@companyhelm/runner 0.0.12 → 0.0.13

package/dist/commands/root.js

@@ -0,0 +1,2627 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toErrorMessage = toErrorMessage;
+exports.isRetryableApiConnectionError = isRetryableApiConnectionError;
+exports.formatApiConnectionFailureMessage = formatApiConnectionFailureMessage;
+exports.formatApiConnectionFailureDiagnostics = formatApiConnectionFailureDiagnostics;
+exports.shouldUseTurnSteer = shouldUseTurnSteer;
+exports.isNoActiveTurnSteerError = isNoActiveTurnSteerError;
+exports.isNoRunningTurnInterruptError = isNoRunningTurnInterruptError;
+exports.normalizeThreadAgentApiUrlForRuntime = normalizeThreadAgentApiUrlForRuntime;
+exports.extractThreadNameUpdateFromNotification = extractThreadNameUpdateFromNotification;
+exports.extractServerMessageRequestId = extractServerMessageRequestId;
+exports.runCommandLoop = runCommandLoop;
+exports.isInternalDaemonChildProcess = isInternalDaemonChildProcess;
+exports.runDetachedDaemonProcess = runDetachedDaemonProcess;
+exports.sendDaemonParentMessage = sendDaemonParentMessage;
+exports.runRootCommand = runRootCommand;
+exports.buildRootConfig = buildRootConfig;
+const protobuf_1 = require("@bufbuild/protobuf");
+const protos_1 = require("@companyhelm/protos");
+const drizzle_orm_1 = require("drizzle-orm");
+const grpc = __importStar(require("@grpc/grpc-js"));
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const config_js_1 = require("../config.js");
+const startup_js_1 = require("./startup.js");
+const companyhelm_api_client_js_1 = require("../service/companyhelm_api_client.js");
+const buffered_client_message_sender_js_1 = require("../service/buffered_client_message_sender.js");
+const host_js_1 = require("../service/host.js");
+const refresh_models_js_1 = require("../service/sdk/refresh_models.js");
+const app_server_js_1 = require("../service/app_server.js");
+const runtime_app_server_exec_js_1 = require("../service/docker/runtime_app_server_exec.js");
+const thread_runtime_js_1 = require("../service/thread_runtime.js");
+const thread_turn_state_js_1 = require("../service/thread_turn_state.js");
+const thread_user_message_request_store_js_1 = require("../service/thread_user_message_request_store.js");
+const thread_lifecycle_js_1 = require("../service/thread_lifecycle.js");
+const daemon_state_js_1 = require("../state/daemon_state.js");
+const db_js_1 = require("../state/db.js");
+const schema_js_1 = require("../state/schema.js");
+const daemon_js_1 = require("../utils/daemon.js");
+const logger_js_1 = require("../utils/logger.js");
+const path_js_1 = require("../utils/path.js");
+const terminal_js_1 = require("../utils/terminal.js");
+const workspace_agents_js_1 = require("../service/workspace_agents.js");
+const COMMAND_CHANNEL_CONNECT_RETRY_DELAY_MS = 1000;
+const COMMAND_CHANNEL_OPEN_TIMEOUT_MS = 5000;
+const TURN_COMPLETION_TIMEOUT_MS = 2 * 60 * 60000;
+const GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS = 5 * 60000;
+const GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS = 30000;
+const GITHUB_INSTALLATIONS_REFRESH_WINDOW_MS = 15 * 60000;
+const WORKSPACE_INSTALLATIONS_DIRECTORY = ".companyhelm";
+const WORKSPACE_INSTALLATIONS_FILENAME = "installations.json";
+const THREAD_GIT_SKILLS_CONFIG_FILENAME = "thread-git-skills.json";
+const THREAD_MCP_CONFIG_FILENAME = "thread-mcp.json";
+const THREAD_AGENT_CLI_CONFIG_FILENAME = "thread-agent-cli.json";
+const THREAD_MCP_BEARER_TOKEN_ENV_PREFIX = "COMPANYHELM_MCP_TOKEN_";
+const THREAD_MCP_AUTH_TYPE_BEARER_TOKEN = 2;
+const THREAD_MCP_STARTUP_TIMEOUT_SECONDS = 60;
+const YOLO_APPROVAL_POLICY = "never";
+const YOLO_SANDBOX_MODE = "danger-full-access";
+const YOLO_SANDBOX_POLICY = { type: "dangerFullAccess" };
+const DOCKER_INTERNAL_HOSTNAME = "host.docker.internal";
+const LOCALHOST_HOSTNAMES = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1"]);
+const DAEMON_STARTUP_TIMEOUT_MS = 15000;
+class RootCommandInterruptedError extends Error {
+    constructor(message = "Root command interrupted.") {
+        super(message);
+        this.name = "RootCommandInterruptedError";
+    }
+}
+const threadAppServerSessions = new Map();
+const threadRolloutPaths = new Map();
+function rememberThreadRolloutPath(threadId, rolloutPath) {
+    if (rolloutPath && rolloutPath.trim().length > 0) {
+        threadRolloutPaths.set(threadId, rolloutPath);
+    }
+}
+async function getOrCreateThreadAppServerSession(threadId, runtimeContainer, appServerEnv, clientName, logger) {
+    const existingSession = threadAppServerSessions.get(threadId);
+    if (existingSession && existingSession.runtimeContainer === runtimeContainer) {
+        return existingSession;
+    }
+    if (existingSession && existingSession.runtimeContainer !== runtimeContainer) {
+        await stopThreadAppServerSession(threadId);
+    }
+    const appServer = new app_server_js_1.AppServerService(new runtime_app_server_exec_js_1.RuntimeContainerAppServerTransport(runtimeContainer, undefined, appServerEnv), clientName, logger, () => ({
+        threadId,
+        sdkThreadId: threadAppServerSessions.get(threadId)?.sdkThreadId ?? null,
+    }));
+    const newSession = {
+        runtimeContainer,
+        appServer,
+        appServerEnv,
+        sdkThreadId: null,
+        rolloutPath: threadRolloutPaths.get(threadId) ?? null,
+        started: false,
+    };
+    threadAppServerSessions.set(threadId, newSession);
+    return newSession;
+}
+async function ensureThreadAppServerSessionStarted(session) {
+    if (session.started) {
+        return;
+    }
+    await session.appServer.start();
+    session.started = true;
+}
+async function stopThreadAppServerSession(threadId) {
+    const session = threadAppServerSessions.get(threadId);
+    if (!session) {
+        return;
+    }
+    threadAppServerSessions.delete(threadId);
+    if (!session.started) {
+        return;
+    }
+    await session.appServer.stop().catch(() => undefined);
+    session.started = false;
+}
+async function stopAllThreadAppServerSessions() {
+    const threadIds = [...threadAppServerSessions.keys()];
+    for (const threadId of threadIds) {
+        await stopThreadAppServerSession(threadId);
+    }
+}
+async function stopAllThreadContainers(cfg, logger) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    let containers = [];
+    try {
+        containers = await db
+            .select({
+            runtimeContainer: schema_js_1.threads.runtimeContainer,
+            dindContainer: schema_js_1.threads.dindContainer,
+        })
+            .from(schema_js_1.threads)
+            .all();
+    }
+    finally {
+        client.close();
+    }
+    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
+    for (const container of containers) {
+        await containerService.stopContainer(container.runtimeContainer).catch((error) => {
+            logger.warn(`Failed to stop runtime container '${container.runtimeContainer}': ${toErrorMessage(error)}`);
+        });
+        if (container.dindContainer && container.dindContainer.trim().length > 0) {
+            await containerService.stopContainer(container.dindContainer).catch((error) => {
+                logger.warn(`Failed to stop DinD container '${container.dindContainer}': ${toErrorMessage(error)}`);
+            });
+        }
+    }
+}
+async function reconcileTrackedRunningThreadsOnStartup(cfg, logger) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    let runningThreads = [];
+    try {
+        runningThreads = await db
+            .select({
+            id: schema_js_1.threads.id,
+            sdkThreadId: schema_js_1.threads.sdkThreadId,
+            currentSdkTurnId: schema_js_1.threads.currentSdkTurnId,
+            runtimeContainer: schema_js_1.threads.runtimeContainer,
+        })
+            .from(schema_js_1.threads)
+            .where((0, drizzle_orm_1.eq)(schema_js_1.threads.isCurrentTurnRunning, true))
+            .all();
+    }
+    finally {
+        client.close();
+    }
+    if (runningThreads.length === 0) {
+        return;
+    }
+    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
+    for (const thread of runningThreads) {
+        if (!thread.sdkThreadId || !thread.currentSdkTurnId) {
+            await (0, thread_turn_state_js_1.updateThreadTurnState)(cfg.state_db_path, thread.id, {
+                isCurrentTurnRunning: false,
+            });
+            logger.warn(`Cleared stale running state for thread '${thread.id}' during startup because the tracked SDK thread/turn identifiers were incomplete.`);
+            continue;
+        }
+        let runtimeRunning = false;
+        try {
+            runtimeRunning = await containerService.isContainerRunning(thread.runtimeContainer);
+        }
+        catch (error) {
+            logger.warn(`Failed checking runtime container '${thread.runtimeContainer}' for thread '${thread.id}' during startup reconciliation: ${toErrorMessage(error)}`);
+            continue;
+        }
+        if (!runtimeRunning) {
+            await (0, thread_turn_state_js_1.updateThreadTurnState)(cfg.state_db_path, thread.id, {
+                isCurrentTurnRunning: false,
+            });
+            logger.info(`Cleared stale running state for thread '${thread.id}' during startup because runtime container '${thread.runtimeContainer}' is not running.`);
+        }
+    }
+}
+const SUPPORTED_REASONING_EFFORTS = new Set([
+    "none",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+]);
+function normalizeReasoningLevels(value) {
+    if (Array.isArray(value)) {
+        return value.filter((item) => typeof item === "string");
+    }
+    if (typeof value === "string" && value.trim().length > 0) {
+        try {
+            const parsed = JSON.parse(value);
+            if (Array.isArray(parsed)) {
+                return parsed.filter((item) => typeof item === "string");
+            }
+        }
+        catch {
+            return [];
+        }
+    }
+    return [];
+}
+function toErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function getGrpcStatusCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error)) {
+        return undefined;
+    }
+    const { code } = error;
+    return typeof code === "number" ? code : undefined;
+}
+function getGrpcStatusName(error) {
+    const code = getGrpcStatusCode(error);
+    if (code === undefined) {
+        return undefined;
+    }
+    const statusName = grpc.status[code];
+    return typeof statusName === "string" ? statusName : undefined;
+}
+function isRetryableApiConnectionError(error) {
+    return getGrpcStatusCode(error) !== grpc.status.UNAUTHENTICATED;
+}
+function formatGrpcMetadataForLog(metadata) {
+    if (!metadata) {
+        return undefined;
+    }
+    const rawEntries = metadata.getMap();
+    const entries = Object.entries(rawEntries);
+    if (entries.length === 0) {
+        return undefined;
+    }
+    const normalizedEntries = Object.fromEntries(entries.map(([key, value]) => [
+        key,
+        Buffer.isBuffer(value) ? value.toString("base64") : String(value),
+    ]));
+    return JSON.stringify(normalizedEntries);
+}
+function formatApiConnectionFailureMessage(error, apiUrl, secret) {
+    const statusCode = getGrpcStatusCode(error);
+    const statusName = getGrpcStatusName(error);
+    const serviceError = isGrpcServiceError(error) ? error : undefined;
+    const baseMessage = serviceError && typeof serviceError.details === "string" && serviceError.details.trim().length > 0
+        ? serviceError.details.trim()
+        : toErrorMessage(error);
+    let message = baseMessage;
+    if (statusCode !== undefined) {
+        message = `gRPC ${statusName ?? "UNKNOWN"} (${statusCode}): ${baseMessage}`;
+    }
+    message += ` [endpoint=${apiUrl}]`;
+    if (statusCode === grpc.status.UNAUTHENTICATED && (!secret || secret.trim().length === 0)) {
+        message += " Provide --secret <secret> to authenticate.";
+    }
+    return message;
+}
+function formatApiConnectionFailureDiagnostics(error) {
+    if (!isGrpcServiceError(error)) {
+        return error instanceof Error && typeof error.stack === "string" ? error.stack : undefined;
+    }
+    const diagnostics = [];
+    const statusCode = getGrpcStatusCode(error);
+    const statusName = getGrpcStatusName(error);
+    if (statusCode !== undefined) {
+        diagnostics.push(`code=${statusCode}`);
+    }
+    if (statusName) {
+        diagnostics.push(`status=${statusName}`);
+    }
+    if (typeof error.details === "string" && error.details.trim().length > 0) {
+        diagnostics.push(`details=${JSON.stringify(error.details.trim())}`);
+    }
+    const metadata = formatGrpcMetadataForLog(error.metadata);
+    if (metadata) {
+        diagnostics.push(`metadata=${metadata}`);
+    }
+    if (typeof error.stack === "string" && error.stack.trim().length > 0) {
+        diagnostics.push(`stack=${JSON.stringify(error.stack)}`);
+    }
+    return diagnostics.length > 0 ? diagnostics.join(" ") : undefined;
+}
+function shouldUseTurnSteer(allowSteer, startedFromIdle) {
+    return allowSteer && !startedFromIdle;
+}
+function isNoActiveTurnSteerError(error) {
+    return /no active turn to steer/i.test(toErrorMessage(error));
+}
+function isNoRunningTurnInterruptError(error) {
+    return /no running turn to interrupt/i.test(toErrorMessage(error));
+}
+function isTurnCompletionTimeoutError(error) {
+    return /timed out waiting for completion of turn/i.test(toErrorMessage(error));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function normalizeNonEmptyString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function rewriteLocalTargetForDockerRuntime(target) {
+    const trimmed = target.trim();
+    if (!trimmed) {
+        return trimmed;
+    }
+    if (trimmed.startsWith("[")) {
+        const closingBracketIndex = trimmed.indexOf("]");
+        if (closingBracketIndex > 0) {
+            const host = trimmed.slice(1, closingBracketIndex).toLowerCase();
+            if (LOCALHOST_HOSTNAMES.has(host)) {
+                return `${DOCKER_INTERNAL_HOSTNAME}${trimmed.slice(closingBracketIndex + 1)}`;
+            }
+        }
+        return trimmed;
+    }
+    const colonIndex = trimmed.indexOf(":");
+    const host = (colonIndex >= 0 ? trimmed.slice(0, colonIndex) : trimmed).toLowerCase();
+    if (!LOCALHOST_HOSTNAMES.has(host)) {
+        return trimmed;
+    }
+    return `${DOCKER_INTERNAL_HOSTNAME}${colonIndex >= 0 ? trimmed.slice(colonIndex) : ""}`;
+}
+function normalizeThreadAgentApiUrlForRuntime(agentApiUrl) {
+    const trimmed = agentApiUrl.trim();
+    if (!trimmed) {
+        return trimmed;
+    }
+    if (trimmed.includes("://")) {
+        try {
+            const parsed = new URL(trimmed);
+            if (LOCALHOST_HOSTNAMES.has(parsed.hostname.toLowerCase())) {
+                parsed.hostname = DOCKER_INTERNAL_HOSTNAME;
+            }
+            const pathname = parsed.pathname === "/" ? "" : parsed.pathname;
+            return `${parsed.protocol}//${parsed.host}${pathname}${parsed.search}${parsed.hash}`;
+        }
+        catch {
+            return trimmed;
+        }
+    }
+    const firstSlashIndex = trimmed.indexOf("/");
+    const target = firstSlashIndex >= 0 ? trimmed.slice(0, firstSlashIndex) : trimmed;
+    const pathSuffix = firstSlashIndex >= 0 ? trimmed.slice(firstSlashIndex) : "";
+    const rewrittenTarget = rewriteLocalTargetForDockerRuntime(target);
+    if (rewrittenTarget !== target) {
+        return `http://${rewrittenTarget}${pathSuffix}`;
+    }
+    return `${rewrittenTarget}${pathSuffix}`;
+}
+function extractThreadNameUpdateFromNotification(notification) {
+    if (notification.method === "thread/name/updated") {
+        const rawParams = notification.params;
+        const sdkThreadId = normalizeNonEmptyString(rawParams.threadId) ??
+            normalizeNonEmptyString(rawParams.thread_id) ??
+            normalizeNonEmptyString(rawParams.conversationId) ??
+            normalizeNonEmptyString(rawParams.conversation_id);
+        if (!sdkThreadId) {
+            return null;
+        }
+        return {
+            sdkThreadId,
+            threadName: normalizeNonEmptyString(rawParams.threadName) ??
+                normalizeNonEmptyString(rawParams.thread_name),
+        };
+    }
+    const rawNotification = notification;
+    if (rawNotification.method !== "codex/event/thread_name_updated") {
+        return null;
+    }
+    if (!isRecord(rawNotification.params)) {
+        return null;
+    }
+    const params = rawNotification.params;
+    const msg = isRecord(params.msg) ? params.msg : undefined;
+    const sdkThreadId = normalizeNonEmptyString(msg?.thread_id) ??
+        normalizeNonEmptyString(msg?.threadId) ??
+        normalizeNonEmptyString(params.threadId) ??
+        normalizeNonEmptyString(params.thread_id) ??
+        normalizeNonEmptyString(params.conversationId) ??
+        normalizeNonEmptyString(params.conversation_id);
+    if (!sdkThreadId) {
+        return null;
+    }
+    const threadName = normalizeNonEmptyString(msg?.thread_name) ??
+        normalizeNonEmptyString(msg?.threadName) ??
+        normalizeNonEmptyString(params.threadName) ??
+        normalizeNonEmptyString(params.thread_name);
+    return { sdkThreadId, threadName };
+}
+function isByte(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 255;
+}
+function decodeLengthDelimitedPayload(bytes) {
+    let index = 0;
+    let shift = 0;
+    let length = 0;
+    while (index < bytes.length) {
+        const current = bytes[index];
+        length |= (current & 0x7f) << shift;
+        index += 1;
+        if ((current & 0x80) === 0) {
+            break;
+        }
+        shift += 7;
+        if (shift > 28) {
+            return null;
+        }
+    }
+    if (index === 0) {
+        return null;
+    }
+    if (index + length !== bytes.length) {
+        return null;
+    }
+    return bytes.subarray(index);
+}
+function toUint8Array(data) {
+    if (data instanceof Uint8Array) {
+        return data;
+    }
+    if (Buffer.isBuffer(data)) {
+        return new Uint8Array(data);
+    }
+    if (Array.isArray(data) && data.every(isByte)) {
+        return Uint8Array.from(data);
+    }
+    if (data &&
+        typeof data === "object" &&
+        "type" in data &&
+        data.type === "Buffer" &&
+        "data" in data &&
+        Array.isArray(data.data)) {
+        const values = data.data;
+        if (values.every(isByte)) {
+            return Uint8Array.from(values);
+        }
+    }
+    return null;
+}
+function extractServerMessageRequestId(serverMessage) {
+    if (!serverMessage || typeof serverMessage !== "object") {
+        return undefined;
+    }
+    const typedMessage = serverMessage;
+    if (typeof typedMessage.requestId === "string" && typedMessage.requestId.length > 0) {
+        return typedMessage.requestId;
+    }
+    if (!Array.isArray(typedMessage.$unknown)) {
+        return undefined;
+    }
+    for (const field of typedMessage.$unknown) {
+        if (field?.no !== 1 || field.wireType !== 2) {
+            continue;
+        }
+        const bytes = toUint8Array(field.data);
+        if (!bytes || bytes.length === 0) {
+            continue;
+        }
+        const payload = decodeLengthDelimitedPayload(bytes) ?? bytes;
+        return Buffer.from(payload).toString("utf8");
+    }
+    return undefined;
+}
+function isGrpcServiceError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error);
+}
+function isUnimplementedGrpcMethod(error) {
+    return isGrpcServiceError(error) && error.code === grpc.status.UNIMPLEMENTED;
+}
+function normalizeAccessTokenExpiration(accessTokenExpiresUnixTimeMs) {
+    const rawUnixTimeMs = Number(accessTokenExpiresUnixTimeMs);
+    const expirationUnixTimeMs = Number.isFinite(rawUnixTimeMs) && rawUnixTimeMs > 0
+        ? Math.floor(rawUnixTimeMs)
+        : Date.now() + 60 * 60000;
+    return {
+        accessTokenExpiresUnixTimeMs: expirationUnixTimeMs.toString(),
+        accessTokenExpiration: new Date(expirationUnixTimeMs).toISOString(),
+    };
+}
+async function loadRuntimeGithubInstallations(apiClient, options, logger) {
+    let installationIds = [];
+    try {
+        const listResponse = await apiClient.listGithubInstallationsForRunner(options);
+        installationIds = listResponse.installations.map((installation) => installation.installationId);
+    }
+    catch (error) {
+        const warning = isUnimplementedGrpcMethod(error)
+            ? "CompanyHelm API does not implement listGithubInstallationsForRunner yet."
+            : `Failed to fetch GitHub installations: ${toErrorMessage(error)}`;
+        logger.warn(warning);
+        return [];
+    }
+    const installationDetails = [];
+    for (const installationId of installationIds) {
+        try {
+            const accessTokenResponse = await apiClient.getGithubInstallationAccessTokenForRunner(installationId, options);
+            const accessToken = accessTokenResponse.accessToken.trim();
+            if (!accessToken) {
+                logger.warn(`Received empty GitHub access token for installation ${installationId.toString()}; skipping.`);
+                continue;
+            }
+            const expiration = normalizeAccessTokenExpiration(accessTokenResponse.accessTokenExpiresUnixTimeMs);
+            const repositories = [...new Set(accessTokenResponse.repositories.filter((repository) => repository.trim().length > 0))]
+                .sort((left, right) => left.localeCompare(right));
+            installationDetails.push({
+                installationId: accessTokenResponse.installationId.toString(),
+                accessToken,
+                accessTokenExpiresUnixTimeMs: expiration.accessTokenExpiresUnixTimeMs,
+                accessTokenExpiration: expiration.accessTokenExpiration,
+                repositories,
+            });
+        }
+        catch (error) {
+            const warning = isUnimplementedGrpcMethod(error)
+                ? "CompanyHelm API does not implement getGithubInstallationAccessTokenForRunner yet."
+                : `Failed to fetch GitHub access token for installation ${installationId.toString()}: ${toErrorMessage(error)}`;
+            logger.warn(warning);
+        }
+    }
+    return installationDetails;
+}
+function buildWorkspaceGithubInstallationsPayload(installations) {
+    return {
+        synced_at: new Date().toISOString(),
+        installations: installations.map((installation) => ({
+            installation_id: installation.installationId,
+            access_token: installation.accessToken,
+            access_token_expires_unix_time_ms: installation.accessTokenExpiresUnixTimeMs,
+            access_token_expiration: installation.accessTokenExpiration,
+            repositories: installation.repositories,
+        })),
+    };
+}
+function writeWorkspaceGithubInstallationsPayload(workspaceDirectory, payload, logger) {
+    const installationsDirectory = (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY);
+    const installationsPath = (0, node_path_1.join)(installationsDirectory, WORKSPACE_INSTALLATIONS_FILENAME);
+    const temporaryPath = `${installationsPath}.tmp`;
+    const serializedPayload = `${JSON.stringify(payload, null, 2)}\n`;
+    try {
+        (0, node_fs_1.mkdirSync)(installationsDirectory, { recursive: true });
+        (0, node_fs_1.writeFileSync)(temporaryPath, serializedPayload, "utf8");
+        (0, node_fs_1.renameSync)(temporaryPath, installationsPath);
+    }
+    catch (error) {
+        logger.warn(`Failed writing GitHub installations file for workspace '${workspaceDirectory}': ${toErrorMessage(error)}`);
+    }
+}
+function isHttpsRepositoryUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeThreadGitSkillDirectoryPath(value) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return null;
+    }
+    if (trimmed.startsWith("/")) {
+        return null;
+    }
+    if (trimmed.includes("\\")) {
+        return null;
+    }
+    const segments = trimmed.split("/").map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+        return null;
+    }
+    if (segments.some((segment) => segment === "." || segment === "..")) {
+        return null;
+    }
+    return segments.join("/");
+}
+function createThreadGitSkillLinkName(rawDirectoryPath) {
+    const fallback = "skill";
+    const segments = rawDirectoryPath.split("/").filter((segment) => segment.length > 0);
+    const lastPathSegment = segments.length > 0 ? segments[segments.length - 1] : fallback;
+    const sanitized = lastPathSegment
+        .replace(/[^a-zA-Z0-9._-]+/g, "-")
+        .replace(/^-+/, "")
+        .replace(/-+$/, "")
+        .replace(/^\.+/, "");
+    return sanitized.length > 0 ? sanitized : fallback;
+}
+function createThreadGitSkillCheckoutDirectoryName(repositoryUrl, commitReference, index) {
+    const digest = (0, node_crypto_1.createHash)("sha256")
+        .update(`${repositoryUrl}\n${commitReference}`)
+        .digest("hex")
+        .slice(0, 12);
+    const repoPathPart = repositoryUrl
+        .replace(/^https?:\/\//i, "")
+        .replace(/[^a-zA-Z0-9]+/g, "-")
+        .replace(/^-+/, "")
+        .replace(/-+$/, "")
+        .toLowerCase()
+        .slice(0, 48) || "repo";
+    return `${String(index + 1).padStart(2, "0")}-${repoPathPart}-${digest}`;
+}
+function normalizeThreadGitSkillPackagesForThreadConfig(rawPackages, logger) {
+    if (!Array.isArray(rawPackages) || rawPackages.length === 0) {
+        return [];
+    }
+    const normalizedPackages = [];
+    const linkNameAllocations = new Map();
+    for (const [packageIndex, rawPackage] of rawPackages.entries()) {
+        const repositoryUrl = normalizeNonEmptyString(rawPackage.repositoryUrl);
+        const commitReference = normalizeNonEmptyString(rawPackage.commitReference);
+        if (!repositoryUrl || !isHttpsRepositoryUrl(repositoryUrl)) {
+            logger.warn(`Skipping thread git skill package at index ${packageIndex}: repositoryUrl must be an https URL.`);
+            continue;
+        }
+        if (!commitReference) {
+            logger.warn(`Skipping thread git skill package at index ${packageIndex}: commitReference is required.`);
+            continue;
+        }
+        const rawSkills = Array.isArray(rawPackage.skills) ? rawPackage.skills : [];
+        const skills = [];
+        for (const rawSkill of rawSkills) {
+            const normalizedDirectoryPath = normalizeThreadGitSkillDirectoryPath(rawSkill.directoryPath ?? "");
+            if (!normalizedDirectoryPath) {
+                logger.warn(`Skipping thread git skill '${rawSkill.directoryPath ?? ""}' in package '${repositoryUrl}': invalid relative directory path.`);
+                continue;
+            }
+            const baseLinkName = createThreadGitSkillLinkName(normalizedDirectoryPath);
+            const allocation = linkNameAllocations.get(baseLinkName) ?? 0;
+            linkNameAllocations.set(baseLinkName, allocation + 1);
+            const linkName = allocation === 0 ? baseLinkName : `${baseLinkName}-${allocation + 1}`;
+            skills.push({
+                directoryPath: normalizedDirectoryPath,
+                linkName,
+            });
+        }
+        if (skills.length === 0) {
+            logger.warn(`Skipping thread git skill package '${repositoryUrl}@${commitReference}': no valid skill directory paths were provided.`);
+            continue;
+        }
+        normalizedPackages.push({
+            repositoryUrl,
+            commitReference,
+            checkoutDirectoryName: createThreadGitSkillCheckoutDirectoryName(repositoryUrl, commitReference, normalizedPackages.length),
+            skills,
+        });
+    }
+    return normalizedPackages;
+}
+function normalizeThreadMcpHeaderEntries(rawEntries, context, logger) {
+    if (!Array.isArray(rawEntries) || rawEntries.length === 0) {
+        return [];
+    }
+    const seenKeys = new Set();
+    const normalizedEntries = [];
+    for (const rawEntry of rawEntries) {
+        const key = normalizeNonEmptyString(rawEntry.key);
+        if (!key) {
+            logger.warn(`Skipping ${context} entry with empty key.`);
+            continue;
+        }
+        const dedupeKey = key.toLowerCase();
+        if (seenKeys.has(dedupeKey)) {
+            logger.warn(`Skipping duplicate ${context} key '${key}'.`);
+            continue;
+        }
+        seenKeys.add(dedupeKey);
+        normalizedEntries.push({
+            key,
+            value: typeof rawEntry.value === "string" ? rawEntry.value : "",
+        });
+    }
+    return normalizedEntries;
+}
+function normalizeThreadMcpServersForThreadConfig(rawServers, logger) {
+    if (!Array.isArray(rawServers) || rawServers.length === 0) {
+        return [];
+    }
+    const nameAllocations = new Map();
+    const normalizedServers = [];
+    for (const [serverIndex, rawServer] of rawServers.entries()) {
+        const rawName = normalizeNonEmptyString(rawServer.name);
+        if (!rawName) {
+            logger.warn(`Skipping thread MCP server at index ${serverIndex}: name is required.`);
+            continue;
+        }
+        const normalizedNameKey = rawName.toLowerCase();
+        const allocation = nameAllocations.get(normalizedNameKey) ?? 0;
+        nameAllocations.set(normalizedNameKey, allocation + 1);
+        const resolvedName = allocation === 0 ? rawName : `${rawName}-${allocation + 1}`;
+        if (resolvedName !== rawName) {
+            logger.warn(`Renaming duplicate thread MCP server '${rawName}' to '${resolvedName}'.`);
+        }
+        if (rawServer.transportConfig.case === "stdio") {
+            const command = normalizeNonEmptyString(rawServer.transportConfig.value.command);
+            if (!command) {
+                logger.warn(`Skipping thread MCP stdio server '${resolvedName}': command is required.`);
+                continue;
+            }
+            const args = Array.isArray(rawServer.transportConfig.value.args)
+                ? rawServer.transportConfig.value.args.filter((arg) => typeof arg === "string")
+                : [];
+            const envVars = normalizeThreadMcpHeaderEntries(rawServer.transportConfig.value.envVars, `thread MCP stdio env var for '${resolvedName}'`, logger);
+            normalizedServers.push({
+                name: resolvedName,
+                transport: "stdio",
+                command,
+                args,
+                envVars,
+                authType: "none",
+                headers: [],
+            });
+            continue;
+        }
+        if (rawServer.transportConfig.case !== "streamableHttp") {
+            logger.warn(`Skipping thread MCP server '${resolvedName}': transport is missing.`);
+            continue;
+        }
+        const url = normalizeNonEmptyString(rawServer.transportConfig.value.url);
+        if (!url) {
+            logger.warn(`Skipping thread MCP streamable_http server '${resolvedName}': url is required.`);
+            continue;
+        }
+        const authType = rawServer.transportConfig.value.authType === THREAD_MCP_AUTH_TYPE_BEARER_TOKEN
+            ? "bearer_token"
+            : "none";
+        const bearerToken = authType === "bearer_token"
+            ? normalizeNonEmptyString(rawServer.transportConfig.value.bearerToken)
+            : null;
+        if (authType === "bearer_token" && !bearerToken) {
+            logger.warn(`Skipping thread MCP streamable_http server '${resolvedName}': bearer token is required.`);
+            continue;
+        }
+        const headers = normalizeThreadMcpHeaderEntries(rawServer.transportConfig.value.headers, `thread MCP streamable_http header for '${resolvedName}'`, logger);
+        normalizedServers.push({
+            name: resolvedName,
+            transport: "streamable_http",
+            args: [],
+            envVars: [],
+            url,
+            authType,
+            bearerToken,
+            headers,
+        });
+    }
+    return normalizedServers;
+}
+function resolveThreadMcpConfigPath(workspaceDirectory) {
+    return (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY, THREAD_MCP_CONFIG_FILENAME);
+}
+function writeWorkspaceThreadMcpConfig(workspaceDirectory, mcpServers, logger) {
+    const configPath = resolveThreadMcpConfigPath(workspaceDirectory);
+    const configDirectory = (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY);
+    const temporaryPath = `${configPath}.tmp`;
+    try {
+        (0, node_fs_1.mkdirSync)(configDirectory, { recursive: true });
+        if (mcpServers.length === 0) {
+            (0, node_fs_1.rmSync)(configPath, { force: true });
+            (0, node_fs_1.rmSync)(temporaryPath, { force: true });
+            return;
+        }
+        (0, node_fs_1.writeFileSync)(temporaryPath, `${JSON.stringify({ servers: mcpServers }, null, 2)}\n`, "utf8");
+        (0, node_fs_1.renameSync)(temporaryPath, configPath);
+    }
+    catch (error) {
+        logger.warn(`Failed writing thread MCP config for workspace '${workspaceDirectory}': ${toErrorMessage(error)}`);
+    }
+}
+function parseThreadMcpConfig(content) {
+    if (!isRecord(content) || !Array.isArray(content.servers)) {
+        return null;
+    }
+    const parsedServers = [];
+    for (const rawServer of content.servers) {
+        if (!isRecord(rawServer)) {
+            return null;
+        }
+        const name = normalizeNonEmptyString(rawServer.name);
+        const transport = rawServer.transport;
+        const authType = rawServer.authType;
+        if (!name ||
+            (transport !== "stdio" && transport !== "streamable_http") ||
+            (authType !== "none" && authType !== "bearer_token")) {
+            return null;
+        }
+        const args = Array.isArray(rawServer.args) && rawServer.args.every((arg) => typeof arg === "string")
+            ? rawServer.args
+            : [];
+        const envVars = Array.isArray(rawServer.envVars)
+            ? rawServer.envVars
+                .filter((entry) => isRecord(entry))
+                .map((entry) => ({
+                key: normalizeNonEmptyString(entry.key) ?? "",
+                value: typeof entry.value === "string" ? entry.value : "",
+            }))
+                .filter((entry) => entry.key.length > 0)
+            : [];
+        const headers = Array.isArray(rawServer.headers)
+            ? rawServer.headers
+                .filter((entry) => isRecord(entry))
+                .map((entry) => ({
+                key: normalizeNonEmptyString(entry.key) ?? "",
+                value: typeof entry.value === "string" ? entry.value : "",
+            }))
+                .filter((entry) => entry.key.length > 0)
+            : [];
+        if (transport === "stdio") {
+            const command = normalizeNonEmptyString(rawServer.command);
+            if (!command) {
+                return null;
+            }
+            parsedServers.push({
+                name,
+                transport,
+                command,
+                args,
+                envVars,
+                authType,
+                headers: [],
+            });
+            continue;
+        }
+        const url = normalizeNonEmptyString(rawServer.url);
+        const bearerToken = authType === "bearer_token"
+            ? normalizeNonEmptyString(rawServer.bearerToken)
+            : null;
+        if (!url) {
+            return null;
+        }
+        if (authType === "bearer_token" && !bearerToken) {
+            return null;
+        }
+        parsedServers.push({
+            name,
+            transport,
+            args: [],
+            envVars: [],
+            url,
+            authType,
+            bearerToken,
+            headers,
+        });
+    }
+    return parsedServers;
+}
+function readWorkspaceThreadMcpConfig(workspaceDirectory, logger) {
+    const configPath = resolveThreadMcpConfigPath(workspaceDirectory);
+    try {
+        const rawContent = (0, node_fs_1.readFileSync)(configPath, "utf8");
+        const parsedContent = JSON.parse(rawContent);
+        const parsedConfig = parseThreadMcpConfig(parsedContent);
+        if (!parsedConfig) {
+            logger.warn(`Thread MCP config has invalid shape at '${configPath}'.`);
+            return [];
+        }
+        return parsedConfig;
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return [];
+        }
+        logger.warn(`Failed reading thread MCP config at '${configPath}': ${toErrorMessage(error)}`);
+        return [];
+    }
+}
+function resolveThreadAgentCliConfigPath(workspaceDirectory) {
+    return (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY, THREAD_AGENT_CLI_CONFIG_FILENAME);
+}
+function parseThreadAgentCliConfig(content) {
+    if (!isRecord(content)) {
+        return null;
+    }
+    const agentApiUrl = normalizeNonEmptyString(content.agent_api_url);
+    const token = normalizeNonEmptyString(content.token);
+    if (!agentApiUrl || !token) {
+        return null;
+    }
+    return {
+        agent_api_url: agentApiUrl,
+        token,
+    };
+}
+function writeWorkspaceThreadAgentCliConfig(workspaceDirectory, cliSecret, agentApiUrl, logger) {
+    const configPath = resolveThreadAgentCliConfigPath(workspaceDirectory);
+    const configDirectory = (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY);
+    const temporaryPath = `${configPath}.tmp`;
+    try {
+        (0, node_fs_1.mkdirSync)(configDirectory, { recursive: true });
+        if (cliSecret.length === 0) {
+            (0, node_fs_1.rmSync)(configPath, { force: true });
+            (0, node_fs_1.rmSync)(temporaryPath, { force: true });
+            return;
+        }
+        const payload = {
+            agent_api_url: normalizeThreadAgentApiUrlForRuntime(agentApiUrl),
+            token: cliSecret,
+        };
+        (0, node_fs_1.writeFileSync)(temporaryPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+        (0, node_fs_1.renameSync)(temporaryPath, configPath);
+    }
+    catch (error) {
+        logger.warn(`Failed writing thread agent CLI config for workspace '${workspaceDirectory}': ${toErrorMessage(error)}`);
+    }
+}
+function readWorkspaceThreadAgentCliConfig(workspaceDirectory, logger) {
+    const configPath = resolveThreadAgentCliConfigPath(workspaceDirectory);
+    try {
+        const rawContent = (0, node_fs_1.readFileSync)(configPath, "utf8");
+        const parsedContent = JSON.parse(rawContent);
+        const parsedConfig = parseThreadAgentCliConfig(parsedContent);
+        if (!parsedConfig) {
+            logger.warn(`Thread agent CLI config has invalid shape at '${configPath}'.`);
+            return null;
+        }
+        return parsedConfig;
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return null;
+        }
+        logger.warn(`Failed reading thread agent CLI config at '${configPath}': ${toErrorMessage(error)}`);
+        return null;
+    }
+}
+function escapeTomlString(value) {
+    return JSON.stringify(value);
+}
+function formatTomlKey(value) {
+    return /^[A-Za-z0-9_-]+$/.test(value) ? value : escapeTomlString(value);
+}
+function buildThreadMcpBearerTokenEnvVarName(serverName, serverIndex) {
+    const normalized = serverName
+        .toUpperCase()
+        .replace(/[^A-Z0-9]+/g, "_")
+        .replace(/^_+/, "")
+        .replace(/_+$/, "");
+    const suffix = normalized.length > 0 ? normalized : `SERVER_${serverIndex + 1}`;
+    return `${THREAD_MCP_BEARER_TOKEN_ENV_PREFIX}${suffix}`;
+}
+function buildThreadCodexMcpSetup(mcpServers) {
+    const lines = [
+        "# Generated by CompanyHelm. Thread-scoped MCP server configuration for Codex.",
+    ];
+    const appServerEnv = {};
+    for (const [serverIndex, server] of mcpServers.entries()) {
+        const serverTableName = escapeTomlString(server.name);
+        lines.push("", `[mcp_servers.${serverTableName}]`);
+        lines.push(`startup_timeout_sec = ${THREAD_MCP_STARTUP_TIMEOUT_SECONDS}`);
+        if (server.transport === "stdio") {
+            lines.push(`command = ${escapeTomlString(server.command ?? "")}`);
+            if (server.args.length > 0) {
+                lines.push(`args = [${server.args.map((arg) => escapeTomlString(arg)).join(", ")}]`);
+            }
+            if (server.envVars.length > 0) {
+                lines.push("", `[mcp_servers.${serverTableName}.env]`);
+                for (const envVar of server.envVars) {
+                    lines.push(`${formatTomlKey(envVar.key)} = ${escapeTomlString(envVar.value)}`);
+                }
+            }
+            continue;
+        }
+        lines.push(`url = ${escapeTomlString(server.url ?? "")}`);
+        if (server.authType === "bearer_token" && server.bearerToken) {
+            const envVarName = buildThreadMcpBearerTokenEnvVarName(server.name, serverIndex);
+            lines.push(`bearer_token_env_var = ${escapeTomlString(envVarName)}`);
+            appServerEnv[envVarName] = server.bearerToken;
+        }
+        if (server.headers.length > 0) {
+            const renderedHeaders = server.headers
+                .map((header) => `${formatTomlKey(header.key)} = ${escapeTomlString(header.value)}`)
+                .join(", ");
+            lines.push(`http_headers = { ${renderedHeaders} }`);
+        }
+    }
+    return {
+        configToml: `${lines.join("\n").trimEnd()}\n`,
+        appServerEnv,
+    };
+}
+function resolveThreadGitSkillsConfigPath(workspaceDirectory) {
+    return (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY, THREAD_GIT_SKILLS_CONFIG_FILENAME);
+}
+function writeWorkspaceThreadGitSkillsConfig(workspaceDirectory, gitSkillPackages, logger) {
+    const configPath = resolveThreadGitSkillsConfigPath(workspaceDirectory);
+    const configDirectory = (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY);
+    const temporaryPath = `${configPath}.tmp`;
+    try {
+        (0, node_fs_1.mkdirSync)(configDirectory, { recursive: true });
+        if (gitSkillPackages.length === 0) {
+            (0, node_fs_1.rmSync)(configPath, { force: true });
+            (0, node_fs_1.rmSync)(temporaryPath, { force: true });
+            return;
+        }
+        (0, node_fs_1.writeFileSync)(temporaryPath, `${JSON.stringify({ packages: gitSkillPackages }, null, 2)}\n`, "utf8");
+        (0, node_fs_1.renameSync)(temporaryPath, configPath);
+    }
+    catch (error) {
+        logger.warn(`Failed writing thread git skills config for workspace '${workspaceDirectory}': ${toErrorMessage(error)}`);
+    }
+}
+function parseThreadGitSkillsConfig(content) {
+    if (!isRecord(content) || !Array.isArray(content.packages)) {
+        return null;
+    }
+    const parsedPackages = [];
+    for (const rawPackage of content.packages) {
+        if (!isRecord(rawPackage)) {
+            return null;
+        }
+        const repositoryUrl = normalizeNonEmptyString(rawPackage.repositoryUrl);
+        const commitReference = normalizeNonEmptyString(rawPackage.commitReference);
+        const checkoutDirectoryName = normalizeNonEmptyString(rawPackage.checkoutDirectoryName);
+        const rawSkills = rawPackage.skills;
+        if (!repositoryUrl ||
+            !isHttpsRepositoryUrl(repositoryUrl) ||
+            !commitReference ||
+            !checkoutDirectoryName ||
+            checkoutDirectoryName.includes("/") ||
+            checkoutDirectoryName.includes("\\") ||
+            !Array.isArray(rawSkills)) {
+            return null;
+        }
+        const parsedSkills = [];
+        for (const rawSkill of rawSkills) {
+            if (!isRecord(rawSkill)) {
+                return null;
+            }
+            const directoryPath = normalizeThreadGitSkillDirectoryPath(normalizeNonEmptyString(rawSkill.directoryPath) ?? "");
+            const linkName = normalizeNonEmptyString(rawSkill.linkName);
+            if (!directoryPath ||
+                !linkName ||
+                linkName.includes("/") ||
+                linkName.includes("\\") ||
+                linkName.trim().length === 0 ||
+                linkName.trim() === "." ||
+                linkName.trim() === "..") {
+                return null;
+            }
+            parsedSkills.push({ directoryPath, linkName });
+        }
+        if (parsedSkills.length === 0) {
+            continue;
+        }
+        parsedPackages.push({
+            repositoryUrl,
+            commitReference,
+            checkoutDirectoryName,
+            skills: parsedSkills,
+        });
+    }
+    return parsedPackages;
+}
+function readWorkspaceThreadGitSkillsConfig(workspaceDirectory, logger) {
+    const configPath = resolveThreadGitSkillsConfigPath(workspaceDirectory);
+    try {
+        const rawContent = (0, node_fs_1.readFileSync)(configPath, "utf8");
+        const parsedContent = JSON.parse(rawContent);
+        const parsedPackages = parseThreadGitSkillsConfig(parsedContent);
+        if (!parsedPackages) {
+            logger.warn(`Thread git skills config has invalid shape at '${configPath}'.`);
+            return [];
+        }
+        return parsedPackages;
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return [];
+        }
+        logger.warn(`Failed reading thread git skills config at '${configPath}': ${toErrorMessage(error)}`);
+        return [];
+    }
+}
+async function ensureThreadGitSkillsInRuntime(cfg, threadState, containerService, logger) {
+    const packages = readWorkspaceThreadGitSkillsConfig(threadState.workspace, logger);
+    if (packages.length === 0) {
+        return;
+    }
+    await containerService.ensureRuntimeContainerThreadGitSkills(threadState.runtimeContainer, {
+        uid: threadState.uid,
+        gid: threadState.gid,
+        agentUser: cfg.agent_user,
+        agentHomeDirectory: threadState.homeDirectory,
+    }, {
+        cloneRootDirectory: cfg.thread_git_skills_directory,
+        packages,
+    });
+}
+function buildThreadRuntimeUser(cfg, threadState) {
+    return {
+        uid: threadState.uid,
+        gid: threadState.gid,
+        agentUser: cfg.agent_user,
+        agentHomeDirectory: threadState.homeDirectory,
+    };
+}
+async function reconcileThreadRunningStateBeforeUserMessage(cfg, threadState, logger) {
+    if (!threadState.isCurrentTurnRunning) {
+        return threadState;
+    }
+    if (!threadState.sdkThreadId || !threadState.currentSdkTurnId) {
+        await updateThreadTurnState(cfg, threadState.id, {
+            isCurrentTurnRunning: false,
+        });
+        logger.warn(`Cleared stale running state for thread '${threadState.id}' before user message handling because the tracked SDK thread/turn identifiers were incomplete.`);
+        return {
+            ...threadState,
+            isCurrentTurnRunning: false,
+        };
+    }
+    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
+    if (!(await containerService.isContainerRunning(threadState.runtimeContainer))) {
+        await stopThreadAppServerSession(threadState.id);
+        await updateThreadTurnState(cfg, threadState.id, {
+            isCurrentTurnRunning: false,
+        });
+        logger.info(`Cleared stale running state for thread '${threadState.id}' before user message handling because runtime container '${threadState.runtimeContainer}' is not running.`);
+        return {
+            ...threadState,
+            isCurrentTurnRunning: false,
+        };
+    }
+    const threadMcpSetup = buildThreadCodexMcpSetup(readWorkspaceThreadMcpConfig(threadState.workspace, logger));
+    const threadAgentCliConfig = readWorkspaceThreadAgentCliConfig(threadState.workspace, logger);
+    const appServerSession = await getOrCreateThreadAppServerSession(threadState.id, threadState.runtimeContainer, threadMcpSetup.appServerEnv, cfg.codex.app_server_client_name, logger);
+    const runtimeUser = buildThreadRuntimeUser(cfg, threadState);
+    await (0, thread_runtime_js_1.ensureThreadRuntimeReady)({
+        dindContainer: threadState.dindContainer,
+        runtimeContainer: threadState.runtimeContainer,
+        containerService,
+        gitUserName: cfg.git_user_name,
+        gitUserEmail: cfg.git_user_email,
+        user: runtimeUser,
+    });
+    await ensureThreadGitSkillsInRuntime(cfg, threadState, containerService, logger);
+    if (threadAgentCliConfig) {
+        await containerService.ensureRuntimeContainerAgentCliConfig(threadState.runtimeContainer, runtimeUser, threadAgentCliConfig);
+    }
+    if (!appServerSession.started) {
+        await containerService.ensureRuntimeContainerCodexConfig(threadState.runtimeContainer, runtimeUser, threadMcpSetup.configToml);
+    }
+    await ensureThreadAppServerSessionStarted(appServerSession);
+    const resumeResult = await appServerSession.appServer.resumeThread({
+        threadId: threadState.sdkThreadId,
+        approvalPolicy: YOLO_APPROVAL_POLICY,
+        sandbox: YOLO_SANDBOX_MODE,
+        persistExtendedHistory: true,
+    });
+    appServerSession.sdkThreadId = resumeResult.thread.id;
+    appServerSession.rolloutPath = resumeResult.thread.path;
+    rememberThreadRolloutPath(threadState.id, resumeResult.thread.path);
+    const trackedTurn = resumeResult.thread.turns.find((turn) => turn.id === threadState.currentSdkTurnId);
+    if (trackedTurn?.status === "inProgress") {
+        return {
+            ...threadState,
+            sdkThreadId: resumeResult.thread.id,
+        };
+    }
+    await updateThreadTurnState(cfg, threadState.id, {
+        sdkThreadId: resumeResult.thread.id,
+        isCurrentTurnRunning: false,
+    });
+    logger.info(`Cleared stale running state for thread '${threadState.id}' before user message handling because SDK turn '${threadState.currentSdkTurnId}' is no longer in progress.`);
+    return {
+        ...threadState,
+        sdkThreadId: resumeResult.thread.id,
+        isCurrentTurnRunning: false,
+    };
+}
+async function listTrackedThreadWorkspaces(cfg, logger) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        const rows = await db.select({ workspace: schema_js_1.threads.workspace }).from(schema_js_1.threads);
+        return [...new Set(rows.map((row) => row.workspace.trim()).filter((workspace) => workspace.length > 0))];
+    }
+    catch (error) {
+        logger.warn(`Failed to list tracked thread workspaces for GitHub installation sync: ${toErrorMessage(error)}`);
+        return [];
+    }
+    finally {
+        client.close();
+    }
+}
+function resolveGithubInstallationsSyncDelayMs(installations) {
+    let syncDelayMs = GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS;
+    const now = Date.now();
+    for (const installation of installations) {
+        const expirationUnixTimeMs = Number(installation.accessTokenExpiresUnixTimeMs);
+        if (!Number.isFinite(expirationUnixTimeMs) || expirationUnixTimeMs <= 0) {
+            continue;
+        }
+        const refreshInMs = expirationUnixTimeMs - now - GITHUB_INSTALLATIONS_REFRESH_WINDOW_MS;
+        const boundedRefreshDelayMs = Math.max(GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS, Math.min(GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS, refreshInMs));
+        syncDelayMs = Math.min(syncDelayMs, boundedRefreshDelayMs);
+    }
+    return Math.max(GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS, Math.min(GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS, syncDelayMs));
+}
+async function syncGithubInstallationsForWorkspaces(apiClient, options, workspaceDirectories, logger) {
+    const uniqueWorkspaces = [
+        ...new Set(workspaceDirectories.map((workspace) => workspace.trim()).filter((workspace) => workspace.length > 0)),
+    ];
+    if (uniqueWorkspaces.length === 0) {
+        return [];
+    }
+    const installations = await loadRuntimeGithubInstallations(apiClient, options, logger);
+    const payload = buildWorkspaceGithubInstallationsPayload(installations);
+    for (const workspaceDirectory of uniqueWorkspaces) {
+        writeWorkspaceGithubInstallationsPayload(workspaceDirectory, payload, logger);
+    }
+    logger.debug(`Synced ${installations.length} GitHub installation token(s) to ${uniqueWorkspaces.length} workspace(s).`);
+    return installations;
+}
+async function waitForAbort(signal, delayMs) {
+    if (signal.aborted) {
+        return;
+    }
+    await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", handleAbort);
+            resolve();
+        }, delayMs);
+        function handleAbort() {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", handleAbort);
+            resolve();
+        }
+        signal.addEventListener("abort", handleAbort);
+    });
+}
+async function runGithubInstallationsSyncLoop(cfg, apiClient, options, logger, signal) {
+    while (!signal.aborted) {
+        let nextDelayMs = GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS;
+        try {
+            const workspaces = await listTrackedThreadWorkspaces(cfg, logger);
+            const installations = await syncGithubInstallationsForWorkspaces(apiClient, options, workspaces, logger);
+            nextDelayMs = resolveGithubInstallationsSyncDelayMs(installations);
+        }
+        catch (error) {
+            logger.warn(`GitHub installation sync loop iteration failed: ${toErrorMessage(error)}`);
+            nextDelayMs = GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS;
+        }
+        await waitForAbort(signal, nextDelayMs);
+    }
+}
+function normalizeReasoningEffort(value) {
+    if (!value) {
+        return null;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (!SUPPORTED_REASONING_EFFORTS.has(normalized)) {
+        return null;
+    }
+    return normalized;
+}
+function normalizeAdditionalModelInstructions(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function buildThreadDeveloperInstructions(additionalModelInstructions) {
+    return normalizeAdditionalModelInstructions(additionalModelInstructions);
+}
+function buildUserTextInput(text) {
+    return [
+        {
+            type: "text",
+            text,
+            text_elements: [],
+        },
+    ];
+}
+function truncateSummary(text, maxLength = 240) {
+    const normalized = text.trim();
+    if (normalized.length <= maxLength) {
+        return normalized;
+    }
+    return `${normalized.slice(0, Math.max(0, maxLength - 3))}...`;
+}
+function summarizeUserInput(input) {
+    switch (input.type) {
+        case "text":
+            return input.text.trim();
+        case "image":
+            return `[image] ${input.url}`;
+        case "localImage":
+            return `[local image] ${input.path}`;
+        case "skill":
+            return `[skill] ${input.name} (${input.path})`;
+        case "mention":
+            return `[mention] ${input.name} (${input.path})`;
+        default:
+            return "";
+    }
+}
+function summarizeWebSearchItem(item) {
+    if (!item.action) {
+        return `Web search: ${truncateSummary(item.query, 180)}`;
+    }
+    switch (item.action.type) {
+        case "search": {
+            const query = item.action.query?.trim()
+                || item.action.queries?.map((entry) => entry.trim()).filter((entry) => entry.length > 0).join(", ")
+                || item.query;
+            return `Web search: ${truncateSummary(query, 180)}`;
+        }
+        case "openPage":
+            return item.action.url ? `Opened web page: ${item.action.url}` : "Opened web page";
+        case "findInPage": {
+            const target = item.action.url ? ` in ${item.action.url}` : "";
+            const pattern = item.action.pattern?.trim();
+            if (!pattern) {
+                return `Find in page${target}`;
+            }
+            return `Find in page${target}: ${truncateSummary(pattern, 140)}`;
+        }
+        case "other":
+        default:
+            return `Web search action: ${truncateSummary(item.query, 180)}`;
+    }
+}
+function mapThreadItemType(item) {
+    switch (item.type) {
+        case "userMessage":
+            return protos_1.ItemType.USER_MESSAGE;
+        case "agentMessage":
+            return protos_1.ItemType.AGENT_MESSAGE;
+        case "plan":
+            return protos_1.ItemType.PLAN;
+        case "reasoning":
+            return protos_1.ItemType.REASONING;
+        case "commandExecution":
+            return protos_1.ItemType.COMMAND_EXECUTION;
+        case "fileChange":
+            return protos_1.ItemType.FILE_CHANGE;
+        case "mcpToolCall":
+            return protos_1.ItemType.MCP_TOOL_CALL;
+        case "collabAgentToolCall":
+            return protos_1.ItemType.COLLAB_AGENT_TOOL_CALL;
+        case "webSearch":
+            return protos_1.ItemType.WEB_SEARCH;
+        case "imageView":
+            return protos_1.ItemType.IMAGE_VIEW;
+        case "enteredReviewMode":
+            return protos_1.ItemType.ENTERED_REVIEW_MODE;
+        case "exitedReviewMode":
+            return protos_1.ItemType.EXITED_REVIEW_MODE;
+        case "contextCompaction":
+            return protos_1.ItemType.CONTEXT_COMPACTION;
+        default:
+            return protos_1.ItemType.ITEM_TYPE_UNKNOWN;
+    }
+}
+function summarizeThreadItemText(item) {
+    switch (item.type) {
+        case "userMessage": {
+            const summarizedInputs = item.content
+                .map((input) => summarizeUserInput(input))
+                .map((value) => value.trim())
+                .filter((value) => value.length > 0);
+            if (summarizedInputs.length === 0) {
+                return "User message";
+            }
+            return truncateSummary(summarizedInputs.join("\n"), 800);
+        }
+        case "agentMessage":
+            return item.text.trim() || "Agent message";
+        case "plan":
+            return item.text.trim() || "Plan update";
+        case "reasoning": {
+            const summary = item.summary.join("\n").trim();
+            if (summary) {
+                return truncateSummary(summary, 800);
+            }
+            const reasoningContent = item.content.join("\n").trim();
+            return reasoningContent ? truncateSummary(reasoningContent, 800) : "Reasoning update";
+        }
+        case "commandExecution":
+            return item.command.trim() || "Command execution";
+        case "fileChange": {
+            const changedPaths = item.changes
+                .map((change) => String(change.path || "").trim())
+                .filter((path) => path.length > 0);
+            if (changedPaths.length === 0) {
+                return `File change (${item.status})`;
+            }
+            const preview = changedPaths.slice(0, 3).join(", ");
+            const suffix = changedPaths.length > 3 ? ", ..." : "";
+            const noun = changedPaths.length === 1 ? "file" : "files";
+            return `File change (${item.status}): ${changedPaths.length} ${noun} (${preview}${suffix})`;
+        }
+        case "mcpToolCall": {
+            const base = `MCP ${item.server}/${item.tool} (${item.status})`;
+            if (item.error?.message) {
+                return `${base}: ${truncateSummary(item.error.message, 140)}`;
+            }
+            if (item.status === "completed") {
+                return `${base}: completed`;
+            }
+            return base;
+        }
+        case "collabAgentToolCall": {
+            const receiverCount = item.receiverThreadIds.length;
+            const receiverLabel = receiverCount === 1 ? "1 receiver" : `${receiverCount} receivers`;
+            const prompt = item.prompt?.trim();
+            if (prompt) {
+                return `Collab ${item.tool} (${item.status}, ${receiverLabel}): ${truncateSummary(prompt, 140)}`;
+            }
+            return `Collab ${item.tool} (${item.status}, ${receiverLabel})`;
+        }
+        case "webSearch":
+            return summarizeWebSearchItem(item);
+        case "imageView":
+            return item.path.trim() ? `Viewed image: ${item.path}` : "Viewed image";
+        case "enteredReviewMode":
+            return item.review.trim() ? `Entered review mode: ${truncateSummary(item.review, 180)}` : "Entered review mode";
+        case "exitedReviewMode":
+            return item.review.trim() ? `Exited review mode: ${truncateSummary(item.review, 180)}` : "Exited review mode";
+        case "contextCompaction":
+            return "Context compaction";
+        default:
+            return undefined;
+    }
+}
+function buildCommandExecutionItem(item) {
+    if (item.type !== "commandExecution") {
+        return undefined;
+    }
+    return {
+        command: item.command,
+        cwd: item.cwd,
+        processId: item.processId ?? "unknown",
+        output: item.aggregatedOutput ?? undefined,
+    };
+}
+function removeWorkspaceDirectory(workspacePath) {
+    (0, node_fs_1.rmSync)(workspacePath, { recursive: true, force: true });
+}
+async function sendRequestError(commandChannel, errorMessage, requestId) {
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        requestId,
+        payload: {
+            case: "requestError",
+            value: {
+                errorMessage,
+            },
+        },
+    });
+    await commandChannel.send(message);
+}
+async function sendHeartbeatResponse(commandChannel, requestId) {
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        requestId,
+        payload: {
+            case: "heartbeatResponse",
+            value: {},
+        },
+    });
+    await commandChannel.send(message);
+}
+async function sendThreadUpdate(commandChannel, threadId, status, requestId) {
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        requestId,
+        payload: {
+            case: "threadUpdate",
+            value: {
+                threadId,
+                status,
+            },
+        },
+    });
+    await commandChannel.send(message);
+}
+async function sendThreadNameUpdate(commandChannel, threadId, threadName) {
+    const normalizedThreadName = typeof threadName === "string"
+        ? threadName.trim() || undefined
+        : undefined;
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        payload: {
+            case: "threadNameUpdate",
+            value: {
+                threadId,
+                threadName: normalizedThreadName,
+            },
+        },
+    });
+    await commandChannel.send(message);
+}
+async function sendTurnExecutionUpdate(commandChannel, threadId, sdkTurnId, status, requestId) {
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        requestId,
+        payload: {
+            case: "turnUpdate",
+            value: {
+                threadId,
+                sdkTurnId,
+                status,
+            },
+        },
+    });
+    await commandChannel.send(message);
+}
+async function sendItemExecutionUpdate(commandChannel, threadId, sdkTurnId, sdkItemId, status, item, requestId) {
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        requestId,
+        payload: {
+            case: "itemUpdate",
+            value: {
+                sdkItemId,
+                status,
+                itemType: mapThreadItemType(item),
+                text: summarizeThreadItemText(item),
+                commandExecutionItem: buildCommandExecutionItem(item),
+                threadId,
+                sdkTurnId,
+            },
+        },
+    });
+    await commandChannel.send(message);
+}
+async function buildRegisterRunnerRequest(cfg) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        const configuredSdks = await db.select().from(schema_js_1.agentSdks).orderBy(schema_js_1.agentSdks.name).all();
+        if (configuredSdks.length === 0) {
+            throw new Error("No SDKs configured. Run startup before connecting to CompanyHelm API.");
+        }
+        const models = await db.select().from(schema_js_1.llmModels).orderBy(schema_js_1.llmModels.sdkName, schema_js_1.llmModels.name).all();
+        const modelsBySdk = new Map();
+        for (const model of models) {
+            const sdkModels = modelsBySdk.get(model.sdkName) ?? [];
+            sdkModels.push({
+                name: model.name,
+                reasoning: normalizeReasoningLevels(model.reasoningLevels),
+            });
+            modelsBySdk.set(model.sdkName, sdkModels);
+        }
+        return (0, protobuf_1.create)(protos_1.RegisterRunnerRequestSchema, {
+            agentSdks: configuredSdks.map((sdk) => ({
+                name: sdk.name,
+                models: modelsBySdk.get(sdk.name) ?? [],
+            })),
+        });
+    }
+    finally {
+        client.close();
+    }
+}
+async function hasConfiguredSdks(cfg) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        const configuredSdks = await db.select().from(schema_js_1.agentSdks).all();
+        return configuredSdks.length > 0;
+    }
+    finally {
+        client.close();
+    }
+}
+async function countSdkModels(cfg, sdkName) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        const models = await db.select({ name: schema_js_1.llmModels.name }).from(schema_js_1.llmModels).where((0, drizzle_orm_1.eq)(schema_js_1.llmModels.sdkName, sdkName)).all();
+        return models.length;
+    }
+    finally {
+        client.close();
+    }
+}
+async function refreshCodexModelsForRegistration(cfg, logger) {
+    try {
+        const results = await (0, refresh_models_js_1.refreshSdkModels)({ sdk: "codex", logger });
+        const modelCount = results[0]?.modelCount ?? 0;
+        logger.info(`Refreshed Codex models from container app-server (${modelCount} models).`);
+    }
+    catch (error) {
+        const cachedModelCount = await countSdkModels(cfg, "codex");
+        const failureMessage = (0, refresh_models_js_1.formatSdkModelRefreshFailure)("codex", error);
+        if (cachedModelCount === 0) {
+            throw new Error(`${failureMessage} Runner startup aborted because no cached Codex models are available; refusing to register zero models.`);
+        }
+        logger.warn(`${failureMessage} Using ${cachedModelCount} cached Codex model(s) from local state instead of registering zero models.`);
+    }
+}
+async function resolveThreadAuthMode(cfg) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        const codexSdk = await db.select().from(schema_js_1.agentSdks).where((0, drizzle_orm_1.eq)(schema_js_1.agentSdks.name, "codex")).get();
+        if (!codexSdk) {
+            throw new Error("Codex SDK is not configured.");
+        }
+        if (codexSdk.authentication !== "host" && codexSdk.authentication !== "dedicated") {
+            throw new Error(`Unsupported Codex authentication mode '${codexSdk.authentication}' for thread creation.`);
+        }
+        return codexSdk.authentication;
+    }
+    finally {
+        client.close();
+    }
+}
+async function handleCreateThreadRequest(cfg, commandChannel, request, requestId, apiClient, apiCallOptions, logger) {
+    const threadId = (request.threadId ?? "").trim();
+    const modelName = (request.model ?? "").trim();
+    const requestedReasoningLevel = (request.reasoningLevel ?? "").trim();
+    if (!threadId) {
+        logger.warn("Rejecting createThreadRequest: threadId is required.");
+        await sendRequestError(commandChannel, "Thread id is required.", requestId);
+        return;
+    }
+    if (!modelName) {
+        logger.warn("Rejecting createThreadRequest: model is required.");
+        await sendRequestError(commandChannel, "Model is required.", requestId);
+        return;
+    }
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    const threadDirectory = (0, thread_lifecycle_js_1.resolveThreadDirectory)(cfg.config_directory, cfg.workspaces_directory, threadId);
+    const containerNames = (0, thread_lifecycle_js_1.buildThreadContainerNames)(threadId);
+    const hostInfo = (0, host_js_1.getHostInfo)(cfg.codex.codex_auth_path);
+    const normalizedAdditionalModelInstructions = normalizeAdditionalModelInstructions(request.additionalModelInstructions);
+    const threadGitSkillPackages = normalizeThreadGitSkillPackagesForThreadConfig(request.gitSkillPackages, logger);
+    const threadMcpServers = normalizeThreadMcpServersForThreadConfig(request.mcpServers, logger);
+    const cliSecret = String(request.cliSecret ?? "").trim();
+    logger.debug(`Received createThreadRequest for thread '${threadId}' (model '${modelName}', reasoning '${requestedReasoningLevel}', additional instructions length '${normalizedAdditionalModelInstructions?.length ?? 0}', git skill packages '${threadGitSkillPackages.length}', MCP servers '${threadMcpServers.length}').`);
+    let authMode;
+    try {
+        authMode = await resolveThreadAuthMode(cfg);
+        const modelConfig = await db
+            .select({
+            name: schema_js_1.llmModels.name,
+            reasoningLevels: schema_js_1.llmModels.reasoningLevels,
+        })
+            .from(schema_js_1.llmModels)
+            .where((0, drizzle_orm_1.eq)(schema_js_1.llmModels.name, modelName))
+            .get();
+        const configuredModelSample = await db
+            .select({ name: schema_js_1.llmModels.name })
+            .from(schema_js_1.llmModels)
+            .limit(1)
+            .all();
+        if (configuredModelSample.length > 0) {
+            if (!modelConfig) {
+                throw new Error(`Model '${modelName}' is not configured.`);
+            }
+            if (requestedReasoningLevel.length > 0) {
+                const supportedReasoningLevels = normalizeReasoningLevels(modelConfig.reasoningLevels);
+                if (supportedReasoningLevels.length > 0 && !supportedReasoningLevels.includes(requestedReasoningLevel)) {
+                    throw new Error(`Reasoning level '${requestedReasoningLevel}' is not configured for model '${modelName}'.`);
+                }
+            }
+        }
+        await db.insert(schema_js_1.threads).values({
+            id: threadId,
+            sdkThreadId: null,
+            cliSecret: cliSecret.length > 0 ? cliSecret : null,
+            model: modelName,
+            reasoningLevel: requestedReasoningLevel,
+            additionalModelInstructions: normalizedAdditionalModelInstructions,
+            status: "pending",
+            currentSdkTurnId: null,
+            isCurrentTurnRunning: false,
+            workspace: threadDirectory,
+            runtimeContainer: containerNames.runtime,
+            dindContainer: cfg.use_host_docker_runtime ? null : containerNames.dind,
+            homeDirectory: cfg.agent_home_directory,
+            uid: hostInfo.uid,
+            gid: hostInfo.gid,
+        });
+        logger.debug(`Thread '${threadId}' inserted with status 'pending'.`);
+    }
+    catch (error) {
+        logger.warn(`Failed to initialize thread '${threadId}': ${toErrorMessage(error)}`);
+        await sendRequestError(commandChannel, `Failed to initialize thread '${threadId}': ${toErrorMessage(error)}`, requestId);
+        return;
+    }
+    finally {
+        client.close();
+    }
+    (0, node_fs_1.mkdirSync)(threadDirectory, { recursive: true });
+    (0, workspace_agents_js_1.ensureWorkspaceAgentsMd)(threadDirectory, cfg.agent_home_directory);
+    writeWorkspaceThreadGitSkillsConfig(threadDirectory, threadGitSkillPackages, logger);
+    writeWorkspaceThreadMcpConfig(threadDirectory, threadMcpServers, logger);
+    writeWorkspaceThreadAgentCliConfig(threadDirectory, cliSecret, cfg.agent_api_url, logger);
+    await syncGithubInstallationsForWorkspaces(apiClient, apiCallOptions, [threadDirectory], logger);
+    logger.debug(`Thread '${threadId}' workspace initialized at '${threadDirectory}'.`);
+    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
+    const mounts = (0, thread_lifecycle_js_1.buildSharedThreadMounts)({
+        threadDirectory,
+        homeVolumeName: containerNames.home,
+        tmpVolumeName: containerNames.tmp,
+        codexAuthMode: authMode,
+        codexAuthPath: cfg.codex.codex_auth_path,
+        codexAuthFilePath: cfg.codex.codex_auth_file_path,
+        configDirectory: cfg.config_directory,
+        containerHomeDirectory: cfg.agent_home_directory,
+    });
+    try {
+        await containerService.createThreadContainers({
+            dindImage: cfg.dind_image,
+            runtimeImage: cfg.runtime_image,
+            names: containerNames,
+            user: {
+                uid: hostInfo.uid,
+                gid: hostInfo.gid,
+                agentUser: cfg.agent_user,
+                agentHomeDirectory: cfg.agent_home_directory,
+            },
+            mounts,
+            useHostDockerRuntime: cfg.use_host_docker_runtime,
+            hostDockerPath: cfg.host_docker_path,
+            imageStatusReporter: (message) => {
+                logger.info(`[thread ${threadId}] ${message}`);
+            },
+        });
+        if (cfg.use_host_docker_runtime) {
+            logger.debug(`Thread '${threadId}' runtime container created (${containerNames.runtime}) in host docker mode.`);
+        }
+        else {
+            logger.debug(`Thread '${threadId}' containers created (${containerNames.runtime}, ${containerNames.dind}).`);
+        }
+    }
+    catch (error) {
+        logger.warn(`Failed to create containers for thread '${threadId}': ${toErrorMessage(error)}`);
+        await sendRequestError(commandChannel, `Failed to create containers for thread '${threadId}': ${toErrorMessage(error)}`, requestId);
+        return;
+    }
+    let readyRequestId;
+    const { db: updateDb, client: updateClient } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        const threadState = await (0, thread_turn_state_js_1.loadThreadMessageExecutionState)(cfg.state_db_path, threadId);
+        if (!threadState) {
+            throw new Error(`Thread '${threadId}' disappeared before SDK bootstrap.`);
+        }
+        const threadMcpSetup = buildThreadCodexMcpSetup(readWorkspaceThreadMcpConfig(threadState.workspace, logger));
+        const threadAgentCliConfig = readWorkspaceThreadAgentCliConfig(threadState.workspace, logger);
+        const appServerSession = await getOrCreateThreadAppServerSession(threadId, threadState.runtimeContainer, threadMcpSetup.appServerEnv, cfg.codex.app_server_client_name, logger);
+        const runtimeUser = {
+            uid: threadState.uid,
+            gid: threadState.gid,
+            agentUser: cfg.agent_user,
+            agentHomeDirectory: threadState.homeDirectory,
+        };
+        await (0, thread_runtime_js_1.ensureThreadRuntimeReady)({
+            dindContainer: threadState.dindContainer,
+            runtimeContainer: threadState.runtimeContainer,
+            containerService,
+            gitUserName: cfg.git_user_name,
+            gitUserEmail: cfg.git_user_email,
+            user: runtimeUser,
+        });
+        await ensureThreadGitSkillsInRuntime(cfg, threadState, containerService, logger);
+        if (threadAgentCliConfig) {
+            await containerService.ensureRuntimeContainerAgentCliConfig(threadState.runtimeContainer, runtimeUser, threadAgentCliConfig);
+        }
+        if (!appServerSession.started) {
+            await containerService.ensureRuntimeContainerCodexConfig(threadState.runtimeContainer, runtimeUser, threadMcpSetup.configToml);
+        }
+        await ensureThreadAppServerSessionStarted(appServerSession);
+        const developerInstructions = buildThreadDeveloperInstructions(threadState.additionalModelInstructions);
+        logger.debug(`Starting app-server thread '${threadId}' with developer instructions: ${JSON.stringify(developerInstructions)}.`);
+        const threadStartResponse = await appServerSession.appServer.startThreadWithResponse({
+            model: threadState.model,
+            modelProvider: null,
+            cwd: "/workspace",
+            approvalPolicy: YOLO_APPROVAL_POLICY,
+            sandbox: YOLO_SANDBOX_MODE,
+            config: null,
+            baseInstructions: null,
+            developerInstructions,
+            personality: null,
+            ephemeral: null,
+            experimentalRawEvents: false,
+            persistExtendedHistory: true,
+        }, requestId);
+        if (requestId && threadStartResponse.id !== requestId) {
+            throw new Error(`App-server thread/start response id '${String(threadStartResponse.id)}' did not match runner request id '${requestId}'.`);
+        }
+        if (!threadStartResponse.result.thread?.id) {
+            throw new Error(`App-server thread/start did not return an SDK thread id for thread '${threadId}'.`);
+        }
+        readyRequestId = typeof threadStartResponse.id === "string" && threadStartResponse.id.length > 0
+            ? threadStartResponse.id
+            : undefined;
+        appServerSession.sdkThreadId = threadStartResponse.result.thread.id;
+        appServerSession.rolloutPath = threadStartResponse.result.thread.path;
+        rememberThreadRolloutPath(threadId, threadStartResponse.result.thread.path);
+        await updateDb
+            .update(schema_js_1.threads)
+            .set({
+            status: "ready",
+            sdkThreadId: threadStartResponse.result.thread.id,
+        })
+            .where((0, drizzle_orm_1.eq)(schema_js_1.threads.id, threadId));
+    }
+    catch (error) {
+        logger.warn(`Failed to mark thread '${threadId}' as ready: ${toErrorMessage(error)}`);
+        await containerService.forceRemoveContainer(containerNames.runtime);
+        if (!cfg.use_host_docker_runtime) {
+            await containerService.forceRemoveContainer(containerNames.dind);
+        }
+        await containerService.forceRemoveVolume(containerNames.home);
+        await containerService.forceRemoveVolume(containerNames.tmp);
+        await sendRequestError(commandChannel, `Failed to mark thread '${threadId}' as ready: ${toErrorMessage(error)}`, requestId);
+        return;
+    }
+    finally {
+        updateClient.close();
+    }
+    logger.info(`Thread '${threadId}' created and ready.`);
+    await sendThreadUpdate(commandChannel, threadId, protos_1.ThreadStatus.READY, readyRequestId);
+}
+async function deleteThreadWithCleanup(cfg, request) {
+    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    let existingThread;
+    try {
+        existingThread = await db
+            .select({
+            id: schema_js_1.threads.id,
+            runtimeContainer: schema_js_1.threads.runtimeContainer,
+            dindContainer: schema_js_1.threads.dindContainer,
+            workspace: schema_js_1.threads.workspace,
+        })
+            .from(schema_js_1.threads)
+            .where((0, drizzle_orm_1.eq)(schema_js_1.threads.id, request.threadId))
+            .get();
+    }
+    catch (error) {
+        return {
+            kind: "error",
+            message: `Failed to load thread '${request.threadId}': ${toErrorMessage(error)}`,
+        };
+    }
+    finally {
+        client.close();
+    }
+    if (!existingThread) {
+        return { kind: "not_found" };
+    }
+    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
+    try {
+        const containerNames = (0, thread_lifecycle_js_1.buildThreadContainerNames)(existingThread.id);
+        await stopThreadAppServerSession(request.threadId);
+        threadRolloutPaths.delete(request.threadId);
+        await containerService.forceRemoveContainer(existingThread.runtimeContainer);
+        if (existingThread.dindContainer && existingThread.dindContainer.trim().length > 0) {
+            await containerService.forceRemoveContainer(existingThread.dindContainer);
+        }
+        await containerService.forceRemoveVolume(containerNames.home);
+        await containerService.forceRemoveVolume(containerNames.tmp);
+        removeWorkspaceDirectory(existingThread.workspace);
+    }
+    catch (error) {
+        return {
+            kind: "error",
+            message: `Failed to delete resources for thread '${request.threadId}': ${toErrorMessage(error)}`,
+        };
+    }
+    const { db: deleteDb, client: deleteClient } = await (0, db_js_1.initDb)(cfg.state_db_path);
+    try {
+        await deleteDb
+            .delete(schema_js_1.threads)
+            .where((0, drizzle_orm_1.eq)(schema_js_1.threads.id, request.threadId));
+    }
+    catch (error) {
+        return {
+            kind: "error",
+            message: `Failed to delete thread '${request.threadId}': ${toErrorMessage(error)}`,
+        };
+    }
+    finally {
+        deleteClient.close();
+    }
+    return { kind: "deleted" };
+}
+async function handleDeleteThreadRequest(cfg, commandChannel, request, logger) {
+    const deleteResult = await deleteThreadWithCleanup(cfg, request);
+    if (deleteResult.kind === "not_found") {
+        logger.warn(`Delete requested for missing thread '${request.threadId}'. Treating as deleted.`);
+        await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.DELETED);
+        return;
+    }
+    if (deleteResult.kind === "error") {
+        await sendRequestError(commandChannel, deleteResult.message);
+        return;
+    }
+    await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.DELETED);
+}
+async function reportNoRunningInterruptAsReady(cfg, commandChannel, request, threadState, logger, logMessage) {
+    try {
+        await updateThreadTurnState(cfg, request.threadId, {
+            isCurrentTurnRunning: false,
+        });
+    }
+    catch (error) {
+        logger.warn(`Failed to persist non-running interrupt state for thread '${request.threadId}': ${toErrorMessage(error)}`);
+    }
+    if (threadState.currentSdkTurnId) {
+        await sendTurnExecutionUpdate(commandChannel, request.threadId, threadState.currentSdkTurnId, protos_1.TurnStatus.COMPLETED);
+    }
+    await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.READY);
+    logger.info(logMessage);
+}
+async function handleInterruptTurnRequest(cfg, commandChannel, request, logger) {
+    let threadState;
+    try {
+        threadState = await (0, thread_turn_state_js_1.loadThreadMessageExecutionState)(cfg.state_db_path, request.threadId);
+    }
+    catch (error) {
+        await sendRequestError(commandChannel, `Failed to load thread '${request.threadId}': ${toErrorMessage(error)}`);
+        return;
+    }
+    if (!threadState) {
+        await sendRequestError(commandChannel, `Thread '${request.threadId}' does not exist.`);
+        return;
+    }
+    if (!threadState.isCurrentTurnRunning) {
+        await reportNoRunningInterruptAsReady(cfg, commandChannel, request, threadState, logger, `Interrupt requested for thread '${request.threadId}' with no running turn; reported ready state.`);
+        return;
+    }
+    if (!threadState.currentSdkTurnId) {
+        await sendRequestError(commandChannel, `Thread '${request.threadId}' is running but current SDK turn id is missing.`);
+        return;
+    }
+    if (!threadState.sdkThreadId) {
+        await sendRequestError(commandChannel, `Thread '${request.threadId}' is running but SDK thread id is missing.`);
+        return;
+    }
+    const appServerSession = await getOrCreateThreadAppServerSession(request.threadId, threadState.runtimeContainer, {}, cfg.codex.app_server_client_name, logger);
+    try {
+        await ensureThreadAppServerSessionStarted(appServerSession);
+    }
+    catch (error) {
+        const message = toErrorMessage(error);
+        logger.warn(`Failed to start app-server session for interrupt: ${message}`);
+        await sendRequestError(commandChannel, `Failed to connect to app-server for thread '${request.threadId}': ${message}`);
+        return;
+    }
+    const interruptParams = {
+        threadId: threadState.sdkThreadId,
+        turnId: threadState.currentSdkTurnId,
+    };
+    try {
+        await appServerSession.appServer.interruptTurn(interruptParams);
+    }
+    catch (error) {
+        if (isNoRunningTurnInterruptError(error)) {
+            await reportNoRunningInterruptAsReady(cfg, commandChannel, request, threadState, logger, `Interrupt requested for thread '${request.threadId}' but turn '${threadState.currentSdkTurnId}' was already stopped; reported ready state.`);
+            return;
+        }
+        const message = toErrorMessage(error);
+        logger.warn(`Failed to interrupt turn '${threadState.currentSdkTurnId}': ${message}`);
+        await sendRequestError(commandChannel, `Failed to interrupt turn '${threadState.currentSdkTurnId}' for thread '${request.threadId}': ${message}`);
+        return;
+    }
+    logger.info(`Requested interrupt of turn '${threadState.currentSdkTurnId}' for thread '${request.threadId}'.`);
+}
+async function updateThreadTurnState(cfg, threadId, update) {
+    await (0, thread_turn_state_js_1.updateThreadTurnState)(cfg.state_db_path, threadId, update);
+}
+async function waitForThreadTurnCompletion(stateDbPath, appServer, commandChannel, threadId, sdkThreadId, sdkTurnId, logger, requestId) {
+    let receivedThreadNameUpdate = false;
+    try {
+        const terminalStatus = await appServer.waitForTurnCompletion(sdkThreadId, sdkTurnId, async (notification) => {
+            const threadNameUpdate = extractThreadNameUpdateFromNotification(notification);
+            if (threadNameUpdate && threadNameUpdate.sdkThreadId === sdkThreadId) {
+                receivedThreadNameUpdate = true;
+                await sendThreadNameUpdate(commandChannel, threadId, threadNameUpdate.threadName);
+            }
+            if (notification.method === "item/started" &&
+                notification.params.threadId === sdkThreadId &&
+                notification.params.turnId === sdkTurnId) {
+                const itemRequestId = notification.params.item.type === "userMessage"
+                    ? (await (0, thread_user_message_request_store_js_1.assignPendingUserMessageRequestIdForItem)(stateDbPath, threadId, sdkTurnId, notification.params.item.id) ?? requestId)
+                    : requestId;
+                await sendItemExecutionUpdate(commandChannel, threadId, sdkTurnId, notification.params.item.id, protos_1.ItemStatus.RUNNING, notification.params.item, itemRequestId);
+            }
+            if (notification.method === "item/completed" &&
+                notification.params.threadId === sdkThreadId &&
+                notification.params.turnId === sdkTurnId) {
+                const itemRequestId = notification.params.item.type === "userMessage"
+                    ? (await (0, thread_user_message_request_store_js_1.consumePendingUserMessageRequestIdForItem)(stateDbPath, threadId, sdkTurnId, notification.params.item.id) ?? requestId)
+                    : requestId;
+                await sendItemExecutionUpdate(commandChannel, threadId, sdkTurnId, notification.params.item.id, protos_1.ItemStatus.COMPLETED, notification.params.item, itemRequestId);
+            }
+        }, TURN_COMPLETION_TIMEOUT_MS);
+        if (!receivedThreadNameUpdate) {
+            try {
+                const threadReadResponse = await appServer.readThread({
+                    threadId: sdkThreadId,
+                    includeTurns: false,
+                });
+                const fallbackThreadName = normalizeNonEmptyString(threadReadResponse.thread.preview);
+                if (fallbackThreadName) {
+                    await sendThreadNameUpdate(commandChannel, threadId, fallbackThreadName);
+                }
+            }
+            catch (error) {
+                logger.debug(`Failed to read SDK thread '${sdkThreadId}' for fallback thread title inference: ${toErrorMessage(error)}`);
+            }
+        }
+        return terminalStatus;
+    }
+    finally {
+        await (0, thread_user_message_request_store_js_1.clearPendingUserMessageRequestIdsForTurn)(stateDbPath, threadId, sdkTurnId);
+    }
+}
+async function executeCreateUserMessageRequest(cfg, commandChannel, request, requestId, threadState, startedFromIdle, trackTurnCompletion, logger) {
+    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
+    const threadMcpSetup = buildThreadCodexMcpSetup(readWorkspaceThreadMcpConfig(threadState.workspace, logger));
+    const threadAgentCliConfig = readWorkspaceThreadAgentCliConfig(threadState.workspace, logger);
+    const appServerSession = await getOrCreateThreadAppServerSession(request.threadId, threadState.runtimeContainer, threadMcpSetup.appServerEnv, cfg.codex.app_server_client_name, logger);
+    const appServer = appServerSession.appServer;
+    const runtimeUser = buildThreadRuntimeUser(cfg, threadState);
+    let sdkThreadId = threadState.sdkThreadId;
+    let sdkTurnId = threadState.currentSdkTurnId;
+    let turnAccepted = false;
+    let keepRuntimeWarm = false;
+    let shouldTrackTurnCompletion = trackTurnCompletion;
+    let enqueuedRequestTurnId = null;
+    let turnCompletionWaitStarted = false;
+    try {
+        await (0, thread_runtime_js_1.ensureThreadRuntimeReady)({
+            dindContainer: threadState.dindContainer,
+            runtimeContainer: threadState.runtimeContainer,
+            containerService,
+            gitUserName: cfg.git_user_name,
+            gitUserEmail: cfg.git_user_email,
+            user: runtimeUser,
+        });
+        await ensureThreadGitSkillsInRuntime(cfg, threadState, containerService, logger);
+        if (threadAgentCliConfig) {
+            await containerService.ensureRuntimeContainerAgentCliConfig(threadState.runtimeContainer, runtimeUser, threadAgentCliConfig);
+        }
+        if (!appServerSession.started) {
+            await containerService.ensureRuntimeContainerCodexConfig(threadState.runtimeContainer, runtimeUser, threadMcpSetup.configToml);
+        }
+        await ensureThreadAppServerSessionStarted(appServerSession);
+        if (sdkThreadId) {
+            if (appServerSession.sdkThreadId !== sdkThreadId) {
+                const resumeParams = {
+                    threadId: sdkThreadId,
+                    approvalPolicy: YOLO_APPROVAL_POLICY,
+                    sandbox: YOLO_SANDBOX_MODE,
+                    persistExtendedHistory: true,
+                };
+                const resumeResult = await appServer.resumeThread(resumeParams);
+                appServerSession.sdkThreadId = resumeResult.thread.id;
+                appServerSession.rolloutPath = resumeResult.thread.path;
+                rememberThreadRolloutPath(request.threadId, resumeResult.thread.path);
+            }
+        }
+        else if (appServerSession.sdkThreadId) {
+            sdkThreadId = appServerSession.sdkThreadId;
+            await updateThreadTurnState(cfg, request.threadId, { sdkThreadId });
+        }
+        else {
+            const developerInstructions = buildThreadDeveloperInstructions(threadState.additionalModelInstructions);
+            const threadStartParams = {
+                model: request.model ?? threadState.model,
+                modelProvider: null,
+                cwd: "/workspace",
+                approvalPolicy: YOLO_APPROVAL_POLICY,
+                sandbox: YOLO_SANDBOX_MODE,
+                config: null,
+                baseInstructions: null,
+                developerInstructions,
+                personality: null,
+                ephemeral: null,
+                experimentalRawEvents: false,
+                persistExtendedHistory: true,
+            };
+            logger.debug(`Starting app-server thread '${request.threadId}' with developer instructions: ${JSON.stringify(developerInstructions)}.`);
+            const threadStartResult = await appServer.startThread(threadStartParams);
+            sdkThreadId = threadStartResult.thread.id;
+            appServerSession.sdkThreadId = sdkThreadId;
+            appServerSession.rolloutPath = threadStartResult.thread.path;
+            rememberThreadRolloutPath(request.threadId, threadStartResult.thread.path);
+            await updateThreadTurnState(cfg, request.threadId, { sdkThreadId });
+        }
+        if (!sdkThreadId) {
+            throw new Error(`Failed to resolve SDK thread id for thread '${request.threadId}'.`);
+        }
+        const resolvedSdkThreadId = sdkThreadId;
+        const input = buildUserTextInput(request.text);
+        const startNewTurn = async () => {
+            const turnStartParams = {
+                threadId: resolvedSdkThreadId,
+                input,
+                model: request.model ?? null,
+                effort: normalizeReasoningEffort(request.modelReasoningLevel ?? threadState.reasoningLevel),
+                summary: null,
+                personality: null,
+                cwd: null,
+                approvalPolicy: YOLO_APPROVAL_POLICY,
+                sandboxPolicy: YOLO_SANDBOX_POLICY,
+                outputSchema: null,
+                collaborationMode: null,
+            };
+            const turnStartResult = await appServer.startTurn(turnStartParams);
+            return turnStartResult.turn.id;
+        };
+        if (shouldUseTurnSteer(request.allowSteer, startedFromIdle)) {
+            if (!threadState.currentSdkTurnId) {
+                throw new Error(`Thread '${request.threadId}' is marked running but has no current SDK turn id.`);
+            }
+            const activeSdkTurnId = threadState.currentSdkTurnId;
+            const steerParams = {
+                threadId: resolvedSdkThreadId,
+                input,
+                expectedTurnId: activeSdkTurnId,
+            };
+            try {
+                const turnSteerResult = await appServer.steerTurn(steerParams);
+                if (turnSteerResult.turnId && turnSteerResult.turnId !== activeSdkTurnId) {
+                    logger.debug(`turn/steer returned turn '${turnSteerResult.turnId}' for thread '${request.threadId}', preserving active turn '${activeSdkTurnId}' as the canonical turn id.`);
+                }
+                sdkTurnId = activeSdkTurnId;
+            }
+            catch (error) {
+                if (!isNoActiveTurnSteerError(error)) {
+                    throw error;
+                }
+                logger.warn(`No active turn to steer for thread '${request.threadId}'. Starting a new turn for queued steer request.`);
+                shouldTrackTurnCompletion = true;
+                sdkTurnId = await startNewTurn();
+            }
+        }
+        else {
+            sdkTurnId = await startNewTurn();
+        }
+        if (!sdkTurnId) {
+            throw new Error(`Failed to create SDK turn for thread '${request.threadId}'.`);
+        }
+        turnAccepted = true;
+        await (0, thread_user_message_request_store_js_1.enqueuePendingUserMessageRequestIdForTurn)(cfg.state_db_path, request.threadId, sdkTurnId, requestId);
+        enqueuedRequestTurnId = requestId ? sdkTurnId : null;
+        await updateThreadTurnState(cfg, request.threadId, {
+            sdkThreadId,
+            currentSdkTurnId: sdkTurnId,
+            isCurrentTurnRunning: true,
+        });
+        await sendTurnExecutionUpdate(commandChannel, request.threadId, sdkTurnId, protos_1.TurnStatus.RUNNING, requestId);
+        if (!shouldTrackTurnCompletion) {
+            keepRuntimeWarm = true;
+            return;
+        }
+        turnCompletionWaitStarted = true;
+        const terminalStatus = await waitForThreadTurnCompletion(cfg.state_db_path, appServer, commandChannel, request.threadId, sdkThreadId, sdkTurnId, logger, requestId);
+        await updateThreadTurnState(cfg, request.threadId, {
+            currentSdkTurnId: sdkTurnId,
+            isCurrentTurnRunning: false,
+        });
+        await sendTurnExecutionUpdate(commandChannel, request.threadId, sdkTurnId, protos_1.TurnStatus.COMPLETED, requestId);
+        if (terminalStatus === "failed") {
+            await sendRequestError(commandChannel, `Turn '${sdkTurnId}' finished with status '${terminalStatus}' for thread '${request.threadId}'.`, requestId);
+        }
+        else if (terminalStatus === "interrupted") {
+            logger.info(`Turn '${sdkTurnId}' for thread '${request.threadId}' was interrupted.`);
+            keepRuntimeWarm = true;
+        }
+        else {
+            // Keep app-server + containers warm for fast follow-up user messages on the same thread.
+            keepRuntimeWarm = true;
+        }
+    }
+    catch (error) {
+        if (enqueuedRequestTurnId && requestId) {
+            await (0, thread_user_message_request_store_js_1.removePendingUserMessageRequestIdForTurn)(cfg.state_db_path, request.threadId, enqueuedRequestTurnId, requestId);
+        }
+        if (turnCompletionWaitStarted && !isTurnCompletionTimeoutError(error)) {
+            await updateThreadTurnState(cfg, request.threadId, {
+                isCurrentTurnRunning: false,
+            }).catch(() => undefined);
+        }
+        else if (startedFromIdle && !turnAccepted) {
+            await updateThreadTurnState(cfg, request.threadId, {
+                isCurrentTurnRunning: false,
+            }).catch(() => undefined);
+        }
+        logger.warn(`Failed to create user message turn for thread '${request.threadId}': ${toErrorMessage(error)}`);
+        await sendRequestError(commandChannel, toErrorMessage(error), requestId);
+    }
+    finally {
+        if (!keepRuntimeWarm) {
+            await stopThreadAppServerSession(request.threadId);
+            await containerService.stopContainer(threadState.runtimeContainer).catch((error) => {
+                logger.warn(`Failed to stop runtime container '${threadState.runtimeContainer}': ${toErrorMessage(error)}`);
+            });
+            if (threadState.dindContainer && threadState.dindContainer.trim().length > 0) {
+                await containerService.stopContainer(threadState.dindContainer).catch((error) => {
+                    logger.warn(`Failed to stop DinD container '${threadState.dindContainer}': ${toErrorMessage(error)}`);
+                });
+            }
+        }
+    }
+}
+async function handleCreateUserMessageRequest(cfg, commandChannel, request, requestId, logger) {
+    let threadState;
+    try {
+        threadState = await (0, thread_turn_state_js_1.loadThreadMessageExecutionState)(cfg.state_db_path, request.threadId);
+        if (!threadState) {
+            await sendRequestError(commandChannel, `Thread '${request.threadId}' does not exist.`, requestId);
+            return;
+        }
+        if (threadState.isCurrentTurnRunning && !request.allowSteer) {
+            threadState = await reconcileThreadRunningStateBeforeUserMessage(cfg, threadState, logger);
+        }
+        if (!request.allowSteer && threadState.isCurrentTurnRunning) {
+            await sendRequestError(commandChannel, `Thread '${request.threadId}' already has a running turn and allowSteer=false.`, requestId);
+            return;
+        }
+        if (threadState.isCurrentTurnRunning && request.allowSteer && !threadState.currentSdkTurnId) {
+            await sendRequestError(commandChannel, `Thread '${request.threadId}' is in an inconsistent state: running turn id is missing.`, requestId);
+            return;
+        }
+    }
+    catch (error) {
+        await sendRequestError(commandChannel, `Failed to load thread '${request.threadId}': ${toErrorMessage(error)}`, requestId);
+        return;
+    }
+    if (!threadState) {
+        return;
+    }
+    const startedFromIdle = !threadState.isCurrentTurnRunning;
+    if (startedFromIdle) {
+        try {
+            await updateThreadTurnState(cfg, request.threadId, {
+                isCurrentTurnRunning: true,
+            });
+            threadState.isCurrentTurnRunning = true;
+        }
+        catch (error) {
+            await sendRequestError(commandChannel, `Failed to reserve thread '${request.threadId}' for execution: ${toErrorMessage(error)}`, requestId);
+            return;
+        }
+    }
+    const trackTurnCompletion = startedFromIdle;
+    void executeCreateUserMessageRequest(cfg, commandChannel, request, requestId, threadState, startedFromIdle, trackTurnCompletion, logger);
+}
+async function runCommandLoop(cfg, commandChannel, commandMessageSink, apiClient, apiCallOptions, logger) {
+    for await (const serverMessage of commandChannel) {
+        const requestId = extractServerMessageRequestId(serverMessage);
+        switch (serverMessage.request.case) {
+            case "createThreadRequest":
+                await handleCreateThreadRequest(cfg, commandMessageSink, serverMessage.request.value, requestId, apiClient, apiCallOptions, logger);
+                break;
+            case "deleteThreadRequest":
+                await handleDeleteThreadRequest(cfg, commandMessageSink, serverMessage.request.value, logger);
+                break;
+            case "createUserMessageRequest":
+                void handleCreateUserMessageRequest(cfg, commandMessageSink, serverMessage.request.value, requestId, logger).catch((error) => {
+                    logger.warn(`Unhandled createUserMessageRequest error: ${toErrorMessage(error)}`);
+                });
+                break;
+            case "interruptTurnRequest":
+                await handleInterruptTurnRequest(cfg, commandMessageSink, serverMessage.request.value, logger);
+                break;
+            case "heartbeatRequest":
+                await sendHeartbeatResponse(commandMessageSink, requestId);
+                break;
+            default:
+                break;
+        }
+    }
+}
+function buildGrpcAuthCallOptions(secret) {
+    if (!secret || secret.trim().length === 0) {
+        return undefined;
+    }
+    const metadata = new grpc.Metadata();
+    metadata.set("authorization", `Bearer ${secret}`);
+    return { metadata };
+}
+function isInternalDaemonChildProcess() {
+    return process.env[daemon_js_1.DAEMON_CHILD_ENV] === "1";
+}
+function abortErrorFromSignal(signal) {
+    return signal.reason instanceof Error ? signal.reason : new RootCommandInterruptedError();
+}
+function throwIfAborted(signal) {
+    if (signal.aborted) {
+        throw abortErrorFromSignal(signal);
+    }
+}
+function raceWithAbort(promise, signal) {
+    if (signal.aborted) {
+        return Promise.reject(abortErrorFromSignal(signal));
+    }
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => {
+            const onAbort = () => {
+                signal.removeEventListener("abort", onAbort);
+                reject(abortErrorFromSignal(signal));
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+        }),
+    ]);
+}
+function delayWithAbort(delayMs, signal) {
+    if (signal.aborted) {
+        return Promise.reject(abortErrorFromSignal(signal));
+    }
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, delayMs);
+        const onAbort = () => {
+            clearTimeout(timeout);
+            signal.removeEventListener("abort", onAbort);
+            reject(abortErrorFromSignal(signal));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function installRootInterruptHandlers(logger, onInterrupt) {
+    const controller = new AbortController();
+    const requestInterrupt = (reason) => {
+        if (controller.signal.aborted) {
+            return;
+        }
+        (0, terminal_js_1.restoreInteractiveTerminalState)();
+        process.exitCode = 130;
+        logger.info(`${reason} received. Shutting down root command.`);
+        try {
+            onInterrupt();
+        }
+        catch {
+            // Best-effort shutdown hook.
+        }
+        controller.abort(new RootCommandInterruptedError(reason));
+    };
+    const handleSigint = () => {
+        requestInterrupt("SIGINT");
+    };
+    const handleSigterm = () => {
+        requestInterrupt("SIGTERM");
+    };
+    const handleStdinData = (chunk) => {
+        const input = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        if ((0, terminal_js_1.containsCtrlCInterruptInput)(input)) {
+            requestInterrupt("Ctrl-C");
+        }
+    };
+    process.on("SIGINT", handleSigint);
+    process.on("SIGTERM", handleSigterm);
+    if (process.stdin.isTTY) {
+        process.stdin.on("data", handleStdinData);
+        process.stdin.resume();
+    }
+    return {
+        signal: controller.signal,
+        dispose: () => {
+            process.off("SIGINT", handleSigint);
+            process.off("SIGTERM", handleSigterm);
+            if (process.stdin.isTTY) {
+                process.stdin.off("data", handleStdinData);
+            }
+        },
+    };
+}
+function resolveEffectiveDaemonLogPath(cfg) {
+    const envPath = process.env[daemon_js_1.DAEMON_LOG_PATH_ENV];
+    if (envPath && envPath.trim().length > 0) {
+        return (0, path_js_1.expandHome)(envPath);
+    }
+    return (0, daemon_js_1.resolveDaemonLogPath)(cfg.state_db_path);
+}
+async function runDetachedDaemonProcess(options) {
+    const cfg = buildRootConfig(options);
+    const logPath = options.logPath && options.logPath.trim().length > 0
+        ? (0, path_js_1.expandHome)(options.logPath)
+        : (0, daemon_js_1.resolveDaemonLogPath)(cfg.state_db_path);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(logPath), { recursive: true });
+    const logFd = (0, node_fs_1.openSync)(logPath, "a");
+    try {
+        await new Promise((resolve, reject) => {
+            const child = (0, node_child_process_1.spawn)(process.execPath, process.argv.slice(1), {
+                cwd: process.cwd(),
+                detached: true,
+                env: {
+                    ...process.env,
+                    [daemon_js_1.DAEMON_CHILD_ENV]: "1",
+                    [daemon_js_1.DAEMON_LOG_PATH_ENV]: logPath,
+                },
+                stdio: ["ignore", logFd, logFd, "ipc"],
+                windowsHide: true,
+            });
+            let settled = false;
+            const timeout = setTimeout(() => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                child.kill();
+                reject(new Error(`Timed out waiting for daemon startup confirmation. See ${logPath}.`));
+            }, DAEMON_STARTUP_TIMEOUT_MS);
+            const finish = (callback) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                clearTimeout(timeout);
+                callback();
+            };
+            child.once("error", (error) => {
+                finish(() => reject(error));
+            });
+            child.once("exit", (code, signal) => {
+                finish(() => {
+                    reject(new Error(`Daemon exited before startup completed (code=${code ?? "null"}, signal=${signal ?? "null"}). See ${logPath}.`));
+                });
+            });
+            child.on("message", (message) => {
+                if (!message || typeof message !== "object" || !("type" in message)) {
+                    return;
+                }
+                const type = message.type;
+                if (type === "daemon-ready") {
+                    finish(() => {
+                        if (child.connected) {
+                            child.disconnect();
+                        }
+                        child.unref();
+                        console.log(`CompanyHelm daemon started (pid ${child.pid}). Logs: ${logPath}`);
+                        resolve();
+                    });
+                    return;
+                }
+                if (type === "daemon-error") {
+                    const messageValue = message.message;
+                    const daemonErrorMessage = typeof messageValue === "string" ? messageValue : `Daemon startup failed. See ${logPath}.`;
+                    finish(() => reject(new Error(daemonErrorMessage)));
+                }
+            });
+        });
+    }
+    finally {
+        (0, node_fs_1.closeSync)(logFd);
+    }
+}
+function sendDaemonParentMessage(message) {
+    if (typeof process.send === "function") {
+        process.send(message);
+    }
+}
+async function runRootCommand(options, runtimeOptions) {
+    const logger = (0, logger_js_1.createLogger)(options.logLevel ?? "INFO", { daemonMode: options.daemon ?? false });
+    const cfg = buildRootConfig(options);
+    const configuredSdks = await hasConfiguredSdks(cfg);
+    if (!configuredSdks && options.daemon) {
+        throw new Error("No SDKs configured. Daemon mode requires at least one configured SDK.");
+    }
+    if (!configuredSdks) {
+        await (0, startup_js_1.startup)(cfg);
+        (0, terminal_js_1.restoreInteractiveTerminalState)();
+    }
+    await refreshCodexModelsForRegistration(cfg, logger);
+    const registerRequest = await buildRegisterRunnerRequest(cfg);
+    const apiCallOptions = buildGrpcAuthCallOptions(options.secret);
+    if (options.daemon) {
+        await (0, daemon_state_js_1.claimCurrentDaemonState)(cfg.state_db_path, process.pid, resolveEffectiveDaemonLogPath(cfg));
+        runtimeOptions?.onDaemonReady?.();
+    }
+    const commandMessageSink = new buffered_client_message_sender_js_1.BufferedClientMessageSender({
+        maxBufferedEvents: cfg.client_message_buffer_limit,
+        logger,
+    });
+    await reconcileTrackedRunningThreadsOnStartup(cfg, logger);
+    let reconnectAttempt = 0;
+    let activeApiClient = null;
+    let activeCommandChannel = null;
+    const interruptState = installRootInterruptHandlers(logger, () => {
+        activeCommandChannel?.cancel();
+        activeApiClient?.close();
+    });
+    try {
+        while (true) {
+            throwIfAborted(interruptState.signal);
+            const apiClient = new companyhelm_api_client_js_1.CompanyhelmApiClient({ apiUrl: cfg.companyhelm_api_url, logger });
+            activeApiClient = apiClient;
+            let commandChannel = null;
+            let githubInstallationsSyncAbortController = null;
+            let githubInstallationsSyncTask = null;
+            try {
+                reconnectAttempt += 1;
+                commandChannel = await apiClient.connect(registerRequest, apiCallOptions);
+                activeCommandChannel = commandChannel;
+                await raceWithAbort(commandChannel.waitForOpen(COMMAND_CHANNEL_OPEN_TIMEOUT_MS), interruptState.signal);
+                commandMessageSink.bind(commandChannel);
+                const bufferedMessages = commandMessageSink.getBufferedMessageCount();
+                if (bufferedMessages > 0) {
+                    logger.info(`Connected to CompanyHelm API at ${cfg.companyhelm_api_url}; flushing ${bufferedMessages} buffered message(s).`);
+                }
+                else {
+                    logger.info(`Connected to CompanyHelm API at ${cfg.companyhelm_api_url}`);
+                }
+                reconnectAttempt = 0;
+                githubInstallationsSyncAbortController = new AbortController();
+                githubInstallationsSyncTask = runGithubInstallationsSyncLoop(cfg, apiClient, apiCallOptions, logger, githubInstallationsSyncAbortController.signal).catch((error) => {
+                    if (!githubInstallationsSyncAbortController?.signal.aborted) {
+                        logger.warn(`GitHub installation sync loop exited unexpectedly: ${toErrorMessage(error)}`);
+                    }
+                });
+                await raceWithAbort(runCommandLoop(cfg, commandChannel, commandMessageSink, apiClient, apiCallOptions, logger), interruptState.signal);
+                logger.warn("CompanyHelm API command channel closed. Reconnecting...");
+            }
+            catch (error) {
+                if (error instanceof RootCommandInterruptedError) {
+                    return;
+                }
+                const failureMessage = formatApiConnectionFailureMessage(error, cfg.companyhelm_api_url, options.secret);
+                const diagnostics = formatApiConnectionFailureDiagnostics(error);
+                if (diagnostics) {
+                    logger.debug(`CompanyHelm API failure diagnostics: ${diagnostics}`);
+                }
+                if (!isRetryableApiConnectionError(error)) {
+                    throw new Error(failureMessage);
+                }
+                logger.warn(`CompanyHelm API connection attempt ${reconnectAttempt} failed: ${failureMessage}. ` +
+                    "Retrying...");
+            }
+            finally {
+                if (githubInstallationsSyncAbortController) {
+                    githubInstallationsSyncAbortController.abort();
+                }
+                void githubInstallationsSyncTask;
+                if (commandChannel) {
+                    commandChannel.cancel();
+                    commandMessageSink.unbind(commandChannel);
+                }
+                else {
+                    commandMessageSink.unbind();
+                }
+                if (activeCommandChannel === commandChannel) {
+                    activeCommandChannel = null;
+                }
+                if (activeApiClient === apiClient) {
+                    activeApiClient = null;
+                }
+                apiClient.close();
+            }
+            await delayWithAbort(COMMAND_CHANNEL_CONNECT_RETRY_DELAY_MS, interruptState.signal);
+        }
+    }
+    finally {
+        interruptState.dispose();
+        const droppedMessages = commandMessageSink.getDroppedMessageCount();
+        if (droppedMessages > 0) {
+            logger.warn(`Dropped ${droppedMessages} outbound client message(s) while command channel was disconnected.`);
+        }
+        if (options.daemon) {
+            await (0, daemon_state_js_1.clearCurrentDaemonState)(cfg.state_db_path, process.pid).catch((error) => {
+                logger.warn(`Failed to clear daemon state: ${toErrorMessage(error)}`);
+            });
+        }
+        await stopAllThreadAppServerSessions();
+        await stopAllThreadContainers(cfg, logger);
+    }
+}
+function buildRootConfig(options) {
+    return config_js_1.config.parse({
+        config_directory: options.configPath,
+        state_db_path: options.stateDbPath,
+        companyhelm_api_url: options.serverUrl,
+        agent_api_url: options.agentApiUrl,
+        use_host_docker_runtime: options.useHostDockerRuntime,
+        host_docker_path: options.hostDockerPath,
+        thread_git_skills_directory: options.threadGitSkillsDirectory,
+    });
+}