@ccpocket/bridge 1.69.0 → 1.69.3

package/dist/websocket.js

@@ -7,10 +7,11 @@ import { promisify } from "node:util";
 import { WebSocketServer, WebSocket } from "ws";
 import { SessionManager, MAX_HISTORY_PER_SESSION, } from "./session.js";
 import { SdkProcess, listAvailableClaudeModels, } from "./sdk-process.js";
-import { CodexProcess, } from "./codex-process.js";
+import { codexErrorMessage, CodexRpcError, CodexProcess, } from "./codex-process.js";
 import { stopManagedCodexAppServers } from "./codex-transport.js";
 import { parseClientMessage, } from "./parser.js";
 import { getAllRecentSessions, getCodexSessionHistory, getSessionHistory, codexUserTurnUuid, codexThreadToSessionHistory, findSessionsByClaudeIds, extractMessageImages, getClaudeSessionName, getCodexSessionIndexMetadata, loadCodexSessionNames, renameClaudeSession, renameCodexSession, saveCodexSessionProfile, } from "./sessions-index.js";
+import { formatResumePerformanceLog, summarizeResumeHistory, } from "./resume-metrics.js";
 import { ArchiveStore } from "./archive-store.js";
 import { WorktreeStore } from "./worktree-store.js";
 import { listWorktrees, removeWorktree, worktreeExists, getMainBranch, } from "./worktree.js";
@@ -24,6 +25,8 @@ import { fetchAllUsage } from "./usage.js";
 import { getPackageVersion } from "./version.js";
 import { isPathWithinAllowedDirectory, resolvePlatformPath, resolvePlatformPathFrom, } from "./path-utils.js";
 import { deriveCodexPermissionsMode, normalizeCodexPermissionsMode, withDerivedCodexPermissionsMode, } from "./codex-permissions.js";
+const RESUME_OPERATION_TIMEOUT_MS = 5 * 60 * 1000;
+const RESUME_COMPLETED_TTL_MS = 30 * 1000;
 // ---- Available model lists (delivered to clients via session_list) ----
 const FALLBACK_CLAUDE_MODELS = [
     "claude-opus-4-7",
@@ -243,6 +246,9 @@ function normalizeCodexApprovalPolicy(value) {
             return "on-request";
     }
 }
+function isCodexAutoReviewApprovalsReviewer(value) {
+    return value === "auto_review" || value === "guardian_subagent";
+}
 function sanitizeCodexModel(model) {
     if (typeof model !== "string")
         return undefined;
@@ -457,6 +463,8 @@ export class BridgeWebSocketServer {
     archiveStore;
     codexProfiles = [];
     defaultCodexProfile;
+    codexAutoReviewDisabled = false;
+    codexAutoReviewPolicyLoaded = false;
     codexMetadataRequest = null;
     lastConnectMetadataRefreshAt = null;
     claudeModels = FALLBACK_CLAUDE_MODELS;
@@ -486,6 +494,7 @@ export class BridgeWebSocketServer {
     platform;
     clientSupportedServerMessages = new WeakMap();
     pendingClaudeResumeInputs = new WeakMap();
+    resumeOperations = new Map();
     constructor(options) {
         const { server, apiKey, allowedDirs, imageStore, galleryStore, projectHistory, debugTraceStore, recordingStore, firebaseAuth, promptHistoryBackup, promptHistoryStore, platform, fileListMaxEntries, fileListMaxBytes, deltaBatchMs, deltaBatchMaxChars, } = options;
         this.apiKey = apiKey ?? null;
@@ -809,10 +818,10 @@ export class BridgeWebSocketServer {
             fallback: buildCodexHistoryPrefix(session, targetOrdinal - 1),
         });
         this.destroySession(sessionId);
-        const newSessionId = this.sessionManager.create(projectPath, undefined, pastMessages, worktreeOpts, "codex", {
+        const newSessionId = this.sessionManager.create(projectPath, undefined, pastMessages, worktreeOpts, "codex", this.withCodexAutoReviewPolicy({
             ...(codexSettings ?? {}),
             threadId,
-        });
+        }));
         const newSession = this.sessionManager.get(newSessionId);
         this.send(ws, {
             type: "rewind_result",
@@ -824,8 +833,8 @@ export class BridgeWebSocketServer {
             provider: "codex",
             projectPath,
             session: newSession,
-            approvalsReviewer: codexSettings?.approvalsReviewer,
-            sandboxMode: codexSettings?.sandboxMode,
+            approvalsReviewer: newSession?.codexSettings?.approvalsReviewer,
+            sandboxMode: newSession?.codexSettings?.sandboxMode,
             sourceSessionId: sessionId,
         }));
         this.sendSessionList(ws);
@@ -896,18 +905,18 @@ export class BridgeWebSocketServer {
             expectedUserTurns: targetOrdinal,
             fallback: buildCodexHistoryPrefix(session, targetOrdinal),
         });
-        const newSessionId = this.sessionManager.create(projectPath, undefined, pastMessages, worktreeOpts, "codex", {
+        const newSessionId = this.sessionManager.create(projectPath, undefined, pastMessages, worktreeOpts, "codex", this.withCodexAutoReviewPolicy({
             ...(codexSettings ?? {}),
             threadId: forkedThreadId,
-        });
+        }));
         const newSession = this.sessionManager.get(newSessionId);
         this.send(ws, this.buildSessionCreatedMessage({
             sessionId: newSessionId,
             provider: "codex",
             projectPath,
             session: newSession,
-            approvalsReviewer: codexSettings?.approvalsReviewer,
-            sandboxMode: codexSettings?.sandboxMode,
+            approvalsReviewer: newSession?.codexSettings?.approvalsReviewer,
+            sandboxMode: newSession?.codexSettings?.sandboxMode,
             sourceSessionId: sessionId,
         }));
         this.sendSessionList(ws);
@@ -975,7 +984,9 @@ export class BridgeWebSocketServer {
         const threadId = this.codexThreadIdForSession(session);
         if (!threadId)
             return null;
-        const history = await this.getCodexThreadHistoryFromRpc(threadId, session.projectPath, session.process);
+        const history = session.codexInitialHistoryPending
+            ? (session.pastMessages ?? [])
+            : await this.getCodexThreadHistoryFromRpc(threadId, session.projectPath, session.process);
         session.claudeSessionId = threadId;
         const messages = await this.codexHistoryToServerMessages(session, history);
         const entries = messages.map((message, index) => ({
@@ -983,6 +994,7 @@ export class BridgeWebSocketServer {
             message,
         }));
         this.applyCodexCanonicalHistoryBaseline(session, history, entries);
+        session.codexInitialHistoryPending = false;
         return entries;
     }
     applyCodexCanonicalHistoryBaseline(session, history, canonicalEntries) {
@@ -1551,6 +1563,11 @@ export class BridgeWebSocketServer {
     }
     close() {
         console.log("[ws] Shutting down...");
+        for (const operation of this.resumeOperations.values()) {
+            if (operation.timeout)
+                clearTimeout(operation.timeout);
+        }
+        this.resumeOperations.clear();
         this.flushAllDeltaBatches();
         this.sessionManager.destroyAll();
         this.flushAllDeltaBatches();
@@ -1645,9 +1662,13 @@ export class BridgeWebSocketServer {
                 }
                 try {
                     const provider = msg.provider ?? "claude";
-                    const requestedCodexPermissionsMode = provider === "codex"
+                    const normalizedCodexPermissionsMode = provider === "codex"
                         ? normalizeCodexPermissionsMode(msg.codexPermissionsMode)
                         : undefined;
+                    const requestedCodexPermissionsMode = this.codexAutoReviewDisabled &&
+                        normalizedCodexPermissionsMode === "autoReview"
+                        ? "default"
+                        : normalizedCodexPermissionsMode;
                     const codexPermissionSettings = requestedCodexPermissionsMode
                         ? codexSettingsFromPermissionsMode(requestedCodexPermissionsMode)
                         : undefined;
@@ -1723,7 +1744,7 @@ export class BridgeWebSocketServer {
                                 useWorktree: msg.useWorktree,
                                 worktreeBranch: msg.worktreeBranch,
                                 existingWorktreePath: msg.existingWorktreePath,
-                            }, provider, {
+                            }, provider, this.withCodexAutoReviewPolicy({
                                 profile: msg.profile,
                                 approvalPolicy: codexPermissionSettings
                                     ? codexPermissionSettings.approvalPolicy
@@ -1731,9 +1752,8 @@ export class BridgeWebSocketServer {
                                         normalizeCodexApprovalPolicy(executionMode === "fullAccess"
                                             ? "never"
                                             : "on-request")),
-                                approvalsReviewer: codexPermissionSettings
-                                    ? codexPermissionSettings.approvalsReviewer
-                                    : msg.approvalsReviewer,
+                                approvalsReviewer: codexPermissionSettings?.approvalsReviewer ??
+                                    msg.approvalsReviewer,
                                 codexPermissionsMode: codexPermissionSettings?.codexPermissionsMode,
                                 sandboxMode: codexPermissionSettings
                                     ? codexPermissionSettings.sandboxMode
@@ -1750,7 +1770,7 @@ export class BridgeWebSocketServer {
                                 collaborationMode: planMode
                                     ? "plan"
                                     : "default",
-                            }),
+                            })),
                             permissionMode: claudePermissionMode,
                             executionMode,
                             planMode,
@@ -2290,7 +2310,15 @@ export class BridgeWebSocketServer {
                     // Permission mode for Codex requires a session restart (like sandbox mode).
                     // approvalPolicy and collaborationMode are thread-level settings that
                     // only take effect reliably at thread/start or thread/resume time.
-                    const requestedCodexPermissionsMode = normalizeCodexPermissionsMode(msg.codexPermissionsMode);
+                    const normalizedCodexPermissionsMode = normalizeCodexPermissionsMode(msg.codexPermissionsMode);
+                    const requestedCodexPermissionsMode = this.codexAutoReviewDisabled &&
+                        normalizedCodexPermissionsMode === "autoReview"
+                        ? "default"
+                        : normalizedCodexPermissionsMode;
+                    const requestedApprovalsReviewer = this.codexAutoReviewDisabled &&
+                        isCodexAutoReviewApprovalsReviewer(msg.approvalsReviewer)
+                        ? "user"
+                        : msg.approvalsReviewer;
                     const codexPermissionSettings = requestedCodexPermissionsMode
                         ? codexSettingsFromPermissionsMode(requestedCodexPermissionsMode)
                         : undefined;
@@ -2328,23 +2356,28 @@ export class BridgeWebSocketServer {
                     const newSandboxMode = codexPermissionSettings
                         ? codexPermissionSettings.sandboxMode
                         : currentSandboxMode;
-                    const newPermissionsMode = codexPermissionSettings?.codexPermissionsMode ??
+                    const configuredReviewer = requestedCodexPermissionsMode === "custom"
+                        ? undefined
+                        : (codexPermissionSettings?.approvalsReviewer ??
+                            requestedApprovalsReviewer ??
+                            currentReviewer);
+                    const newReviewer = this.codexAutoReviewDisabled
+                        ? "user"
+                        : configuredReviewer;
+                    const derivedPermissionsMode = codexPermissionSettings?.codexPermissionsMode ??
                         (collaborationOnlyChange ? currentPermissionsMode : undefined) ??
                         deriveCodexPermissionsMode({
                             approvalPolicy: newApproval,
-                            approvalsReviewer: codexPermissionSettings?.approvalsReviewer ??
-                                msg.approvalsReviewer ??
-                                currentReviewer,
+                            approvalsReviewer: newReviewer,
                             sandboxMode: newSandboxMode,
                         });
+                    const newPermissionsMode = this.codexAutoReviewDisabled &&
+                        derivedPermissionsMode === "autoReview"
+                        ? "default"
+                        : derivedPermissionsMode;
                     const newCollaboration = planMode
                         ? "plan"
                         : "default";
-                    const newReviewer = requestedCodexPermissionsMode === "custom"
-                        ? undefined
-                        : (codexPermissionSettings?.approvalsReviewer ??
-                            msg.approvalsReviewer ??
-                            currentReviewer);
                     const currentCollaboration = process.collaborationMode;
                     if (newApproval === currentApproval &&
                         newReviewer === currentReviewer &&
@@ -2355,7 +2388,9 @@ export class BridgeWebSocketServer {
                     }
                     const canApplyModeInPlace = session.status === "idle" &&
                         requestedCodexPermissionsMode !== "custom" &&
-                        newSandboxMode === currentSandboxMode;
+                        newSandboxMode === currentSandboxMode &&
+                        (this.codexAutoReviewPolicyLoaded ||
+                            !isCodexAutoReviewApprovalsReviewer(newReviewer));
                     if (canApplyModeInPlace) {
                         const process = session.process;
                         if (newApproval && newApproval !== currentApproval) {
@@ -2411,7 +2446,7 @@ export class BridgeWebSocketServer {
                     if (!threadId || !hasUserMessages) {
                         const newId = this.sessionManager.create(projectPath, undefined, undefined, worktreePath
                             ? { existingWorktreePath: worktreePath, worktreeBranch }
-                            : undefined, "codex", {
+                            : undefined, "codex", this.withCodexAutoReviewPolicy({
                             approvalPolicy: newApproval,
                             approvalsReviewer: newReviewer,
                             codexPermissionsMode: newPermissionsMode,
@@ -2422,7 +2457,7 @@ export class BridgeWebSocketServer {
                             networkAccessEnabled: oldSettings.networkAccessEnabled,
                             webSearchMode: oldSettings.webSearchMode,
                             collaborationMode: newCollaboration,
-                        });
+                        }));
                         const newSession = this.sessionManager.get(newId);
                         if (newSession && sessionName)
                             newSession.name = sessionName;
@@ -2471,7 +2506,7 @@ export class BridgeWebSocketServer {
                     }
                     this.getCodexThreadHistory(threadId, effectiveProjectPath)
                         .then((pastMessages) => {
-                        const newId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", {
+                        const newId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", this.withCodexAutoReviewPolicy({
                             threadId,
                             approvalPolicy: newApproval,
                             approvalsReviewer: newReviewer,
@@ -2483,7 +2518,7 @@ export class BridgeWebSocketServer {
                             networkAccessEnabled: oldSettings.networkAccessEnabled,
                             webSearchMode: oldSettings.webSearchMode,
                             collaborationMode: newCollaboration,
-                        });
+                        }));
                         const newSession = this.sessionManager.get(newId);
                         if (newSession && sessionName) {
                             newSession.name = sessionName;
@@ -2822,8 +2857,10 @@ export class BridgeWebSocketServer {
                     // "no rollout found for thread id".)
                     const newId = this.sessionManager.create(projectPath, undefined, undefined, worktreePath
                         ? { existingWorktreePath: worktreePath, worktreeBranch }
-                        : undefined, "codex", {
+                        : undefined, "codex", this.withCodexAutoReviewPolicy({
                         approvalPolicy: oldSettings.approvalPolicy,
+                        approvalsReviewer: oldSettings.approvalsReviewer,
+                        codexPermissionsMode: oldSettings.codexPermissionsMode,
                         sandboxMode: newSandboxMode,
                         model: oldSettings.model,
                         modelReasoningEffort: oldSettings.modelReasoningEffort,
@@ -2831,7 +2868,7 @@ export class BridgeWebSocketServer {
                         networkAccessEnabled: oldSettings.networkAccessEnabled,
                         webSearchMode: oldSettings.webSearchMode,
                         collaborationMode,
-                    });
+                    }));
                     const newSession = this.sessionManager.get(newId);
                     if (newSession && sessionName)
                         newSession.name = sessionName;
@@ -2873,9 +2910,11 @@ export class BridgeWebSocketServer {
                 }
                 this.getCodexThreadHistory(threadId, effectiveProjectPath)
                     .then((pastMessages) => {
-                    const newId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", {
+                    const newId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", this.withCodexAutoReviewPolicy({
                         threadId,
                         approvalPolicy: oldSettings.approvalPolicy,
+                        approvalsReviewer: oldSettings.approvalsReviewer,
+                        codexPermissionsMode: oldSettings.codexPermissionsMode,
                         sandboxMode: newSandboxMode,
                         model: oldSettings.model,
                         modelReasoningEffort: oldSettings.modelReasoningEffort,
@@ -2883,7 +2922,7 @@ export class BridgeWebSocketServer {
                         networkAccessEnabled: oldSettings.networkAccessEnabled,
                         webSearchMode: oldSettings.webSearchMode,
                         collaborationMode,
-                    });
+                    }));
                     // Restore session name
                     const newSession = this.sessionManager.get(newId);
                     if (newSession && sessionName) {
@@ -3320,25 +3359,39 @@ export class BridgeWebSocketServer {
             }
             case "archive_session": {
                 const { sessionId, provider, projectPath } = msg;
-                this.archiveStore
-                    .archive(sessionId, provider, projectPath)
-                    .then(() => {
-                    // For Codex sessions, also call thread/archive RPC (best-effort).
-                    // Requires a running Codex app-server process; skip if none active.
+                const archiveProjectPath = resolvePlatformPath(projectPath, this.platform);
+                if (!this.isPathAllowed(archiveProjectPath)) {
+                    const pathError = this.buildPathNotAllowedError(projectPath);
+                    this.send(ws, {
+                        type: "archive_result",
+                        sessionId,
+                        success: false,
+                        error: pathError.message,
+                    });
+                    break;
+                }
+                void (async () => {
                     if (provider === "codex") {
-                        const activeSessions = this.sessionManager.list();
-                        const codexSession = activeSessions.find((s) => s.provider === "codex");
-                        if (codexSession) {
-                            const session = this.sessionManager.get(codexSession.id);
-                            if (session) {
-                                session.process
-                                    .archiveThread(sessionId)
-                                    .catch((err) => {
-                                    console.warn(`[ws] Codex thread/archive failed (non-fatal): ${err}`);
-                                });
+                        const activeProcess = this.getActiveCodexProcess();
+                        const codexProcess = activeProcess ??
+                            (await this.createStandaloneCodexProcess(archiveProjectPath));
+                        try {
+                            await codexProcess.archiveThread(sessionId);
+                        }
+                        catch (err) {
+                            if (!(err instanceof CodexRpcError && err.code === -32601)) {
+                                throw err;
                             }
+                            console.warn("[ws] thread/archive unsupported; using local archive marker");
+                        }
+                        finally {
+                            if (!activeProcess)
+                                codexProcess.stop();
                         }
                     }
+                    await this.archiveStore.archive(sessionId, provider, archiveProjectPath);
+                })()
+                    .then(() => {
                     this.send(ws, {
                         type: "archive_result",
                         sessionId,
@@ -3350,22 +3403,32 @@ export class BridgeWebSocketServer {
                         type: "archive_result",
                         sessionId,
                         success: false,
-                        error: String(err),
+                        error: codexErrorMessage(err),
                     });
                 });
                 break;
             }
             case "resume_session": {
+                const resumeStartedAt = Date.now();
                 console.log(`[ws] resume_session: sessionId=${msg.sessionId} projectPath=${msg.projectPath} provider=${msg.provider ?? "claude"}`);
                 const resumeProjectPath = resolvePlatformPath(msg.projectPath, this.platform);
+                const provider = msg.provider ?? "claude";
                 if (!this.isPathAllowed(resumeProjectPath)) {
+                    this.sendResumeFailed(ws, {
+                        provider,
+                        sourceSessionId: msg.sessionId,
+                        projectPath: resumeProjectPath,
+                    });
                     this.send(ws, this.buildPathNotAllowedError(msg.projectPath));
                     break;
                 }
-                const provider = msg.provider ?? "claude";
-                const requestedCodexPermissionsMode = provider === "codex"
+                const normalizedCodexPermissionsMode = provider === "codex"
                     ? normalizeCodexPermissionsMode(msg.codexPermissionsMode)
                     : undefined;
+                const requestedCodexPermissionsMode = this.codexAutoReviewDisabled &&
+                    normalizedCodexPermissionsMode === "autoReview"
+                    ? "default"
+                    : normalizedCodexPermissionsMode;
                 const codexPermissionSettings = requestedCodexPermissionsMode
                     ? codexSettingsFromPermissionsMode(requestedCodexPermissionsMode)
                     : undefined;
@@ -3404,6 +3467,11 @@ export class BridgeWebSocketServer {
                         : undefined;
                     const additionalWritableRoots = this.normalizeAdditionalWritableRoots(msg.additionalWritableRoots, effectiveProjectPath);
                     if (additionalWritableRoots.deniedRoot) {
+                        this.sendResumeFailed(ws, {
+                            provider,
+                            sourceSessionId: sessionRefId,
+                            projectPath: effectiveProjectPath,
+                        });
                         this.send(ws, this.buildPathNotAllowedError(additionalWritableRoots.deniedRoot));
                         break;
                     }
@@ -3422,18 +3490,36 @@ export class BridgeWebSocketServer {
                             };
                         }
                     }
+                    const resumeOperation = this.beginResumeOperation({
+                        ws,
+                        provider: "codex",
+                        sourceSessionId: sessionRefId,
+                        projectPath: effectiveProjectPath,
+                        request: msg,
+                    });
+                    if (!resumeOperation.isOwner)
+                        break;
+                    let historyMetrics = summarizeResumeHistory([]);
+                    let historyLoadMs = 0;
+                    let historyLoaded = false;
+                    let sessionCreateMs = 0;
+                    let nameLoadMs = 0;
+                    const historyStartedAt = Date.now();
                     try {
                         const pastMessages = await this.getCodexThreadHistory(sessionRefId, effectiveProjectPath);
-                        const sessionId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", {
+                        historyLoadMs = Date.now() - historyStartedAt;
+                        historyLoaded = true;
+                        historyMetrics = summarizeResumeHistory(pastMessages);
+                        const createStartedAt = Date.now();
+                        const sessionId = this.sessionManager.create(effectiveProjectPath, undefined, pastMessages, worktreeOpts, "codex", this.withCodexAutoReviewPolicy({
                             threadId: sessionRefId,
                             profile: effectiveProfile,
                             approvalPolicy: codexPermissionSettings
                                 ? codexPermissionSettings.approvalPolicy
                                 : (codexApprovalPolicy ??
                                     normalizeCodexApprovalPolicy(executionMode === "fullAccess" ? "never" : "on-request")),
-                            approvalsReviewer: codexPermissionSettings
-                                ? codexPermissionSettings.approvalsReviewer
-                                : msg.approvalsReviewer,
+                            approvalsReviewer: codexPermissionSettings?.approvalsReviewer ??
+                                msg.approvalsReviewer,
                             codexPermissionsMode: codexPermissionSettings?.codexPermissionsMode,
                             sandboxMode: codexPermissionSettings
                                 ? codexPermissionSettings.sandboxMode
@@ -3449,11 +3535,20 @@ export class BridgeWebSocketServer {
                             collaborationMode: planMode
                                 ? "plan"
                                 : "default",
-                        });
+                        }));
+                        sessionCreateMs = Date.now() - createStartedAt;
                         const createdSession = this.sessionManager.get(sessionId);
+                        if (createdSession) {
+                            // get_history immediately follows session_created on the app.
+                            // Reuse the canonical history loaded above instead of issuing a
+                            // second thread/read for the same restored session.
+                            createdSession.codexInitialHistoryPending = true;
+                        }
                         const cached = this.sessionManager.getCachedCommands("codex", createdSession?.worktreePath ?? effectiveProjectPath);
+                        const nameStartedAt = Date.now();
                         await this.loadAndSetSessionName(createdSession, "codex", effectiveProjectPath, sessionRefId);
-                        this.send(ws, this.buildSessionCreatedMessage({
+                        nameLoadMs = Date.now() - nameStartedAt;
+                        const createdMessage = this.buildSessionCreatedMessage({
                             sessionId,
                             provider: "codex",
                             projectPath: effectiveProjectPath,
@@ -3483,7 +3578,11 @@ export class BridgeWebSocketServer {
                                         : {}),
                                 }
                                 : {}),
-                        }));
+                        });
+                        if (!this.completeResumeOperation(resumeOperation.key, resumeOperation.operationId, sessionId, createdMessage)) {
+                            this.sessionManager.destroy(sessionId);
+                            break;
+                        }
                         this.broadcastSessionList();
                         this.debugEvents.set(sessionId, []);
                         this.recordDebugEvent(sessionId, {
@@ -3493,29 +3592,36 @@ export class BridgeWebSocketServer {
                             detail: `provider=codex thread=${sessionRefId}`,
                         });
                         this.projectHistory?.addProject(effectiveProjectPath);
+                        console.info(formatResumePerformanceLog({
+                            provider: "codex",
+                            sourceSessionId: sessionRefId,
+                            outcome: "success",
+                            ...historyMetrics,
+                            historyLoadMs,
+                            sessionCreateMs,
+                            nameLoadMs,
+                            totalMs: Date.now() - resumeStartedAt,
+                        }));
                     }
                     catch (err) {
-                        this.send(ws, {
-                            type: "error",
-                            message: `Failed to load Codex session history: ${err}`,
-                        });
+                        if (!historyLoaded) {
+                            historyLoadMs = Date.now() - historyStartedAt;
+                        }
+                        console.info(formatResumePerformanceLog({
+                            provider: "codex",
+                            sourceSessionId: sessionRefId,
+                            outcome: "failed",
+                            ...historyMetrics,
+                            historyLoadMs,
+                            sessionCreateMs,
+                            nameLoadMs,
+                            totalMs: Date.now() - resumeStartedAt,
+                        }));
+                        this.failResumeOperation(resumeOperation.key, resumeOperation.operationId, `Failed to load Codex session history: ${err}`);
                     }
                     break;
                 }
                 const claudeSessionId = sessionRefId;
-                let pendingResumes = this.pendingClaudeResumeInputs.get(ws);
-                if (!pendingResumes) {
-                    pendingResumes = new Map();
-                    this.pendingClaudeResumeInputs.set(ws, pendingResumes);
-                }
-                if (pendingResumes.has(claudeSessionId)) {
-                    this.send(ws, {
-                        type: "error",
-                        message: `Session resume already in progress: ${claudeSessionId}`,
-                    });
-                    break;
-                }
-                pendingResumes.set(claudeSessionId, []);
                 // Look up worktree mapping for this Claude session
                 const wtMapping = this.worktreeStore.get(claudeSessionId);
                 let worktreeOpts;
@@ -3535,8 +3641,26 @@ export class BridgeWebSocketServer {
                         };
                     }
                 }
+                const resumeOperation = this.beginResumeOperation({
+                    ws,
+                    provider: "claude",
+                    sourceSessionId: claudeSessionId,
+                    projectPath: resumeProjectPath,
+                    request: msg,
+                });
+                if (!resumeOperation.isOwner)
+                    break;
+                const historyStartedAt = Date.now();
+                let historyMetrics = summarizeResumeHistory([]);
+                let historyLoadMs = 0;
+                let historyLoaded = false;
+                let sessionCreateMs = 0;
                 getSessionHistory(claudeSessionId)
                     .then((pastMessages) => {
+                    historyLoadMs = Date.now() - historyStartedAt;
+                    historyLoaded = true;
+                    historyMetrics = summarizeResumeHistory(pastMessages);
+                    const createStartedAt = Date.now();
                     const { sessionId, permissionMode: effectivePermissionMode, executionMode: effectiveExecutionMode, planMode: effectivePlanMode, usedFallback: autoFallbackUsed, } = this.createClaudeSessionWithFallback({
                         projectPath: resumeProjectPath,
                         options: {
@@ -3556,10 +3680,12 @@ export class BridgeWebSocketServer {
                         pastMessages,
                         worktreeOptions: worktreeOpts,
                     });
+                    sessionCreateMs = Date.now() - createStartedAt;
                     const createdSession = this.sessionManager.get(sessionId);
                     const cached = this.sessionManager.getCachedCommands("claude", createdSession?.worktreePath ?? resumeProjectPath);
+                    const nameStartedAt = Date.now();
                     const finishResume = () => {
-                        this.send(ws, {
+                        const createdMessage = {
                             ...this.buildSessionCreatedMessage({
                                 sessionId,
                                 provider: "claude",
@@ -3588,16 +3714,25 @@ export class BridgeWebSocketServer {
                                     : {}),
                             }),
                             claudeSessionId,
-                        });
-                        const queuedInputs = pendingResumes.get(claudeSessionId) ?? [];
-                        pendingResumes.delete(claudeSessionId);
-                        for (const input of queuedInputs) {
-                            void this.handleClientMessage({ ...input, sessionId }, ws);
+                        };
+                        if (!this.completeResumeOperation(resumeOperation.key, resumeOperation.operationId, sessionId, createdMessage)) {
+                            this.sessionManager.destroy(sessionId);
+                            return;
                         }
                         this.broadcastSessionList();
                         if (autoFallbackUsed) {
                             this.sendTip(ws, sessionId, "auto_mode_fallback_default", createdSession);
                         }
+                        console.info(formatResumePerformanceLog({
+                            provider: "claude",
+                            sourceSessionId: claudeSessionId,
+                            outcome: "success",
+                            ...historyMetrics,
+                            historyLoadMs,
+                            sessionCreateMs,
+                            nameLoadMs: Date.now() - nameStartedAt,
+                            totalMs: Date.now() - resumeStartedAt,
+                        }));
                     };
                     void this.loadAndSetSessionName(createdSession, "claude", resumeProjectPath, claudeSessionId).then(finishResume, (err) => {
                         console.error("[ws] Failed to load resumed session name:", err);
@@ -3613,22 +3748,20 @@ export class BridgeWebSocketServer {
                     this.projectHistory?.addProject(resumeProjectPath);
                 })
                     .catch((err) => {
-                    const queuedInputs = pendingResumes.get(claudeSessionId) ?? [];
-                    pendingResumes.delete(claudeSessionId);
-                    for (const input of queuedInputs) {
-                        if (input.clientMessageId) {
-                            this.send(ws, {
-                                type: "input_rejected",
-                                sessionId: claudeSessionId,
-                                clientMessageId: input.clientMessageId,
-                                reason: "Session resume failed",
-                            });
-                        }
+                    if (!historyLoaded) {
+                        historyLoadMs = Date.now() - historyStartedAt;
                     }
-                    this.send(ws, {
-                        type: "error",
-                        message: `Failed to load session history: ${err}`,
-                    });
+                    console.info(formatResumePerformanceLog({
+                        provider: "claude",
+                        sourceSessionId: claudeSessionId,
+                        outcome: "failed",
+                        ...historyMetrics,
+                        historyLoadMs,
+                        sessionCreateMs,
+                        nameLoadMs: 0,
+                        totalMs: Date.now() - resumeStartedAt,
+                    }));
+                    this.failResumeOperation(resumeOperation.key, resumeOperation.operationId, `Failed to load session history: ${err}`);
                 });
                 break;
             }
@@ -4936,6 +5069,199 @@ export class BridgeWebSocketServer {
     clearPendingClaudeResumeInputs(ws) {
         this.pendingClaudeResumeInputs.get(ws)?.clear();
         this.pendingClaudeResumeInputs.delete(ws);
+        for (const operation of this.resumeOperations.values()) {
+            operation.waiters.delete(ws);
+        }
+    }
+    resumeOperationKey(provider, sourceSessionId) {
+        return `${provider}:${sourceSessionId}`;
+    }
+    resumeRequestFingerprint(msg) {
+        return JSON.stringify({
+            provider: msg.provider ?? "claude",
+            sessionId: msg.sessionId,
+            projectPath: msg.projectPath,
+            permissionMode: msg.permissionMode,
+            executionMode: msg.executionMode,
+            approvalPolicy: msg.approvalPolicy,
+            approvalsReviewer: msg.approvalsReviewer,
+            codexPermissionsMode: msg.codexPermissionsMode,
+            planMode: msg.planMode,
+            sandboxMode: msg.sandboxMode,
+            model: msg.model,
+            effort: msg.effort,
+            maxTurns: msg.maxTurns,
+            maxBudgetUsd: msg.maxBudgetUsd,
+            fallbackModel: msg.fallbackModel,
+            forkSession: msg.forkSession ?? false,
+            persistSession: msg.persistSession,
+            profile: msg.profile,
+            modelReasoningEffort: msg.modelReasoningEffort,
+            serviceTier: msg.serviceTier,
+            networkAccessEnabled: msg.networkAccessEnabled,
+            webSearchMode: msg.webSearchMode,
+            additionalWritableRoots: [...(msg.additionalWritableRoots ?? [])].sort(),
+        });
+    }
+    clearResumeOperation(key, operation) {
+        if (operation.timeout)
+            clearTimeout(operation.timeout);
+        if (this.resumeOperations.get(key) === operation) {
+            this.resumeOperations.delete(key);
+        }
+    }
+    ensurePendingClaudeResume(ws, sourceSessionId) {
+        let pendingResumes = this.pendingClaudeResumeInputs.get(ws);
+        if (!pendingResumes) {
+            pendingResumes = new Map();
+            this.pendingClaudeResumeInputs.set(ws, pendingResumes);
+        }
+        if (!pendingResumes.has(sourceSessionId)) {
+            pendingResumes.set(sourceSessionId, []);
+        }
+    }
+    beginResumeOperation(params) {
+        const { ws, provider, sourceSessionId, projectPath, request } = params;
+        const key = this.resumeOperationKey(provider, sourceSessionId);
+        const fingerprint = this.resumeRequestFingerprint(request);
+        let operation = this.resumeOperations.get(key);
+        if (operation?.completed &&
+            (!this.sessionManager.get(operation.completed.sessionId) ||
+                Date.now() - operation.completed.completedAt >
+                    RESUME_COMPLETED_TTL_MS ||
+                operation.fingerprint !== fingerprint ||
+                request.forkSession === true)) {
+            this.clearResumeOperation(key, operation);
+            operation = undefined;
+        }
+        if (operation &&
+            !operation.completed &&
+            operation.fingerprint !== fingerprint) {
+            this.sendResumeFailed(ws, {
+                provider,
+                sourceSessionId,
+                projectPath,
+            });
+            this.send(ws, {
+                type: "error",
+                message: "This session is already being restored with different settings. Wait for it to finish, then try again.",
+            });
+            return { key, operationId: operation.id, isOwner: false };
+        }
+        this.send(ws, {
+            type: "system",
+            subtype: "session_resume_started",
+            sourceSessionId,
+            provider,
+            projectPath,
+        });
+        if (provider === "claude") {
+            this.ensurePendingClaudeResume(ws, sourceSessionId);
+        }
+        if (operation) {
+            if (operation.completed) {
+                this.send(ws, operation.completed.message);
+                this.flushPendingClaudeResumeInputs(ws, sourceSessionId, operation.completed.sessionId);
+            }
+            else {
+                operation.waiters.add(ws);
+            }
+            return { key, operationId: operation.id, isOwner: false };
+        }
+        const operationId = randomUUID();
+        const newOperation = {
+            id: operationId,
+            provider,
+            sourceSessionId,
+            projectPath,
+            fingerprint,
+            waiters: new Set([ws]),
+        };
+        const timeout = setTimeout(() => {
+            this.failResumeOperation(key, operationId, "Session restore is taking longer than expected. Please reconnect and try again.");
+        }, RESUME_OPERATION_TIMEOUT_MS);
+        timeout.unref?.();
+        newOperation.timeout = timeout;
+        this.resumeOperations.set(key, newOperation);
+        return { key, operationId, isOwner: true };
+    }
+    completeResumeOperation(key, operationId, sessionId, message) {
+        const operation = this.resumeOperations.get(key);
+        if (!operation || operation.id !== operationId)
+            return false;
+        if (operation.timeout)
+            clearTimeout(operation.timeout);
+        operation.completed = {
+            sessionId,
+            message,
+            completedAt: Date.now(),
+        };
+        for (const waiter of operation.waiters) {
+            this.send(waiter, message);
+            this.flushPendingClaudeResumeInputs(waiter, operation.sourceSessionId, sessionId);
+        }
+        operation.waiters.clear();
+        const timeout = setTimeout(() => {
+            this.clearResumeOperation(key, operation);
+        }, RESUME_COMPLETED_TTL_MS);
+        timeout.unref?.();
+        operation.timeout = timeout;
+        this.pruneCompletedResumeOperations();
+        return true;
+    }
+    failResumeOperation(key, operationId, message) {
+        const operation = this.resumeOperations.get(key);
+        if (!operation || operation.id !== operationId)
+            return;
+        this.clearResumeOperation(key, operation);
+        for (const waiter of operation.waiters) {
+            this.rejectPendingClaudeResumeInputs(waiter, operation.sourceSessionId);
+            this.sendResumeFailed(waiter, operation);
+            this.send(waiter, { type: "error", message });
+        }
+    }
+    sendResumeFailed(ws, resume) {
+        this.send(ws, {
+            type: "system",
+            subtype: "session_resume_failed",
+            provider: resume.provider,
+            sourceSessionId: resume.sourceSessionId,
+            projectPath: resume.projectPath,
+        });
+    }
+    flushPendingClaudeResumeInputs(ws, sourceSessionId, sessionId) {
+        const pendingResumes = this.pendingClaudeResumeInputs.get(ws);
+        const queuedInputs = pendingResumes?.get(sourceSessionId) ?? [];
+        pendingResumes?.delete(sourceSessionId);
+        for (const input of queuedInputs) {
+            void this.handleClientMessage({ ...input, sessionId }, ws);
+        }
+    }
+    rejectPendingClaudeResumeInputs(ws, sourceSessionId) {
+        const pendingResumes = this.pendingClaudeResumeInputs.get(ws);
+        const queuedInputs = pendingResumes?.get(sourceSessionId) ?? [];
+        pendingResumes?.delete(sourceSessionId);
+        for (const input of queuedInputs) {
+            if (!input.clientMessageId)
+                continue;
+            this.send(ws, {
+                type: "input_rejected",
+                sessionId: sourceSessionId,
+                clientMessageId: input.clientMessageId,
+                reason: "Session resume failed",
+            });
+        }
+    }
+    pruneCompletedResumeOperations() {
+        const completed = [...this.resumeOperations.entries()]
+            .filter((entry) => entry[1].completed)
+            .sort((a, b) => (a[1].completed?.completedAt ?? 0) -
+            (b[1].completed?.completedAt ?? 0));
+        while (completed.length > 100) {
+            const oldest = completed.shift();
+            if (oldest)
+                this.clearResumeOperation(oldest[0], oldest[1]);
+        }
     }
     /**
      * Load the saved session name from CLI storage and set it on the SessionInfo.
@@ -5033,6 +5359,7 @@ export class BridgeWebSocketServer {
             codexModelServiceTiers: this.codexModelServiceTiers,
             codexProfiles: this.codexProfiles,
             defaultCodexProfile: this.defaultCodexProfile,
+            codexAutoReviewDisabled: this.codexAutoReviewDisabled,
             bridgeVersion: getPackageVersion(),
         });
     }
@@ -5064,6 +5391,7 @@ export class BridgeWebSocketServer {
             codexModelServiceTiers: this.codexModelServiceTiers,
             codexProfiles: this.codexProfiles,
             defaultCodexProfile: this.defaultCodexProfile,
+            codexAutoReviewDisabled: this.codexAutoReviewDisabled,
             bridgeVersion: getPackageVersion(),
         });
     }
@@ -5312,6 +5640,7 @@ export class BridgeWebSocketServer {
             console.warn(`[ws] Failed to load Codex metadata: ${err}`);
             this.codexProfiles = [];
             this.defaultCodexProfile = undefined;
+            this.codexAutoReviewPolicyLoaded = false;
             this.applyFallbackCodexModels();
             this.broadcastSessionList();
         })
@@ -5324,9 +5653,10 @@ export class BridgeWebSocketServer {
         const activeProcess = this.getActiveCodexProcess();
         const codexProcess = activeProcess ?? (await this.createStandaloneCodexProcess(projectPath));
         try {
-            const [profileResult, modelResult] = await Promise.allSettled([
+            const [profileResult, modelResult, requirementsResult] = await Promise.allSettled([
                 codexProcess.readProfileConfig(projectPath),
                 this.readCodexModels(codexProcess),
+                this.readCodexAutoReviewDisabled(codexProcess),
             ]);
             if (profileResult.status === "fulfilled") {
                 this.codexProfiles = profileResult.value.profiles;
@@ -5346,6 +5676,14 @@ export class BridgeWebSocketServer {
                 }
                 this.applyFallbackCodexModels();
             }
+            if (requirementsResult.status === "fulfilled") {
+                this.codexAutoReviewDisabled = requirementsResult.value;
+                this.codexAutoReviewPolicyLoaded = true;
+            }
+            else {
+                console.warn(`[ws] Failed to load Codex config requirements: ${requirementsResult.reason}`);
+                this.codexAutoReviewPolicyLoaded = false;
+            }
             this.broadcastSessionList();
         }
         finally {
@@ -5409,6 +5747,14 @@ export class BridgeWebSocketServer {
             supportedServiceTiers: fallbackCodexServiceTiers(model),
         }));
     }
+    async readCodexAutoReviewDisabled(codexProcess) {
+        const requirementsSource = codexProcess;
+        if (typeof requirementsSource.readConfigRequirements !== "function") {
+            return false;
+        }
+        return (await requirementsSource.readConfigRequirements())
+            .autoReviewDisabled;
+    }
     applyCodexModels(models) {
         this.codexModels = models.map((model) => model.model);
         this.codexModelReasoningEfforts = Object.fromEntries(models.map((model) => [
@@ -5487,6 +5833,19 @@ export class BridgeWebSocketServer {
             ? session.process
             : null;
     }
+    withCodexAutoReviewPolicy(options) {
+        const disableAutoReview = this.codexAutoReviewDisabled;
+        return {
+            ...options,
+            ...(disableAutoReview ? { approvalsReviewer: "user" } : {}),
+            ...(disableAutoReview && options.codexPermissionsMode === "autoReview"
+                ? { codexPermissionsMode: "default" }
+                : {}),
+            autoReviewDisabledByPolicy: this.codexAutoReviewPolicyLoaded
+                ? disableAutoReview
+                : null,
+        };
+    }
     getActiveClaudeProcess() {
         const summary = this.sessionManager
             .list()