@bridge4dev/runner 0.11.0

package/dist/adapters/codex.js

@@ -0,0 +1,1406 @@
+import { AsyncQueue } from '../async-queue.js';
+import { log } from '../log.js';
+import { evaluateToolUse, maskSecrets, maskString } from '../policy.js';
+import { RUNNER_VERSION } from '../version.js';
+import { repairCodexAuth } from './codex-home.js';
+import { AppServerClient, asRecord, num, str } from './codex-protocol.js';
+import { truncate } from './claude.js';
+import { AGENT_MODES, } from './types.js';
+// Codex adapter over `codex app-server` (stage C). The normalized AgentEvent
+// contract is unchanged, so the dashboard renders Codex sessions with the same
+// components it already uses for Claude.
+//
+// Everything below is anchored to a live probe of codex-cli 0.135.0
+// (2026-07-25). The generated bindings alone are not enough: `collaborationMode`
+// (plan mode) is missing from them entirely, `ModeKind` understates its own
+// variants, and several response fields are undocumented.
+const CODEX_BIN = 'codex';
+/** Server-side event suppression — the cheapest defence against delta floods. */
+const OPT_OUT_NOTIFICATIONS = [
+    'item/reasoning/textDelta',
+    'item/reasoning/summaryTextDelta',
+    'item/agentMessage/delta',
+    'item/plan/delta',
+    'item/commandExecution/outputDelta',
+    'account/rateLimits/updated',
+];
+/**
+ * `on-request` is the only policy that lets the agent ASK.
+ *
+ * The alternatives were tried live and all fail us:
+ *  - `untrusted` produces no approvals at all and hard-rejects escalation;
+ *  - `{granular:{…}}` looks like finer-grained control, and its post-failure
+ *    "retry without sandbox?" prompt does work — but a *proactive* escalation
+ *    request is rejected outright by codex itself:
+ *    "reject command — you cannot ask for escalated permissions if the approval
+ *    policy is Granular(…)". A Codex session in that mode could edit files but
+ *    never commit, and told the user its escalation was "declined
+ *    automatically" with nothing on screen to approve;
+ *  - `never` skips approvals entirely, which also bypasses the layer-1 policy —
+ *    acceptable only for the explicitly unrestricted mode.
+ */
+const ASK_POLICY = 'on-request';
+/**
+ * Normalized mode → Codex policy. Codex splits "do I ask?" across two axes: the
+ * approval policy and the sandbox. A write inside a `workspace-write` sandbox
+ * never escalates (verified live), so `ask` deliberately runs read-only — that
+ * is what makes every mutation produce a card, matching Claude's `default`.
+ *
+ * Plan mode is prompt-level, not sandbox-level, so it is paired with read-only
+ * to make "propose, don't touch" an actual guarantee.
+ */
+const MODE_POLICY = {
+    ask: { approvalPolicy: ASK_POLICY, sandbox: 'read-only', plan: false },
+    plan: { approvalPolicy: ASK_POLICY, sandbox: 'read-only', plan: true },
+    auto: { approvalPolicy: ASK_POLICY, sandbox: 'workspace-write', plan: false },
+    // The owner's explicit call (2026-07-24): "full" restricts nothing. Codex
+    // sends no approvals at all in this mode, so layer 1 cannot gate tools —
+    // exactly like Claude's bypassPermissions. The dashboard says so.
+    full: { approvalPolicy: 'never', sandbox: 'danger-full-access', plan: false },
+};
+const SYSTEM_APPEND = [
+    'You are running inside a DevBridge dev session, controlled from the DevBridge dashboard.',
+    'Rules:',
+    '- Work ONLY inside the current working directory (a dedicated git worktree on a session branch).',
+    '- Commit your work in the current branch with clear messages. NEVER push to main/master and never force-push.',
+    '- If DevBridge MCP tools are available and the task mentions tickets: fetch the ticket first, set its status to IN_PROGRESS when you start and READY_FOR_REVIEW when your implementation is complete, and leave a short summary comment.',
+    '- The user is not in a terminal: if you need a decision, use your question tool or ask in plain text and end your turn.',
+    '- Never print secrets (tokens, API keys, private keys) in your output.',
+].join('\n');
+// Allowlist, not denylist: whatever secrets live in the daemon's environment
+// must not reach the agent process. OPENAI_API_KEY is absent by design — it
+// would override the subscription login the same way ANTHROPIC_API_KEY does for
+// Claude.
+const ENV_ALLOWLIST = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'LANG',
+    'LANGUAGE',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TERM',
+    'TMPDIR',
+    'TZ',
+    'COLORTERM',
+    'XDG_RUNTIME_DIR',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+    'NODE_EXTRA_CA_CERTS',
+];
+function scrubbedEnv(codexHome) {
+    const env = {};
+    for (const key of ENV_ALLOWLIST) {
+        const value = process.env[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    env['CODEX_HOME'] = codexHome;
+    return env;
+}
+/** Approval kinds we answer, mapped to the policy tool they resemble. */
+const APPROVAL_METHODS = new Set([
+    'item/commandExecution/requestApproval',
+    'item/fileChange/requestApproval',
+    'item/permissions/requestApproval',
+    'mcpServer/elicitation/request',
+]);
+/** An unanswered agent question must not hold the turn forever. */
+const QUESTION_TIMEOUT_MS = 30 * 60_000;
+class CodexSession {
+    spec;
+    home;
+    output = new AsyncQueue();
+    client;
+    approvals = new Map();
+    /** Last known state of each item — approval params alone are too thin. */
+    items = new Map();
+    seenNotices = new Set();
+    queuedInput = [];
+    /** Null when the home was injected — an injected home is the whole truth. */
+    repairHome;
+    question = null;
+    threadId = null;
+    threadModel = null;
+    activeTurnId = null;
+    /** Plan card waiting for the user; approving it starts the real work. */
+    heldPlan = null;
+    lastCollabMode = null;
+    mode;
+    model;
+    effort;
+    /** Last model catalogue from `model/list` — effort sets differ per model. */
+    knownModels = [];
+    stopped = false;
+    ready = false;
+    capabilitiesInFlight = false;
+    events = this.output;
+    constructor(spec, home, deps) {
+        this.spec = spec;
+        this.home = home;
+        this.mode = spec.mode ?? 'ask';
+        this.model = spec.model;
+        this.effort = spec.effort;
+        this.repairHome = deps.repairHome ?? (deps.codexHome ? null : repairCodexAuth);
+        const wiring = {
+            env: scrubbedEnv(home.path),
+            onNotification: (method, params) => this.onNotification(method, params),
+            onServerRequest: (request) => this.onServerRequest(request),
+            onExit: (info) => this.onExit(info),
+            onStderr: (text) => this.onStderr(text),
+        };
+        this.client = deps.spawnClient
+            ? deps.spawnClient(wiring)
+            : new AppServerClient({
+                command: CODEX_BIN,
+                args: ['app-server'],
+                cwd: spec.cwd,
+                ...wiring,
+            });
+        void this.boot();
+    }
+    // ─── Boot ──────────────────────────────────────────────────────────
+    async boot() {
+        try {
+            const init = asRecord(await this.client.request('initialize', {
+                clientInfo: {
+                    name: 'devbridge-runner',
+                    title: 'DevBridge',
+                    version: RUNNER_VERSION,
+                },
+                // experimentalApi gates plan mode AND granular approvals — without it
+                // both come back as -32600. The initialize result does not echo
+                // capabilities, so there is no way to confirm the opt-in except by
+                // using a gated field.
+                capabilities: {
+                    experimentalApi: true,
+                    requestAttestation: false,
+                    optOutNotificationMethods: OPT_OUT_NOTIFICATIONS,
+                },
+            }));
+            const reportedHome = str(init['codexHome']);
+            if (reportedHome !== this.home.path) {
+                // Refuse rather than run against the host user's config: theirs can
+                // carry approval_policy="never", danger-full-access and their own MCP
+                // key. This is a hard stop, not a warning — and it is fail-CLOSED: a
+                // build that stops reporting the field must not silently disable the
+                // check (QA-100 MINOR-1).
+                throw new Error(`codex is using an unexpected CODEX_HOME (${reportedHome ?? 'not reported'}) — refusing to start the session`);
+            }
+            this.client.notify('initialized', {});
+            if (this.home.auth === 'missing') {
+                // One repair attempt before telling the user their login is broken: the
+                // credential link can be removed under a running daemon, and putting it
+                // back is cheaper — and far less confusing — than a sign-in prompt for
+                // an account that never expired.
+                const repaired = this.repairHome?.() ?? this.home;
+                if (repaired.auth === 'missing') {
+                    this.emit({
+                        type: 'error',
+                        message: 'Codex is not signed in on this server — sign in from the Server panel',
+                        // `missing`, not `expired`: nothing expired, there is simply no login.
+                        code: 'auth_missing',
+                    });
+                    this.finish();
+                    return;
+                }
+                this.home = repaired;
+                log.info('codex: credential was missing and has been restored', {
+                    sessionId: this.spec.sessionId,
+                });
+            }
+            const thread = await this.openThread();
+            if (this.stopped)
+                return;
+            this.threadId = thread.id;
+            this.threadModel = thread.model;
+            this.ready = true;
+            this.emit({
+                type: 'provider_session',
+                providerSessionId: thread.id,
+                ...(thread.model ? { model: thread.model } : {}),
+            });
+            this.refreshCapabilities();
+            const initial = this.spec.prompt?.trim();
+            if (initial) {
+                this.startTurn(initial);
+            }
+            this.flushQueued();
+        }
+        catch (error) {
+            // Before finish(): it ends the output queue, so emitting after it would
+            // drop the error entirely and the session would just stop with no reason.
+            this.classifyAndEmitFailure(error);
+            this.finish();
+        }
+    }
+    /**
+     * How long to wait before the second `thread/resume` attempt.
+     *
+     * QA-101 left this open: resuming the very same thread with the very same
+     * parameters succeeds in isolation, so the rejection seen after a fast
+     * stop→continue is transient — the previous agent process is still holding
+     * the rollout file when the new one asks for it. One short retry costs a
+     * second; losing the conversation costs the whole context.
+     */
+    static RESUME_RETRY_DELAY_MS = 1_500;
+    async resumeThread(resumeId) {
+        // Resume takes the SAME overrides as start, and it must: the per-thread MCP
+        // overlay lives only in memory, so resuming with just a thread id brings the
+        // conversation back without DevBridge access — the agent then hunts for
+        // tickets it can no longer reach (found in the live check).
+        const result = asRecord(await this.client.request('thread/resume', {
+            threadId: resumeId,
+            ...this.threadParams(),
+        }));
+        const thread = asRecord(result['thread']);
+        const id = str(thread['id']);
+        if (!id)
+            throw new Error('thread/resume returned no thread id');
+        return { id, model: str(result['model']) ?? null };
+    }
+    async openThread() {
+        const resumeId = this.spec.resumeProviderSessionId;
+        if (resumeId) {
+            try {
+                return await this.resumeThread(resumeId);
+            }
+            catch (firstError) {
+                let error = firstError;
+                // Matched on the message rather than the error class: the same failure
+                // can arrive as an RPC error or as a transport error, and a missed match
+                // would fail the session instead of retrying it.
+                if (isMissingRollout(error)) {
+                    log.warn('codex: thread/resume rejected — retrying once', {
+                        sessionId: this.spec.sessionId,
+                        threadId: resumeId,
+                        error: maskString(describe(error)).slice(0, 300),
+                    });
+                    await delay(CodexSession.RESUME_RETRY_DELAY_MS);
+                    try {
+                        const resumed = await this.resumeThread(resumeId);
+                        log.info('codex: thread/resume succeeded on retry', {
+                            sessionId: this.spec.sessionId,
+                        });
+                        return resumed;
+                    }
+                    catch (retryError) {
+                        error = retryError;
+                    }
+                }
+                if (isMissingRollout(error)) {
+                    // Losing the conversation is expensive, so record WHY. Verified live
+                    // (2026-07-25): resuming this exact thread with these exact params
+                    // succeeds in isolation, so a failure here is transient — most likely
+                    // the previous agent process still holding the thread during a rapid
+                    // stop→continue cycle. Without this line the only trace is a feed
+                    // notice that says the context is gone and nothing about the cause.
+                    log.warn('codex: thread/resume rejected — falling back to a fresh thread', {
+                        sessionId: this.spec.sessionId,
+                        threadId: resumeId,
+                        error: maskString(describe(error)).slice(0, 300),
+                    });
+                    // The supervisor relaunches once without a resume id; the git worktree
+                    // still holds every change the previous process made.
+                    throw new ResumeFailed(describe(error));
+                }
+                log.warn('codex: thread/resume failed', {
+                    sessionId: this.spec.sessionId,
+                    error: maskString(describe(error)).slice(0, 300),
+                });
+                throw error;
+            }
+        }
+        const params = this.threadParams();
+        try {
+            return this.readThread(await this.client.request('thread/start', params));
+        }
+        catch (error) {
+            // Future-proofing: if the experimental capability is ever renamed, fall
+            // back to the plain policy rather than failing the session outright.
+            if (/experimentalApi/i.test(describe(error))) {
+                this.notice('warn', 'This codex build rejected granular approvals — using on-request.');
+                return this.readThread(await this.client.request('thread/start', { ...params, approvalPolicy: 'on-request' }));
+            }
+            throw error;
+        }
+    }
+    /** Everything a thread needs, whether it is being started or resumed. */
+    threadParams() {
+        const policy = MODE_POLICY[this.mode];
+        return {
+            cwd: this.spec.cwd,
+            approvalPolicy: policy.approvalPolicy,
+            sandbox: policy.sandbox,
+            developerInstructions: SYSTEM_APPEND,
+            ...(this.model ? { model: this.model } : {}),
+            ...(this.spec.mcp ? { config: this.mcpOverlay() } : {}),
+        };
+    }
+    readThread(raw) {
+        const result = asRecord(raw);
+        const thread = asRecord(result['thread']);
+        const id = str(thread['id']);
+        if (!id)
+            throw new Error('thread/start returned no thread id');
+        return { id, model: str(result['model']) ?? null };
+    }
+    /**
+     * The DevBridge MCP server, injected per thread and never written to disk.
+     * The key travels in an Authorization header rather than the URL query string
+     * so it does not land in the MCP gateway's access logs.
+     */
+    mcpOverlay() {
+        const mcp = this.spec.mcp;
+        if (!mcp)
+            return {};
+        return {
+            mcp_servers: {
+                devbridge: {
+                    url: mcp.url,
+                    http_headers: { Authorization: `Bearer ${mcp.token}` },
+                    // Reading and updating tickets is what the session is FOR — the same
+                    // call is unconditionally allowed by the layer-1 policy, so asking
+                    // per call would be noise (and the live check confirmed it is).
+                    default_tools_approval_mode: 'approve',
+                },
+            },
+        };
+    }
+    // ─── Turns ─────────────────────────────────────────────────────────
+    startTurn(text) {
+        if (!this.threadId || this.stopped)
+            return;
+        const policy = MODE_POLICY[this.mode];
+        const wantCollab = policy.plan ? 'plan' : 'default';
+        const params = {
+            threadId: this.threadId,
+            // text_elements is required by the bindings but defaulted on the wire;
+            // [] is accepted, null is rejected outright.
+            input: [{ type: 'text', text, text_elements: [] }],
+            approvalPolicy: policy.approvalPolicy,
+            sandboxPolicy: sandboxPolicyFor(policy.sandbox, this.spec.cwd),
+            ...(this.model ? { model: this.model } : {}),
+            // "Override the reasoning effort for this turn and subsequent turns" —
+            // the same sticky-override channel the model uses (there is still no
+            // settings/update in this protocol version).
+            ...(this.effort ? { effort: this.effort } : {}),
+        };
+        // Collaboration mode is turn-scoped but sticky, and its `settings` REPLACE
+        // the thread's developer instructions — so only send it on a real change,
+        // and restore our own rules when leaving plan mode.
+        if (this.lastCollabMode !== wantCollab) {
+            params['collaborationMode'] = {
+                mode: wantCollab,
+                settings: {
+                    model: this.model ?? this.threadModel ?? 'gpt-5.5',
+                    reasoning_effort: null,
+                    developer_instructions: wantCollab === 'plan' ? null : SYSTEM_APPEND,
+                },
+            };
+            this.lastCollabMode = wantCollab;
+        }
+        void this.client
+            .request('turn/start', params)
+            .then((raw) => {
+            // turn/start is non-blocking and returns the turn id immediately —
+            // that id is what turn/interrupt needs.
+            const turn = asRecord(asRecord(raw)['turn']);
+            this.activeTurnId = str(turn['id']) ?? this.activeTurnId;
+        })
+            .catch((error) => {
+            this.emit({ type: 'turn_end', ok: false, errorMessage: describe(error) });
+        });
+    }
+    flushQueued() {
+        const queued = this.queuedInput.splice(0);
+        if (queued.length === 0)
+            return;
+        this.startTurn(queued.join('\n\n'));
+    }
+    send(text) {
+        if (this.stopped) {
+            log.warn('codex: send after session ended — message dropped', {
+                sessionId: this.spec.sessionId,
+            });
+            return;
+        }
+        // A parked elicitation takes priority: the agent is blocked on it, and
+        // starting a turn would deadlock behind the open request.
+        if (this.question) {
+            this.answerQuestion(text);
+            return;
+        }
+        // Answering a plan card by typing instead of clicking is normal ("do it
+        // differently"). Without this the held plan stayed forever and
+        // onTurnCompleted swallowed every later turn_end — the session hung in
+        // RUNNING with no way out but Stop (QA-100 MAJOR-2).
+        if (this.heldPlan) {
+            const { requestId } = this.heldPlan;
+            this.heldPlan = null;
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: false,
+                source: 'user',
+                reason: 'Answered with a message instead of approving the plan',
+            });
+        }
+        // Approving the plan is the moment the agent may actually work.
+        if (!this.ready) {
+            this.queuedInput.push(text);
+            return;
+        }
+        if (this.activeTurnId) {
+            void this.steer(text);
+            return;
+        }
+        this.startTurn(text);
+    }
+    async steer(text) {
+        if (!this.threadId || !this.activeTurnId)
+            return this.startTurn(text);
+        try {
+            await this.client.request('turn/steer', {
+                threadId: this.threadId,
+                input: [{ type: 'text', text, text_elements: [] }],
+                expectedTurnId: this.activeTurnId,
+            });
+        }
+        catch {
+            // The steerable window is narrower than "a turn exists"; fall back to a
+            // fresh turn once the current one settles.
+            this.queuedInput.push(text);
+        }
+    }
+    async setModel(model) {
+        this.model = model;
+        // No context-meter refresh here, unlike Claude — and that is not an
+        // oversight. The app-server pushes token usage (`thread/tokenUsage/updated`)
+        // and offers no way to ask for it, and every model codex currently lists
+        // reports the same 258 400-token effective window (272 000 × 95 %), so a
+        // switch cannot change the denominator anyway.
+        //
+        // There is no settings/update in this protocol version: the model is a
+        // turn/start override that sticks for subsequent turns.
+        this.emit({ type: 'settings', model });
+        // Models advertise different effort sets (Sol/Terra add max/ultra) — an
+        // effort the new model does not support would be rejected on turn/start,
+        // so drop it and let the model's own default take over.
+        if (this.effort) {
+            const supported = this.knownModels.find((m) => m.id === model)?.efforts;
+            if (supported && !supported.some((option) => option.id === this.effort)) {
+                delete this.effort;
+                // Tell everyone, not just ourselves: the API stores the pinned level
+                // and would otherwise hand the dead one back on the next relaunch,
+                // where codex rejects it and the turn fails (QA-100 MAJOR-5).
+                this.emit({ type: 'settings', effort: null });
+            }
+        }
+        // The refreshed capabilities carry currentEffort (the model's default when
+        // we just dropped an unsupported pick), so the UI dial stays truthful.
+        this.refreshCapabilities();
+    }
+    async setEffort(effort) {
+        if (effort)
+            this.effort = effort;
+        else
+            delete this.effort;
+        this.emit({ type: 'settings', effort });
+        this.refreshCapabilities();
+    }
+    async setMode(mode) {
+        this.mode = mode;
+        this.emit({ type: 'settings', mode });
+    }
+    async interrupt() {
+        if (!this.threadId || !this.activeTurnId)
+            return;
+        try {
+            await this.client.request('turn/interrupt', {
+                threadId: this.threadId,
+                turnId: this.activeTurnId,
+            });
+        }
+        catch (error) {
+            if (/no active turn/i.test(describe(error)))
+                return;
+            log.warn('codex: interrupt failed', { error: describe(error) });
+        }
+    }
+    stop() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        // Release anything the agent is blocked on so the child can exit cleanly.
+        for (const [requestId, pending] of [...this.approvals]) {
+            this.approvals.delete(requestId);
+            this.client.respond(pending.rpcId, { decision: 'cancel' });
+        }
+        if (this.question) {
+            if (this.question.timer)
+                clearTimeout(this.question.timer);
+            this.client.respond(this.question.rpcId, { answers: {} });
+            this.question = null;
+        }
+        this.client.kill();
+    }
+    // ─── Server requests (approvals, questions) ────────────────────────
+    onServerRequest(request) {
+        if (request.method === 'item/tool/requestUserInput') {
+            this.onQuestion(request);
+            return;
+        }
+        if (APPROVAL_METHODS.has(request.method)) {
+            this.onApproval(request);
+            return;
+        }
+        // Never leave a server request hanging: an unanswered one blocks the turn
+        // forever (there is no server-side timeout).
+        log.warn('codex: unhandled server request', { method: request.method });
+        this.client.respondError(request.id, -32601, 'unsupported by DevBridge runner');
+    }
+    onApproval(request) {
+        const requestId = String(request.id);
+        const enriched = this.describeApproval(request);
+        const verdict = enriched.forceAsk
+            ? { decision: 'ask', reason: 'details unavailable' }
+            : evaluateToolUse(enriched.policyTool, enriched.policyInput, {
+                trustMode: this.spec.trustMode,
+                worktreePath: this.spec.cwd,
+            });
+        if (verdict.decision === 'allow') {
+            this.client.respond(request.id, { decision: 'accept' });
+            return;
+        }
+        if (verdict.decision === 'deny') {
+            this.client.respond(request.id, { decision: 'decline' });
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: false,
+                source: 'policy',
+                reason: verdict.reason,
+            });
+            return;
+        }
+        this.approvals.set(requestId, { rpcId: request.id, toolName: enriched.toolName });
+        this.emit({
+            type: 'permission',
+            requestId,
+            toolName: enriched.toolName,
+            title: enriched.title,
+            ...(enriched.description ? { description: enriched.description } : {}),
+            input: enriched.input,
+        });
+    }
+    /**
+     * Approval params are anaemic — `item/fileChange/requestApproval` arrives as
+     * `{threadId, turnId, itemId, startedAtMs, reason, grantRoot}` with no paths
+     * and no diff. The card is only usable because we keep the last `item/started`
+     * payload for that itemId.
+     */
+    describeApproval(request) {
+        const params = request.params;
+        const itemId = str(params['itemId']);
+        const cached = itemId ? asRecord(this.items.get(itemId)) : {};
+        const reason = str(params['reason']);
+        if (request.method === 'item/commandExecution/requestApproval') {
+            const command = str(params['command']) ?? str(cached['command']) ?? '';
+            const cwd = str(params['cwd']) ?? str(cached['cwd']);
+            return {
+                toolName: 'Bash',
+                title: 'Run a command?',
+                ...(reason ? { description: reason } : {}),
+                input: { command: truncate(command, 2_000), ...(cwd ? { cwd } : {}) },
+                policyTool: 'Bash',
+                policyInput: { command },
+            };
+        }
+        if (request.method === 'item/fileChange/requestApproval') {
+            const changes = Array.isArray(cached['changes']) ? cached['changes'] : [];
+            const files = changes
+                .map((change) => str(asRecord(change)['path']))
+                .filter((file) => Boolean(file));
+            const diff = changes
+                .map((change) => str(asRecord(change)['diff']) ?? '')
+                .filter(Boolean)
+                .join('\n');
+            return {
+                toolName: 'Edit',
+                title: files.length === 1
+                    ? `Edit ${basename(files[0])}?`
+                    : files.length
+                        ? `Edit ${files.length} files?`
+                        : 'Codex asks to edit files (details unavailable)',
+                ...(reason ? { description: reason } : {}),
+                input: {
+                    ...(files.length ? { files } : {}),
+                    ...(diff ? { diff: truncate(diff, 4_000) } : {}),
+                },
+                policyTool: 'Edit',
+                // Evaluate the first path; multi-file patches outside the worktree are
+                // caught because every path shares one root in practice. With NO path
+                // (item cache miss) we must NOT fall back to the worktree root: that
+                // reads as "an edit inside the worktree" and auto-allows the very
+                // write this approval exists to gate (QA-100 MAJOR-4). No path => ask.
+                policyInput: files.length ? { file_path: files[0] } : {},
+                ...(files.length ? {} : { forceAsk: true }),
+            };
+        }
+        if (request.method === 'mcpServer/elicitation/request') {
+            // MCP elicitations are mostly "may this server run tool X?". The raw
+            // params are unreadable — they carry the whole tool description — so the
+            // card shows the server's own message plus the call arguments, and the
+            // policy sees a proper `mcp__<server>__<tool>` name (which is what makes
+            // DevBridge's own tools pass without bothering the user).
+            const server = str(params['serverName']) ?? 'mcp';
+            const message = str(params['message']);
+            const meta = asRecord(params['_meta']);
+            const tool = str(meta['tool_name']) ?? toolNameFromMessage(message) ?? 'tool';
+            const args = asRecord(meta['tool_params']);
+            return {
+                toolName: `mcp__${server}__${tool}`,
+                title: message ?? `Allow the ${server} MCP server to run ${tool}?`,
+                input: Object.keys(args).length ? truncateRecord(args) : {},
+                policyTool: `mcp__${server}__${tool}`,
+                policyInput: {},
+            };
+        }
+        return {
+            toolName: request.method,
+            title: 'Codex needs permission',
+            ...(reason ? { description: reason } : {}),
+            input: truncateRecord(params),
+            policyTool: request.method,
+            policyInput: {},
+        };
+    }
+    answerPermission(requestId, allow, note) {
+        if (this.heldPlan && this.heldPlan.requestId === requestId) {
+            const plan = this.heldPlan;
+            this.heldPlan = null;
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow,
+                source: 'user',
+                ...(note ? { reason: note } : {}),
+            });
+            if (allow) {
+                // Leave plan mode and let the agent execute what it proposed — in
+                // "ask", never "auto": approving a PLAN must not also switch off the
+                // permission cards for every later edit (QA-100 MAJOR-3; Claude keeps
+                // its mode too). Unattended edits stay an explicit, separate choice.
+                this.mode = this.mode === 'plan' ? 'ask' : this.mode;
+                this.emit({ type: 'settings', mode: this.mode });
+                this.startTurn(note?.trim()
+                    ? `The plan is approved with this note: ${note}\n\nImplement it now.`
+                    : 'The plan is approved. Implement it now.');
+            }
+            else {
+                this.notice('info', 'Plan rejected — tell the agent what to change.');
+                void plan;
+            }
+            return;
+        }
+        const pending = this.approvals.get(requestId);
+        if (!pending) {
+            log.warn('codex: permission answer for unknown request', { requestId });
+            return;
+        }
+        this.approvals.delete(requestId);
+        this.emit({
+            type: 'permission_resolved',
+            requestId,
+            allow,
+            source: 'user',
+            ...(note ? { reason: note } : {}),
+        });
+        this.client.respond(pending.rpcId, { decision: allow ? 'accept' : 'decline' });
+    }
+    onQuestion(request) {
+        const questions = Array.isArray(request.params['questions']) ? request.params['questions'] : [];
+        const first = asRecord(questions[0]);
+        const questionId = str(first['id']);
+        const text = str(first['question']) ?? str(first['header']);
+        if (!questionId || !text) {
+            // Nothing renderable — answer empty so the turn continues instead of
+            // blocking forever.
+            this.client.respond(request.id, { answers: {} });
+            return;
+        }
+        const rawOptions = Array.isArray(first['options']) ? first['options'] : [];
+        const options = rawOptions
+            .map((option) => {
+            const row = asRecord(option);
+            const label = str(row['label']);
+            if (!label)
+                return null;
+            const description = str(row['description']);
+            return truncate(description ? `${label} — ${description}` : label, 300);
+        })
+            .filter((option) => Boolean(option))
+            .slice(0, 8);
+        // There is no server-side timeout for elicitations: an unanswered question
+        // blocks the turn forever and the only way out is Stop (QA-100 MINOR-4).
+        const timer = setTimeout(() => {
+            if (this.question?.rpcId !== request.id)
+                return;
+            this.question = null;
+            this.client.respond(request.id, { answers: {} });
+            this.notice('warn', 'The agent question went unanswered for 30 minutes — it was skipped.');
+        }, QUESTION_TIMEOUT_MS);
+        timer.unref();
+        this.question = { rpcId: request.id, questionId, timer };
+        this.emit({
+            type: 'question',
+            text: truncate(text, 2_000),
+            ...(options.length ? { options } : {}),
+        });
+    }
+    /**
+     * The user's next message answers the open elicitation. The wire wants the
+     * option label verbatim, and free text is legal whenever `isOther` is set —
+     * so we forward whatever was typed, and the option list the dashboard shows
+     * is made of those same labels.
+     */
+    answerQuestion(text) {
+        const pending = this.question;
+        if (!pending)
+            return;
+        if (pending.timer)
+            clearTimeout(pending.timer);
+        this.question = null;
+        const answer = stripOptionHint(text);
+        this.client.respond(pending.rpcId, {
+            answers: { [pending.questionId]: { answers: [answer] } },
+        });
+    }
+    // ─── Notifications ─────────────────────────────────────────────────
+    onNotification(method, params) {
+        switch (method) {
+            case 'item/started':
+            case 'item/updated':
+            case 'item/completed': {
+                this.onItem(method, params);
+                return;
+            }
+            case 'turn/started': {
+                this.activeTurnId = str(params['turnId']) ?? str(asRecord(params['turn'])['id']) ?? null;
+                return;
+            }
+            case 'turn/completed': {
+                this.onTurnCompleted(params);
+                return;
+            }
+            case 'thread/tokenUsage/updated': {
+                const usage = asRecord(params['tokenUsage']);
+                // `last` is the occupancy of the most recent model request; `total` is a
+                // lifetime billing counter that never drops (live: 87k "total" vs 17k
+                // real in the same turn) and would ship a meter that only goes up.
+                const used = num(asRecord(usage['last'])['totalTokens']);
+                const max = num(usage['modelContextWindow']);
+                if (used !== undefined && max !== undefined && max > 0) {
+                    this.emit({ type: 'context_usage', usedTokens: used, maxTokens: max });
+                }
+                return;
+            }
+            case 'thread/settings/updated': {
+                const collab = asRecord(params['collaborationMode']);
+                const model = str(params['model']);
+                const effort = str(params['effort']);
+                const modeKind = str(collab['mode']);
+                if (model && model !== this.model) {
+                    this.model = model;
+                    this.emit({ type: 'settings', model });
+                }
+                // Codex reports the effort it settled on (a `/model` command inside the
+                // session, or its own default) — mirror it instead of arguing.
+                if (effort && effort !== this.effort) {
+                    this.effort = effort;
+                    this.emit({ type: 'settings', effort });
+                }
+                if (modeKind === 'plan' && this.mode !== 'plan') {
+                    this.mode = 'plan';
+                    this.emit({ type: 'settings', mode: 'plan' });
+                }
+                return;
+            }
+            case 'serverRequest/resolved': {
+                // Resolved elsewhere (another client) — drop our pending entry. Report
+                // what actually happened when codex says so; claiming "allowed" for an
+                // unknown outcome would put a false approval in the audit trail
+                // (QA-100 MINOR-3).
+                const resolved = String(params['requestId'] ?? '');
+                if (this.approvals.delete(resolved)) {
+                    const decision = str(params['decision']) ?? str(asRecord(params['response'])['decision']);
+                    const allow = decision === 'accept' || decision === 'approved';
+                    this.emit({
+                        type: 'permission_resolved',
+                        requestId: resolved,
+                        allow,
+                        source: 'user',
+                        reason: decision
+                            ? `Answered elsewhere (${decision})`
+                            : 'Answered elsewhere — outcome not reported by codex',
+                    });
+                }
+                return;
+            }
+            case 'error': {
+                const willRetry = params['willRetry'] === true;
+                if (willRetry)
+                    return;
+                const detail = asRecord(params['error']);
+                this.classifyAndEmitFailure(new Error(str(detail['message']) ?? 'Codex reported an error'));
+                return;
+            }
+            case 'configWarning':
+            case 'warning':
+            case 'guardianWarning':
+            case 'deprecationNotice': {
+                // Each of these carries its text under a different key: `message` for
+                // warnings, `summary`/`details` for config and deprecation notices.
+                // Falling back to the method name printed a bare "configWarning" in the
+                // feed, which told the user nothing (found in the live check).
+                const summary = str(params['message']) ?? str(params['summary']);
+                const details = str(params['details']);
+                if (!summary && !details)
+                    return;
+                this.notice('warn', [summary, details].filter(Boolean).join(' — '));
+                return;
+            }
+            case 'model/rerouted': {
+                const to = str(params['toModel']);
+                this.notice('info', `Codex rerouted this turn to ${to ?? 'another model'}`);
+                return;
+            }
+            case 'mcpServer/startupStatus/updated': {
+                const name = str(params['name']) ?? 'MCP server';
+                const status = str(params['status']);
+                if (status === 'failed') {
+                    this.notice('warn', `MCP server ${name} failed to start — the agent cannot reach tickets`);
+                }
+                return;
+            }
+            default:
+                return;
+        }
+    }
+    onItem(method, params) {
+        const item = asRecord(params['item']);
+        const type = str(item['type']);
+        const id = str(item['id']);
+        if (!type)
+            return;
+        if (id) {
+            this.items.set(id, item);
+            // Bound the cache: a long session would otherwise hold every item.
+            if (this.items.size > 400) {
+                const oldest = this.items.keys().next().value;
+                if (oldest !== undefined)
+                    this.items.delete(oldest);
+            }
+        }
+        const done = method === 'item/completed';
+        switch (type) {
+            case 'agentMessage': {
+                if (!done)
+                    return;
+                const text = str(item['text']);
+                if (text)
+                    this.emit({ type: 'message', role: 'assistant', text: truncate(text) });
+                return;
+            }
+            case 'reasoning': {
+                if (!done)
+                    return;
+                const parts = [
+                    ...(Array.isArray(item['summary']) ? item['summary'] : []),
+                    ...(Array.isArray(item['content']) ? item['content'] : []),
+                ]
+                    .map((part) => str(part))
+                    .filter((part) => Boolean(part));
+                if (parts.length)
+                    this.emit({ type: 'thinking', text: truncate(parts.join('\n'), 8_000) });
+                return;
+            }
+            case 'plan': {
+                if (!done)
+                    return;
+                const text = str(item['text']);
+                if (!text)
+                    return;
+                // Claude signals a plan with a blocking ExitPlanMode permission; Codex
+                // just emits an item. Normalize into the shape the dashboard already
+                // renders as a plan card, and hold the session until it is approved.
+                const requestId = `plan:${this.activeTurnId ?? id ?? 'turn'}`;
+                this.heldPlan = { requestId, text };
+                this.emit({
+                    type: 'permission',
+                    requestId,
+                    toolName: 'ExitPlanMode',
+                    title: 'The agent proposes a plan',
+                    input: {},
+                    plan: truncate(text, 12_000),
+                });
+                return;
+            }
+            case 'commandExecution': {
+                const command = str(item['command']) ?? '';
+                if (!done) {
+                    this.emit({
+                        type: 'tool',
+                        phase: 'use',
+                        name: 'Bash',
+                        ...(id ? { toolUseId: id } : {}),
+                        detail: { command: truncate(command, 2_000) },
+                    });
+                    return;
+                }
+                const output = str(item['aggregatedOutput']) ?? '';
+                const exitCode = num(item['exitCode']);
+                this.emit({
+                    type: 'tool',
+                    phase: 'result',
+                    name: 'Bash',
+                    ...(id ? { toolUseId: id } : {}),
+                    text: truncate(exitCode !== undefined ? `exit ${exitCode}\n${output}` : output, 4_000),
+                });
+                return;
+            }
+            case 'fileChange': {
+                const changes = Array.isArray(item['changes']) ? item['changes'] : [];
+                const files = changes
+                    .map((change) => str(asRecord(change)['path']))
+                    .filter((file) => Boolean(file));
+                this.emit({
+                    type: 'tool',
+                    phase: done ? 'result' : 'use',
+                    name: 'Edit',
+                    ...(id ? { toolUseId: id } : {}),
+                    ...(done
+                        ? {
+                            text: `${files.map((file) => basename(file)).join(', ')} (${str(item['status']) ?? 'done'})`,
+                        }
+                        : { detail: { files } }),
+                });
+                return;
+            }
+            case 'mcpToolCall': {
+                const tool = `${str(item['server']) ?? 'mcp'}__${str(item['tool']) ?? 'tool'}`;
+                if (!done) {
+                    this.emit({
+                        type: 'tool',
+                        phase: 'use',
+                        name: tool,
+                        ...(id ? { toolUseId: id } : {}),
+                        detail: truncateRecord(asRecord(item['arguments'])),
+                    });
+                    return;
+                }
+                this.emit({
+                    type: 'tool',
+                    phase: 'result',
+                    name: tool,
+                    ...(id ? { toolUseId: id } : {}),
+                    text: truncate(stringifyMcpResult(item), 4_000),
+                });
+                return;
+            }
+            case 'contextCompaction': {
+                if (done)
+                    this.notice('info', 'Conversation compacted');
+                return;
+            }
+            case 'webSearch':
+            case 'dynamicToolCall': {
+                if (!done) {
+                    this.emit({
+                        type: 'tool',
+                        phase: 'use',
+                        name: type,
+                        ...(id ? { toolUseId: id } : {}),
+                        detail: truncateRecord(item),
+                    });
+                }
+                return;
+            }
+            default:
+                // Unknown item types are ignored on purpose: 0.145 adds several, and an
+                // unknown kind must never take the session down.
+                return;
+        }
+    }
+    onTurnCompleted(params) {
+        const turn = asRecord(params['turn']);
+        const status = str(turn['status']);
+        this.activeTurnId = null;
+        // A held plan means the turn ended by proposing, not by finishing the work.
+        if (this.heldPlan)
+            return;
+        if (status === 'failed') {
+            const error = asRecord(turn['error']);
+            this.emit({
+                type: 'turn_end',
+                ok: false,
+                errorMessage: maskString(str(error['message']) ?? 'The Codex turn failed').slice(0, 500),
+            });
+            return;
+        }
+        // `interrupted` is a user-initiated Stop: the session stays usable.
+        this.emit({ type: 'turn_end', ok: true });
+        this.flushQueued();
+    }
+    onStderr(text) {
+        const trimmed = text.trim();
+        if (!trimmed)
+            return;
+        // codex is chatty on stderr (bubblewrap notices, MCP transport spam). Log
+        // locally, never turn it into session events.
+        log.warn('codex: stderr', { text: maskString(trimmed).slice(0, 500) });
+    }
+    onExit(info) {
+        if (!this.stopped && !this.ready) {
+            this.emit({
+                type: 'error',
+                message: `codex app-server exited before the session was ready (code ${info.code ?? 'null'})`,
+            });
+        }
+        this.finish();
+    }
+    // ─── Capabilities ──────────────────────────────────────────────────
+    refreshCapabilities() {
+        if (this.capabilitiesInFlight || this.stopped)
+            return;
+        this.capabilitiesInFlight = true;
+        void this.publishCapabilities()
+            .catch((error) => log.warn('codex: capabilities probe failed', { error: describe(error) }))
+            .finally(() => {
+            this.capabilitiesInFlight = false;
+        });
+    }
+    async publishCapabilities() {
+        // Every probe carries its own catch: an unknown method on a newer or older
+        // codex must degrade a picker, not kill the session.
+        const [models, commands, account, mcpServers] = await Promise.all([
+            this.listModels().catch(() => []),
+            this.listCommands().catch(() => []),
+            this.readAccount().catch(() => null),
+            this.listMcpServers().catch(() => []),
+        ]);
+        this.knownModels = models;
+        const currentModel = this.model ?? this.threadModel ?? undefined;
+        // Effort in force: what the user picked, else what the current model
+        // defaults to — so the picker never shows an empty dial.
+        const currentEffort = this.effort ?? models.find((m) => m.id === currentModel)?.defaultEffort ?? undefined;
+        const capabilities = {
+            models,
+            modes: [...AGENT_MODES],
+            commands,
+            currentMode: this.mode,
+            ...(currentModel ? { currentModel } : {}),
+            ...(currentEffort ? { currentEffort } : {}),
+            ...(account ? { account } : {}),
+            mcpServers,
+            interrupt: true,
+        };
+        this.emit({ type: 'capabilities', capabilities });
+    }
+    async listModels() {
+        const result = asRecord(await this.client.request('model/list', { limit: 50 }, 15_000));
+        const data = Array.isArray(result['data']) ? result['data'] : [];
+        const options = [];
+        for (const entry of data) {
+            const row = asRecord(entry);
+            if (row['hidden'] === true)
+                continue;
+            const id = str(row['id']) ?? str(row['model']);
+            if (!id)
+                continue;
+            const description = str(row['description']);
+            const efforts = readEfforts(row['supportedReasoningEfforts']);
+            const defaultEffort = str(row['defaultReasoningEffort']);
+            options.push({
+                id,
+                label: str(row['displayName']) ?? id,
+                ...(description ? { description: truncate(description, 160) } : {}),
+                ...(row['isDefault'] === true ? { isDefault: true } : {}),
+                ...(efforts.length ? { efforts } : {}),
+                ...(defaultEffort ? { defaultEffort } : {}),
+            });
+        }
+        return options;
+    }
+    async listCommands() {
+        const result = asRecord(await this.client.request('skills/list', { cwds: [this.spec.cwd] }, 15_000));
+        const entries = Array.isArray(result['data']) ? result['data'] : [];
+        const options = [];
+        for (const entry of entries) {
+            const skills = Array.isArray(asRecord(entry)['skills']) ? asRecord(entry)['skills'] : [];
+            for (const skill of skills) {
+                const row = asRecord(skill);
+                const name = str(row['name']);
+                if (!name)
+                    continue;
+                const description = str(row['description']);
+                options.push({
+                    name,
+                    ...(description ? { description: truncate(description, 160) } : {}),
+                });
+                if (options.length >= 150)
+                    return options;
+            }
+        }
+        return options;
+    }
+    async readAccount() {
+        const result = asRecord(await this.client.request('account/read', {}, 15_000));
+        const account = asRecord(result['account']);
+        const email = str(account['email']);
+        const plan = str(account['planType']);
+        if (!email && !plan)
+            return null;
+        return {
+            ...(email ? { email } : {}),
+            ...(plan ? { plan: `ChatGPT ${plan}` } : {}),
+        };
+    }
+    async listMcpServers() {
+        if (!this.threadId)
+            return [];
+        // Without threadId this call does NOT see per-thread servers — it would
+        // report our injected DevBridge server as absent.
+        const result = asRecord(await this.client.request('mcpServerStatus/list', { threadId: this.threadId }, 15_000));
+        const data = Array.isArray(result['data']) ? result['data'] : [];
+        return data.map((entry) => {
+            const row = asRecord(entry);
+            const tools = asRecord(row['tools']);
+            const count = Object.keys(tools).length;
+            return {
+                name: str(row['name']) ?? 'mcp',
+                status: count > 0 ? `ready · ${count} tools` : 'no tools',
+            };
+        });
+    }
+    // ─── Emission helpers ──────────────────────────────────────────────
+    emit(event) {
+        this.output.push(maskSecrets(event));
+    }
+    notice(level, text) {
+        const key = `${level}:${text}`;
+        // codex repeats the same warning on every start and on every failed MCP
+        // handshake; surface each distinct one once per session.
+        if (this.seenNotices.has(key))
+            return;
+        this.seenNotices.add(key);
+        this.emit({ type: 'notice', level, text: truncate(text, 500) });
+    }
+    /**
+     * Classify a failure and emit it.
+     *
+     * Renamed from `emitFailure` because it now does more than emit: before we
+     * accuse a user's sign-in of being broken it re-checks the credential. The
+     * old code turned any message containing "401" — including a 401 from an MCP
+     * server — into "your Codex login expired".
+     *
+     * Stays synchronous on purpose: it is called from a notification handler and
+     * from a catch that ends the output queue on the next line, and an awaited
+     * probe in either place would either float a promise or drop the event.
+     */
+    classifyAndEmitFailure(error) {
+        const message = maskString(describe(error));
+        if (error instanceof ResumeFailed) {
+            this.emit({
+                type: 'error',
+                message: 'The previous Codex thread could not be resumed — starting a fresh one',
+                code: 'resume_failed',
+            });
+            return;
+        }
+        if (isAuthError(message)) {
+            const probe = this.probeAuth();
+            this.emit({
+                type: 'error',
+                message: probe === 'missing'
+                    ? 'Codex is not signed in on this server — sign in from the Server panel'
+                    : 'Codex authentication was rejected — sign in again from the Server panel',
+                code: probe === 'missing' ? 'auth_missing' : 'auth_expired',
+            });
+            return;
+        }
+        this.emit({ type: 'error', message: `Codex session error: ${message.slice(0, 1_000)}` });
+    }
+    /**
+     * Second opinion on the sign-in.
+     *
+     * Deliberately does NOT shell out to `codex login status`: that probe is
+     * purely local (verified — it answers with no network at all), so it can tell
+     * us nothing the filesystem cannot, while adding a 10-second subprocess to a
+     * failure path. Re-asserting the home is a couple of lstat calls and answers
+     * the only question that matters here — is there a credential at all?
+     */
+    probeAuth() {
+        const home = this.repairHome?.() ?? this.home;
+        if (home.auth !== 'missing')
+            this.home = home;
+        return home.auth === 'missing' ? 'missing' : 'expired';
+    }
+    finish() {
+        this.stopped = true;
+        this.output.end();
+    }
+}
+class ResumeFailed extends Error {
+}
+function sandboxPolicyFor(mode, cwd) {
+    // turn/start takes the structured SandboxPolicy, while thread/start takes the
+    // CLI-style SandboxMode string. Same intent, two shapes.
+    switch (mode) {
+        case 'read-only':
+            return { type: 'readOnly', networkAccess: false };
+        case 'danger-full-access':
+            return { type: 'dangerFullAccess' };
+        default:
+            return {
+                type: 'workspaceWrite',
+                writableRoots: [cwd],
+                networkAccess: false,
+                excludeTmpdirEnvVar: false,
+                excludeSlashTmp: false,
+            };
+    }
+}
+/**
+ * Codex's own wording for "the sign-in did not work".
+ *
+ * A bare `401`/`unauthorized` is deliberately NOT here: those appear in MCP
+ * server errors and proxy failures too, and matching them turned unrelated
+ * problems into "your Codex login expired". A 401 only counts when the same
+ * message also talks about tokens or signing in — and never when it names MCP.
+ */
+export function isAuthError(message) {
+    if (/\bmcp\b/i.test(message))
+        return false;
+    if (/no codex credentials were found|run codex login|not logged in|stored credentials are incomplete/i.test(message)) {
+        return true;
+    }
+    if (/refresh token (has expired|was already used|was revoked)|access token could not be refreshed|log out and sign in again/i.test(message)) {
+        return true;
+    }
+    // The corroborating word must be a real one: `\bauth\b` and not a bare
+    // `auth` substring, because "unauthorized" contains "auth" and would happily
+    // vouch for itself.
+    return (/\b401\b|unauthorized/i.test(message) &&
+        /\btoken\b|\bauth\b|\bauthentication\b|\blogin\b|\bsign ?in\b|\bcredentials?\b/i.test(message));
+}
+function describe(error) {
+    return String(error instanceof Error ? error.message : error);
+}
+/**
+ * "The thread you asked for is not there." Matched on the message and not on an
+ * error class, because the same condition arrives as an RPC error or as a
+ * transport error depending on where the app-server gave up.
+ */
+function isMissingRollout(error) {
+    return /no rollout found|not found/i.test(describe(error));
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+    });
+}
+function basename(file) {
+    if (!file)
+        return 'file';
+    const parts = file.split('/');
+    return parts[parts.length - 1] || file;
+}
+/**
+ * MCP tool-call elicitations name the tool only inside their human message:
+ * `Allow the devbridge MCP server to run tool "devbridge_list_tickets"?`
+ */
+function toolNameFromMessage(message) {
+    return message?.match(/tool\s+"([^"]+)"/)?.[1];
+}
+/** The dashboard shows "label — description"; the wire wants the label. */
+export function stripOptionHint(text) {
+    const separator = text.indexOf(' — ');
+    return separator === -1 ? text : text.slice(0, separator);
+}
+/**
+ * `supportedReasoningEfforts` from `model/list`: a list of
+ * `{reasoningEffort, description}`. Codex 0.145 ships six levels on the Sol
+ * line (low…ultra) and four on the older models, so the labels are derived,
+ * never enumerated on our side.
+ */
+export function readEfforts(value) {
+    if (!Array.isArray(value))
+        return [];
+    const options = [];
+    for (const entry of value) {
+        const row = asRecord(entry);
+        const id = str(row['reasoningEffort']) ?? str(row['effort']) ?? str(row['id']);
+        if (!id)
+            continue;
+        const description = str(row['description']);
+        options.push({
+            id,
+            label: id.charAt(0).toUpperCase() + id.slice(1),
+            ...(description ? { description: truncate(description, 160) } : {}),
+        });
+    }
+    return options;
+}
+function truncateRecord(value) {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        out[key] = typeof entry === 'string' ? truncate(entry, 2_000) : entry;
+    }
+    return out;
+}
+function stringifyMcpResult(item) {
+    const errorMessage = str(asRecord(item['error'])['message']);
+    if (errorMessage)
+        return `error: ${errorMessage}`;
+    const result = asRecord(item['result']);
+    const content = Array.isArray(result['content']) ? result['content'] : [];
+    const text = content
+        .map((part) => str(asRecord(part)['text']))
+        .filter((part) => Boolean(part))
+        .join('\n');
+    return text || (str(item['status']) ?? 'done');
+}
+export class CodexAdapter {
+    deps;
+    id = 'codex';
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
+    startSession(spec) {
+        // Re-assert rather than reuse: `repairCodexAuth` is a couple of lstat calls
+        // and it puts a credential link back if something removed it since boot.
+        //
+        // The configured mode has to travel with it. Repairing with the default
+        // would silently re-link the host user's credential into a home the owner
+        // explicitly asked to keep isolated — turning off a security control by
+        // accident.
+        const repair = () => repairCodexAuth({ auth: this.deps.authMode ?? 'link' });
+        const home = this.deps.codexHome ?? repair();
+        return new CodexSession(spec, home, {
+            ...this.deps,
+            repairHome: this.deps.repairHome ?? (this.deps.codexHome ? undefined : repair),
+        });
+    }
+}
+//# sourceMappingURL=codex.js.map