@inixiative/agent-session 0.1.0 → 0.2.0

package/src/codex-session.ts

@@ -1,3 +1,6 @@
+import { TurnState } from "./turn-state";
+import { retainEvidence } from "./retained-evidence";
+import { isDeepStrictEqual } from "node:util";
 // ---------------------------------------------------------------------------
 // CodexSession — long-lived OpenAI Codex CLI process with full event capture
 // ---------------------------------------------------------------------------
@@ -8,7 +11,7 @@
 // the shared SessionEvent taxonomy and resolving a turn on completion.
 //
 //   CodexMcpSession        (default)      — `codex mcp-server`  (stdio MCP JSON-RPC)
-//   CodexAppServerSession  (experimental) — `codex app-server`  (WebSocket JSON-RPC)
+//   CodexAppServerSession  (experimental) — `codex app-server`  (stdio JSON-RPC)
 //
 // Both DISABLE codex's own approvals + sandbox (the union of
 // `--dangerously-bypass-approvals-and-sandbox`) so OUR container is the only
@@ -67,6 +70,15 @@ export type CodexSpawn = (
 // ---------------------------------------------------------------------------
 
 export interface CodexSessionConfig {
+  /** Explicit app-server integration. Never applied by the default MCP engine.
+   * Config is native launch data, not event/recording data. */
+  appServer?: {
+    /** Persist the actual returned binding before model admission; failure blocks work. */
+    onThreadReady?: (binding: string) => void | Promise<void>;
+    requireConfiguration?: boolean;
+    config?: Readonly<Record<string, unknown>>;
+    requiredMcpServer?: { readonly name: string; readonly tools: readonly string[] };
+  };
   /** Path to codex CLI binary. Defaults to "codex". */
   bin?: string;
   /** Model. Defaults to "gpt-5.5". */
@@ -88,8 +100,8 @@ export interface CodexSessionConfig {
   baseContext?: string;
   /**
    * codex's native thread ID (the value the `codex` tool returns). When set, the
-   * first send() continues that thread via `codex-reply` — used for fork and
-   * crash recovery. Also set by a SessionAdapter resuming a mapped Foundry thread.
+   * first send() uses `codex-reply` on MCP (loaded threads only), or
+   * `thread/resume` on app-server. Only app-server supports cold resume by ID.
    */
   externalSessionId?: string;
   /**
@@ -105,6 +117,8 @@ export interface CodexSessionConfig {
 // ---------------------------------------------------------------------------
 
 interface QueuedTurn {
+  onAdmission?: import("./harness-session").SessionSendOptions["onAdmission"];
+  evidence: TurnState;
   message: string;
   timeout: number;
   resolve: (result: SessionResult) => void;
@@ -141,8 +155,10 @@ abstract class BaseCodexSession implements HarnessSession {
   // -- Session state --
   protected _externalSessionId?: string;
   protected _alive = false;
+  private _endEmitted = false;
   protected _eventLog: SessionEvent[] = [];
   protected _handlers: SessionEventHandler[] = [];
+  private _observerFailures = { synchronous: 0, asynchronous: 0 };
   protected _beforeSendHooks: BeforeSendHook[] = [];
   protected _turns = 0;
   protected _totalTokens = { input: 0, output: 0 };
@@ -163,6 +179,8 @@ abstract class BaseCodexSession implements HarnessSession {
 
   // -- Turn queue (identical to ClaudeCodeSession) --
   protected _queue: QueuedTurn[] = [];
+  protected _attempts: TurnState[] = [];
+  protected _seenTerminals = new Set<string>();
   protected _inflight: QueuedTurn | null = null;
   protected _turnEvents: SessionEvent[] = [];
   protected _resultText = "";
@@ -193,9 +211,13 @@ abstract class BaseCodexSession implements HarnessSession {
   // Accessors (identical to ClaudeCodeSession)
   // ---------------------------------------------------------------------------
 
+  get accounting() { return "observed-only" as const; }
+  get attempts() { return this._attempts.map(a => a.snapshot()); }
+  get diagnostics() { return Object.freeze({ observerFailures: Object.freeze({ ...this._observerFailures }) }); }
+
   get alive(): boolean { return this._alive; }
   get externalSessionId(): string | undefined { return this._externalSessionId; }
-  get events(): readonly SessionEvent[] { return this._eventLog; }
+  get events(): readonly SessionEvent[] { return Object.freeze([...this._eventLog]); }
   get turns(): number { return this._turns; }
   get totalTokens(): Readonly<{ input: number; output: number }> {
     return { ...this._totalTokens };
@@ -242,7 +264,7 @@ abstract class BaseCodexSession implements HarnessSession {
 
   interrupt(): void {
     if (!this._inflight) return;
-    this._rejectInflight(new Error("Turn interrupted"));
+    this._rejectInflight(new Error("Local waiter interrupted; native cancellation unacknowledged"), "interrupt-request");
   }
 
   kill(): void {
@@ -254,7 +276,7 @@ abstract class BaseCodexSession implements HarnessSession {
       this._turnTimer = null;
     }
 
-    this._rejectInflight(new Error("Session killed"));
+    this._rejectInflight(new Error("Session killed; native outcome may remain unknown"), "killed");
     this._rejectQueue(new Error("Session killed"));
     for (const p of this._pending.values()) p.reject(new Error("Session killed"));
     this._pending.clear();
@@ -269,6 +291,7 @@ abstract class BaseCodexSession implements HarnessSession {
   artifact(): SessionArtifact {
     return {
       externalSessionId: this._externalSessionId,
+      attempts: this.attempts, accounting: "observed-only", diagnostics: this.diagnostics,
       events: [...this._eventLog],
       startedAt: this._startedAt,
       endedAt: this._alive ? undefined : Date.now(),
@@ -285,6 +308,7 @@ abstract class BaseCodexSession implements HarnessSession {
   // ---------------------------------------------------------------------------
 
   async start(): Promise<void> {
+    if (this._attempts.some(a => a.dispatch === "attempted" && a.nativeOutcome === "unknown")) throw new Error("Native outcome unresolved; automatic resume is blocked");
     if (this._proc) throw new Error("Session already started");
 
     const args = this._buildSpawnArgs();
@@ -306,14 +330,17 @@ abstract class BaseCodexSession implements HarnessSession {
     }
 
     this._alive = true;
+    this._endEmitted = false;
     this._emit({ kind: "session_start", timestamp: Date.now() });
 
-    this._readStdout();
+    const proc = this._proc;
+    const stdoutDone = this._readStdout(proc);
     this._readStderr();
 
-    this._proc.exited.then((code) => {
-      if (!this._alive) return;
+    proc.exited.then(async (code) => {
+      if (this._proc !== proc || !this._alive) return;
       this._alive = false;
+      await stdoutDone; // Drain buffered terminal evidence before interpreting process exit.
       const errMsg = this._stderr.trim()
         ? `Process exited (code ${code}): ${this._stderr.trim().slice(0, 500)}`
         : `Process exited with code ${code}`;
@@ -321,7 +348,7 @@ abstract class BaseCodexSession implements HarnessSession {
       this._rejectQueue(new Error("Session ended"));
       for (const p of this._pending.values()) p.reject(new Error("Session ended"));
       this._pending.clear();
-      this._emit({ kind: "session_end", timestamp: Date.now() });
+      this._emit({ kind: "session_end", timestamp: Date.now(), transportOutcome: "failed" });
     });
 
     await this._handshake();
@@ -333,8 +360,12 @@ abstract class BaseCodexSession implements HarnessSession {
 
   async send(
     message: string,
-    opts?: { timeout?: number },
+    opts?: import("./harness-session").SessionSendOptions,
   ): Promise<SessionResult> {
+    if (this._attempts.some(a => a.dispatch === "attempted" && a.nativeOutcome === "unknown" && (!this._alive || a.localOutcome !== "pending"))) {
+      const blocked = new TurnState(); this._attempts.push(blocked);
+      throw blocked.fail(new Error("Native outcome unresolved; send not dispatched"), "blocked");
+    }
     if (!this._proc && this._externalSessionId) {
       await this.start();
     }
@@ -355,7 +386,11 @@ abstract class BaseCodexSession implements HarnessSession {
     }
 
     return new Promise<SessionResult>((resolve, reject) => {
-      const turn: QueuedTurn = { message: transformed, timeout, resolve, reject };
+      const evidence = new TurnState(); this._attempts.push(evidence);
+      const turn: QueuedTurn = { evidence, message: transformed, timeout, resolve, reject, onAdmission: opts?.onAdmission };
+      if (!this._alive || (this._inflight && this._inflight.evidence.localOutcome !== "pending")) {
+        reject(evidence.fail(new Error("Previous native work unresolved; send not dispatched"), "blocked")); return;
+      }
       if (!this._inflight) {
         this._dispatchTurn(turn);
       } else {
@@ -368,16 +403,35 @@ abstract class BaseCodexSession implements HarnessSession {
   // Private — turn dispatch + queue (mirrors ClaudeCodeSession)
   // ---------------------------------------------------------------------------
 
+  readonly admissionProtocol = "prewrite-v1" as const;
+  inspectAttempt(admissionId: string) { return this._attempts.find(attempt => attempt.admissionId === admissionId)?.snapshot(); }
+
   private _dispatchTurn(turn: QueuedTurn): void {
     this._inflight = turn;
-    this._turnEvents = [];
+    if (turn.onAdmission) {
+      Promise.resolve().then(() => turn.onAdmission!(turn.evidence.snapshot())).then(() => {
+        if (this._inflight === turn && this._alive && turn.evidence.localOutcome === "pending") this._writeTurn(turn);
+        else if (this._inflight === turn && turn.evidence.dispatch === "not-dispatched") { this._inflight = null; this._processNextTurn(); }
+      }).catch(error => {
+        turn.reject(turn.evidence.fail(error instanceof Error ? error : new Error(String(error)), "registration"));
+        if (this._inflight === turn) { this._inflight = null; this._processNextTurn(); }
+      });
+      return;
+    }
+    this._writeTurn(turn);
+  }
+
+  private _writeTurn(turn: QueuedTurn): void {
+    turn.evidence.dispatch = "attempted";
+    this._turnEvents = turn.evidence.events;
     this._resultText = "";
 
     // Send via the subclass's wire protocol. The returned promise resolves when
     // the tools/call (or turn) completes; that resolves the turn.
     this._sendTurn(turn.message)
       .then((tokens) => {
-        if (this._inflight !== turn) return; // interrupted / timed out
+        if (this._inflight !== turn) return;
+        turn.evidence.rpcSettled = true;
         if (tokens) {
           this._totalTokens.input += tokens.input;
           this._totalTokens.output += tokens.output;
@@ -386,14 +440,16 @@ abstract class BaseCodexSession implements HarnessSession {
       })
       .catch((err: Error) => {
         if (this._inflight !== turn) return;
-        this._rejectInflight(err);
-        this._processNextTurn();
+        turn.evidence.rpcSettled = true;
+        if (turn.evidence.rpcOutcome === "pending") turn.evidence.rpcOutcome = "unknown";
+        this._rejectInflight(err, err instanceof NativeValidationError ? "validation" : "rpc");
+        this._releaseKnownTurn();
       });
 
     if (turn.timeout > 0) {
       this._turnTimer = setTimeout(() => {
         this._turnTimer = null;
-        this._rejectInflight(new Error(`Turn timed out after ${turn.timeout}ms`));
+        this._rejectInflight(new Error(`Turn timed out after ${turn.timeout}ms`), "timeout");
       }, turn.timeout);
     }
   }
@@ -406,38 +462,54 @@ abstract class BaseCodexSession implements HarnessSession {
       this._turnTimer = null;
     }
 
+    const a = this._inflight.evidence;
+    a.content = this._resultText;
+    a.tokens = tokens ?? a.tokens;
+    if (a.localOutcome === "pending") {
+      a.localOutcome = "resolved";
+      this._inflight.resolve(a.result(this._externalSessionId));
+    }
+    if (a.nativeOutcome === "unknown") this._rejectQueue(new Error("Native terminal missing; queued send not dispatched"));
+    this._releaseKnownTurn();
+  }
+
+  private _releaseKnownTurn(): void {
+    const a = this._inflight?.evidence;
+    if (!a || !this._canReleaseAttempt(a) || a.nativeOutcome === "unknown") return;
     this._turns++;
-    const result: SessionResult = {
-      content: this._resultText,
-      events: [...this._turnEvents],
-      tokens: tokens ?? this._turnEvents.find((e) => e.tokens)?.tokens,
-      externalSessionId: this._externalSessionId,
-    };
-    this._inflight.resolve(result);
     this._inflight = null;
-
     this._processNextTurn();
   }
 
+  protected _canReleaseAttempt(attempt: TurnState): boolean { return attempt.rpcSettled; }
+
   private _processNextTurn(): void {
-    if (this._queue.length > 0 && this._alive) {
+    if (!this._inflight && this._queue.length > 0 && this._alive) {
       const next = this._queue.shift()!;
       this._dispatchTurn(next);
     }
   }
 
-  protected _rejectInflight(err: Error): void {
+  protected _rejectInflight(err: Error, reason: import("./harness-session").SessionAttempt["localFailure"] = "transport"): void {
     if (!this._inflight) return;
-    if (this._turnTimer) {
-      clearTimeout(this._turnTimer);
-      this._turnTimer = null;
-    }
-    this._inflight.reject(err);
-    this._inflight = null;
+    if (this._turnTimer) { clearTimeout(this._turnTimer); this._turnTimer = null; }
+    const a = this._inflight.evidence;
+    if ((reason === "transport" || reason === "killed") && a.transportOutcome === "open") a.transportOutcome = reason === "killed" ? "closed" : "failed";
+    if (a.localOutcome === "pending") this._inflight.reject(a.fail(err, reason));
+    this._rejectQueue(new Error("Previous native work unresolved; queued send not dispatched"));
+  }
+
+  private _transportFailure(err: Error): void {
+    this._alive = false;
+    this._rejectInflight(err);
+    this._rejectQueue(err);
+    this._emit({ kind: "session_end", timestamp: Date.now(), transportOutcome: "failed" });
+    for (const p of this._pending.values()) p.reject(err);
+    this._pending.clear();
   }
 
   protected _rejectQueue(err: Error): void {
-    for (const turn of this._queue) turn.reject(err);
+    for (const turn of this._queue) turn.reject(turn.evidence.fail(err, "blocked"));
     this._queue = [];
   }
 
@@ -445,8 +517,8 @@ abstract class BaseCodexSession implements HarnessSession {
   // Private — stdout/stderr readers (mirrors ClaudeCodeSession)
   // ---------------------------------------------------------------------------
 
-  private async _readStdout(): Promise<void> {
-    const reader = this._proc!.stdout.getReader();
+  private async _readStdout(proc: PipedSubprocess): Promise<void> {
+    const reader = proc.stdout.getReader();
     const decoder = new TextDecoder();
     let buffer = "";
     try {
@@ -458,12 +530,13 @@ abstract class BaseCodexSession implements HarnessSession {
         buffer = lines.pop()!;
         for (const line of lines) {
           if (!line.trim()) continue;
-          this._processLine(line);
+          if (this._proc === proc || !this._proc) this._processLine(line);
         }
       }
-      if (buffer.trim()) this._processLine(buffer);
+      if (buffer.trim() && (this._proc === proc || !this._proc)) this._processLine(buffer);
+      if (this._proc === proc && this._alive) this._transportFailure(new Error(this._stderr.trim() ? `Native stdout closed: ${this._stderr.trim().slice(0, 500)}` : "Native stdout closed"));
     } catch (err) {
-      this._rejectInflight(err as Error);
+      if (this._proc === proc) this._transportFailure(err as Error);
     }
   }
 
@@ -490,36 +563,42 @@ abstract class BaseCodexSession implements HarnessSession {
     } catch {
       return;
     }
-    const raw = msg as Record<string, unknown>;
+    const raw = object(msg);
+    if (!raw) return;
+    if (typeof raw.method === "string" && (typeof raw.id === "string" || typeof raw.id === "number") && this._serverRequest(raw)) return;
 
     // JSON-RPC response to one of our requests (has matching `id` + result/error).
     if (typeof raw.id === "number" && (("result" in raw) || ("error" in raw))) {
       const pending = this._pending.get(raw.id);
       if (pending) {
         this._pending.delete(raw.id);
+        const a = this._inflight?.evidence;
+        if (a?.identity.rpcRequestId === raw.id) a.rpcOutcome = raw.error ? "failed" : "resolved";
         if ("error" in raw && raw.error) {
           const e = raw.error as Record<string, unknown>;
           pending.reject(new Error((e.message as string) ?? JSON.stringify(e)));
         } else {
-          pending.resolve(raw.result);
+          // Apply protocol identity synchronously before later lines in this
+          // same stdout chunk. Awaiting the promise first can lose a terminal.
+          try { this._observeRpcResult(raw.id, raw.result); pending.resolve(raw.result); }
+          catch (error) { pending.reject(error instanceof Error ? error : new Error(String(error))); }
         }
         return;
       }
     }
 
-    // Otherwise it's a notification (streamed event) — classify it.
     const classified = this._classify(raw);
     for (const event of classified) {
-      this._emit(event);
-      this._turnEvents.push(event);
-      if (event.kind === "result" || event.kind === "text") {
-        if (event.text) this._resultText = event.text;
-      }
-      if (event.tokens) {
-        this._totalTokens.input += event.tokens.input;
-        this._totalTokens.output += event.tokens.output;
-      }
+      const a = this._inflight?.evidence;
+      if (!a || event.unattributedReason) { this._emit(event); continue; }
+      const e = a.record(event);
+      this._resultText = a.content;
+      if (e.nativeOutcome && e.terminal) { a.nativeOutcome = e.nativeOutcome; a.terminal = e.terminal; }
+      if (e.tokens) { this._totalTokens.input += e.tokens.input; this._totalTokens.output += e.tokens.output; }
+      this._emit(e);
     }
+    this._releaseKnownTurn();
+
   }
 
   // ---------------------------------------------------------------------------
@@ -527,16 +606,19 @@ abstract class BaseCodexSession implements HarnessSession {
   // ---------------------------------------------------------------------------
 
   protected _emit(event: SessionEvent): void {
+    event = retainEvidence(event);
+    if (event.kind === "session_end") {
+      if (this._endEmitted) return;
+      this._endEmitted = true;
+    }
     this._eventLog.push(event);
     for (const handler of this._handlers) {
       try {
-        handler(event);
-      } catch (err) {
-        console.warn(
-          `[${this.constructor.name}] handler error:`,
-          (err as Error).message,
-        );
-      }
+        const observation: unknown = handler(event);
+        if (observation && typeof (observation as PromiseLike<unknown>).then === "function") {
+          void Promise.resolve(observation).catch(() => { this._observerFailures.asynchronous++; });
+        }
+      } catch { this._observerFailures.synchronous++; }
     }
   }
 
@@ -546,6 +628,10 @@ abstract class BaseCodexSession implements HarnessSession {
 
   protected _rpcRequest(method: string, params?: unknown): Promise<unknown> {
     const id = ++this._rpcId;
+    if ((method === "tools/call" || method === "turn/start") && this._inflight) {
+      this._inflight.evidence.identity = { ...this._inflight.evidence.identity, rpcRequestId: id };
+      this._inflight.evidence.rpcOutcome = "pending";
+    }
     const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n";
     return new Promise<unknown>((resolve, reject) => {
       this._pending.set(id, { resolve, reject });
@@ -559,6 +645,8 @@ abstract class BaseCodexSession implements HarnessSession {
     });
   }
 
+  protected _serverRequest(_request: Record<string, unknown>): boolean { return false; }
+
   protected _rpcNotify(method: string, params?: unknown): void {
     const payload = JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n";
     this._proc!.stdin.write(payload);
@@ -580,8 +668,11 @@ abstract class BaseCodexSession implements HarnessSession {
   /** Map a streamed notification to SessionEvents. */
   protected abstract _classify(msg: Record<string, unknown>): SessionEvent[];
 
+  protected _observeRpcResult(_id: number, _result: unknown): void {}
+
   /** Shared fork constructor — subclass passes its own ctor. */
   fork(opts?: { cwd?: string; baseContext?: string }): HarnessSession {
+    if (this._inflight) throw new Error("Cannot fork while native ownership is unresolved");
     if (!this._externalSessionId) {
       throw new Error(
         "Cannot fork — no thread ID yet (send at least one message first)",
@@ -617,6 +708,8 @@ abstract class BaseCodexSession implements HarnessSession {
 // multi-turn + fork).
 
 export class CodexMcpSession extends BaseCodexSession {
+  private _mcpAdmission?: string;
+  private _mcpCalls = new Map<string, { invocation: Record<string, unknown>; ended: boolean }>();
   protected _buildSpawnArgs(): string[] {
     // Disable codex's own approvals + sandbox (the union of
     // --dangerously-bypass-approvals-and-sandbox) so OUR container is the jail.
@@ -672,14 +765,17 @@ export class CodexMcpSession extends BaseCodexSession {
       | Record<string, unknown>
       | undefined;
     const threadId = structured?.threadId as string | undefined;
+    if (threadId && this._externalSessionId && threadId !== this._externalSessionId) throw new Error("MCP response changed the native resume binding");
     if (threadId && !this._externalSessionId) {
       this._externalSessionId = threadId;
     }
+    if (threadId && this._inflight) this._inflight.evidence.identity = { ...this._inflight.evidence.identity, threadId };
     // Final text: prefer structuredContent.content, else the tool result content.
     const finalText =
       (structured?.content as string | undefined) ??
       this._extractToolText(result?.content);
-    if (finalText) this._resultText = finalText;
+    if (result?.isError === true) throw new Error(finalText ?? "MCP tools/call failed");
+    if (finalText) { this._resultText = finalText; if (this._inflight) this._inflight.evidence.content = finalText; }
 
     // Usage, when the call result reports it. Streamed token_count events are
     // already accounted by the base loop; the call result is the authoritative
@@ -688,7 +784,7 @@ export class CodexMcpSession extends BaseCodexSession {
     // token event was seen this turn.
     const sawStreamedTokens = this._turnEvents.some((e) => e.tokens);
     const usage = structured?.usage as Record<string, number> | undefined;
-    if (usage && !sawStreamedTokens) {
+    if (usage && !sawStreamedTokens && typeof (usage.input_tokens ?? usage.inputTokens) === "number" && typeof (usage.output_tokens ?? usage.outputTokens) === "number") {
       return {
         input: (usage.input_tokens ?? usage.inputTokens ?? 0) as number,
         output: (usage.output_tokens ?? usage.outputTokens ?? 0) as number,
@@ -714,114 +810,365 @@ export class CodexMcpSession extends BaseCodexSession {
     const params = msg.params as Record<string, unknown> | undefined;
     const ev = (params?.msg ?? params) as Record<string, unknown> | undefined;
     if (!ev) return [];
-    return classifyCodexEvent(ev, "type");
+    const a = this._inflight?.evidence;
+    const str = (v: unknown) => typeof v === "string" ? v : undefined;
+    const nativeSessionId = str(ev.session_id), threadId = str(ev.thread_id);
+    const turnId = str(ev.turn_id), envelopeId = str(params?.id);
+    const item = ev.item as Record<string, unknown> | undefined;
+    const unowned = (reason: NonNullable<SessionEvent["unattributedReason"]>): SessionEvent[] => [{
+      kind: "native_status", timestamp: Date.now(), correlation: "unknown", unattributedReason: reason,
+      nativeSessionId, threadId, turnId, callId: str(ev.call_id), itemId: str(item?.id) ?? str(ev.item_id),
+      // Keep the envelope too: params.id may explain a rejected correlation.
+      // Unowned MCP calls retain identity/type diagnostics, never unrelated tool payloads.
+      raw: ev.type === "mcp_tool_call_begin" || ev.type === "mcp_tool_call_end" ? { type: ev.type } : msg,
+    }];
+    if (threadId && this._externalSessionId && threadId !== this._externalSessionId) return unowned("foreign-session");
+    if (nativeSessionId && a?.identity.nativeSessionId && nativeSessionId !== a.identity.nativeSessionId) return unowned("foreign-session");
+    if ((envelopeId && this._seenTerminals.has(envelopeId)) || (turnId && this._seenTerminals.has(turnId))) {
+      return unowned(ev.type === "task_complete" ? "duplicate-terminal" : "after-terminal");
+    }
+    if (!a) {
+      if (ev.type === "task_complete" && turnId) this._seenTerminals.add(turnId);
+      return unowned("no-admission");
+    }
+    if (ev.type === "session_configured") {
+      if (!this._externalSessionId && threadId) this._externalSessionId = threadId;
+      a.identity = { ...a.identity, nativeSessionId, threadId };
+    }
+    if (ev.type !== "session_configured" && a.identity.turnId && envelopeId && envelopeId !== a.identity.turnId) return unowned("foreign-turn");
+    if (threadId && a.identity.threadId && threadId !== a.identity.threadId) return unowned("foreign-session");
+    if (ev.type === "task_started" && turnId && !a.identity.turnId) a.identity = { ...a.identity, turnId, correlation: "native-turn" };
+    if (turnId && turnId !== a.identity.turnId) return unowned("foreign-turn");
+    if (ev.type === "task_complete") {
+      if (!turnId || turnId !== a.identity.turnId) return unowned("unrecognized-event");
+      this._seenTerminals.add(turnId);
+      return [{ ...a.identity, kind: "result", timestamp: Date.now(), nativeOutcome: "completed", terminal: { type: "task_complete", turnId }, raw: ev }];
+    }
+    const identity = { ...a.identity, threadId: threadId ?? a.identity.threadId, turnId: turnId ?? a.identity.turnId,
+      callId: str(ev.call_id), itemId: str(item?.id) ?? str(ev.item_id) };
+    if (ev.type === "mcp_tool_call_begin" || ev.type === "mcp_tool_call_end") {
+      const invocation = object(ev.invocation);
+      if (!identity.callId || !invocation || typeof invocation.server !== "string" || !invocation.server
+        || typeof invocation.tool !== "string" || !invocation.tool) return unowned("malformed-tool");
+      if (this._mcpAdmission !== a.identity.admissionId) {
+        this._mcpAdmission = a.identity.admissionId; this._mcpCalls.clear();
+      }
+      // Compare the original argument value, including absence. Never join a result
+      // for another server/tool or silently substitute arguments from its envelope.
+      const join = { server: invocation.server, tool: invocation.tool, arguments: invocation.arguments };
+      const prior = this._mcpCalls.get(identity.callId);
+      const tool = { toolName: `mcp__${invocation.server}__${invocation.tool}`, toolServer: invocation.server, toolMethod: invocation.tool };
+      if (ev.type === "mcp_tool_call_begin") {
+        if (prior) return unowned("duplicate-tool");
+        this._mcpCalls.set(identity.callId, { invocation: structuredClone(join), ended: false });
+        const args = publicMcpArguments(invocation.arguments);
+        return [{ ...identity, ...tool, kind: "tool_use", timestamp: Date.now(), ...args }];
+      }
+      if (!prior || !isDeepStrictEqual(prior.invocation, join)) return unowned("unmatched-tool");
+      if (prior.ended) return unowned("duplicate-tool");
+      const result = publicMcpResult(ev.result);
+      if (!result) return unowned("malformed-tool");
+      prior.ended = true;
+      return [{ ...identity, ...tool, kind: "tool_result", timestamp: Date.now(), ...result }];
+    }
+    if (["session_configured", "task_started", "item_started", "item_completed"].includes(String(ev.type))) {
+      return [{ ...identity, kind: "native_status", timestamp: Date.now(), nativeOutcome: a.nativeOutcome, raw: ev }];
+    }
+    // Notifications without a turn ID are associated only with the single owned RPC.
+    const classified = classifyCodexEvent(ev, "type");
+    return classified.length ? classified.map(event => ({ ...identity, ...event })) : unowned("unrecognized-event");
   }
 }
 
 // ---------------------------------------------------------------------------
-// CodexAppServerSession (EXPERIMENTAL) — `codex app-server` over WebSocket
+// CodexAppServerSession (EXPERIMENTAL) — `codex app-server` over stdio
 // ---------------------------------------------------------------------------
 //
-// EXPERIMENTAL: the app-server protocol is newer and less battle-tested than
-// mcp-server. Prefer CodexMcpSession unless you specifically need app-server.
-//
-// `codex app-server --listen ws://127.0.0.1:<port>` — localhost needs no auth
-// token. JSON-RPC 2.0 with slash-delimited methods:
-//   initialize → initialized → thread/start (returns thread.id) → turn/start
-// Consume turn/started, item/started, item/completed, turn/completed
-// notifications (ThreadItem types agentMessage / reasoning / commandExecution;
-// ThreadTokenUsage). Mapped to SessionEvents.
-//
-// We connect over the spawned process's stdin/stdout JSON-RPC for parity with
-// the rest of the harness (the WebSocket listen address is for external
-// clients; the stdio channel carries the same JSON-RPC frames). The base
-// class's read/write loop is reused unchanged.
+// Wire contract: installed codex-cli 0.153.4 v2 JSON schema. Controlled tests
+// establish source behavior, not a real create/resume/native-completion capture.
+// No default switch. Full history hydration, native fork and cancellation remain
+// separate integration work; a local interrupt never acknowledges native stop.
+
+class NativeValidationError extends Error {}
 
 export class CodexAppServerSession extends BaseCodexSession {
-  /** Resolves when the in-flight turn's `turn/completed` arrives. */
-  private _turnDone?: {
-    resolve: (t: { input: number; output: number } | undefined) => void;
-    reject: (e: Error) => void;
-  };
+  readonly appServerProtocol = "owned-thread-v1";
+  private readonly _options: NonNullable<CodexSessionConfig["appServer"]>;
+  private readonly _onThreadReady?: (binding: string) => void | Promise<void>;
+  private _startedOnce = false;
+  private _threadReady = false;
+  private _nativeSessionId?: string;
+  private _appAdmission?: string;
+  private _turnDone?: () => void;
+  private _items = new Map<string, { type: string; input?: unknown; completed: boolean; server?: string; tool?: string; text?: string }>();
+
+  constructor(config?: CodexSessionConfig) {
+    super(config);
+    const {onThreadReady,...options}=config?.appServer??{};
+    this._onThreadReady=onThreadReady;
+    this._options = retainEvidence(options);
+    const required = this._options.requiredMcpServer;
+    if (required && (!/^[a-zA-Z0-9_-]+$/.test(required.name) || !required.tools.length || required.tools.some(t => !/^[a-zA-Z0-9_-]+$/.test(t))))
+      throw new NativeValidationError("Invalid required MCP inventory");
+  }
+
+  override fork(): HarnessSession { throw Error("Native app-server fork is not implemented; a same-thread wrapper cannot create a native fork or inherit a process capability"); }
+
+  override async start(): Promise<void> {
+    if (this._inflight) throw Error("Native call ownership unresolved; automatic resume is blocked");
+    if (this._startedOnce && !this._alive) throw Error("App-server restart requires a new owned instance and preflight");
+    this._startedOnce = true;
+    try { await super.start(); }
+    catch(error) { this.kill(); throw error; }
+  }
+
+  protected override _serverRequest(request: Record<string, unknown>): boolean {
+    // JSON-RPC's explicit method-not-supported refusal also covers unknown future
+    // requests. Never approve native work or echo private request parameters.
+    const payload = JSON.stringify({ jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "Client interaction is unsupported by this adapter" } }) + "\n";
+    const params=object(request.params),a=this._inflight?.evidence;
+    const identity=a?.identity.turnId && params?.threadId===a.identity.threadId && params?.turnId===a.identity.turnId
+      ? {...a.identity,admissionId:a.admissionId} : {unattributedReason:"unrecognized-event" as const};
+    try { this._proc!.stdin.write(payload); this._proc!.stdin.flush(); }
+    catch { this._emit({ ...identity, kind: "native_status", timestamp: Date.now(), raw: { type: "server-request-refusal", status: "write-failed" } }); return true; }
+    this._emit({ ...identity, kind: "native_status", timestamp: Date.now(), raw: { type: "server-request-refusal", status: "refused" } });
+    return true;
+  }
+
+  private _refuse(reason: string, status = "unknown"): never {
+    const a = this._inflight?.evidence;
+    this._emit({ ...(a ? { admissionId: a.admissionId, ...a.identity } : {}), kind: "native_status", timestamp: Date.now(),
+      raw: { type: "thread-refused", reason, status } });
+    throw new NativeValidationError(`Native thread validation refused: ${reason} (${status}); no turn was sent`);
+  }
+
+  private async _readiness(): Promise<void> {
+    const required = this._options.requiredMcpServer;
+    if (!required) return;
+    let cursor: string | undefined;
+    const seen = new Set<string>(); let found: Record<string, unknown> | undefined;
+    // Pagination only, never polling/retrying a starting or failed native server.
+    for (let page = 0; page < 32; page++) {
+      const result = object(await this._rpcRequest("mcpServerStatus/list", { threadId: this._externalSessionId, detail: "toolsAndAuthOnly", limit: 100, ...(cursor ? { cursor } : {}) }));
+      if (!Array.isArray(result?.data)) this._refuse("mcp-inventory-malformed");
+      for (const entry of result.data) {
+        const server = object(entry);
+        if (server?.name === required.name) { if (found) this._refuse("mcp-inventory-duplicate"); found = server; }
+      }
+      if (result.nextCursor == null) {
+        const tools = object(found?.tools);
+        if (!found || found.runtimeStatus !== "connected" || !tools || required.tools.some(name => object(tools[name])?.name !== name))
+          this._refuse("mcp-inventory-unavailable");
+        const a = this._inflight!.evidence;
+        this._emit({ ...a.identity, admissionId: a.admissionId, kind: "native_status", timestamp: Date.now(), raw: { type: "mcp-ready", status: "connected", server: required.name, tools: [...required.tools] } });
+        return;
+      }
+      if (typeof result.nextCursor !== "string" || !result.nextCursor || seen.has(result.nextCursor)) this._refuse("mcp-inventory-cursor");
+      cursor = result.nextCursor; seen.add(cursor);
+    }
+    this._refuse("mcp-inventory-page-limit");
+  }
+
+  protected override _canReleaseAttempt(a: TurnState): boolean {
+    // An observer/write failure may occur after delivery. A terminal alone does
+    // not settle the unanswered turn/start call or authorize another admission.
+    return a.rpcSettled && (a.rpcOutcome === "resolved" || a.rpcOutcome === "failed");
+  }
 
   protected _buildSpawnArgs(): string[] {
-    // app-server on localhost needs no auth token. Approvals/sandbox are set
-    // per-thread in thread/start (approvalPolicy / sandbox below).
-    return ["app-server", "--listen", "ws://127.0.0.1:0"];
+    return ["app-server", "--listen", "stdio://"];
   }
 
   protected async _handshake(): Promise<void> {
-    await this._rpcRequest("initialize", {
-      protocolVersion: "2025-06-18",
+    this._threadReady = false;
+    const initialized = object(await this._rpcRequest("initialize", {
       capabilities: {},
       clientInfo: { name: "inixiative-bench", version: "0.1.0" },
-    });
+    }));
+    if (this._options.requireConfiguration && ["userAgent","platformFamily","platformOs","codexHome"].some(key=>typeof initialized?.[key]!=="string" || !initialized[key]))
+      throw new NativeValidationError("Native initialize response lacks required configuration; no thread or turn was sent");
     this._rpcNotify("initialized");
   }
 
   protected async _sendTurn(
     message: string,
   ): Promise<{ input: number; output: number } | undefined> {
-    // Start (or reuse) a thread. Disable codex's approvals + sandbox so OUR
-    // container is the only jail.
-    if (!this._externalSessionId) {
-      const started = (await this._rpcRequest("thread/start", {
+    const a = this._inflight!.evidence;
+    if (!this._threadReady) {
+      const binding = this._externalSessionId;
+      const method = binding ? "thread/resume" : "thread/start";
+      const response = object(await this._rpcRequest(method, {
+        ...(binding ? { threadId: binding } : {}),
         model: this._model,
         cwd: this._cwd,
         approvalPolicy: "never",
         sandbox: "danger-full-access",
-        ...(this._effort ? { modelReasoningEffort: this._effort } : {}),
-      })) as Record<string, unknown> | undefined;
-      const thread = started?.thread as Record<string, unknown> | undefined;
-      const id = (thread?.id ?? started?.threadId) as string | undefined;
-      if (id) this._externalSessionId = id;
+        ...(this._options.config ? { config: this._options.config } : {}),
+      }));
+      const thread = object(response?.thread), id = thread?.id;
+      if (typeof id !== "string" || !id || (binding && id !== binding)) this._refuse("binding-mismatch");
+      // Resume may rejoin a live thread. Never steer known pre-existing work.
+      // The installed schema requires status. Missing/unknown state cannot
+      // authorize work, even if this response otherwise identifies our thread.
+      if (object(thread?.status)?.type !== "idle"
+        || (Array.isArray(thread?.turns) && thread.turns.some(turn => object(turn)?.status === "inProgress")))
+        this._refuse("not-idle", ["active", "notLoaded", "systemError"].includes(String(object(thread?.status)?.type)) ? String(object(thread?.status)?.type) : "unknown");
+      if (this._options.requireConfiguration && (typeof response?.model !== "string" || !response.model || typeof response.modelProvider !== "string" || !response.modelProvider
+        || response.cwd !== this._cwd || response.approvalPolicy !== "never" || response.approvalsReviewer !== "user" || object(response.sandbox)?.type !== "dangerFullAccess"
+        || !Array.isArray(thread?.turns) || thread.turns.some(value=>!this._turn(value)))) this._refuse("configuration-missing-or-incompatible");
+      this._externalSessionId = id;
+      this._nativeSessionId = typeof thread?.sessionId === "string" && thread.sessionId ? thread.sessionId : undefined;
+      a.identity = { ...a.identity, threadId: id, ...(this._nativeSessionId ? {nativeSessionId:this._nativeSessionId} : {}) };
+      if (this._onThreadReady) {
+        try { await this._onThreadReady(id); }
+        catch (cause) { throw new NativeValidationError("Native binding persistence failed before turn/start", {cause}); }
+      }
+      this._threadReady = true;
+      // Configuration belongs to this process/thread, never to the next turn.
+      // Do not copy historical turns, instructions, paths or arbitrary config.
+      this._emit({ kind: "native_status", timestamp: Date.now(), threadId: id,
+        nativeSessionId: this._nativeSessionId, unattributedReason: "session-configuration", raw: { type: "thread-configured", method, threadId: id,
+          ...(object(thread?.status)?.type === "idle" ? { status: "idle" } : {}),
+          ...(typeof response?.model === "string" ? { model: response.model } : {}),
+          ...(response?.reasoningEffort === null || VALID_EFFORTS.includes(String(response?.reasoningEffort)) ? { reasoningEffort: response?.reasoningEffort } : {}),
+          history: { source: method, turns: Array.isArray(thread?.turns) ? thread.turns.slice(0,200).flatMap(value => {const t=this._turn(value);return t?[{id:t.id,status:t.status}]:[];}) : [],
+            available: Array.isArray(thread?.turns), hasMore: !!response?.turnsBackwardsCursor || (Array.isArray(thread?.turns) && thread.turns.length>200) } } });
     }
-
-    const completed = new Promise<{ input: number; output: number } | undefined>(
-      (resolve, reject) => {
-        this._turnDone = { resolve, reject };
-      },
-    );
-
-    // turn/start streams turn/started, item/*, turn/completed back as
-    // notifications, consumed in _classify; turn/completed resolves the turn.
+    a.identity = { ...a.identity, threadId: this._externalSessionId, ...(this._nativeSessionId ? { nativeSessionId: this._nativeSessionId } : {}) };
+    await this._readiness();
+    // Timeout/kill during create/resume must not cause a later model write.
+    if (this._inflight?.evidence !== a || a.localOutcome !== "pending" || !this._alive) throw Error("Local admission closed before turn/start; no turn was sent");
+    a.identity = { ...a.identity, threadId: this._externalSessionId, ...(this._nativeSessionId ? { nativeSessionId: this._nativeSessionId } : {}) };
+    this._appAdmission = a.admissionId; this._items.clear();
+    const completed = new Promise<void>(resolve => { this._turnDone = resolve; });
     await this._rpcRequest("turn/start", {
       threadId: this._externalSessionId,
-      input: message,
+      input: [{ type: "text", text: message }],
+      ...(this._effort ? { effort: this._effort } : {}),
     });
+    await completed; // Native terminal and RPC acknowledgment are both required.
+    return a.tokens;
+  }
 
-    return completed;
+  protected override _observeRpcResult(id: number, result: unknown): void {
+    const a = this._inflight?.evidence;
+    if (!a || this._appAdmission !== a.admissionId || a.identity.rpcRequestId !== id) return;
+    const turn = this._turn(object(result)?.turn);
+    if (!turn || (a.identity.turnId && turn.id !== a.identity.turnId)
+      || (!a.identity.turnId && this._seenTerminals.has(turn.id))) throw new NativeValidationError("Native turn/start response missing or conflicts with owned turn");
+    a.identity = { ...a.identity, turnId: turn.id, correlation: "native-turn" };
+  }
+
+  private _turn(value: unknown): { id: string; status: string; error?: unknown } | undefined {
+    const turn = object(value);
+    if (!turn || typeof turn.id !== "string" || !turn.id || !Array.isArray(turn.items)
+      || !["inProgress", "completed", "failed", "interrupted"].includes(String(turn.status))) return;
+    return turn as { id: string; status: string; error?: unknown };
   }
 
   protected _classify(msg: Record<string, unknown>): SessionEvent[] {
-    const method = msg.method as string | undefined;
+    const method = typeof msg.method === "string" ? msg.method : undefined;
     if (!method) return [];
-    const params = (msg.params ?? {}) as Record<string, unknown>;
-
+    const params = object(msg.params), turn = this._turn(params?.turn), item = object(params?.item);
+    const str = (value: unknown) => typeof value === "string" && value ? value : undefined;
+    const threadId = str(params?.threadId), turnId = turn?.id ?? str(params?.turnId), itemId = str(item?.id) ?? str(params?.itemId);
+    const unowned = (reason: NonNullable<SessionEvent["unattributedReason"]>): SessionEvent[] => [{
+      kind: "native_status", timestamp: Date.now(), threadId, turnId, itemId, correlation: "unknown", unattributedReason: reason,
+      raw: { method: ["turn/started", "turn/completed", "item/started", "item/completed", "thread/tokenUsage/updated", "item/agentMessage/delta", "item/commandExecution/outputDelta"].includes(method) ? method : "unrecognized",
+        ...(item ? { itemType: ["agentMessage", "commandExecution", "reasoning", "mcpToolCall"].includes(String(item.type)) ? item.type : "unsupported" } : {}) },
+    }];
+    const a = this._inflight?.evidence;
+    if (!threadId || threadId !== this._externalSessionId) return unowned("foreign-session");
+    if (!a || this._appAdmission !== a.admissionId) return unowned("no-admission");
+    if (turnId && this._seenTerminals.has(turnId)) return unowned(method === "turn/completed" ? "duplicate-terminal" : "after-terminal");
+    if (method === "turn/started" && turn?.status === "inProgress" && !a.identity.turnId)
+      a.identity = { ...a.identity, threadId, turnId: turn.id, correlation: "native-turn" };
+    if (!turnId || turnId !== a.identity.turnId) return unowned("foreign-turn");
+    const identity = { ...a.identity, threadId, turnId, ...(itemId ? { itemId } : {}) };
+    const status = (): SessionEvent[] => [{ ...identity, kind: "native_status", timestamp: Date.now(), raw: { method } }];
     if (method === "turn/completed") {
-      const usage = (params.usage ?? params.tokenUsage) as
-        | Record<string, number>
-        | undefined;
-      const tokens = usage
-        ? {
-            input: (usage.inputTokens ?? usage.input_tokens ?? 0) as number,
-            output: (usage.outputTokens ?? usage.output_tokens ?? 0) as number,
-          }
-        : undefined;
-      this._turnDone?.resolve(tokens);
+      if (!turn || turn.status === "inProgress") return unowned("unrecognized-event");
+      const error = object(turn.error);
+      if (turn.error != null && typeof error?.message !== "string") return unowned("unrecognized-event");
+      this._seenTerminals.add(turnId);
+      this._turnDone?.();
       this._turnDone = undefined;
-      // Note: no `tokens` on this event — _sendTurn returns them to _dispatchTurn,
-      // which does the accounting once. Putting tokens here too would double-count.
-      return [{ kind: "result", timestamp: Date.now(), text: this._resultText, raw: msg }];
+      return [{ ...identity, kind: "result", timestamp: Date.now(), text: a.content,
+        nativeOutcome: turn.status === "completed" && !error ? "completed" : "failed",
+        terminal: { type: method, turnId, subtype: turn.status, ...(error ? { reason: error.message as string } : {}) } }];
+    }
+    if (method === "thread/tokenUsage/updated") {
+      const last = object(object(params?.tokenUsage)?.last);
+      if (typeof last?.inputTokens !== "number" || typeof last?.outputTokens !== "number"
+        || !Number.isSafeInteger(last.inputTokens) || !Number.isSafeInteger(last.outputTokens) || last.inputTokens < 0 || last.outputTokens < 0) return unowned("unrecognized-event");
+      // `last` is a snapshot, not an additive delta. Total accounting happens once
+      // when the original native turn and RPC settle; absent usage stays absent.
+      a.tokens = { input: last.inputTokens, output: last.outputTokens };
+      return status();
+    }
+    if (method === "item/agentMessage/delta" || method === "item/commandExecution/outputDelta") {
+      if (!itemId || typeof params?.delta !== "string") return unowned("unrecognized-event");
+      const prior = this._items.get(itemId);
+      if (prior?.completed) return unowned("after-terminal");
+      if (method === "item/agentMessage/delta") {
+        if (prior && prior.type !== "agentMessage") return unowned("unmatched-tool");
+        this._items.set(itemId, { type: "agentMessage", completed: false, text: (prior?.text ?? "") + params.delta });
+        return [{ ...identity, kind: "text_delta", timestamp: Date.now(), text: params.delta }];
+      }
+      if (prior?.type !== "commandExecution") return unowned("unmatched-tool");
+      return [{ ...identity, kind: "native_status", timestamp: Date.now(), toolName: "shell", text: params.delta }];
     }
-
     if (method === "item/completed" || method === "item/started") {
-      const item = (params.item ?? params) as Record<string, unknown>;
-      return classifyCodexEvent(item, "type");
+      if (!itemId || !item || typeof item.type !== "string") return unowned("unrecognized-event");
+      if (item.type === "agentMessage") {
+        if (method !== "item/completed") return status();
+        if (this._items.get(itemId)?.completed) return unowned("after-terminal");
+        if (typeof item.text !== "string" || (item.phase != null && !["commentary", "final_answer"].includes(String(item.phase)))) return unowned("unrecognized-event");
+        this._items.set(itemId, { type: item.type, completed: true });
+        return [{ ...identity, kind: "text", timestamp: Date.now(), text: item.text }];
+      }
+      if (item.type === "commandExecution") {
+        if (typeof item.command !== "string") return unowned("malformed-tool");
+        const prior = this._items.get(itemId);
+        if (method === "item/started") {
+          if (prior) return unowned("duplicate-tool");
+          this._items.set(itemId, { type: item.type, input: item.command, completed: false });
+          return [{ ...identity, kind: "tool_use", timestamp: Date.now(), toolName: "shell", toolInput: { command: item.command } }];
+        }
+        if (!prior || prior.type !== item.type || prior.input !== item.command) return unowned("unmatched-tool");
+        if (prior.completed) return unowned("duplicate-tool");
+        if (!["completed", "failed", "declined"].includes(String(item.status))) return unowned("malformed-tool");
+        prior.completed = true;
+        return [{ ...identity, kind: "tool_result", timestamp: Date.now(), toolName: "shell",
+          ...(typeof item.aggregatedOutput === "string" ? { toolOutput: item.aggregatedOutput } : { toolOutputOmitted: true }),
+          toolError: item.status !== "completed" || (typeof item.exitCode === "number" && item.exitCode !== 0) }];
+      }
+      if (item.type === "mcpToolCall") {
+        if (typeof item.server !== "string" || !item.server || typeof item.tool !== "string" || !item.tool) return unowned("malformed-tool");
+        const prior = this._items.get(itemId);
+        const tool = { toolServer: item.server, toolMethod: item.tool, toolName: `mcp__${item.server}__${item.tool}` };
+        if (method === "item/started") {
+          if (prior) return unowned("duplicate-tool");
+          if (item.status !== "inProgress") return unowned("malformed-tool");
+          this._items.set(itemId, { type: item.type, server: item.server, tool: item.tool, input: retainEvidence(item.arguments), completed: false });
+          return [{ ...identity, ...tool, kind: "tool_use", timestamp: Date.now(), ...publicMcpArguments(item.arguments) }];
+        }
+        if (!prior || prior.type !== item.type || prior.server !== item.server || prior.tool !== item.tool || !isDeepStrictEqual(prior.input, item.arguments)) return unowned("unmatched-tool");
+        if (prior.completed) return unowned("duplicate-tool");
+        if (!["completed", "failed"].includes(String(item.status))) return unowned("malformed-tool");
+        const error = object(item.error), result = object(item.result);
+        const output = result ? publicMcpResult({ Ok: { content: result.content } }) : undefined;
+        if (item.error != null && typeof error?.message !== "string") return unowned("malformed-tool");
+        prior.completed = true;
+        return [{ ...identity, ...tool, kind: "tool_result", timestamp: Date.now(),
+          ...(output ?? (error ? { toolOutput: error.message as string } : { toolOutputOmitted: true })),
+          toolError: item.status === "failed" || !!error,
+          ...(result && Object.keys(result).some(k => k !== "content" && result[k] != null) ? { toolOutputOmitted: true } : {}) }];
+      }
+      // Reasoning and unsupported items retain safe identity/type diagnostics only.
+      return unowned("unrecognized-event");
     }
-
-    // turn/started and other lifecycle notifications carry no turn content.
-    return [];
+    return method === "turn/started" ? status() : unowned("unrecognized-event");
   }
 }
 
@@ -838,6 +1185,50 @@ export class CodexAppServerSession extends BaseCodexSession {
 //   command_execution / commandExecution → tool_use (+ tool_result when done)
 //   token_count / usage              → tokens (attached to a result event)
 
+const object = (value: unknown): Record<string, unknown> | undefined =>
+  value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+
+function publicMcpArguments(value: unknown): Pick<SessionEvent, "toolInput" | "toolInputOmitted"> {
+  if (!object(value)) return { toolInputOmitted: "Native arguments absent or not an object" };
+  let omitted = false;
+  const clean = (v: unknown, depth = 0): unknown => {
+    if (depth > 32) { omitted = true; return null; }
+    if (v === null || ["string", "number", "boolean"].includes(typeof v)) return v;
+    if (Array.isArray(v)) return v.map(x => clean(x, depth + 1));
+    if (!object(v)) { omitted = true; return null; }
+    return Object.fromEntries(Object.entries(v as Record<string, unknown>).flatMap(([key, item]) => {
+      if (/^(?:__proto__|constructor|prototype|env|environment|authorization|credentials?|api[-_]?key|access[-_]?token|refresh[-_]?token|password|secret|reasoning|thinking)$/i.test(key)) { omitted = true; return []; }
+      return [[key, clean(item, depth + 1)]];
+    }));
+  };
+  const toolInput = clean(value) as Record<string, unknown>;
+  return { toolInput, ...(omitted ? { toolInputOmitted: "Non-public or unsupported argument fields omitted" } : {}) };
+}
+
+/** Rust Result<CallToolResult,String> from protocol.rs. This is legacy event
+ * normalization, not the app-server ThreadItem schema. Keep all public text
+ * blocks (including the bridge's JSON receipt), not arbitrary envelope fields. */
+function publicMcpResult(value: unknown): Pick<SessionEvent, "toolOutput" | "toolError" | "toolOutputOmitted"> | undefined {
+  const result = object(value);
+  if (!result || Object.keys(result).length !== 1) return;
+  if (typeof result.Err === "string") return { toolOutput: result.Err, toolError: true };
+  const ok = object(result.Ok);
+  if (!ok || !Array.isArray(ok.content) || (ok.isError !== undefined && typeof ok.isError !== "boolean")) return;
+  let omitted = Object.keys(ok).some(k => k !== "content" && k !== "isError");
+  const content = ok.content.map(value => {
+    const block = object(value);
+    if (block?.type === "text" && typeof block.text === "string") {
+      if (Object.keys(block).some(k => k !== "type" && k !== "text")) omitted = true;
+      return { type: "text", text: block.text };
+    }
+    omitted = true;
+    // Unknown shape values are not safe labels. Known non-text types retain type only.
+    return { type: ["image", "audio", "resource", "resource_link"].includes(String(block?.type)) ? block!.type : "unsupported" };
+  });
+  return { toolOutput: JSON.stringify({ content, ...(ok.isError !== undefined ? { isError: ok.isError } : {}) }),
+    ...(ok.isError !== undefined ? { toolError: ok.isError as boolean } : {}), ...(omitted ? { toolOutputOmitted: true } : {}) };
+}
+
 function classifyCodexEvent(
   ev: Record<string, unknown>,
   tag: string,
@@ -874,7 +1265,7 @@ function classifyCodexEvent(
   ) {
     const command = (ev.command ?? ev.cmd) as string | string[] | undefined;
     const cmdStr = Array.isArray(command) ? command.join(" ") : command;
-    events.push({
+    if (type !== "exec_command_end") events.push({
       kind: "tool_use",
       timestamp: ts,
       toolName: "shell",