@corca-org/ceal-host-linux-arm64 1.0.19 → 1.0.20

package/libexec/ceal-host/codex-producer.mjs

@@ -1016,6 +1016,7 @@ var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_f
 var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
 
 // packages/ceal-client-protocol/src/resource-row.ts
+var CEAL_RESOURCE_ROW_TITLE_MATCH_DISPOSITIONS = vocabulary(["exact", "not_exact", "unknown"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
 var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "authored_by", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
@@ -1099,6 +1100,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   next: { required: true, timestamp: false },
   kind: { required: true, timestamp: false },
   matched_kinds: { required: false, timestamp: false },
+  title_match: { required: false, timestamp: false },
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
@@ -1584,7 +1586,7 @@ var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
   invalid_arguments: Object.freeze({ classification: "host_arguments_invalid", next_action: "answer_with_gap" }),
   options_invalid: Object.freeze({ classification: "host_configuration_invalid", next_action: "answer_with_gap" }),
   session_unavailable: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
-  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "refresh_host_invocation_context", remedy: "the Host has no invocation context from the current transcript turn; run `ceal-host install` to repair the Host hook registration, then retry this command on a fresh Host turn" }),
+  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "refresh_host_invocation_context", remedy: "the Host has no invocation context from the current transcript turn; send a new message to start a fresh Host turn, then retry this command on that turn (run `ceal-host install` only if the Host hook registration is missing or drifted)" }),
   context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
   no_binding: Object.freeze({ classification: "host_binding_unavailable", next_action: "refresh_host_invocation_context" }),
   context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
@@ -1605,6 +1607,7 @@ var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
 });
 
 // packages/ceal-client-protocol/src/host-service-diagnostic.ts
+var CEAL_HOST_SERVICE_DIAGNOSTIC_SCHEMA = "ceal.host_service_diagnostic.v1";
 var CEAL_HOST_SERVICE_DIAGNOSTIC_PRODUCERS = vocabulary(["claude", "codex"]);
 var CEAL_HOST_SERVICE_DIAGNOSTIC_EVENTS = vocabulary([
   "hook_invoked",
@@ -1613,6 +1616,7 @@ var CEAL_HOST_SERVICE_DIAGNOSTIC_EVENTS = vocabulary([
   "watcher_turn_observed",
   "current_prompt_registered",
   "current_prompt_registration_failed",
+  "current_prompt_capacity_exhausted",
   "activation_recorded",
   "activation_failed",
   "watcher_scan_failed",
@@ -2085,7 +2089,7 @@ function exactOptional(value, required, optional) {
 // host/relay/src/host-producer-core.ts
 import { createHash as createHash3 } from "node:crypto";
 import { O_NOFOLLOW, O_RDONLY as O_RDONLY2 } from "node:constants";
-import { mkdir as mkdir2, open as open3, readFile, rename as rename2, writeFile } from "node:fs/promises";
+import { mkdir as mkdir2, open as open4, readFile, rename as rename2, writeFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
 
 // host/relay/src/relay-ipc.ts
@@ -2111,6 +2115,64 @@ var MAX_STATE_BYTES = 8 * 1024 * 1024;
 // host/relay/src/current-prompt-custody.ts
 var HOST_CURRENT_PROMPT_MAX_BYTES = 256 * 1024;
 
+// host/service-log.ts
+import { copyFile, open as open3, stat, truncate } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
+function writeHostServiceDiagnostic(producer_id, event, failure_kind, cause, sink) {
+  const line = `${JSON.stringify({ schema_version: CEAL_HOST_SERVICE_DIAGNOSTIC_SCHEMA, producer_id, event, ...event === "watcher_scan_failed" && failure_kind !== void 0 ? { failure_kind } : {}, ...event === "watcher_scan_failed" && cause !== void 0 ? { cause } : {} })}
+`;
+  try {
+    (sink ?? defaultHostServiceDiagnosticSink)(line);
+  } catch {
+  }
+}
+function defaultHostServiceDiagnosticSink(line) {
+  process.stderr.write(line);
+}
+var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
+var HOST_SERVICE_LOG_CHECK_INTERVAL_MS = 6e4;
+function hostServiceLogPreviousPath(path) {
+  return `${path}.1`;
+}
+async function rotateHostServiceLog(path, maxBytes = HOST_SERVICE_LOG_MAX_BYTES) {
+  let size;
+  try {
+    size = (await stat(path)).size;
+  } catch (error) {
+    if (isNotFound(error)) return false;
+    throw error;
+  }
+  if (size <= maxBytes) return false;
+  await copyFile(path, hostServiceLogPreviousPath(path));
+  await truncate(path, 0);
+  return true;
+}
+function boundHostServiceLog(environment = process.env) {
+  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
+  if (path === void 0 || !isAbsolute(path)) return () => void 0;
+  let reported = false;
+  const check = () => {
+    rotateHostServiceLog(path).catch((error) => {
+      if (reported) return;
+      reported = true;
+      process.stderr.write(`[host-service-log] rotation_failed code=${errorCode(error)}
+`);
+    });
+  };
+  check();
+  const timer = setInterval(check, HOST_SERVICE_LOG_CHECK_INTERVAL_MS);
+  timer.unref();
+  return () => clearInterval(timer);
+}
+var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
+function isNotFound(error) {
+  return errorCode(error) === "ENOENT";
+}
+function errorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : "unknown";
+}
+
 // host/relay/src/relay-ipc.ts
 var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
   "schema_version",
@@ -2129,6 +2191,7 @@ var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
 ]);
 var HOST_RELAY_IPC_RESPONSE_SCHEMA = "ceal.host_relay_admission.v1";
 var HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA = "ceal.host_relay_current_prompt_register.v1";
+var HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA = "ceal.host_relay_current_prompt_release.v1";
 var HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA = "ceal.host_relay_current_prompt_result.v1";
 var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
 var HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES = 4096;
@@ -2187,11 +2250,17 @@ var HostRelayIpcError = class extends Error {
     this.failure = failure;
   }
 };
+var HostRelayCurrentPromptCapacityRefusal = class extends Error {
+  constructor() {
+    super("current_prompt_capacity_exhausted");
+    this.name = "HostRelayCurrentPromptCapacityRefusal";
+  }
+};
 function hostRelayExchangeFailure(error) {
   return error instanceof HostRelayIpcError ? error.failure : void 0;
 }
 function socketErrorFailure(error) {
-  switch (errorCode(error)) {
+  switch (errorCode2(error)) {
     case "EACCES":
     case "EPERM":
       return "permission_denied";
@@ -2226,8 +2295,14 @@ var HostRelayCurrentPromptPort = class {
   async register(input) {
     const request2 = { schema_version: HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA, ...input };
     const response2 = await exchange(this.endpoint, encodeLengthPrefixed(request2), this.timeout_ms, decodeCurrentPromptResponseBuffer);
+    if (response2.status === "capacity_exhausted") throw new HostRelayCurrentPromptCapacityRefusal();
     if (response2.status !== "registered") throw new HostRelayIpcError("relay_unavailable", response2.status);
   }
+  async release(identity) {
+    const request2 = { schema_version: HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA, ...identity };
+    const response2 = await exchange(this.endpoint, encodeLengthPrefixed(request2), this.timeout_ms, decodeCurrentPromptResponseBuffer);
+    if (response2.status !== "released") throw new HostRelayIpcError("relay_unavailable", response2.status, "response_invalid");
+  }
 };
 function submitHostProducerFrame(endpoint, frame, timeoutMs = 5e3) {
   return exchange(endpoint, encodeHostProducerFrame(frame), timeoutMs, decodeResponseBuffer);
@@ -2310,7 +2385,7 @@ function decodeResponseBuffer(buffer) {
 function decodeCurrentPromptResponseBuffer(buffer) {
   const value = decodeLengthPrefixedJson(buffer, HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES);
   if (value === null) return null;
-  if (!record2(value) || !exactKeys2(value, ["schema_version", "status"]) || value.schema_version !== HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA || value.status !== "registered" && value.status !== "current_prompt_unavailable") throw new HostRelayIpcError("relay_unavailable");
+  if (!record2(value) || !exactKeys2(value, ["schema_version", "status"]) || value.schema_version !== HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA || value.status !== "registered" && value.status !== "capacity_exhausted" && value.status !== "current_prompt_unavailable" && value.status !== "released") throw new HostRelayIpcError("relay_unavailable", "Host Relay current-prompt response is invalid.", "response_invalid");
   return { schema_version: HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA, status: value.status };
 }
 function decodeLengthPrefixedJson(input, maximum) {
@@ -2336,7 +2411,7 @@ function exactKeys2(value, required, optional = []) {
   const keys = Object.keys(value);
   return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
 }
-function errorCode(error) {
+function errorCode2(error) {
   return record2(error) && typeof error.code === "string" ? error.code : null;
 }
 
@@ -2346,6 +2421,29 @@ function isHostTranscriptCursorReason(value) {
   return typeof value === "string" && HOST_TRANSCRIPT_CURSOR_REASONS.some((reason) => reason === value);
 }
 var TRANSCRIPT_MISSING_REASON = "transcript_missing";
+var TRANSCRIPT_SCAN_READ_ERROR_ERRNOS = ["EBADF", "EACCES", "EIO", "EMFILE", "ENFILE", "ENOENT", "ENOTDIR", "EPERM"];
+function transcriptScanFailureKind(error, adapterFailureKind) {
+  if (transcriptErrorCode(error) === "ELOOP") return "symlink";
+  const adapter = adapterFailureKind(error);
+  if (adapter !== void 0) return adapter;
+  const code = transcriptErrorCode(error);
+  if (code === "EFBIG") return "size_budget";
+  if (code !== null && TRANSCRIPT_SCAN_READ_ERROR_ERRNOS.includes(code)) return "read_error";
+  return "other";
+}
+async function registerHostCurrentPromptDiagnosed(register, diagnostic) {
+  try {
+    await register();
+    diagnostic("current_prompt_registered");
+    return true;
+  } catch (error) {
+    if (!(error instanceof HostRelayCurrentPromptCapacityRefusal)) diagnostic("current_prompt_registration_failed");
+    throw error;
+  }
+}
+function transcriptErrorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : null;
+}
 var HOST_TRANSCRIPT_READ_CHUNK_BYTES = 256 * 1024;
 async function readTranscriptCompleteChunk(handle, offset, size) {
   const available = Math.max(0, size - offset);
@@ -2454,19 +2552,24 @@ var HostTranscriptWatcher = class {
     return scanTranscriptRegistrations(await this.listRegistrations(), (registration) => this.scanRegistration(registration));
   }
   async scanRegistration(registration) {
-    return this.openTranscript(registration, (handle) => this.scanOpened(handle, registration), {
-      missing: () => this.retireMissing(registration),
-      failed: (handle, error) => this.scanFailed(handle, registration, error)
-    });
+    try {
+      return await this.openTranscript(registration, (handle) => this.scanOpened(handle, registration), {
+        missing: () => this.retireMissing(registration),
+        failed: (handle, error) => this.scanFailed(handle, registration, error)
+      });
+    } catch (error) {
+      if (error instanceof HostRelayCurrentPromptCapacityRefusal) return { records: 0, enqueued: 0, quarantined: false };
+      throw error;
+    }
   }
   async openTranscript(registration, scan, handlers) {
     let handle;
     try {
-      handle = await open3(this.transcriptPathOf(registration), O_RDONLY2 | O_NOFOLLOW);
+      handle = await open4(this.transcriptPathOf(registration), O_RDONLY2 | O_NOFOLLOW);
       return await scan(handle);
     } catch (error) {
       if (handle === void 0 && isMissingTranscriptError(error)) return handlers.missing();
-      if (hostRelayExchangeFailure(error) !== void 0) throw error;
+      if (hostRelayExchangeFailure(error) !== void 0 || error instanceof HostRelayCurrentPromptCapacityRefusal) throw error;
       return handlers.failed(handle, error);
     } finally {
       await handle?.close();
@@ -2607,7 +2710,7 @@ var HostProducerDrainCore = class {
       const value = JSON.parse(await readFile(this.statePath, "utf8"));
       return this.decodeState(value);
     } catch (error) {
-      if (errorCode2(error) !== "ENOENT") throw error;
+      if (errorCode3(error) !== "ENOENT") throw error;
       return { schema_version: this.stateSchema, producer_installation_ref: this.installationRef, producer_epoch: this.epoch, next_sequence: 1, pending: {} };
     }
   }
@@ -2653,7 +2756,7 @@ var HostProducerDrainCore = class {
 function isDrainStateHeader(value, schema, installationRef) {
   return isTranscriptRecord(value) && value.schema_version === schema && value.producer_installation_ref === installationRef && Number.isSafeInteger(value.producer_epoch) && Number(value.producer_epoch) > 0 && Number.isSafeInteger(value.next_sequence) && Number(value.next_sequence) > 0 && isTranscriptRecord(value.pending);
 }
-function errorCode2(error) {
+function errorCode3(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
 
@@ -2672,8 +2775,8 @@ import { createHash as createHash4 } from "node:crypto";
 
 // host/codex/src/codex-outbox.ts
 import { O_NOFOLLOW as O_NOFOLLOW2, O_RDONLY as O_RDONLY3 } from "node:constants";
-import { lstat as lstat3, mkdir as mkdir3, open as open4, readdir, rename as rename3, unlink as unlink2 } from "node:fs/promises";
-import { dirname, isAbsolute, join as join3 } from "node:path";
+import { lstat as lstat3, mkdir as mkdir3, open as open5, readdir, rename as rename3, unlink as unlink2 } from "node:fs/promises";
+import { dirname, isAbsolute as isAbsolute2, join as join3 } from "node:path";
 
 // host/invocation-context.ts
 var HOST_INVOCATION_IDENTITY_KEYS = ["host_session_ref", "host_turn_ref", "host_source_ref"];
@@ -2859,7 +2962,7 @@ var CodexOutboxStore = class {
     try {
       await unlink2(this.entryPath(entry.submission_ref));
     } catch (error) {
-      if (!isNotFound(error)) throw storageError("Unable to remove the Codex outbox entry.");
+      if (!isNotFound2(error)) throw storageError("Unable to remove the Codex outbox entry.");
     }
   }
   async writeBinding(binding) {
@@ -2882,7 +2985,7 @@ var CodexOutboxStore = class {
       try {
         await unlink2(path);
       } catch (unlinkError) {
-        if (!isNotFound(unlinkError)) throw storageError("Unable to clear a failed Codex Host context replacement.");
+        if (!isNotFound2(unlinkError)) throw storageError("Unable to clear a failed Codex Host context replacement.");
       }
       throw error;
     }
@@ -2943,7 +3046,7 @@ var CodexOutboxStore = class {
     try {
       await unlink2(this.activeContextPath(identity));
     } catch (error) {
-      if (!isNotFound(error)) throw storageError("Unable to clear the Codex Host invocation context.");
+      if (!isNotFound2(error)) throw storageError("Unable to clear the Codex Host invocation context.");
     }
     return true;
   }
@@ -3059,7 +3162,7 @@ async function removeOwnerState(path, what) {
   try {
     await unlink2(path);
   } catch (error) {
-    if (!isNotFound(error)) throw storageError(`Unable to retire the Codex transcript ${what}.`);
+    if (!isNotFound2(error)) throw storageError(`Unable to retire the Codex transcript ${what}.`);
   }
 }
 function sessionStateKey(sourceRef, sessionRef) {
@@ -3109,7 +3212,7 @@ async function writeAtomicJson(path, value) {
   if (text === void 0) throw storageError("Codex owner state cannot be serialized.");
   const temp = `${path}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
   try {
-    const handle = await open4(temp, "wx", 384);
+    const handle = await open5(temp, "wx", 384);
     try {
       await handle.writeFile(text, "utf8");
       await handle.sync();
@@ -3129,7 +3232,7 @@ async function writeAtomicJson(path, value) {
 }
 async function syncDirectory(path) {
   try {
-    const handle = await open4(path, "r");
+    const handle = await open5(path, "r");
     try {
       await handle.sync();
     } finally {
@@ -3144,7 +3247,7 @@ async function readOptionalJson(path, validate) {
     validate(value);
     return value;
   } catch (error) {
-    if (isNotFound(error)) return null;
+    if (isNotFound2(error)) return null;
     if (error instanceof CodexHostAdapterError) throw error;
     throw storageError("Codex owner state is malformed.");
   }
@@ -3153,7 +3256,7 @@ async function ensurePrivateOwnerDirectory(path) {
   try {
     await lstat3(path);
   } catch (error) {
-    if (!isNotFound(error)) throw storageError("Codex owner state directory is unavailable.");
+    if (!isNotFound2(error)) throw storageError("Codex owner state directory is unavailable.");
     await mkdir3(path, { recursive: true, mode: 448 });
   }
   const stats = await lstat3(path);
@@ -3165,7 +3268,7 @@ async function ensurePrivateOwnerDirectory(path) {
 async function readPrivateFile(path) {
   let handle;
   try {
-    handle = await open4(path, O_RDONLY3 | O_NOFOLLOW2);
+    handle = await open5(path, O_RDONLY3 | O_NOFOLLOW2);
     const stats = await handle.stat();
     const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
     if (!stats.isFile()) throw storageError(`Codex owner state path is not a regular file (${refusalFact("mode", `0o${stats.mode.toString(8)}`, "a regular-file mode (0o100xxx)")}).`);
@@ -3208,7 +3311,7 @@ function validateRegistrationFields(value) {
   if (!isTimestamp(value.registered_at) || !isTimestamp(value.expires_at)) throw storageError(`Codex transcript registration timestamps are malformed (${refusalFacts([{ name: "registered_at", value: value.registered_at }, { name: "expires_at", value: value.expires_at }])}).`);
 }
 function validRegistrationCwd(value) {
-  return value === void 0 || typeof value === "string" && isAbsolute(value) && value.length <= CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS && !value.includes("\0");
+  return value === void 0 || typeof value === "string" && isAbsolute2(value) && value.length <= CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS && !value.includes("\0");
 }
 function validateCursor(value) {
   if (!isRecord4(value)) throw storageError("Codex transcript cursor is malformed.");
@@ -3303,7 +3406,7 @@ function sameKeys(value, required, optional = []) {
 function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function isNotFound(error) {
+function isNotFound2(error) {
   return isRecord4(error) && error.code === "ENOENT";
 }
 function storageError(message) {
@@ -3693,6 +3796,8 @@ function codexSubmissionReference(hostInputRef, event, ordinal) {
 var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
   store;
   registerCurrentPrompt;
+  releaseCurrentPrompt;
+  diagnostic;
   constructor(options) {
     super(options, {
       default_retention_ms: CODEX_DEFAULT_RETENTION_MS,
@@ -3701,6 +3806,8 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
     });
     this.store = new CodexOutboxStore(options.outbox_dir);
     this.registerCurrentPrompt = options.register_current_prompt;
+    this.releaseCurrentPrompt = options.release_current_prompt;
+    this.diagnostic = options.diagnostic ?? (() => void 0);
   }
   transcriptPathOf(registration) {
     return registration.transcript_path;
@@ -3716,17 +3823,22 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
     if (complete === "empty" || complete === "partial") return { records: 0, enqueued: 0, quarantined: false };
     return await this.consumeCompleteChunk(registration, handle, preflight.cursor, complete, device, inode);
   }
-  async scanFailed(handle, registration, _error) {
+  async scanFailed(handle, registration, error) {
+    this.diagnostic("watcher_scan_failed", codexTranscriptScanFailureKind(error));
     await this.quarantineFailure(registration, handle);
     return { records: 0, enqueued: 0, quarantined: true };
   }
   async retireMissing(registration) {
+    await this.releaseStoredPromptBestEffort(registration.host_session_ref, await this.store.readTranscriptCursor(registration).catch(() => null));
     return this.retireMissingTranscript(registration.transcript_path, "Codex", () => this.store.retireTranscriptRegistration(registration));
   }
   async preflight(registration, handle, size, device, inode) {
     const existing = await this.store.readTranscriptCursor(registration);
     let cursor = existing ?? codexTranscriptInitialCursor(registration, device, inode, this.now);
-    if (cursor.status === "quarantined") return { cursor: null, result: { records: 0, enqueued: 0, quarantined: true } };
+    if (cursor.status === "quarantined") {
+      if (cursor.reason !== "transcript_malformed") await this.releaseStoredPromptBestEffort(registration.host_session_ref, cursor);
+      return { cursor: null, result: { records: 0, enqueued: 0, quarantined: true } };
+    }
     const reason = this.cursorIdentityReason(cursor, registration.transcript_path, device, inode) ?? await this.cursorBoundsReason(handle, cursor, size);
     if (reason === null) return { cursor, result: { records: 0, enqueued: 0, quarantined: false } };
     await this.quarantine(registration, cursor, device, inode, reason);
@@ -3765,25 +3877,41 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
     const stats = await handle.stat().catch(() => null);
     if (stats === null) return;
     const existing = await this.store.readTranscriptCursor(registration).catch(() => null);
-    await this.quarantine(registration, existing ?? codexTranscriptInitialCursor(registration, String(stats.dev), String(stats.ino), this.now), String(stats.dev), String(stats.ino), "transcript_malformed");
+    const quarantined = {
+      ...existing ?? codexTranscriptInitialCursor(registration, String(stats.dev), String(stats.ino), this.now),
+      transcript_path: registration.transcript_path,
+      device: String(stats.dev),
+      inode: String(stats.ino),
+      status: "quarantined",
+      reason: "transcript_malformed",
+      updated_at: this.stamp()
+    };
+    await this.store.writeTranscriptCursor(quarantined);
   }
   async processRecord(registration, activeTask, record3) {
-    if (record3.kind === "task_started") {
-      return { activeTask: { codex_turn_id: record3.turn_id, host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id), started_at: record3.timestamp }, enqueued: 0 };
-    }
+    if (record3.kind === "task_started") return this.processTaskStarted(registration, activeTask, record3);
     if (record3.kind === "turn_context") return { ...activeTask === void 0 ? {} : { activeTask: record3.turn_id === activeTask.codex_turn_id ? { ...activeTask, model: record3.model } : activeTask }, enqueued: 0 };
     if (record3.kind === "token_count") return { ...activeTask === void 0 ? {} : { activeTask: accumulateTokenCount(activeTask, record3) }, enqueued: 0 };
     if (record3.kind === "user_text") return this.processUserInput(registration, activeTask, record3);
     if (record3.kind === "task_complete" || record3.kind === "turn_aborted") return this.processTerminal(registration, activeTask, record3);
     return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
   }
+  async processTaskStarted(registration, activeTask, record3) {
+    if (activeTask !== void 0 && activeTask.codex_turn_id !== record3.turn_id && activeTask.prompt_ref !== void 0) await this.releasePrompt(registration.host_session_ref, activeTask, activeTask.prompt_ref);
+    return { activeTask: { codex_turn_id: record3.turn_id, host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id), started_at: record3.timestamp }, enqueued: 0 };
+  }
   async processUserInput(registration, activeTask, record3) {
-    if (activeTask === void 0 || activeTask.codex_turn_id !== record3.turn_id) return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
+    if (activeTask === void 0 || activeTask.codex_turn_id !== record3.turn_id) {
+      const adopted = await this.adoptHookCorrelatedTurn(registration, activeTask, record3);
+      if (adopted === void 0) return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
+      activeTask = adopted;
+    }
     const hostInputRef = hostInputReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id, record3.message_id, record3.ordinal, record3.prompt);
     const origin = activeTask.origin_host_input_ref === void 0;
     const promptValue = promptObservationValue(record3.prompt);
     const currentPromptRef = hostProducerPromptRef(promptValue.body_sha256);
     const promptRef = activeTask.prompt_ref ?? currentPromptRef;
+    const steeredPromptRef = await this.steeredPromptRef(registration, activeTask, origin, currentPromptRef);
     const identity = { host_source_ref: registration.host_source_ref, host_session_ref: registration.host_session_ref, host_turn_ref: activeTask.host_turn_ref };
     const observations = [{
       observation_ref: observationRef("transcript_user_text", hostInputRef, record3.prompt),
@@ -3809,14 +3937,88 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
       created_at: record3.timestamp,
       expires_at: this.expire(this.outboxRetentionMs)
     };
-    await this.registerPrompt(origin, registration, activeTask, currentPromptRef, record3.prompt, envelope.expires_at);
-    await this.store.put(envelope);
-    if (origin) await activateTranscriptTurnContext(this.store, identity, promptRef, envelope.expires_at);
+    const persisted = await this.persistUserInputTurn(registration, activeTask, record3, hostInputRef, origin, currentPromptRef, promptRef, identity, envelope);
+    if (steeredPromptRef !== null) await this.activateTranscriptTurnContext(identity, steeredPromptRef, envelope.expires_at);
+    return persisted;
+  }
+  /**
+   * The steered prompt to re-activate under the running task, or null when
+   * there is nothing to repair. A steered message joins the running turn
+   * with new prompt bytes but no task_started. When the steer hook already
+   * replaced the turn selection (a turn id the hook did not recognize as
+   * the running one, or a hook that ran before any context was live), the
+   * running task's context no longer matches and the next invocation would
+   * wait for a boundary that never comes. When the hook kept the live
+   * selection, the context still matches and this stays null.
+   */
+  async steeredPromptRef(registration, activeTask, origin, currentPromptRef) {
+    if (origin || activeTask.prompt_ref === void 0 || activeTask.prompt_ref === currentPromptRef) return null;
+    const selection = await this.store.readInvocationTurnSelection(registration.host_source_ref, registration.host_session_ref).catch(() => null);
+    return selection?.prompt_ref === currentPromptRef ? currentPromptRef : null;
+  }
+  /**
+   * Adopt the live hooked turn when its transcript message arrives before
+   * (or without) its task_started, as an interrupted turn's follow-up can.
+   * The UserPromptSubmit hook names the exact hooked prompt, so only a
+   * message carrying those bytes adopts; inherited history and other turns
+   * stay ignored. A stale active task for another turn releases first, the
+   * same as a task_started supersession.
+   */
+  async adoptHookCorrelatedTurn(registration, activeTask, record3) {
+    const currentPromptRef = hostProducerPromptRef(promptObservationValue(record3.prompt).body_sha256);
+    const selection = await this.store.readInvocationTurnSelection(registration.host_source_ref, registration.host_session_ref);
+    if (selection?.prompt_ref !== currentPromptRef) return void 0;
+    if (activeTask !== void 0 && activeTask.codex_turn_id !== record3.turn_id && activeTask.prompt_ref !== void 0) {
+      await this.releasePrompt(registration.host_session_ref, activeTask, activeTask.prompt_ref);
+    }
+    return {
+      codex_turn_id: record3.turn_id,
+      host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id),
+      started_at: record3.timestamp
+    };
+  }
+  async persistUserInputTurn(registration, activeTask, record3, hostInputRef, origin, currentPromptRef, promptRef, identity, envelope) {
+    const custodyRegistered = await this.registerPrompt(origin, registration, activeTask, currentPromptRef, record3.prompt, envelope.expires_at);
+    if (custodyRegistered) this.diagnostic("watcher_turn_observed");
+    try {
+      await this.store.put(envelope);
+      if (origin) await this.activateTranscriptTurnContext(identity, promptRef, envelope.expires_at);
+    } catch (error) {
+      if (custodyRegistered) await this.releasePrompt(registration.host_session_ref, activeTask, currentPromptRef).catch(() => void 0);
+      throw error;
+    }
     return { activeTask: { ...activeTask, origin_host_input_ref: activeTask.origin_host_input_ref ?? hostInputRef, prompt_ref: activeTask.prompt_ref ?? currentPromptRef }, enqueued: 1 };
   }
   async registerPrompt(origin, registration, activeTask, promptRef, prompt, expiresAt) {
-    if (!origin || this.producerInstallationRef === void 0 || this.registerCurrentPrompt === void 0) return;
-    await this.registerCurrentPrompt({ producer_id: "codex", producer_installation_ref: this.producerInstallationRef, local_session_ref: registration.host_session_ref, local_turn_ref: activeTask.host_turn_ref, prompt_ref: promptRef, current_prompt: prompt, context_expires_at: expiresAt });
+    if (!origin || this.producerInstallationRef === void 0 || this.registerCurrentPrompt === void 0) return false;
+    const register = this.registerCurrentPrompt;
+    const installationRef = this.producerInstallationRef;
+    return registerHostCurrentPromptDiagnosed(
+      () => register({ producer_id: "codex", producer_installation_ref: installationRef, local_session_ref: registration.host_session_ref, local_turn_ref: activeTask.host_turn_ref, prompt_ref: promptRef, current_prompt: prompt, context_expires_at: expiresAt }),
+      (event) => this.diagnostic(event)
+    );
+  }
+  async activateTranscriptTurnContext(identity, promptRef, expiresAt) {
+    try {
+      const selection = await this.store.readInvocationTurnSelection(identity.host_source_ref, identity.host_session_ref);
+      const turnGenerationRef = selection?.prompt_ref === promptRef ? selection.turn_generation_ref : void 0;
+      await this.store.activateInvocationContext(identity, promptRef, expiresAt, turnGenerationRef);
+      this.diagnostic("activation_recorded");
+    } catch (error) {
+      this.diagnostic("activation_failed");
+      throw error;
+    }
+  }
+  async releasePrompt(sessionRef, activeTask, promptRef) {
+    if (this.producerInstallationRef === void 0 || this.releaseCurrentPrompt === void 0) return;
+    await this.releaseCurrentPrompt({ producer_id: "codex", producer_installation_ref: this.producerInstallationRef, local_session_ref: sessionRef, local_turn_ref: activeTask.host_turn_ref, prompt_ref: promptRef });
+  }
+  async releaseStoredPromptBestEffort(sessionRef, cursor) {
+    await this.releaseActiveTaskBestEffort(sessionRef, cursor?.active_task);
+  }
+  async releaseActiveTaskBestEffort(sessionRef, activeTask) {
+    if (activeTask?.prompt_ref === void 0) return;
+    await this.releasePrompt(sessionRef, activeTask, activeTask.prompt_ref).catch(() => void 0);
   }
   async processTerminal(registration, activeTask, record3) {
     if (activeTask === void 0 || activeTask.codex_turn_id !== record3.turn_id || activeTask.origin_host_input_ref === void 0 || activeTask.prompt_ref === void 0) return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
@@ -3836,18 +4038,23 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
       created_at: record3.timestamp,
       expires_at: this.expire(this.outboxRetentionMs)
     });
+    await this.releasePrompt(registration.host_session_ref, activeTask, activeTask.prompt_ref);
     await this.store.clearInvocationContext(identity, this.now());
     return { enqueued: 1 };
   }
   async quarantine(registration, cursor, device, inode, reason) {
+    await this.releaseStoredPromptBestEffort(registration.host_session_ref, cursor);
     const quarantined = { ...cursor, transcript_path: registration.transcript_path, device, inode, status: "quarantined", reason, updated_at: this.stamp() };
     await this.store.writeTranscriptCursor(quarantined);
   }
 };
-async function activateTranscriptTurnContext(store, identity, promptRef, expiresAt) {
-  const selection = await store.readInvocationTurnSelection(identity.host_source_ref, identity.host_session_ref);
-  const turnGenerationRef = selection?.prompt_ref === promptRef ? selection.turn_generation_ref : void 0;
-  await store.activateInvocationContext(identity, promptRef, expiresAt, turnGenerationRef);
+function codexTranscriptScanFailureKind(error) {
+  return transcriptScanFailureKind(error, (candidate) => {
+    if (!(candidate instanceof CodexHostAdapterError)) return void 0;
+    if (candidate.code === "payload_rejected") return "payload_rejected";
+    if (candidate.code === "storage") return "read_error";
+    return void 0;
+  });
 }
 function accumulateTokenCount(activeTask, record3) {
   if (record3.usage_gap_reason !== void 0) return { ...activeTask, token_usage_gap_reason: record3.usage_gap_reason };
@@ -3935,7 +4142,16 @@ function assertRecordSequence(registration, cursor, records, lastOrdinal, record
 // host/codex/src/codex-producer-runtime.ts
 async function drainCodexProducerOnce(options) {
   const promptPort = new HostRelayCurrentPromptPort(options.relay_endpoint, options.timeout_ms);
-  const scan = await new CodexTranscriptWatcher({ outbox_dir: options.outbox_dir, producer_installation_ref: options.producer_installation_ref, register_current_prompt: (input) => promptPort.register(input) }).scanOnce();
+  const scan = await new CodexTranscriptWatcher({
+    outbox_dir: options.outbox_dir,
+    producer_installation_ref: options.producer_installation_ref,
+    register_current_prompt: (input) => promptPort.register(input),
+    release_current_prompt: (identity) => promptPort.release(identity),
+    diagnostic: (event, failure_kind) => writeHostServiceDiagnostic("codex", event, failure_kind)
+  }).scanOnce().catch((error) => {
+    writeHostServiceDiagnostic("codex", "watcher_scan_failed", codexTranscriptScanFailureKind(error));
+    throw error;
+  });
   const producer = new CodexProducer({ outbox_dir: options.outbox_dir, producer_installation_ref: options.producer_installation_ref, relay: new HostRelayIpcAdmissionPort(options.relay_endpoint, options.timeout_ms), ...options.producer_epoch === void 0 ? {} : { producer_epoch: options.producer_epoch }, ...options.now === void 0 ? {} : { now: options.now } });
   return { scanned: scan.enqueued, ...await producer.drainOutbox() };
 }
@@ -3961,53 +4177,6 @@ function runCodexProducerCli(args, signal, dependencies = {}) {
   return runHostProducerCli(CODEX_PRODUCER_DESCRIPTOR, args, signal, dependencies);
 }
 
-// host/service-log.ts
-import { copyFile, open as open5, stat, truncate } from "node:fs/promises";
-import { isAbsolute as isAbsolute2 } from "node:path";
-var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
-var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
-var HOST_SERVICE_LOG_CHECK_INTERVAL_MS = 6e4;
-function hostServiceLogPreviousPath(path) {
-  return `${path}.1`;
-}
-async function rotateHostServiceLog(path, maxBytes = HOST_SERVICE_LOG_MAX_BYTES) {
-  let size;
-  try {
-    size = (await stat(path)).size;
-  } catch (error) {
-    if (isNotFound2(error)) return false;
-    throw error;
-  }
-  if (size <= maxBytes) return false;
-  await copyFile(path, hostServiceLogPreviousPath(path));
-  await truncate(path, 0);
-  return true;
-}
-function boundHostServiceLog(environment = process.env) {
-  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
-  if (path === void 0 || !isAbsolute2(path)) return () => void 0;
-  let reported = false;
-  const check = () => {
-    rotateHostServiceLog(path).catch((error) => {
-      if (reported) return;
-      reported = true;
-      process.stderr.write(`[host-service-log] rotation_failed code=${errorCode3(error)}
-`);
-    });
-  };
-  check();
-  const timer = setInterval(check, HOST_SERVICE_LOG_CHECK_INTERVAL_MS);
-  timer.unref();
-  return () => clearInterval(timer);
-}
-var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
-function isNotFound2(error) {
-  return errorCode3(error) === "ENOENT";
-}
-function errorCode3(error) {
-  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : "unknown";
-}
-
 // host/producer-command.ts
 async function runProducerCommand(schemaVersion, run) {
   const controller = new AbortController();