@fitlab-ai/agent-infra 0.9.5 → 0.9.6

package/dist/bin/internal-cli.js

@@ -8,7 +8,7 @@ const command = process.argv[2] || '';
 if (process.env.AGENT_INFRA_CONTROL_TOKEN
     && (command === 'task-lifecycle' || command === 'task-orchestration')) {
     const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
-    sandboxControl(['client', command, ...process.argv.slice(3)]);
+    await sandboxControl(['client', command, ...process.argv.slice(3)]);
 }
 else
     switch (command) {
@@ -19,7 +19,7 @@ else
         }
         case 'sandbox-control': {
             const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
-            sandboxControl(process.argv.slice(3));
+            await sandboxControl(process.argv.slice(3));
             break;
         }
         case 'agent-client': {
@@ -109,7 +109,7 @@ else
         }
         case 'task-orchestration': {
             const { taskOrchestration } = await import('../lib/internal/task-orchestration.js');
-            taskOrchestration(process.argv.slice(3));
+            await taskOrchestration(process.argv.slice(3));
             break;
         }
         case 'task-review': {

package/dist/lib/agent-clients/adapters/codex-lifecycle/app-server.js

@@ -6,10 +6,12 @@ import path from 'node:path';
 import semver from 'semver';
 const LIFECYCLE_HOOKS = Object.freeze([
     Object.freeze({ event: 'PreToolUse', matcher: '^collaborationspawn_agent$', phase: 'pre-tool' }),
-    Object.freeze({ event: 'PostToolUse', matcher: '^collaborationspawn_agent$', phase: 'post-tool' }),
-    Object.freeze({ event: 'SubagentStart', matcher: '^agent-infra-lifecycle-(executor|reviewer)$', phase: 'subagent-start' }),
-    Object.freeze({ event: 'SubagentStop', matcher: '^agent-infra-lifecycle-(executor|reviewer)$', phase: 'subagent-stop' })
+    Object.freeze({ event: 'PostToolUse', matcher: '', phase: 'post-tool' }),
+    Object.freeze({ event: 'SubagentStart', matcher: '', phase: 'subagent-start' }),
+    Object.freeze({ event: 'SubagentStop', matcher: '', phase: 'subagent-stop' })
 ]);
+const DEFAULT_ROLLOUT_READ_ATTEMPTS = 81;
+const DEFAULT_ROLLOUT_RETRY_MS = 100;
 function object(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -18,6 +20,58 @@ function object(value) {
 function nonEmpty(value) {
     return typeof value === 'string' && value.trim() ? value : null;
 }
+function resolveCodexSpawnedChild(transcriptPath, expected) {
+    const name = path.basename(transcriptPath);
+    if (!transcriptPath || (!name.endsWith(`-${expected.sessionId}.jsonl`) && name !== `${expected.sessionId}.jsonl`)) {
+        throw new Error('Codex parent rollout path is invalid');
+    }
+    const stat = fs.lstatSync(transcriptPath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('Codex parent rollout is not a regular file');
+    const maxBytes = 8 * 1024 * 1024;
+    const offset = Math.max(0, stat.size - maxBytes);
+    const buffer = Buffer.alloc(stat.size - offset);
+    const descriptor = fs.openSync(transcriptPath, 'r');
+    try {
+        fs.readSync(descriptor, buffer, 0, buffer.length, offset);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    let text = buffer.toString('utf8');
+    if (offset)
+        text = text.slice(text.indexOf('\n') + 1);
+    const records = text.split(/\r?\n/).filter(Boolean).map((line) => object(JSON.parse(line))).filter(Boolean);
+    const calls = records.filter((record) => {
+        const payload = object(record?.payload);
+        return record?.type === 'response_item'
+            && payload?.type === 'function_call'
+            && payload.call_id === expected.toolUseId
+            && payload.namespace === 'collaboration'
+            && payload.name === 'spawn_agent';
+    });
+    if (calls.length !== 1)
+        throw new Error('Codex parent rollout spawn call was not found uniquely');
+    const call = object(calls[0]?.payload);
+    const args = object(JSON.parse(nonEmpty(call?.arguments) ?? '{}'));
+    if (args?.agent_type !== expected.nativeAgent
+        || args.task_name !== expected.taskName
+        || (expected.requestedModel && args.model !== expected.requestedModel)
+        || (expected.requestedReasoningEffort && args.reasoning_effort !== expected.requestedReasoningEffort))
+        throw new Error('Codex parent rollout spawn identity does not match the hook event');
+    const activities = records.filter((record) => {
+        const payload = object(record?.payload);
+        return record?.type === 'event_msg'
+            && payload?.type === 'sub_agent_activity'
+            && payload.event_id === expected.toolUseId
+            && payload.kind === 'started'
+            && payload.agent_path === `/root/${expected.taskName}`
+            && nonEmpty(payload.agent_thread_id);
+    });
+    if (activities.length !== 1)
+        throw new Error('Codex parent rollout child activity was not found uniquely');
+    return nonEmpty(object(activities[0]?.payload)?.agent_thread_id);
+}
 function validateCodexLifecycleHookConfig(value) {
     const hooks = object(object(value)?.hooks);
     const valid = hooks && LIFECYCLE_HOOKS.every(({ event, matcher, phase }) => {
@@ -31,7 +85,7 @@ function validateCodexLifecycleHookConfig(value) {
             return entry.hooks.some((hookValue) => {
                 const hook = object(hookValue);
                 return hook?.type === 'command'
-                    && hook.timeout === 5
+                    && hook.timeout === 15
                     && hook.command === `node "$(git rev-parse --show-toplevel)/.agents/hooks/lifecycle-delegation.js" --client codex --event ${phase}`;
             });
         });
@@ -84,25 +138,37 @@ function hasCodexRuntimeLiveness(runtimeRoot, hookDefinitionHash, identity) {
         }
     });
 }
-function parseCodexThreadResolution(readValue, resumeValue) {
+function parseCodexThreadResolution(readValue, rolloutRecords) {
     const readRoot = object(readValue);
-    const resumeRoot = object(resumeValue);
     const thread = object(readRoot?.thread);
-    const resumedThread = object(resumeRoot?.thread);
     const source = object(thread?.source);
     const subAgent = object(source?.subAgent);
     const threadSpawn = object(subAgent?.thread_spawn);
+    const sessionMeta = rolloutRecords
+        .map(object)
+        .find((record) => record?.type === 'session_meta');
+    const sessionPayload = object(sessionMeta?.payload);
+    const turnContext = rolloutRecords
+        .map(object)
+        .filter((record) => record?.type === 'turn_context')
+        .at(-1);
+    const turnPayload = object(turnContext?.payload);
     const childThreadId = nonEmpty(thread?.id);
     const parentThreadId = nonEmpty(thread?.parentThreadId);
     const sourceParentThreadId = nonEmpty(threadSpawn?.parent_thread_id);
-    const resumedChildThreadId = nonEmpty(resumedThread?.id);
-    const model = nonEmpty(resumeRoot?.model);
-    const reasoningEffort = nonEmpty(resumeRoot?.reasoningEffort ?? object(resumeRoot?.settings)?.effort);
+    const rolloutChildThreadId = nonEmpty(sessionPayload?.id);
+    const rolloutParentThreadId = nonEmpty(sessionPayload?.parent_thread_id);
+    const agentRole = nonEmpty(sessionPayload?.agent_role);
+    const model = nonEmpty(turnPayload?.model);
+    const reasoningEffort = nonEmpty(turnPayload?.effort);
     const forkedFromId = thread?.forkedFromId;
     if (!childThreadId
-        || resumedChildThreadId !== childThreadId
+        || rolloutChildThreadId !== childThreadId
         || !parentThreadId
         || !sourceParentThreadId
+        || rolloutParentThreadId !== parentThreadId
+        || rolloutParentThreadId !== sourceParentThreadId
+        || !/^agent-infra-lifecycle-(executor|reviewer)$/.test(agentRole ?? '')
         || !model
         || !reasoningEffort
         || (forkedFromId !== null && typeof forkedFromId !== 'string')) {
@@ -114,7 +180,8 @@ function parseCodexThreadResolution(readValue, resumeValue) {
             childThreadId,
             parentThreadId,
             forkedFromId,
-            sourceParentThreadId
+            sourceParentThreadId,
+            nativeAgent: agentRole
         }),
         settings: Object.freeze({
             type: 'app-settings',
@@ -124,6 +191,46 @@ function parseCodexThreadResolution(readValue, resumeValue) {
         })
     });
 }
+function readCodexRolloutRecords(readValue, childThreadId) {
+    const thread = object(object(readValue)?.thread);
+    const rolloutPath = nonEmpty(thread?.path);
+    const rolloutName = rolloutPath ? path.basename(rolloutPath) : '';
+    if (!rolloutPath || (rolloutName !== `${childThreadId}.jsonl` && !rolloutName.endsWith(`-${childThreadId}.jsonl`))) {
+        throw new Error('Codex App Server rollout path is invalid');
+    }
+    const stat = fs.statSync(rolloutPath);
+    if (!stat.isFile())
+        throw new Error('Codex App Server rollout path is not a regular file');
+    const maxBytes = 1024 * 1024;
+    const bytes = Math.min(stat.size, maxBytes);
+    const descriptor = fs.openSync(rolloutPath, 'r');
+    try {
+        const buffer = Buffer.alloc(bytes);
+        fs.readSync(descriptor, buffer, 0, bytes, 0);
+        const text = buffer.toString('utf8');
+        const completeText = stat.size <= maxBytes ? text : text.slice(0, text.lastIndexOf('\n'));
+        return Object.freeze(completeText.split(/\r?\n/).filter(Boolean).map((line) => JSON.parse(line)));
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+async function resolveCodexRolloutRecords(readValue, childThreadId, attempts, retryMs) {
+    let lastError;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+            const records = readCodexRolloutRecords(readValue, childThreadId);
+            parseCodexThreadResolution(readValue, records);
+            return records;
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt + 1 < attempts)
+                await new Promise((resolve) => setTimeout(resolve, retryMs));
+        }
+    }
+    throw lastError;
+}
 function parseCodexTurnCompleted(value) {
     const root = object(value);
     const turn = object(root?.turn);
@@ -287,13 +394,13 @@ async function resolveCodexThread(childThreadId, options = {}) {
         const readThread = object(readResult?.thread);
         if (nonEmpty(readThread?.id) !== childThreadId)
             throw new Error('Codex App Server returned the wrong child thread');
-        const resumeResult = await transport.request('thread/resume', { threadId: childThreadId });
         let resolution;
         try {
-            resolution = parseCodexThreadResolution(readResult, resumeResult);
+            const rolloutRecords = await resolveCodexRolloutRecords(readResult, childThreadId, options.rolloutReadAttempts ?? DEFAULT_ROLLOUT_READ_ATTEMPTS, options.rolloutRetryMs ?? DEFAULT_ROLLOUT_RETRY_MS);
+            resolution = parseCodexThreadResolution(readResult, rolloutRecords);
         }
         catch {
-            throw new Error('Codex App Server resumed settings are unavailable');
+            throw new Error('Codex App Server rollout metadata is unavailable');
         }
         const reroutes = transport.notifications
             .filter((entry) => entry.method === 'model/rerouted')
@@ -322,6 +429,9 @@ async function resolveCodexTerminal(childThreadId, options = {}) {
             throw new Error('Codex App Server returned the wrong child thread');
         const turns = Array.isArray(thread?.turns) ? thread.turns : [];
         const turn = turns.at(-1);
+        const turnValue = object(turn);
+        if (!turnValue || turnValue.status === 'inProgress')
+            throw new Error('CODEX_TURN_NOT_TERMINAL');
         return parseCodexTurnCompleted({ threadId: childThreadId, turn });
     }
     finally {
@@ -378,5 +488,5 @@ async function preflightCodexLifecycleEvidence(repoRoot = process.cwd(), runtime
         diagnostics: transport.diagnostics
     });
 }
-export { CodexAppServerTransport, hasCodexRuntimeLiveness, parseCodexModelReroute, parseCodexHooksList, parseCodexThreadResolution, parseCodexTurnCompleted, preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread, validateCodexLifecycleHookConfig };
+export { CodexAppServerTransport, hasCodexRuntimeLiveness, parseCodexModelReroute, parseCodexHooksList, parseCodexThreadResolution, parseCodexTurnCompleted, resolveCodexSpawnedChild, preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread, validateCodexLifecycleHookConfig };
 //# sourceMappingURL=app-server.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/evidence.js

@@ -35,17 +35,29 @@ function requiredStrings(event) {
 }
 function derive(state) {
     const { spawn, child, thread, settings, reroute, terminal, stop } = state;
-    if (spawn && child && (spawn.sessionId !== child.sessionId
+    if (spawn && child && (spawn.sessionId !== child.parentThreadId
         || spawn.nativeAgent !== child.nativeAgent)) {
         return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook spawn and child identity do not match');
     }
+    if (child && child.sessionId !== child.parentThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'child event session does not match the parent thread');
+    }
     if (child && thread && child.childThreadId !== thread.childThreadId) {
         return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook and App Server child identity do not match');
     }
+    if (child && thread && child.nativeAgent !== thread.nativeAgent) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook and App Server agent roles do not match');
+    }
+    if (child && thread && child.parentThreadId !== thread.parentThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_PARENT_MISMATCH', 'hook and App Server parent identity do not match');
+    }
     if (spawn && thread && (thread.parentThreadId !== spawn.sessionId
         || thread.sourceParentThreadId !== spawn.sessionId)) {
         return invalid(state, 'CODEX_EVIDENCE_PARENT_MISMATCH', 'App Server parent identity does not match the spawning session');
     }
+    if (spawn && thread && spawn.nativeAgent !== thread.nativeAgent) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'spawn and App Server agent roles do not match');
+    }
     if (thread?.forkedFromId !== null && thread?.forkedFromId !== undefined) {
         return invalid(state, 'CODEX_EVIDENCE_FORK_FORBIDDEN', 'forked child threads are not fresh lifecycle evidence');
     }
@@ -105,7 +117,7 @@ function derive(state) {
             childThreadId: startEvidence.childThreadId,
             turnId: terminal.turnId,
             terminalStatus: 'completed',
-            hookStopObserved: true
+            hookStopObserved: stop.source !== 'parent-rollout'
         });
     }
     const status = stopEvidence

package/dist/lib/agent-clients/adapters/codex-lifecycle/store.js

@@ -99,7 +99,7 @@ function createCodexLifecycleStore(options) {
         if (event.type === 'hook-child') {
             const matches = recordFiles(root).filter((file) => {
                 const state = readRecord(file).state;
-                return state.spawn?.sessionId === event.sessionId
+                return state.spawn?.sessionId === event.parentThreadId
                     && state.spawn.nativeAgent === event.nativeAgent
                     && (!state.child || state.child.childThreadId === event.childThreadId);
             });
@@ -146,6 +146,43 @@ function createCodexLifecycleStore(options) {
             return Object.freeze({ path: file, revision: next.revision, state: next.state });
         });
     }
+    function applyToSpawn(identity, event) {
+        return withWriteLock(() => {
+            const file = path.join(root, `${digest(`${identity.sessionId}\0${identity.turnId}\0${identity.toolUseId}`)}.json`);
+            if (!fs.existsSync(file))
+                throw new Error('Codex lifecycle spawn identity was not found');
+            const current = readRecord(file);
+            if (current.consumer)
+                throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+            if (current.state.spawn?.sessionId !== identity.sessionId
+                || current.state.spawn.turnId !== identity.turnId
+                || current.state.spawn.toolUseId !== identity.toolUseId)
+                throw new Error('Codex lifecycle spawn identity does not match the stored event');
+            const nextState = reduceCodexLifecycleEvent(current.state, event);
+            const next = Object.freeze({
+                ...current,
+                revision: current.revision + 1,
+                state: nextState,
+                updatedAt: now()
+            });
+            writeRecord(file, next, current.revision);
+            return Object.freeze({ path: file, revision: next.revision, state: next.state });
+        });
+    }
+    function findByParent(parentThreadId) {
+        const matches = recordFiles(root)
+            .map(readRecord)
+            .filter((record) => record.state.startEvidence?.parentThreadId === parentThreadId
+            && ['start-ready', 'observed-terminal', 'stop-ready'].includes(record.state.status));
+        const unconsumed = matches.filter((record) => !record.consumer);
+        if (unconsumed.length > 1)
+            throw new Error(`Codex lifecycle parent '${parentThreadId}' has ambiguous active children`);
+        if (unconsumed.length === 1)
+            return Object.freeze(unconsumed);
+        return Object.freeze(matches
+            .filter((record) => record.consumer && record.state.status === 'stop-ready')
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)));
+    }
     function read(childThreadId) {
         const matches = findByChild(childThreadId);
         if (matches.length !== 1)
@@ -161,8 +198,15 @@ function createCodexLifecycleStore(options) {
                 throw new Error(`Codex lifecycle child '${childThreadId}' was not found uniquely`);
             const file = matches[0];
             const current = readRecord(file);
-            if (current.consumer)
-                throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+            if (current.consumer) {
+                if (current.consumer !== consumer) {
+                    throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+                }
+                if (expectedHookDefinitionHash
+                    && current.state.startEvidence?.hookDefinitionHash !== expectedHookDefinitionHash)
+                    throw new Error('Codex lifecycle hook definition hash is stale');
+                return current;
+            }
             if (current.state.status !== 'stop-ready')
                 throw new Error('Codex lifecycle evidence is not stop-ready');
             if (expectedHookDefinitionHash
@@ -205,7 +249,7 @@ function createCodexLifecycleStore(options) {
             return changed;
         });
     }
-    return Object.freeze({ root, apply, consume, expireBefore, read });
+    return Object.freeze({ root, apply, applyToSpawn, consume, expireBefore, findByParent, read });
 }
 export { createCodexLifecycleStore };
 //# sourceMappingURL=store.js.map

package/dist/lib/agent-clients/adapters/codex.js

@@ -11,7 +11,7 @@ const codexAdapter = defineAgentClientAdapter({
         commands: { level: 'integrated' },
         hooks: { level: 'integrated' },
         subagents: { level: 'experimental' },
-        orchestration: { level: 'unsupported' },
+        orchestration: { level: 'experimental' },
         sandbox: { level: 'integrated' },
         verification: { level: 'compatible' }
     },

package/dist/lib/git/workflow.js

@@ -119,7 +119,6 @@ function pushRebasedBranch(input, runner = defaultRunner) {
         .map((name) => value(runner, input.cwd, ['rev-parse', '--git-path', name]))
         .filter((candidate) => Boolean(candidate));
     if (snapshot.worktree.length > 0 || snapshot.staged.length > 0 ||
-        run(runner, input.cwd, ['rev-parse', '-q', '--verify', 'REBASE_HEAD']).status === 0 ||
         rebasePaths.some((candidate) => fs.existsSync(path.isAbsolute(candidate) ? candidate : path.join(input.cwd, candidate)))) {
         return { status: 'failed', changed: false, snapshot, operations: [], error: { code: 'GIT_LOCAL_STATE_UNSAFE', message: 'Working tree must be clean with no rebase in progress' } };
     }

package/dist/lib/internal/codex-lifecycle.js

@@ -4,6 +4,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { preflightCodexLifecycleEvidence, resolveCodexTerminal, resolveCodexThread } from '../agent-clients/adapters/codex-lifecycle/app-server.js';
 import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.js';
+import { activateCodexOrchestrationDelegation, activateCodexSpawnDelegation, reconcileCodexOrchestrationDelegation, sealCodexOrchestrationDelegation, sealCodexParentDelegation } from '../task/codex-orchestration.js';
 const USAGE = 'Usage: agent-infra-internal codex-lifecycle <hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
 const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
 function output(value) {
@@ -13,6 +14,15 @@ function failure(code, message) {
     output({ status: 'failed', changed: false, evidence: null, diagnostics: [], error: { code, message } });
     process.exitCode = 1;
 }
+function outputBridgeResult(result) {
+    if (result.error?.code === 'ORCHESTRATION_DELEGATION_MISSING') {
+        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+        return;
+    }
+    output(result);
+    if (result.status !== 'running')
+        process.exitCode = 1;
+}
 function parse(args) {
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
@@ -24,7 +34,7 @@ function parse(args) {
         return null;
     }
     const allowed = {
-        'hook-event': ['--event'],
+        'hook-event': ['--event', '--bridge'],
         'resolve-start': ['--child-id'],
         'resolve-stop': ['--child-id'],
         preflight: ['--format', '--session-id', '--turn-id', '--tool-use-id'],
@@ -110,6 +120,12 @@ function recordFromPayload(phase, payload) {
         return null;
     throw new Error(`unknown Codex lifecycle hook phase '${phase}'`);
 }
+function payloadText(payload, key) {
+    return payload && typeof payload === 'object' && !Array.isArray(payload)
+        && typeof payload[key] === 'string'
+        ? payload[key]
+        : '';
+}
 async function codexLifecycle(args = []) {
     const parsed = parse(args);
     if (!parsed || process.exitCode)
@@ -146,12 +162,94 @@ async function codexLifecycle(args = []) {
             if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
                 throw new Error('hook-event requires a known --event');
             }
-            const event = recordFromPayload(phase, await readStdin());
+            if (parsed.values['--bridge'] !== undefined && parsed.values['--bridge'] !== 'true') {
+                throw new Error("hook-event --bridge must be 'true'");
+            }
+            const payload = await readStdin();
+            if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+                const toolName = payloadText(payload, 'toolName');
+                if (toolName === 'collaborationspawn_agent') {
+                    const nativeAgent = payloadText(payload, 'nativeAgent');
+                    if (!MANAGED_AGENT.test(nativeAgent)) {
+                        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+                        return;
+                    }
+                    const requestedModel = payloadText(payload, 'requestedModel');
+                    const requestedReasoningEffort = payloadText(payload, 'requestedReasoningEffort');
+                    const bridged = await activateCodexSpawnDelegation({
+                        sessionId: payloadText(payload, 'sessionId'),
+                        turnId: payloadText(payload, 'turnId'),
+                        toolUseId: payloadText(payload, 'toolUseId'),
+                        transcriptPath: payloadText(payload, 'transcriptPath'),
+                        nativeAgent,
+                        taskName: payloadText(payload, 'taskName'),
+                        ...(requestedModel ? { requestedModel } : {}),
+                        ...(requestedReasoningEffort ? { requestedReasoningEffort } : {})
+                    }, { store });
+                    outputBridgeResult(bridged);
+                    return;
+                }
+                if (toolName === 'collaborationwait_agent') {
+                    outputBridgeResult(await sealCodexParentDelegation(payloadText(payload, 'sessionId'), { store }));
+                    return;
+                }
+                output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+                return;
+            }
+            const event = recordFromPayload(phase, payload);
             if (!event) {
+                if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+                    const value = payload;
+                    const childThreadId = String(value.childThreadId ?? '');
+                    const reconciled = reconcileCodexOrchestrationDelegation(childThreadId);
+                    outputBridgeResult(reconciled);
+                    return;
+                }
                 output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
                 return;
             }
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+                try {
+                    if (store.read(event.childThreadId).consumer) {
+                        const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
+                        outputBridgeResult(bridged);
+                        return;
+                    }
+                }
+                catch {
+                    // The normal apply path below owns missing or invalid evidence errors.
+                }
+            }
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-child') {
+                const resolved = await resolveCodexThread(event.childThreadId);
+                store.apply({
+                    ...event,
+                    parentThreadId: resolved.resolution.thread.parentThreadId
+                });
+                const bridged = await activateCodexOrchestrationDelegation(event.childThreadId, {
+                    store,
+                    resolveThread: async () => resolved
+                });
+                outputBridgeResult(bridged);
+                return;
+            }
+            if (event.type === 'hook-child') {
+                const resolved = await resolveCodexThread(event.childThreadId);
+                const result = store.apply({
+                    ...event,
+                    parentThreadId: resolved.resolution.thread.parentThreadId
+                });
+                output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: resolved.diagnostics, error: result.state.error });
+                if (result.state.status === 'invalid')
+                    process.exitCode = 1;
+                return;
+            }
             const result = store.apply(event);
+            if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+                const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
+                outputBridgeResult(bridged);
+                return;
+            }
             output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: [], error: result.state.error });
             if (result.state.status === 'invalid')
                 process.exitCode = 1;