "assistant" &&
+        typeof item.id === "string" && item.id.trim().length > 0) {
+        return `assistant:${item.id}`;
+    }
+    if (isCodexRawResponseItemRenderable(item)) {
+        return `raw:${codexResponseItemKey(item)}`;
+    }
+    return `synthetic:${codexResponseItemKey(item)}`;
+}
+function codexResponseOutputIndexes(input) {
+    const indexes = new Map();
+    const claimed = new Set();
+    const state = input.assistantState;
+    if (state) {
+        for (const item of input.items) {
+            const locator = codexResponseOutputLocator(item);
+            if (indexes.has(locator))
+                continue;
+            if (item.type === "message" && item.role === "assistant" &&
+                typeof item.id === "string") {
+                const index = state.assistantOutputIndexByItemId.get(item.id);
+                if (typeof index === "number") {
+                    indexes.set(locator, index);
+                    claimed.add(index);
+                }
+                continue;
+            }
+            if (isCodexRawResponseItemRenderable(item)) {
+                const index = state.rawOutputIndexByItemKey.get(codexResponseItemKey(item));
+                if (typeof index === "number") {
+                    indexes.set(locator, index);
+                    claimed.add(index);
+                }
+            }
+        }
+    }
+    let nextIndex = claimed.size === 0 ? 0 : Math.max(...claimed) + 1;
+    for (const item of input.items) {
+        const locator = codexResponseOutputLocator(item);
+        if (indexes.has(locator))
+            continue;
+        while (claimed.has(nextIndex))
+            nextIndex += 1;
+        indexes.set(locator, nextIndex);
+        claimed.add(nextIndex);
+        nextIndex += 1;
+    }
+    return indexes;
+}
+function mergeCodexResponseOutput(input) {
+    const assistantOutput = input.assistantMessages.length > 0
+        ? responseItemsFromAssistantMessages(input.assistantMessages)
+        : responseItemsFromAssistantMessage(input.assistantMessage);
+    const rawOutput = (input.rawResponseItems ?? []).filter(isCodexRawResponseItemRenderable);
+    if (rawOutput.length === 0)
+        return assistantOutput;
+    const seen = new Set(assistantOutput.map(codexResponseItemKey));
+    const mergedOutput = [
+        ...assistantOutput,
+        ...rawOutput.filter((item) => {
+            const key = codexResponseItemKey(item);
+            if (seen.has(key))
+                return false;
+            seen.add(key);
+            return true;
+        }),
+    ];
+    const outputIndexes = codexResponseOutputIndexes({
+        items: mergedOutput,
+        assistantState: input.assistantState,
+    });
+    return mergedOutput.sort((left, right) => (outputIndexes.get(codexResponseOutputLocator(left)) ?? 0) -
+        (outputIndexes.get(codexResponseOutputLocator(right)) ?? 0));
+}
 function stringContent(content) {
     if (typeof content === "string")
         return content.trim();
     return "";
 }
-function renderMessagesForPrompt(messages) {
+function codexInstructionsForMessages(messages) {
     return messages
-        .map((message) => {
-        const content = stringContent(message.content);
-        if (!content)
-            return "";
-        return `${message.role.toUpperCase()}:\n${content}`;
-    })
+        .filter((message) => message.role === "system")
+        .map((message) => stringContent(message.content))
         .filter(Boolean)
         .join("\n\n");
 }
@@ -502,66 +1725,36 @@ function latestUserPrompt(messages) {
 function promptForCodexTurn(input) {
     if (input.priorThreadId) {
         // Thread resume should be incremental: only send the newest user turn.
-        return latestUserPrompt(input.messages);
-    }
-    return renderMessagesForPrompt(input.messages);
-}
-function parseNumber(input) {
-    return typeof input === "number" && Number.isFinite(input) ? input : 0;
-}
-function parseCodexStdout(stdout) {
-    let threadId;
-    let assistantText = "";
-    let usage;
-    for (const line of stdout.split(/\r?\n/)) {
-        const trimmed = line.trim();
-        if (!trimmed.startsWith("{"))
-            continue;
-        let parsed = null;
-        try {
-            parsed = JSON.parse(trimmed);
-        }
-        catch {
-            continue;
-        }
-        if (!parsed || typeof parsed !== "object")
-            continue;
-        if (parsed.type === "thread.started") {
-            if (typeof parsed.thread_id === "string" && parsed.thread_id.trim()) {
-                threadId = parsed.thread_id.trim();
-            }
-            continue;
-        }
-        if (parsed.type === "item.completed") {
-            const item = parsed.item;
-            if (!item || typeof item !== "object")
-                continue;
-            if (item.type !== "agent_message")
+        for (let idx = input.messages.length - 1; idx >= 0; idx -= 1) {
+            const msg = input.messages[idx];
+            if (msg.role === "system")
                 continue;
-            if (typeof item.text !== "string")
-                continue;
-            const content = item.text.trim();
-            if (content)
-                assistantText = content;
-            continue;
-        }
-        if (parsed.type === "turn.completed") {
-            const rawUsage = parsed.usage;
-            if (!rawUsage || typeof rawUsage !== "object")
-                continue;
-            usage = {
-                promptTokens: parseNumber(rawUsage.input_tokens),
-                completionTokens: parseNumber(rawUsage.output_tokens),
-                totalTokens: parseNumber(rawUsage.total_tokens),
-            };
+            if (msg.role !== "user")
+                return "";
+            return stringContent(msg.content);
         }
+        return latestUserPrompt(input.messages);
     }
-    return { threadId, assistantText, usage };
+    const nonSystemMessages = input.messages.filter((message) => message.role !== "system");
+    const latestUser = latestUserPrompt(nonSystemMessages);
+    if (nonSystemMessages.length <= 1 &&
+        nonSystemMessages.every((message) => message.role === "user")) {
+        return latestUser;
+    }
+    throw new Error("Codex fresh-thread continuation is unsupported; missing codex.threadId for prior conversation state.");
 }
 function buildUpdatedState(input) {
     const priorState = input.priorState;
     const baseMessages = input.messages.map((message) => ({ ...message }));
-    baseMessages.push({ role: "assistant", content: input.assistantText });
+    if (input.assistantMessages && input.assistantMessages.length > 0) {
+        baseMessages.push(...input.assistantMessages.map((message) => ({
+            role: "assistant",
+            content: message.text,
+        })));
+    }
+    else {
+        baseMessages.push({ role: "assistant", content: input.assistantText });
+    }
     const meta = { ...(priorState?.meta ?? {}) };
     if (input.threadId) {
         meta[CODEX_THREAD_META_KEY] = input.threadId;
@@ -578,93 +1771,38 @@ function buildUpdatedState(input) {
         conversationScore: priorState?.conversationScore,
     };
 }
-function defaultCommandRunner(input) {
-    const codexBin = dntShim.Deno.env.get(CODEX_BIN_ENV)?.trim() || "codex";
-    const child = new dntShim.Deno.Command(codexBin, {
-        args: input.args,
-        cwd: input.cwd,
-        stdout: "piped",
-        stderr: "piped",
-    }).spawn();
-    const abort = () => {
-        try {
-            child.kill("SIGTERM");
-        }
-        catch {
-            // ignore
-        }
-    };
-    if (input.signal?.aborted) {
-        abort();
-    }
-    else if (input.signal) {
-        input.signal.addEventListener("abort", abort, { once: true });
-    }
-    const readStream = async (stream, onLine) => {
-        if (!stream)
-            return new Uint8Array();
-        const reader = stream.getReader();
-        const decoder = new TextDecoder();
-        const chunks = [];
-        let buffered = "";
-        while (true) {
-            const { value, done } = await reader.read();
-            if (done)
-                break;
-            if (value) {
-                chunks.push(value);
-                if (onLine) {
-                    buffered += decoder.decode(value, { stream: true });
-                    const parts = buffered.split(/\r?\n/);
-                    buffered = parts.pop() ?? "";
-                    for (const line of parts)
-                        onLine(line);
-                }
-            }
-        }
-        if (onLine && buffered.trim())
-            onLine(buffered);
-        const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
-        const out = new Uint8Array(total);
-        let offset = 0;
-        for (const chunk of chunks) {
-            out.set(chunk, offset);
-            offset += chunk.length;
-        }
-        return out;
-    };
-    return Promise.all([
-        child.status,
-        readStream(child.stdout, input.onStdoutLine),
-        readStream(child.stderr),
-    ]).then(([status, stdout, stderr]) => ({
-        success: status.success,
-        code: status.code,
-        stdout,
-        stderr,
-    })).finally(() => {
-        if (input.signal) {
-            input.signal.removeEventListener("abort", abort);
-        }
-    });
-}
 function buildCodexStreamHandler(input) {
     const toolNames = new Map();
     const emittedCalls = new Set();
-    const emittedResults = new Set();
+    const emittedTerminalResults = new Set();
+    const lastResultFingerprintByCallId = new Map();
     const toolOutputIndexByCallId = new Map();
     const nextOutputIndexRef = { value: 0 };
     return (event) => {
+        emitCodexAssistantTextEvents({
+            event,
+            emit: input.emitTool,
+            emitText: input.emitText,
+            assistantState: input.assistantState,
+            nextOutputIndexRef,
+        });
         emitCodexReasoningEvents({
             event,
             emit: input.emitTool,
         });
+        emitCodexRawResponseItemEvents({
+            event,
+            emit: input.emitTool,
+            assistantState: input.assistantState,
+            nextOutputIndexRef,
+        });
         emitCodexToolEvents({
             event,
             emit: input.emitTool,
             toolNames,
             emittedCalls,
-            emittedResults,
+            emittedTerminalResults,
+            lastResultFingerprintByCallId,
             toolOutputIndexByCallId,
             nextOutputIndexRef,
         });
@@ -672,20 +1810,36 @@ function buildCodexStreamHandler(input) {
     };
 }
 export function createCodexProvider(opts) {
-    const runCommand = opts?.runCommand ?? defaultCommandRunner;
-    const runChat = async (input) => {
+    const runAppServerTurn = opts?.runAppServerTurn ?? defaultAppServerTurnRunner;
+    const runCodexTurn = async (input) => {
         if (input.signal?.aborted) {
             throw new DOMException("Run canceled", "AbortError");
         }
-        const streamHandler = (input.onStreamEvent || input.onTraceEvent)
+        const assistantState = {
+            streamedText: "",
+            sawAssistantTextStream: false,
+            assistantOutputIndexByItemId: new Map(),
+            emittedTerminalAssistantItemIds: new Set(),
+            rawOutputIndexByItemKey: new Map(),
+            emittedTerminalRawItemKeys: new Set(),
+        };
+        const streamHandler = (input.onStreamEvent || input.onTraceEvent ||
+            (input.stream && input.onStreamText))
             ? buildCodexStreamHandler({
                 emitRaw: (event) => input.onStreamEvent?.(event),
                 emitTool: (event) => {
-                    input.onStreamEvent?.(event);
-                    input.onTraceEvent?.(
-                    // this predates the lint rule
-                    event);
+                    input.onStreamEvent?.(responseEventToJsonRecord(event));
+                    if (isProviderTraceEvent(event)) {
+                        const traceEvent = responseEventToProviderTraceEvent(event);
+                        if (traceEvent) {
+                            input.onTraceEvent?.(traceEvent);
+                        }
+                    }
                 },
+                emitText: input.stream
+                    ? (text) => input.onStreamText?.(text)
+                    : undefined,
+                assistantState,
             })
             : undefined;
         const priorThreadIdRaw = input.state?.meta?.[CODEX_THREAD_META_KEY];
@@ -693,97 +1847,94 @@ export function createCodexProvider(opts) {
             priorThreadIdRaw.trim().length > 0
             ? priorThreadIdRaw.trim()
             : undefined;
-        const model = normalizeCodexModel(input.model);
+        const instructions = codexInstructionsForMessages(input.messages);
         const prompt = promptForCodexTurn({
             messages: input.messages,
             priorThreadId,
         });
-        const cwd = runCwd();
-        const args = priorThreadId
-            ? [
-                "exec",
-                "resume",
-                "--skip-git-repo-check",
-                "--json",
-            ]
-            : ["exec", "--skip-git-repo-check", "--json"];
-        args.push(...codexConfigArgs({
-            cwd,
+        const cwd = codexRunCwd({ deckPath: input.deckPath });
+        const preparedMcpRoot = await prepareCodexMcpRootDeck({
             deckPath: input.deckPath,
-            params: input.params,
-        }));
-        if (model && model !== "default") {
-            args.push("-m", model);
-        }
-        if (priorThreadId) {
-            args.push(priorThreadId);
-        }
-        args.push(prompt);
-        const handleStdoutLine = (line) => {
-            const trimmed = line.trim();
-            if (!trimmed.startsWith("{"))
-                return;
-            try {
-                const parsed = JSON.parse(trimmed);
-                if (parsed && typeof parsed === "object" && !Array.isArray(parsed) &&
-                    streamHandler) {
-                    streamHandler(parsed);
-                }
-            }
-            catch {
-                // ignore malformed/non-json lines
-            }
-        };
-        const out = await runCommand({
-            args,
-            cwd,
-            signal: input.signal,
-            onStdoutLine: streamHandler ? handleStdoutLine : undefined,
         });
-        if (input.signal?.aborted) {
-            throw new DOMException("Run canceled", "AbortError");
-        }
-        const stdout = new TextDecoder().decode(out.stdout);
-        const stderr = new TextDecoder().decode(out.stderr);
-        if (!out.success) {
-            throw new Error(`codex exec failed (exit ${out.code}): ${stderr.trim() || stdout.trim()}`);
+        try {
+            const result = await runAppServerTurn({
+                model: input.model,
+                messages: input.messages,
+                state: input.state,
+                params: input.params,
+                deckPath: preparedMcpRoot.deckPath ?? input.deckPath,
+                signal: input.signal,
+                onStreamEvent: streamHandler,
+                instructions,
+                prompt,
+                injectItems: [],
+                cwd,
+                priorThreadId,
+            });
+            const assistantText = result.assistantMessages.map((message) => message.text).join("");
+            if (input.stream && input.onStreamText && assistantText &&
+                !assistantState.sawAssistantTextStream) {
+                input.onStreamText(assistantText);
+            }
+            const updatedState = buildUpdatedState({
+                priorState: input.state,
+                messages: input.messages,
+                assistantText,
+                assistantMessages: result.assistantMessages,
+                threadId: result.threadId ?? priorThreadId,
+            });
+            return {
+                message: { role: "assistant", content: assistantText },
+                finishReason: "stop",
+                updatedState,
+                usage: result.usage,
+                assistantMessages: result.assistantMessages,
+                rawResponseItems: result.rawResponseItems ?? [],
+            };
         }
-        const parsed = parseCodexStdout(stdout);
-        const threadId = parsed.threadId ?? priorThreadId;
-        if (input.stream && input.onStreamText && parsed.assistantText) {
-            input.onStreamText(parsed.assistantText);
+        finally {
+            await preparedMcpRoot.cleanup?.();
         }
-        const updatedState = buildUpdatedState({
-            priorState: input.state,
-            messages: input.messages,
-            assistantText: parsed.assistantText,
-            threadId,
-        });
+    };
+    const runChat = async (input) => {
+        const result = await runCodexTurn(input);
         return {
-            message: { role: "assistant", content: parsed.assistantText },
-            finishReason: "stop",
-            updatedState,
-            usage: parsed.usage,
+            message: result.message,
+            finishReason: result.finishReason,
+            updatedState: result.updatedState,
+            usage: result.usage,
         };
     };
     return {
         async responses(input) {
             const streamHandler = input.onStreamEvent
-                ? buildCodexStreamHandler({
-                    emitRaw: (event) => {
-                        input.onStreamEvent?.({
-                            type: "codex.event",
-                            payload: event,
-                            // this predates the lint rule
-                        });
-                    },
-                    emitTool: (event) => {
-                        // this predates the lint rule
-                        input.onStreamEvent?.(event);
-                    },
-                })
+                ? (() => {
+                    const assistantState = {
+                        streamedText: "",
+                        sawAssistantTextStream: false,
+                        assistantOutputIndexByItemId: new Map(),
+                        emittedTerminalAssistantItemIds: new Set(),
+                        rawOutputIndexByItemKey: new Map(),
+                        emittedTerminalRawItemKeys: new Set(),
+                    };
+                    return {
+                        assistantState,
+                        handle: buildCodexStreamHandler({
+                            emitRaw: (event) => {
+                                input.onStreamEvent?.({
+                                    type: "codex.event",
+                                    payload: event,
+                                });
+                            },
+                            emitTool: (event) => {
+                                input.onStreamEvent?.(event);
+                            },
+                            assistantState,
+                        }),
+                    };
+                })()
                 : undefined;
-            const result = await runChat({
+            const result = await runCodexTurn({
                 model: input.request.model,
                 messages: responseItemsToChatMessages(input.request.input, input.request.instructions),
                 stream: input.request.stream,
@@ -791,9 +1942,18 @@ export function createCodexProvider(opts) {
                 state: input.state,
                 deckPath: input.deckPath,
                 signal: input.signal,
-                onStreamEvent: streamHandler,
+                onStreamEvent: streamHandler?.handle,
+            });
+            const output = mergeCodexResponseOutput({
+                assistantMessages: result.assistantMessages,
+                assistantMessage: result.message,
+                rawResponseItems: result.rawResponseItems,
+                assistantState: streamHandler?.assistantState,
+            });
+            const outputIndexes = codexResponseOutputIndexes({
+                items: output,
+                assistantState: streamHandler?.assistantState,
             });
-            const output = responseItemsFromAssistantMessage(result.message);
             const responseId = `codex-${crypto.randomUUID()}`;
             const createdAt = Math.floor(Date.now() / 1000);
             if (input.request.stream) {
@@ -811,31 +1971,62 @@ export function createCodexProvider(opts) {
                         error: null,
                     },
                 });
-                if (typeof result.message.content === "string" && result.message.content) {
-                    input.onStreamEvent?.({
-                        type: "response.output_text.delta",
-                        sequence_number: 1,
-                        output_index: 0,
-                        delta: result.message.content,
-                    });
-                    input.onStreamEvent?.({
-                        type: "response.output_text.done",
-                        sequence_number: 2,
-                        output_index: 0,
-                        text: result.message.content,
+                if (!streamHandler?.assistantState.sawAssistantTextStream) {
+                    const fallbackMessages = result.assistantMessages.length > 0
+                        ? result.assistantMessages
+                        : typeof result.message.content === "string" &&
+                            result.message.content
+                            ? [{ itemId: null, text: result.message.content }]
+                            : [];
+                    fallbackMessages.forEach((message, index) => {
+                        if (!message.text)
+                            return;
+                        const fallbackItem = {
+                            type: "message",
+                            role: "assistant",
+                            content: [{ type: "output_text", text: message.text }],
+                            ...(message.itemId ? { id: message.itemId } : {}),
+                        };
+                        const outputIndex = outputIndexes.get(codexResponseOutputLocator(fallbackItem)) ??
+                            output.length + index;
+                        input.onStreamEvent?.({
+                            type: "response.output_text.delta",
+                            sequence_number: 1 + (index * 2),
+                            output_index: outputIndex,
+                            delta: message.text,
+                            ...(message.itemId ? { item_id: message.itemId } : {}),
+                        });
+                        input.onStreamEvent?.({
+                            type: "response.output_text.done",
+                            sequence_number: 2 + (index * 2),
+                            output_index: outputIndex,
+                            text: message.text,
+                            ...(message.itemId ? { item_id: message.itemId } : {}),
+                        });
                     });
                 }
                 output.forEach((item, index) => {
+                    const outputIndex = outputIndexes.get(codexResponseOutputLocator(item)) ?? index;
+                    if (item.type === "message" &&
+                        item.role === "assistant" &&
+                        typeof item.id === "string" &&
+                        streamHandler?.assistantState.emittedTerminalAssistantItemIds.has(item.id)) {
+                        return;
+                    }
+                    if (isCodexRawResponseItemRenderable(item) &&
+                        streamHandler?.assistantState.emittedTerminalRawItemKeys.has(codexResponseItemKey(item))) {
+                        return;
+                    }
                     input.onStreamEvent?.({
                         type: "response.output_item.added",
                         sequence_number: 3 + (index * 2),
-                        output_index: index,
+                        output_index: outputIndex,
                         item,
                     });
                     input.onStreamEvent?.({
                         type: "response.output_item.done",
                         sequence_number: 4 + (index * 2),
-                        output_index: index,
+                        output_index: outputIndex,
                         item,
                     });
                 });
@@ -864,36 +2055,24 @@ export function createCodexProvider(opts) {
         chat: runChat,
     };
 }
-export function parseCodexArgsForTest(input) {
-    const priorThreadIdRaw = input.state?.meta?.[CODEX_THREAD_META_KEY];
-    const priorThreadId = typeof priorThreadIdRaw === "string" &&
-        priorThreadIdRaw.trim().length > 0
-        ? priorThreadIdRaw.trim()
-        : undefined;
-    const model = normalizeCodexModel(input.model);
-    const prompt = promptForCodexTurn({
-        messages: input.messages,
-        priorThreadId,
-    });
-    const args = priorThreadId
-        ? ["exec", "resume", "--skip-git-repo-check", "--json"]
-        : ["exec", "--skip-git-repo-check", "--json"];
-    args.push(...codexConfigArgs({
-        cwd: input.cwd ?? runCwd(),
-        deckPath: input.deckPath,
-        params: input.params,
-    }));
-    if (model && model !== "default") {
-        args.push("-m", model);
-    }
-    if (priorThreadId)
-        args.push(priorThreadId);
-    args.push(prompt);
-    return args;
+export function normalizeCodexModelForTest(model) {
+    return normalizeCodexModel(model);
 }
-export function parseCodexStdoutForTest(stdout) {
-    return parseCodexStdout(stdout);
+export function codexInstructionsForMessagesForTest(messages) {
+    return codexInstructionsForMessages(messages);
+}
+export function promptForCodexTurnForTest(input) {
+    return promptForCodexTurn(input);
+}
+export function codexConfigArgsForTest(input) {
+    return codexConfigArgs(input);
 }
 export function safeJsonForTest(text) {
     return safeJsonObject(text);
 }
+export function sanitizeCodexSpawnArgsForTest(args) {
+    return sanitizeCodexSpawnArgsForDebug(args);
+}
+export function extractCodexConfigValuesForTest(args, flag, prefix) {
+    return extractCodexConfigValues(args, flag, prefix);
+}