@inixiative/agent-session 0.1.0 → 0.3.0

package/src/codex-session.ts

@@ -1,3 +1,8 @@
+import { isDeepStrictEqual } from 'node:util';
+import { codexLimitSnapshot, type LimitSnapshot, mergeLimits } from './limits';
+import { retainEvidence } from './retained-evidence';
+import { TRANSPORTS } from './transport';
+import { TurnState } from './turn-state';
 // ---------------------------------------------------------------------------
 // CodexSession — long-lived OpenAI Codex CLI process with full event capture
 // ---------------------------------------------------------------------------
@@ -8,7 +13,7 @@
 // the shared SessionEvent taxonomy and resolving a turn on completion.
 //
 //   CodexMcpSession        (default)      — `codex mcp-server`  (stdio MCP JSON-RPC)
-//   CodexAppServerSession  (experimental) — `codex app-server`  (WebSocket JSON-RPC)
+//   CodexAppServerSession  (experimental) — `codex app-server`  (stdio JSON-RPC)
 //
 // Both DISABLE codex's own approvals + sandbox (the union of
 // `--dangerously-bypass-approvals-and-sandbox`) so OUR container is the only
@@ -30,19 +35,20 @@
 import type {
   BeforeSendHook,
   HarnessSession,
+  NativeInterruptOutcome,
+  SessionArtifact,
   SessionEvent,
   SessionEventHandler,
   SessionResult,
-  SessionArtifact,
-} from "./harness-session";
+} from './harness-session';
 
 // Re-export types so importers can stay on one path (mirrors claude-code-session).
 export type {
+  SessionArtifact,
   SessionEvent,
   SessionEventKind,
   SessionResult,
-  SessionArtifact,
-} from "./harness-session";
+} from './harness-session';
 
 // ---------------------------------------------------------------------------
 // Shared subprocess shape (mirrors ClaudeCodeSession.PipedSubprocess)
@@ -67,6 +73,15 @@ export type CodexSpawn = (
 // ---------------------------------------------------------------------------
 
 export interface CodexSessionConfig {
+  /** Explicit app-server integration. Never applied by the default MCP engine.
+   * Config is native launch data, not event/recording data. */
+  appServer?: {
+    /** Persist the actual returned binding before model admission; failure blocks work. */
+    onThreadReady?: (binding: string) => void | Promise<void>;
+    requireConfiguration?: boolean;
+    config?: Readonly<Record<string, unknown>>;
+    requiredMcpServer?: { readonly name: string; readonly tools: readonly string[] };
+  };
   /** Path to codex CLI binary. Defaults to "codex". */
   bin?: string;
   /** Model. Defaults to "gpt-5.5". */
@@ -88,10 +103,12 @@ export interface CodexSessionConfig {
   baseContext?: string;
   /**
    * codex's native thread ID (the value the `codex` tool returns). When set, the
-   * first send() continues that thread via `codex-reply` — used for fork and
-   * crash recovery. Also set by a SessionAdapter resuming a mapped Foundry thread.
+   * first send() uses `codex-reply` on MCP (loaded threads only), or
+   * `thread/resume` on app-server. Only app-server supports cold resume by ID.
    */
   externalSessionId?: string;
+  /** Environment merged over process.env (e.g. CODEX_HOME for a profile). */
+  env?: Record<string, string | undefined>;
   /**
    * Override for the process spawner. Defaults to Bun.spawn. Tests inject a fake
    * subprocess that emulates the codex JSON-RPC protocol; the docker-spawn helper
@@ -105,6 +122,8 @@ export interface CodexSessionConfig {
 // ---------------------------------------------------------------------------
 
 interface QueuedTurn {
+  onAdmission?: import('./harness-session').SessionSendOptions['onAdmission'];
+  evidence: TurnState;
   message: string;
   timeout: number;
   resolve: (result: SessionResult) => void;
@@ -112,7 +131,7 @@ interface QueuedTurn {
 }
 
 // codex reasoning-effort levels (model_reasoning_effort), low→high.
-const VALID_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+const VALID_EFFORTS = ['minimal', 'low', 'medium', 'high', 'xhigh'];
 
 // ---------------------------------------------------------------------------
 // Base class — shared queue, event log, classification helpers, lifecycle
@@ -133,16 +152,19 @@ abstract class BaseCodexSession implements HarnessSession {
   protected _defaultTimeout: number;
   protected _baseContext?: string;
   protected _spawn?: CodexSpawn;
+  protected _env?: Record<string, string | undefined>;
 
   // -- Process --
   protected _proc: PipedSubprocess | null = null;
-  protected _stderr = "";
+  protected _stderr = '';
 
   // -- Session state --
   protected _externalSessionId?: string;
   protected _alive = false;
+  private _endEmitted = false;
   protected _eventLog: SessionEvent[] = [];
   protected _handlers: SessionEventHandler[] = [];
+  private _observerFailures = { synchronous: 0, asynchronous: 0 };
   protected _beforeSendHooks: BeforeSendHook[] = [];
   protected _turns = 0;
   protected _totalTokens = { input: 0, output: 0 };
@@ -163,29 +185,32 @@ abstract class BaseCodexSession implements HarnessSession {
 
   // -- Turn queue (identical to ClaudeCodeSession) --
   protected _queue: QueuedTurn[] = [];
+  protected _attempts: TurnState[] = [];
+  protected _seenTerminals = new Set<string>();
   protected _inflight: QueuedTurn | null = null;
   protected _turnEvents: SessionEvent[] = [];
-  protected _resultText = "";
+  protected _resultText = '';
   protected _turnTimer: ReturnType<typeof setTimeout> | null = null;
 
   constructor(config?: CodexSessionConfig) {
-    const bin = config?.bin ?? "codex";
-    if (!/^[a-zA-Z0-9_.\/\\-]+$/.test(bin)) {
+    const bin = config?.bin ?? 'codex';
+    if (!/^[a-zA-Z0-9_./\\-]+$/.test(bin)) {
       throw new Error(`Invalid codex CLI binary path: "${bin}"`);
     }
     if (config?.effort && !VALID_EFFORTS.includes(config.effort)) {
       throw new Error(
-        `Invalid codex effort "${config.effort}". Valid: ${VALID_EFFORTS.join(", ")}`,
+        `Invalid codex effort "${config.effort}". Valid: ${VALID_EFFORTS.join(', ')}`,
       );
     }
     this._bin = bin;
-    this._model = config?.model ?? "gpt-5.5";
+    this._model = config?.model ?? 'gpt-5.5';
     this._effort = config?.effort;
     this._cwd = config?.cwd ?? process.cwd();
     this._defaultTimeout = config?.timeout ?? 600_000;
     this._baseContext = config?.baseContext;
     this._externalSessionId = config?.externalSessionId;
     this._spawn = config?.spawn;
+    this._env = config?.env;
     this._startedAt = Date.now();
   }
 
@@ -193,10 +218,28 @@ abstract class BaseCodexSession implements HarnessSession {
   // Accessors (identical to ClaudeCodeSession)
   // ---------------------------------------------------------------------------
 
-  get alive(): boolean { return this._alive; }
-  get externalSessionId(): string | undefined { return this._externalSessionId; }
-  get events(): readonly SessionEvent[] { return this._eventLog; }
-  get turns(): number { return this._turns; }
+  get accounting() {
+    return 'observed-only' as const;
+  }
+  get attempts() {
+    return this._attempts.map((a) => a.snapshot());
+  }
+  get diagnostics() {
+    return Object.freeze({ observerFailures: Object.freeze({ ...this._observerFailures }) });
+  }
+
+  get alive(): boolean {
+    return this._alive;
+  }
+  get externalSessionId(): string | undefined {
+    return this._externalSessionId;
+  }
+  get events(): readonly SessionEvent[] {
+    return Object.freeze([...this._eventLog]);
+  }
+  get turns(): number {
+    return this._turns;
+  }
   get totalTokens(): Readonly<{ input: number; output: number }> {
     return { ...this._totalTokens };
   }
@@ -229,7 +272,7 @@ abstract class BaseCodexSession implements HarnessSession {
    */
   async push(payload: { kind: string; text: string }): Promise<void> {
     this._emit({
-      kind: "error",
+      kind: 'error',
       timestamp: Date.now(),
       text: `push_ignored: kind=${payload.kind} — codex turn has no OOB channel`,
       raw: payload,
@@ -242,7 +285,10 @@ abstract class BaseCodexSession implements HarnessSession {
 
   interrupt(): void {
     if (!this._inflight) return;
-    this._rejectInflight(new Error("Turn interrupted"));
+    this._rejectInflight(
+      new Error('Local waiter interrupted; native cancellation unacknowledged'),
+      'interrupt-request',
+    );
   }
 
   kill(): void {
@@ -254,29 +300,40 @@ abstract class BaseCodexSession implements HarnessSession {
       this._turnTimer = null;
     }
 
-    this._rejectInflight(new Error("Session killed"));
-    this._rejectQueue(new Error("Session killed"));
-    for (const p of this._pending.values()) p.reject(new Error("Session killed"));
+    this._rejectInflight(new Error('Session killed; native outcome may remain unknown'), 'killed');
+    this._rejectQueue(new Error('Session killed'));
+    for (const p of this._pending.values()) p.reject(new Error('Session killed'));
     this._pending.clear();
 
-    try { this._proc.stdin.end(); } catch { /* already closed */ }
-    try { this._proc.kill(); } catch { /* already dead */ }
+    try {
+      this._proc.stdin.end();
+    } catch {
+      /* already closed */
+    }
+    try {
+      this._proc.kill();
+    } catch {
+      /* already dead */
+    }
     this._proc = null;
 
-    this._emit({ kind: "session_end", timestamp: Date.now() });
+    this._emit({ kind: 'session_end', timestamp: Date.now() });
   }
 
   artifact(): SessionArtifact {
     return {
       externalSessionId: this._externalSessionId,
+      attempts: this.attempts,
+      accounting: 'observed-only',
+      diagnostics: this.diagnostics,
       events: [...this._eventLog],
       startedAt: this._startedAt,
       endedAt: this._alive ? undefined : Date.now(),
       turns: this._turns,
       totalTokens: { ...this._totalTokens },
-      toolCalls: this._eventLog.filter((e) => e.kind === "tool_use").length,
-      toolResults: this._eventLog.filter((e) => e.kind === "tool_result").length,
-      errors: this._eventLog.filter((e) => e.kind === "error").length,
+      toolCalls: this._eventLog.filter((e) => e.kind === 'tool_use').length,
+      toolResults: this._eventLog.filter((e) => e.kind === 'tool_result').length,
+      errors: this._eventLog.filter((e) => e.kind === 'error').length,
     };
   }
 
@@ -285,43 +342,53 @@ abstract class BaseCodexSession implements HarnessSession {
   // ---------------------------------------------------------------------------
 
   async start(): Promise<void> {
-    if (this._proc) throw new Error("Session already started");
+    if (this._attempts.some((a) => a.dispatch === 'attempted' && a.nativeOutcome === 'unknown'))
+      throw new Error('Native outcome unresolved; automatic resume is blocked');
+    if (this._proc) throw new Error('Session already started');
 
     const args = this._buildSpawnArgs();
     const env: Record<string, string | undefined> = {
       ...process.env,
-      DISABLE_AUTOUPDATER: "1",
+      ...this._env,
+      DISABLE_AUTOUPDATER: '1',
     };
+    // Subscription transport: an inherited API key never selects metered billing.
+    delete env.OPENAI_API_KEY;
+    delete env.CODEX_API_KEY;
+    for (const key of Object.keys(env)) if (env[key] === undefined) delete env[key];
 
     if (this._spawn) {
       this._proc = this._spawn([this._bin, ...args], { cwd: this._cwd, env });
     } else {
       this._proc = Bun.spawn([this._bin, ...args], {
         cwd: this._cwd,
-        stdin: "pipe",
-        stdout: "pipe",
-        stderr: "pipe",
+        stdin: 'pipe',
+        stdout: 'pipe',
+        stderr: 'pipe',
         env,
       }) as unknown as PipedSubprocess;
     }
 
     this._alive = true;
-    this._emit({ kind: "session_start", timestamp: Date.now() });
+    this._endEmitted = false;
+    this._emit({ kind: 'session_start', timestamp: Date.now() });
 
-    this._readStdout();
+    const proc = this._proc;
+    const stdoutDone = this._readStdout(proc);
     this._readStderr();
 
-    this._proc.exited.then((code) => {
-      if (!this._alive) return;
+    proc.exited.then(async (code) => {
+      if (this._proc !== proc || !this._alive) return;
       this._alive = false;
+      await stdoutDone; // Drain buffered terminal evidence before interpreting process exit.
       const errMsg = this._stderr.trim()
         ? `Process exited (code ${code}): ${this._stderr.trim().slice(0, 500)}`
         : `Process exited with code ${code}`;
       this._rejectInflight(new Error(errMsg));
-      this._rejectQueue(new Error("Session ended"));
-      for (const p of this._pending.values()) p.reject(new Error("Session ended"));
+      this._rejectQueue(new Error('Session ended'));
+      for (const p of this._pending.values()) p.reject(new Error('Session ended'));
       this._pending.clear();
-      this._emit({ kind: "session_end", timestamp: Date.now() });
+      this._emit({ kind: 'session_end', timestamp: Date.now(), transportOutcome: 'failed' });
     });
 
     await this._handshake();
@@ -333,13 +400,25 @@ abstract class BaseCodexSession implements HarnessSession {
 
   async send(
     message: string,
-    opts?: { timeout?: number },
+    opts?: import('./harness-session').SessionSendOptions,
   ): Promise<SessionResult> {
+    if (
+      this._attempts.some(
+        (a) =>
+          a.dispatch === 'attempted' &&
+          a.nativeOutcome === 'unknown' &&
+          (!this._alive || a.localOutcome !== 'pending'),
+      )
+    ) {
+      const blocked = new TurnState();
+      this._attempts.push(blocked);
+      throw blocked.fail(new Error('Native outcome unresolved; send not dispatched'), 'blocked');
+    }
     if (!this._proc && this._externalSessionId) {
       await this.start();
     }
-    if (!this._proc) throw new Error("Session not started — call start() first");
-    if (!this._alive) throw new Error("Session ended");
+    if (!this._proc) throw new Error('Session not started — call start() first');
+    if (!this._alive) throw new Error('Session ended');
 
     const timeout = opts?.timeout ?? this._defaultTimeout;
 
@@ -355,7 +434,25 @@ abstract class BaseCodexSession implements HarnessSession {
     }
 
     return new Promise<SessionResult>((resolve, reject) => {
-      const turn: QueuedTurn = { message: transformed, timeout, resolve, reject };
+      const evidence = new TurnState();
+      this._attempts.push(evidence);
+      const turn: QueuedTurn = {
+        evidence,
+        message: transformed,
+        timeout,
+        resolve,
+        reject,
+        onAdmission: opts?.onAdmission,
+      };
+      if (!this._alive || (this._inflight && this._inflight.evidence.localOutcome !== 'pending')) {
+        reject(
+          evidence.fail(
+            new Error('Previous native work unresolved; send not dispatched'),
+            'blocked',
+          ),
+        );
+        return;
+      }
       if (!this._inflight) {
         this._dispatchTurn(turn);
       } else {
@@ -368,16 +465,52 @@ abstract class BaseCodexSession implements HarnessSession {
   // Private — turn dispatch + queue (mirrors ClaudeCodeSession)
   // ---------------------------------------------------------------------------
 
+  readonly admissionProtocol = 'prewrite-v1' as const;
+  inspectAttempt(admissionId: string) {
+    return this._attempts.find((attempt) => attempt.admissionId === admissionId)?.snapshot();
+  }
+
   private _dispatchTurn(turn: QueuedTurn): void {
     this._inflight = turn;
-    this._turnEvents = [];
-    this._resultText = "";
+    if (turn.onAdmission) {
+      Promise.resolve()
+        .then(() => turn.onAdmission!(turn.evidence.snapshot()))
+        .then(() => {
+          if (this._inflight === turn && this._alive && turn.evidence.localOutcome === 'pending')
+            this._writeTurn(turn);
+          else if (this._inflight === turn && turn.evidence.dispatch === 'not-dispatched') {
+            this._inflight = null;
+            this._processNextTurn();
+          }
+        })
+        .catch((error) => {
+          turn.reject(
+            turn.evidence.fail(
+              error instanceof Error ? error : new Error(String(error)),
+              'registration',
+            ),
+          );
+          if (this._inflight === turn) {
+            this._inflight = null;
+            this._processNextTurn();
+          }
+        });
+      return;
+    }
+    this._writeTurn(turn);
+  }
+
+  private _writeTurn(turn: QueuedTurn): void {
+    turn.evidence.dispatch = 'attempted';
+    this._turnEvents = turn.evidence.events;
+    this._resultText = '';
 
     // Send via the subclass's wire protocol. The returned promise resolves when
     // the tools/call (or turn) completes; that resolves the turn.
     this._sendTurn(turn.message)
       .then((tokens) => {
-        if (this._inflight !== turn) return; // interrupted / timed out
+        if (this._inflight !== turn) return;
+        turn.evidence.rpcSettled = true;
         if (tokens) {
           this._totalTokens.input += tokens.input;
           this._totalTokens.output += tokens.output;
@@ -386,14 +519,16 @@ abstract class BaseCodexSession implements HarnessSession {
       })
       .catch((err: Error) => {
         if (this._inflight !== turn) return;
-        this._rejectInflight(err);
-        this._processNextTurn();
+        turn.evidence.rpcSettled = true;
+        if (turn.evidence.rpcOutcome === 'pending') turn.evidence.rpcOutcome = 'unknown';
+        this._rejectInflight(err, err instanceof NativeValidationError ? 'validation' : 'rpc');
+        this._releaseKnownTurn();
       });
 
     if (turn.timeout > 0) {
       this._turnTimer = setTimeout(() => {
         this._turnTimer = null;
-        this._rejectInflight(new Error(`Turn timed out after ${turn.timeout}ms`));
+        this._rejectInflight(new Error(`Turn timed out after ${turn.timeout}ms`), 'timeout');
       }, turn.timeout);
     }
   }
@@ -406,38 +541,64 @@ abstract class BaseCodexSession implements HarnessSession {
       this._turnTimer = null;
     }
 
+    const a = this._inflight.evidence;
+    a.content = this._resultText;
+    a.tokens = tokens ?? a.tokens;
+    if (a.localOutcome === 'pending') {
+      a.localOutcome = 'resolved';
+      this._inflight.resolve(a.result(this._externalSessionId));
+    }
+    if (a.nativeOutcome === 'unknown')
+      this._rejectQueue(new Error('Native terminal missing; queued send not dispatched'));
+    this._releaseKnownTurn();
+  }
+
+  private _releaseKnownTurn(): void {
+    const a = this._inflight?.evidence;
+    if (!a || !this._canReleaseAttempt(a) || a.nativeOutcome === 'unknown') return;
     this._turns++;
-    const result: SessionResult = {
-      content: this._resultText,
-      events: [...this._turnEvents],
-      tokens: tokens ?? this._turnEvents.find((e) => e.tokens)?.tokens,
-      externalSessionId: this._externalSessionId,
-    };
-    this._inflight.resolve(result);
     this._inflight = null;
-
     this._processNextTurn();
   }
 
+  protected _canReleaseAttempt(attempt: TurnState): boolean {
+    return attempt.rpcSettled;
+  }
+
   private _processNextTurn(): void {
-    if (this._queue.length > 0 && this._alive) {
+    if (!this._inflight && this._queue.length > 0 && this._alive) {
       const next = this._queue.shift()!;
       this._dispatchTurn(next);
     }
   }
 
-  protected _rejectInflight(err: Error): void {
+  protected _rejectInflight(
+    err: Error,
+    reason: import('./harness-session').SessionAttempt['localFailure'] = 'transport',
+  ): void {
     if (!this._inflight) return;
     if (this._turnTimer) {
       clearTimeout(this._turnTimer);
       this._turnTimer = null;
     }
-    this._inflight.reject(err);
-    this._inflight = null;
+    const a = this._inflight.evidence;
+    if ((reason === 'transport' || reason === 'killed') && a.transportOutcome === 'open')
+      a.transportOutcome = reason === 'killed' ? 'closed' : 'failed';
+    if (a.localOutcome === 'pending') this._inflight.reject(a.fail(err, reason));
+    this._rejectQueue(new Error('Previous native work unresolved; queued send not dispatched'));
+  }
+
+  private _transportFailure(err: Error): void {
+    this._alive = false;
+    this._rejectInflight(err);
+    this._rejectQueue(err);
+    this._emit({ kind: 'session_end', timestamp: Date.now(), transportOutcome: 'failed' });
+    for (const p of this._pending.values()) p.reject(err);
+    this._pending.clear();
   }
 
   protected _rejectQueue(err: Error): void {
-    for (const turn of this._queue) turn.reject(err);
+    for (const turn of this._queue) turn.reject(turn.evidence.fail(err, 'blocked'));
     this._queue = [];
   }
 
@@ -445,25 +606,33 @@ abstract class BaseCodexSession implements HarnessSession {
   // Private — stdout/stderr readers (mirrors ClaudeCodeSession)
   // ---------------------------------------------------------------------------
 
-  private async _readStdout(): Promise<void> {
-    const reader = this._proc!.stdout.getReader();
+  private async _readStdout(proc: PipedSubprocess): Promise<void> {
+    const reader = proc.stdout.getReader();
     const decoder = new TextDecoder();
-    let buffer = "";
+    let buffer = '';
     try {
       while (true) {
         const { done, value } = await reader.read();
         if (done) break;
         buffer += decoder.decode(value, { stream: true });
-        const lines = buffer.split("\n");
+        const lines = buffer.split('\n');
         buffer = lines.pop()!;
         for (const line of lines) {
           if (!line.trim()) continue;
-          this._processLine(line);
+          if (this._proc === proc || !this._proc) this._processLine(line);
         }
       }
-      if (buffer.trim()) this._processLine(buffer);
+      if (buffer.trim() && (this._proc === proc || !this._proc)) this._processLine(buffer);
+      if (this._proc === proc && this._alive)
+        this._transportFailure(
+          new Error(
+            this._stderr.trim()
+              ? `Native stdout closed: ${this._stderr.trim().slice(0, 500)}`
+              : 'Native stdout closed',
+          ),
+        );
     } catch (err) {
-      this._rejectInflight(err as Error);
+      if (this._proc === proc) this._transportFailure(err as Error);
     }
   }
 
@@ -476,7 +645,9 @@ abstract class BaseCodexSession implements HarnessSession {
         if (done) break;
         this._stderr += decoder.decode(value, { stream: true });
       }
-    } catch { /* ignore */ }
+    } catch {
+      /* ignore */
+    }
   }
 
   // ---------------------------------------------------------------------------
@@ -490,36 +661,59 @@ abstract class BaseCodexSession implements HarnessSession {
     } catch {
       return;
     }
-    const raw = msg as Record<string, unknown>;
+    const raw = object(msg);
+    if (!raw) return;
+    if (
+      typeof raw.method === 'string' &&
+      (typeof raw.id === 'string' || typeof raw.id === 'number') &&
+      this._serverRequest(raw)
+    )
+      return;
 
     // JSON-RPC response to one of our requests (has matching `id` + result/error).
-    if (typeof raw.id === "number" && (("result" in raw) || ("error" in raw))) {
+    if (typeof raw.id === 'number' && ('result' in raw || 'error' in raw)) {
       const pending = this._pending.get(raw.id);
       if (pending) {
         this._pending.delete(raw.id);
-        if ("error" in raw && raw.error) {
+        const a = this._inflight?.evidence;
+        if (a?.identity.rpcRequestId === raw.id) a.rpcOutcome = raw.error ? 'failed' : 'resolved';
+        if ('error' in raw && raw.error) {
           const e = raw.error as Record<string, unknown>;
           pending.reject(new Error((e.message as string) ?? JSON.stringify(e)));
         } else {
-          pending.resolve(raw.result);
+          // Apply protocol identity synchronously before later lines in this
+          // same stdout chunk. Awaiting the promise first can lose a terminal.
+          try {
+            this._observeRpcResult(raw.id, raw.result);
+            pending.resolve(raw.result);
+          } catch (error) {
+            pending.reject(error instanceof Error ? error : new Error(String(error)));
+          }
         }
         return;
       }
     }
 
-    // Otherwise it's a notification (streamed event) — classify it.
     const classified = this._classify(raw);
     for (const event of classified) {
-      this._emit(event);
-      this._turnEvents.push(event);
-      if (event.kind === "result" || event.kind === "text") {
-        if (event.text) this._resultText = event.text;
+      const a = this._inflight?.evidence;
+      if (!a || event.unattributedReason) {
+        this._emit(event);
+        continue;
+      }
+      const e = a.record(event);
+      this._resultText = a.content;
+      if (e.nativeOutcome && e.terminal) {
+        a.nativeOutcome = e.nativeOutcome;
+        a.terminal = e.terminal;
       }
-      if (event.tokens) {
-        this._totalTokens.input += event.tokens.input;
-        this._totalTokens.output += event.tokens.output;
+      if (e.tokens) {
+        this._totalTokens.input += e.tokens.input;
+        this._totalTokens.output += e.tokens.output;
       }
+      this._emit(e);
     }
+    this._releaseKnownTurn();
   }
 
   // ---------------------------------------------------------------------------
@@ -527,15 +721,22 @@ abstract class BaseCodexSession implements HarnessSession {
   // ---------------------------------------------------------------------------
 
   protected _emit(event: SessionEvent): void {
+    event = retainEvidence(event);
+    if (event.kind === 'session_end') {
+      if (this._endEmitted) return;
+      this._endEmitted = true;
+    }
     this._eventLog.push(event);
     for (const handler of this._handlers) {
       try {
-        handler(event);
-      } catch (err) {
-        console.warn(
-          `[${this.constructor.name}] handler error:`,
-          (err as Error).message,
-        );
+        const observation: unknown = handler(event);
+        if (observation && typeof (observation as PromiseLike<unknown>).then === 'function') {
+          void Promise.resolve(observation).catch(() => {
+            this._observerFailures.asynchronous++;
+          });
+        }
+      } catch {
+        this._observerFailures.synchronous++;
       }
     }
   }
@@ -546,7 +747,11 @@ abstract class BaseCodexSession implements HarnessSession {
 
   protected _rpcRequest(method: string, params?: unknown): Promise<unknown> {
     const id = ++this._rpcId;
-    const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n";
+    if ((method === 'tools/call' || method === 'turn/start') && this._inflight) {
+      this._inflight.evidence.identity = { ...this._inflight.evidence.identity, rpcRequestId: id };
+      this._inflight.evidence.rpcOutcome = 'pending';
+    }
+    const payload = `${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`;
     return new Promise<unknown>((resolve, reject) => {
       this._pending.set(id, { resolve, reject });
       try {
@@ -559,8 +764,12 @@ abstract class BaseCodexSession implements HarnessSession {
     });
   }
 
+  protected _serverRequest(_request: Record<string, unknown>): boolean {
+    return false;
+  }
+
   protected _rpcNotify(method: string, params?: unknown): void {
-    const payload = JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n";
+    const payload = `${JSON.stringify({ jsonrpc: '2.0', method, params })}\n`;
     this._proc!.stdin.write(payload);
     this._proc!.stdin.flush();
   }
@@ -580,12 +789,13 @@ abstract class BaseCodexSession implements HarnessSession {
   /** Map a streamed notification to SessionEvents. */
   protected abstract _classify(msg: Record<string, unknown>): SessionEvent[];
 
+  protected _observeRpcResult(_id: number, _result: unknown): void {}
+
   /** Shared fork constructor — subclass passes its own ctor. */
   fork(opts?: { cwd?: string; baseContext?: string }): HarnessSession {
+    if (this._inflight) throw new Error('Cannot fork while native ownership is unresolved');
     if (!this._externalSessionId) {
-      throw new Error(
-        "Cannot fork — no thread ID yet (send at least one message first)",
-      );
+      throw new Error('Cannot fork — no thread ID yet (send at least one message first)');
     }
     const Ctor = this.constructor as new (c?: CodexSessionConfig) => BaseCodexSession;
     const forked = new Ctor({
@@ -597,6 +807,7 @@ abstract class BaseCodexSession implements HarnessSession {
       baseContext: opts?.baseContext ?? this._baseContext,
       externalSessionId: this._externalSessionId,
       spawn: this._spawn,
+      env: this._env,
     });
     forked._forking = true;
     return forked;
@@ -617,37 +828,44 @@ abstract class BaseCodexSession implements HarnessSession {
 // multi-turn + fork).
 
 export class CodexMcpSession extends BaseCodexSession {
+  get transport() {
+    return TRANSPORTS['codex-mcp'];
+  }
+  private _mcpAdmission?: string;
+  private _mcpCalls = new Map<string, { invocation: Record<string, unknown>; ended: boolean }>();
   protected _buildSpawnArgs(): string[] {
     // Disable codex's own approvals + sandbox (the union of
     // --dangerously-bypass-approvals-and-sandbox) so OUR container is the jail.
     // model_reasoning_effort sets the effort level; passed as TOML-ish `-c` values.
     const args = [
-      "mcp-server",
-      "-c", `sandbox_mode="danger-full-access"`,
-      "-c", `approval_policy="never"`,
+      'mcp-server',
+      '-c',
+      `sandbox_mode="danger-full-access"`,
+      '-c',
+      `approval_policy="never"`,
     ];
     if (this._effort) {
-      args.push("-c", `model_reasoning_effort="${this._effort}"`);
+      args.push('-c', `model_reasoning_effort="${this._effort}"`);
     }
     return args;
   }
 
   protected async _handshake(): Promise<void> {
-    await this._rpcRequest("initialize", {
-      protocolVersion: "2025-06-18",
+    await this._rpcRequest('initialize', {
+      protocolVersion: '2025-06-18',
       capabilities: {},
-      clientInfo: { name: "inixiative-bench", version: "0.1.0" },
+      clientInfo: { name: 'inixiative-bench', version: '0.1.0' },
     });
-    this._rpcNotify("notifications/initialized");
+    this._rpcNotify('notifications/initialized');
     // tools/list confirms the `codex` + `codex-reply` tools are present.
-    await this._rpcRequest("tools/list", {});
+    await this._rpcRequest('tools/list', {});
   }
 
   protected async _sendTurn(
     message: string,
   ): Promise<{ input: number; output: number } | undefined> {
     const isReply = this._externalSessionId !== undefined;
-    const name = isReply ? "codex-reply" : "codex";
+    const name = isReply ? 'codex-reply' : 'codex';
     const args: Record<string, unknown> = isReply
       ? { prompt: message, threadId: this._externalSessionId }
       : {
@@ -655,31 +873,34 @@ export class CodexMcpSession extends BaseCodexSession {
           model: this._model,
           cwd: this._cwd,
           // Belt-and-suspenders: also disable per-call (matches spawn `-c` flags).
-          sandbox: "danger-full-access",
-          "approval-policy": "never",
-          ...(this._effort
-            ? { config: { model_reasoning_effort: this._effort } }
-            : {}),
+          sandbox: 'danger-full-access',
+          'approval-policy': 'never',
+          ...(this._effort ? { config: { model_reasoning_effort: this._effort } } : {}),
         };
 
-    const result = (await this._rpcRequest("tools/call", {
+    const result = (await this._rpcRequest('tools/call', {
       name,
       arguments: args,
     })) as Record<string, unknown> | undefined;
 
     // Capture the threadId for multi-turn (codex-reply) + fork.
-    const structured = result?.structuredContent as
-      | Record<string, unknown>
-      | undefined;
+    const structured = result?.structuredContent as Record<string, unknown> | undefined;
     const threadId = structured?.threadId as string | undefined;
+    if (threadId && this._externalSessionId && threadId !== this._externalSessionId)
+      throw new Error('MCP response changed the native resume binding');
     if (threadId && !this._externalSessionId) {
       this._externalSessionId = threadId;
     }
+    if (threadId && this._inflight)
+      this._inflight.evidence.identity = { ...this._inflight.evidence.identity, threadId };
     // Final text: prefer structuredContent.content, else the tool result content.
     const finalText =
-      (structured?.content as string | undefined) ??
-      this._extractToolText(result?.content);
-    if (finalText) this._resultText = finalText;
+      (structured?.content as string | undefined) ?? this._extractToolText(result?.content);
+    if (result?.isError === true) throw new Error(finalText ?? 'MCP tools/call failed');
+    if (finalText) {
+      this._resultText = finalText;
+      if (this._inflight) this._inflight.evidence.content = finalText;
+    }
 
     // Usage, when the call result reports it. Streamed token_count events are
     // already accounted by the base loop; the call result is the authoritative
@@ -688,7 +909,12 @@ export class CodexMcpSession extends BaseCodexSession {
     // token event was seen this turn.
     const sawStreamedTokens = this._turnEvents.some((e) => e.tokens);
     const usage = structured?.usage as Record<string, number> | undefined;
-    if (usage && !sawStreamedTokens) {
+    if (
+      usage &&
+      !sawStreamedTokens &&
+      typeof (usage.input_tokens ?? usage.inputTokens) === 'number' &&
+      typeof (usage.output_tokens ?? usage.outputTokens) === 'number'
+    ) {
       return {
         input: (usage.input_tokens ?? usage.inputTokens ?? 0) as number,
         output: (usage.output_tokens ?? usage.outputTokens ?? 0) as number,
@@ -702,126 +928,901 @@ export class CodexMcpSession extends BaseCodexSession {
     const parts: string[] = [];
     for (const block of content) {
       const b = block as Record<string, unknown>;
-      if (b.type === "text" && typeof b.text === "string") parts.push(b.text);
+      if (b.type === 'text' && typeof b.text === 'string') parts.push(b.text);
     }
-    return parts.length ? parts.join("\n") : undefined;
+    return parts.length ? parts.join('\n') : undefined;
   }
 
   protected _classify(msg: Record<string, unknown>): SessionEvent[] {
     // Streamed events arrive as JSON-RPC notifications: method "codex/event"
     // with params carrying a `msg` of a tagged type.
-    if (msg.method !== "codex/event") return [];
+    if (msg.method !== 'codex/event') return [];
     const params = msg.params as Record<string, unknown> | undefined;
     const ev = (params?.msg ?? params) as Record<string, unknown> | undefined;
     if (!ev) return [];
-    return classifyCodexEvent(ev, "type");
+    const a = this._inflight?.evidence;
+    const str = (v: unknown) => (typeof v === 'string' ? v : undefined);
+    const nativeSessionId = str(ev.session_id),
+      threadId = str(ev.thread_id);
+    const turnId = str(ev.turn_id),
+      envelopeId = str(params?.id);
+    const item = ev.item as Record<string, unknown> | undefined;
+    const unowned = (reason: NonNullable<SessionEvent['unattributedReason']>): SessionEvent[] => [
+      {
+        kind: 'native_status',
+        timestamp: Date.now(),
+        correlation: 'unknown',
+        unattributedReason: reason,
+        nativeSessionId,
+        threadId,
+        turnId,
+        callId: str(ev.call_id),
+        itemId: str(item?.id) ?? str(ev.item_id),
+        // Keep the envelope too: params.id may explain a rejected correlation.
+        // Unowned MCP calls retain identity/type diagnostics, never unrelated tool payloads.
+        raw:
+          ev.type === 'mcp_tool_call_begin' || ev.type === 'mcp_tool_call_end'
+            ? { type: ev.type }
+            : msg,
+      },
+    ];
+    if (threadId && this._externalSessionId && threadId !== this._externalSessionId)
+      return unowned('foreign-session');
+    if (
+      nativeSessionId &&
+      a?.identity.nativeSessionId &&
+      nativeSessionId !== a.identity.nativeSessionId
+    )
+      return unowned('foreign-session');
+    if (
+      (envelopeId && this._seenTerminals.has(envelopeId)) ||
+      (turnId && this._seenTerminals.has(turnId))
+    ) {
+      return unowned(ev.type === 'task_complete' ? 'duplicate-terminal' : 'after-terminal');
+    }
+    if (!a) {
+      if (ev.type === 'task_complete' && turnId) this._seenTerminals.add(turnId);
+      return unowned('no-admission');
+    }
+    if (ev.type === 'session_configured') {
+      if (!this._externalSessionId && threadId) this._externalSessionId = threadId;
+      a.identity = { ...a.identity, nativeSessionId, threadId };
+    }
+    if (
+      ev.type !== 'session_configured' &&
+      a.identity.turnId &&
+      envelopeId &&
+      envelopeId !== a.identity.turnId
+    )
+      return unowned('foreign-turn');
+    if (threadId && a.identity.threadId && threadId !== a.identity.threadId)
+      return unowned('foreign-session');
+    if (ev.type === 'task_started' && turnId && !a.identity.turnId)
+      a.identity = { ...a.identity, turnId, correlation: 'native-turn' };
+    if (turnId && turnId !== a.identity.turnId) return unowned('foreign-turn');
+    if (ev.type === 'task_complete') {
+      if (!turnId || turnId !== a.identity.turnId) return unowned('unrecognized-event');
+      this._seenTerminals.add(turnId);
+      return [
+        {
+          ...a.identity,
+          kind: 'result',
+          timestamp: Date.now(),
+          nativeOutcome: 'completed',
+          terminal: { type: 'task_complete', turnId },
+          raw: ev,
+        },
+      ];
+    }
+    const identity = {
+      ...a.identity,
+      threadId: threadId ?? a.identity.threadId,
+      turnId: turnId ?? a.identity.turnId,
+      callId: str(ev.call_id),
+      itemId: str(item?.id) ?? str(ev.item_id),
+    };
+    if (ev.type === 'mcp_tool_call_begin' || ev.type === 'mcp_tool_call_end') {
+      const invocation = object(ev.invocation);
+      if (
+        !identity.callId ||
+        !invocation ||
+        typeof invocation.server !== 'string' ||
+        !invocation.server ||
+        typeof invocation.tool !== 'string' ||
+        !invocation.tool
+      )
+        return unowned('malformed-tool');
+      if (this._mcpAdmission !== a.identity.admissionId) {
+        this._mcpAdmission = a.identity.admissionId;
+        this._mcpCalls.clear();
+      }
+      // Compare the original argument value, including absence. Never join a result
+      // for another server/tool or silently substitute arguments from its envelope.
+      const join = {
+        server: invocation.server,
+        tool: invocation.tool,
+        arguments: invocation.arguments,
+      };
+      const prior = this._mcpCalls.get(identity.callId);
+      const tool = {
+        toolName: `mcp__${invocation.server}__${invocation.tool}`,
+        toolServer: invocation.server,
+        toolMethod: invocation.tool,
+      };
+      if (ev.type === 'mcp_tool_call_begin') {
+        if (prior) return unowned('duplicate-tool');
+        this._mcpCalls.set(identity.callId, { invocation: structuredClone(join), ended: false });
+        const args = publicMcpArguments(invocation.arguments);
+        return [{ ...identity, ...tool, kind: 'tool_use', timestamp: Date.now(), ...args }];
+      }
+      if (!prior || !isDeepStrictEqual(prior.invocation, join)) return unowned('unmatched-tool');
+      if (prior.ended) return unowned('duplicate-tool');
+      const result = publicMcpResult(ev.result);
+      if (!result) return unowned('malformed-tool');
+      prior.ended = true;
+      return [{ ...identity, ...tool, kind: 'tool_result', timestamp: Date.now(), ...result }];
+    }
+    if (
+      ['session_configured', 'task_started', 'item_started', 'item_completed'].includes(
+        String(ev.type),
+      )
+    ) {
+      return [
+        {
+          ...identity,
+          kind: 'native_status',
+          timestamp: Date.now(),
+          nativeOutcome: a.nativeOutcome,
+          raw: ev,
+        },
+      ];
+    }
+    // Notifications without a turn ID are associated only with the single owned RPC.
+    const classified = classifyCodexEvent(ev, 'type');
+    return classified.length
+      ? classified.map((event) => ({ ...identity, ...event }))
+      : unowned('unrecognized-event');
   }
 }
 
 // ---------------------------------------------------------------------------
-// CodexAppServerSession (EXPERIMENTAL) — `codex app-server` over WebSocket
+// CodexAppServerSession (EXPERIMENTAL) — `codex app-server` over stdio
 // ---------------------------------------------------------------------------
 //
-// EXPERIMENTAL: the app-server protocol is newer and less battle-tested than
-// mcp-server. Prefer CodexMcpSession unless you specifically need app-server.
-//
-// `codex app-server --listen ws://127.0.0.1:<port>` — localhost needs no auth
-// token. JSON-RPC 2.0 with slash-delimited methods:
-//   initialize → initialized → thread/start (returns thread.id) → turn/start
-// Consume turn/started, item/started, item/completed, turn/completed
-// notifications (ThreadItem types agentMessage / reasoning / commandExecution;
-// ThreadTokenUsage). Mapped to SessionEvents.
-//
-// We connect over the spawned process's stdin/stdout JSON-RPC for parity with
-// the rest of the harness (the WebSocket listen address is for external
-// clients; the stdio channel carries the same JSON-RPC frames). The base
-// class's read/write loop is reused unchanged.
+// Wire contract: installed codex-cli 0.153.4 v2 JSON schema. Controlled tests
+// establish source behavior, not a real create/resume/native-completion capture.
+// No default switch. Full history hydration, native fork and cancellation remain
+// separate integration work; a local interrupt never acknowledges native stop.
+
+class NativeValidationError extends Error {}
 
 export class CodexAppServerSession extends BaseCodexSession {
-  /** Resolves when the in-flight turn's `turn/completed` arrives. */
-  private _turnDone?: {
-    resolve: (t: { input: number; output: number } | undefined) => void;
-    reject: (e: Error) => void;
-  };
+  get transport() {
+    return TRANSPORTS['codex-app-server'];
+  }
+  readonly appServerProtocol = 'owned-thread-v1';
+  private _limits?: LimitSnapshot;
+
+  /** Latest account limits observed on this session (stream or poll). */
+  get limits(): LimitSnapshot | undefined {
+    return this._limits;
+  }
+
+  private _observeLimits(snapshot: LimitSnapshot): SessionEvent {
+    this._limits = mergeLimits(this._limits, snapshot);
+    return {
+      kind: 'rate_limit',
+      timestamp: Date.now(),
+      correlation: 'unknown',
+      unattributedReason: 'account-status',
+      limits: this._limits,
+    };
+  }
+
+  /** account/rateLimits/read — no model turn. Requires a started session. */
+  async readLimits(opts?: { timeoutMs?: number }): Promise<LimitSnapshot | undefined> {
+    if (!this._proc || !this._alive) throw Error('Session not running');
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const result = await Promise.race([
+      this._rpcRequest('account/rateLimits/read', { excludeResetCreditDetails: true }),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(Error('account/rateLimits/read timed out')),
+          opts?.timeoutMs ?? 10_000,
+        );
+      }),
+    ]).finally(() => clearTimeout(timer));
+    const snapshot = codexLimitSnapshot(result, 'poll');
+    if (snapshot) this._emit(this._observeLimits(snapshot));
+    return snapshot;
+  }
+
+  /**
+   * turn/interrupt for the owned in-flight turn. "acknowledged" once the turn's
+   * own turn/completed arrives; the send() then settles through that terminal.
+   */
+  async interruptNative(opts?: { timeoutMs?: number }): Promise<NativeInterruptOutcome> {
+    const a = this._inflight?.evidence;
+    if (
+      a?.dispatch !== 'attempted' ||
+      a.nativeOutcome !== 'unknown' ||
+      !a.identity.turnId ||
+      !this._externalSessionId
+    )
+      return 'no-turn';
+    const deadline = Date.now() + (opts?.timeoutMs ?? 5_000);
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      await Promise.race([
+        this._rpcRequest('turn/interrupt', {
+          threadId: this._externalSessionId,
+          turnId: a.identity.turnId,
+        }),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(
+            () => reject(Error('turn/interrupt timed out')),
+            Math.max(1, deadline - Date.now()),
+          );
+        }),
+      ]);
+    } catch {
+      return 'unacknowledged';
+    } finally {
+      clearTimeout(timer);
+    }
+    while (a.nativeOutcome === 'unknown' && this._alive && Date.now() < deadline)
+      await Bun.sleep(10);
+    return a.nativeOutcome === 'unknown' ? 'unacknowledged' : 'acknowledged';
+  }
+
+  /** Mid-turn steer (turn/steer) into the owned in-flight turn; otherwise records push_ignored. */
+  override async push(payload: { kind: string; text: string }): Promise<void> {
+    const a = this._inflight?.evidence;
+    const ignored = (reason: string) =>
+      this._emit({
+        kind: 'error',
+        timestamp: Date.now(),
+        text: `push_ignored: kind=${payload.kind} — ${reason}`,
+        raw: { kind: payload.kind },
+      });
+    if (
+      a?.dispatch !== 'attempted' ||
+      a.nativeOutcome !== 'unknown' ||
+      !a.identity.turnId ||
+      !this._externalSessionId
+    )
+      return ignored('no owned in-flight turn');
+    let timer: ReturnType<typeof setTimeout> | undefined,
+      timedOut = false;
+    try {
+      await Promise.race([
+        this._rpcRequest('turn/steer', {
+          threadId: this._externalSessionId,
+          expectedTurnId: a.identity.turnId,
+          input: [{ type: 'text', text: payload.text }],
+        }),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(Error('turn/steer unanswered'));
+          }, 10_000);
+        }),
+      ]);
+      this._emit({
+        ...a.identity,
+        admissionId: a.admissionId,
+        kind: 'native_status',
+        timestamp: Date.now(),
+        raw: { type: 'push-steered', kind: payload.kind },
+      });
+    } catch (error) {
+      // A refusal is the runtime's answer; no answer leaves delivery unknown, never "ignored".
+      if (timedOut || !this._alive)
+        this._emit({
+          ...a.identity,
+          admissionId: a.admissionId,
+          kind: 'native_status',
+          timestamp: Date.now(),
+          raw: { type: 'push-unknown', kind: payload.kind },
+        });
+      else ignored(`turn/steer refused: ${(error as Error).message.slice(0, 200)}`);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  private readonly _options: NonNullable<CodexSessionConfig['appServer']>;
+  private readonly _onThreadReady?: (binding: string) => void | Promise<void>;
+  private _startedOnce = false;
+  private _threadReady = false;
+  private _nativeSessionId?: string;
+  private _appAdmission?: string;
+  private _turnDone?: () => void;
+  private _items = new Map<
+    string,
+    {
+      type: string;
+      input?: unknown;
+      completed: boolean;
+      server?: string;
+      tool?: string;
+      text?: string;
+    }
+  >();
+
+  constructor(config?: CodexSessionConfig) {
+    super(config);
+    const { onThreadReady, ...options } = config?.appServer ?? {};
+    this._onThreadReady = onThreadReady;
+    this._options = retainEvidence(options);
+    const required = this._options.requiredMcpServer;
+    if (
+      required &&
+      (!/^[a-zA-Z0-9_-]+$/.test(required.name) ||
+        !required.tools.length ||
+        required.tools.some((t) => !/^[a-zA-Z0-9_-]+$/.test(t)))
+    )
+      throw new NativeValidationError('Invalid required MCP inventory');
+  }
+
+  override fork(): HarnessSession {
+    throw Error(
+      'Native app-server fork is not implemented; a same-thread wrapper cannot create a native fork or inherit a process capability',
+    );
+  }
+
+  override async start(): Promise<void> {
+    if (this._inflight)
+      throw Error('Native call ownership unresolved; automatic resume is blocked');
+    if (this._startedOnce && !this._alive)
+      throw Error('App-server restart requires a new owned instance and preflight');
+    this._startedOnce = true;
+    try {
+      await super.start();
+    } catch (error) {
+      this.kill();
+      throw error;
+    }
+  }
+
+  protected override _serverRequest(request: Record<string, unknown>): boolean {
+    // JSON-RPC's explicit method-not-supported refusal also covers unknown future
+    // requests. Never approve native work or echo private request parameters.
+    const payload = `${JSON.stringify({
+      jsonrpc: '2.0',
+      id: request.id,
+      error: { code: -32601, message: 'Client interaction is unsupported by this adapter' },
+    })}\n`;
+    const params = object(request.params),
+      a = this._inflight?.evidence;
+    const identity =
+      a?.identity.turnId &&
+      params?.threadId === a.identity.threadId &&
+      params?.turnId === a.identity.turnId
+        ? { ...a.identity, admissionId: a.admissionId }
+        : { unattributedReason: 'unrecognized-event' as const };
+    try {
+      this._proc!.stdin.write(payload);
+      this._proc!.stdin.flush();
+    } catch {
+      this._emit({
+        ...identity,
+        kind: 'native_status',
+        timestamp: Date.now(),
+        raw: { type: 'server-request-refusal', status: 'write-failed' },
+      });
+      return true;
+    }
+    this._emit({
+      ...identity,
+      kind: 'native_status',
+      timestamp: Date.now(),
+      raw: { type: 'server-request-refusal', status: 'refused' },
+    });
+    return true;
+  }
+
+  private _refuse(reason: string, status = 'unknown'): never {
+    const a = this._inflight?.evidence;
+    this._emit({
+      ...(a ? { admissionId: a.admissionId, ...a.identity } : {}),
+      kind: 'native_status',
+      timestamp: Date.now(),
+      raw: { type: 'thread-refused', reason, status },
+    });
+    throw new NativeValidationError(
+      `Native thread validation refused: ${reason} (${status}); no turn was sent`,
+    );
+  }
+
+  private async _readiness(): Promise<void> {
+    const required = this._options.requiredMcpServer;
+    if (!required) return;
+    let cursor: string | undefined;
+    const seen = new Set<string>();
+    let found: Record<string, unknown> | undefined;
+    // Pagination only, never polling/retrying a starting or failed native server.
+    for (let page = 0; page < 32; page++) {
+      const result = object(
+        await this._rpcRequest('mcpServerStatus/list', {
+          threadId: this._externalSessionId,
+          detail: 'toolsAndAuthOnly',
+          limit: 100,
+          ...(cursor ? { cursor } : {}),
+        }),
+      );
+      if (!Array.isArray(result?.data)) this._refuse('mcp-inventory-malformed');
+      for (const entry of result.data) {
+        const server = object(entry);
+        if (server?.name === required.name) {
+          if (found) this._refuse('mcp-inventory-duplicate');
+          found = server;
+        }
+      }
+      if (result.nextCursor == null) {
+        const tools = object(found?.tools);
+        if (
+          found?.runtimeStatus !== 'connected' ||
+          !tools ||
+          required.tools.some((name) => object(tools[name])?.name !== name)
+        )
+          this._refuse('mcp-inventory-unavailable');
+        const a = this._inflight!.evidence;
+        this._emit({
+          ...a.identity,
+          admissionId: a.admissionId,
+          kind: 'native_status',
+          timestamp: Date.now(),
+          raw: {
+            type: 'mcp-ready',
+            status: 'connected',
+            server: required.name,
+            tools: [...required.tools],
+          },
+        });
+        return;
+      }
+      if (
+        typeof result.nextCursor !== 'string' ||
+        !result.nextCursor ||
+        seen.has(result.nextCursor)
+      )
+        this._refuse('mcp-inventory-cursor');
+      cursor = result.nextCursor;
+      seen.add(cursor);
+    }
+    this._refuse('mcp-inventory-page-limit');
+  }
+
+  protected override _canReleaseAttempt(a: TurnState): boolean {
+    // An observer/write failure may occur after delivery. A terminal alone does
+    // not settle the unanswered turn/start call or authorize another admission.
+    return a.rpcSettled && (a.rpcOutcome === 'resolved' || a.rpcOutcome === 'failed');
+  }
 
   protected _buildSpawnArgs(): string[] {
-    // app-server on localhost needs no auth token. Approvals/sandbox are set
-    // per-thread in thread/start (approvalPolicy / sandbox below).
-    return ["app-server", "--listen", "ws://127.0.0.1:0"];
+    return ['app-server', '--listen', 'stdio://'];
   }
 
   protected async _handshake(): Promise<void> {
-    await this._rpcRequest("initialize", {
-      protocolVersion: "2025-06-18",
-      capabilities: {},
-      clientInfo: { name: "inixiative-bench", version: "0.1.0" },
-    });
-    this._rpcNotify("initialized");
+    this._threadReady = false;
+    const initialized = object(
+      await this._rpcRequest('initialize', {
+        capabilities: {},
+        clientInfo: { name: 'inixiative-bench', version: '0.1.0' },
+      }),
+    );
+    if (
+      this._options.requireConfiguration &&
+      ['userAgent', 'platformFamily', 'platformOs', 'codexHome'].some(
+        (key) => typeof initialized?.[key] !== 'string' || !initialized[key],
+      )
+    )
+      throw new NativeValidationError(
+        'Native initialize response lacks required configuration; no thread or turn was sent',
+      );
+    this._rpcNotify('initialized');
   }
 
   protected async _sendTurn(
     message: string,
   ): Promise<{ input: number; output: number } | undefined> {
-    // Start (or reuse) a thread. Disable codex's approvals + sandbox so OUR
-    // container is the only jail.
-    if (!this._externalSessionId) {
-      const started = (await this._rpcRequest("thread/start", {
-        model: this._model,
-        cwd: this._cwd,
-        approvalPolicy: "never",
-        sandbox: "danger-full-access",
-        ...(this._effort ? { modelReasoningEffort: this._effort } : {}),
-      })) as Record<string, unknown> | undefined;
-      const thread = started?.thread as Record<string, unknown> | undefined;
-      const id = (thread?.id ?? started?.threadId) as string | undefined;
-      if (id) this._externalSessionId = id;
-    }
-
-    const completed = new Promise<{ input: number; output: number } | undefined>(
-      (resolve, reject) => {
-        this._turnDone = { resolve, reject };
-      },
-    );
-
-    // turn/start streams turn/started, item/*, turn/completed back as
-    // notifications, consumed in _classify; turn/completed resolves the turn.
-    await this._rpcRequest("turn/start", {
+    const a = this._inflight!.evidence;
+    if (!this._threadReady) {
+      const binding = this._externalSessionId;
+      const method = binding ? 'thread/resume' : 'thread/start';
+      const response = object(
+        await this._rpcRequest(method, {
+          ...(binding ? { threadId: binding } : {}),
+          model: this._model,
+          cwd: this._cwd,
+          approvalPolicy: 'never',
+          sandbox: 'danger-full-access',
+          ...(this._options.config ? { config: this._options.config } : {}),
+        }),
+      );
+      const thread = object(response?.thread),
+        id = thread?.id;
+      if (typeof id !== 'string' || !id || (binding && id !== binding))
+        this._refuse('binding-mismatch');
+      // Resume may rejoin a live thread. Never steer known pre-existing work.
+      // The installed schema requires status. Missing/unknown state cannot
+      // authorize work, even if this response otherwise identifies our thread.
+      if (
+        object(thread?.status)?.type !== 'idle' ||
+        (Array.isArray(thread?.turns) &&
+          thread.turns.some((turn) => object(turn)?.status === 'inProgress'))
+      )
+        this._refuse(
+          'not-idle',
+          ['active', 'notLoaded', 'systemError'].includes(String(object(thread?.status)?.type))
+            ? String(object(thread?.status)?.type)
+            : 'unknown',
+        );
+      if (
+        this._options.requireConfiguration &&
+        (typeof response?.model !== 'string' ||
+          !response.model ||
+          typeof response.modelProvider !== 'string' ||
+          !response.modelProvider ||
+          response.cwd !== this._cwd ||
+          response.approvalPolicy !== 'never' ||
+          response.approvalsReviewer !== 'user' ||
+          object(response.sandbox)?.type !== 'dangerFullAccess' ||
+          !Array.isArray(thread?.turns) ||
+          thread.turns.some((value) => !this._turn(value)))
+      )
+        this._refuse('configuration-missing-or-incompatible');
+      this._externalSessionId = id;
+      this._nativeSessionId =
+        typeof thread?.sessionId === 'string' && thread.sessionId ? thread.sessionId : undefined;
+      a.identity = {
+        ...a.identity,
+        threadId: id,
+        ...(this._nativeSessionId ? { nativeSessionId: this._nativeSessionId } : {}),
+      };
+      if (this._onThreadReady) {
+        try {
+          await this._onThreadReady(id);
+        } catch (cause) {
+          throw new NativeValidationError('Native binding persistence failed before turn/start', {
+            cause,
+          });
+        }
+      }
+      this._threadReady = true;
+      // Configuration belongs to this process/thread, never to the next turn.
+      // Do not copy historical turns, instructions, paths or arbitrary config.
+      this._emit({
+        kind: 'native_status',
+        timestamp: Date.now(),
+        threadId: id,
+        nativeSessionId: this._nativeSessionId,
+        unattributedReason: 'session-configuration',
+        raw: {
+          type: 'thread-configured',
+          method,
+          threadId: id,
+          ...(object(thread?.status)?.type === 'idle' ? { status: 'idle' } : {}),
+          ...(typeof response?.model === 'string' ? { model: response.model } : {}),
+          ...(response?.reasoningEffort === null ||
+          VALID_EFFORTS.includes(String(response?.reasoningEffort))
+            ? { reasoningEffort: response?.reasoningEffort }
+            : {}),
+          history: {
+            source: method,
+            turns: Array.isArray(thread?.turns)
+              ? thread.turns.slice(0, 200).flatMap((value) => {
+                  const t = this._turn(value);
+                  return t ? [{ id: t.id, status: t.status }] : [];
+                })
+              : [],
+            available: Array.isArray(thread?.turns),
+            hasMore:
+              !!response?.turnsBackwardsCursor ||
+              (Array.isArray(thread?.turns) && thread.turns.length > 200),
+          },
+        },
+      });
+    }
+    a.identity = {
+      ...a.identity,
+      threadId: this._externalSessionId,
+      ...(this._nativeSessionId ? { nativeSessionId: this._nativeSessionId } : {}),
+    };
+    await this._readiness();
+    // Timeout/kill during create/resume must not cause a later model write.
+    if (this._inflight?.evidence !== a || a.localOutcome !== 'pending' || !this._alive)
+      throw Error('Local admission closed before turn/start; no turn was sent');
+    a.identity = {
+      ...a.identity,
+      threadId: this._externalSessionId,
+      ...(this._nativeSessionId ? { nativeSessionId: this._nativeSessionId } : {}),
+    };
+    this._appAdmission = a.admissionId;
+    this._items.clear();
+    const completed = new Promise<void>((resolve) => {
+      this._turnDone = resolve;
+    });
+    await this._rpcRequest('turn/start', {
       threadId: this._externalSessionId,
-      input: message,
+      input: [{ type: 'text', text: message }],
+      ...(this._effort ? { effort: this._effort } : {}),
     });
+    await completed; // Native terminal and RPC acknowledgment are both required.
+    return a.tokens;
+  }
 
-    return completed;
+  protected override _observeRpcResult(id: number, result: unknown): void {
+    const a = this._inflight?.evidence;
+    if (!a || this._appAdmission !== a.admissionId || a.identity.rpcRequestId !== id) return;
+    const turn = this._turn(object(result)?.turn);
+    if (
+      !turn ||
+      (a.identity.turnId && turn.id !== a.identity.turnId) ||
+      (!a.identity.turnId && this._seenTerminals.has(turn.id))
+    )
+      throw new NativeValidationError(
+        'Native turn/start response missing or conflicts with owned turn',
+      );
+    a.identity = { ...a.identity, turnId: turn.id, correlation: 'native-turn' };
+  }
+
+  private _turn(value: unknown): { id: string; status: string; error?: unknown } | undefined {
+    const turn = object(value);
+    if (
+      !turn ||
+      typeof turn.id !== 'string' ||
+      !turn.id ||
+      !Array.isArray(turn.items) ||
+      !['inProgress', 'completed', 'failed', 'interrupted'].includes(String(turn.status))
+    )
+      return;
+    return turn as { id: string; status: string; error?: unknown };
   }
 
   protected _classify(msg: Record<string, unknown>): SessionEvent[] {
-    const method = msg.method as string | undefined;
+    const method = typeof msg.method === 'string' ? msg.method : undefined;
     if (!method) return [];
-    const params = (msg.params ?? {}) as Record<string, unknown>;
-
-    if (method === "turn/completed") {
-      const usage = (params.usage ?? params.tokenUsage) as
-        | Record<string, number>
-        | undefined;
-      const tokens = usage
-        ? {
-            input: (usage.inputTokens ?? usage.input_tokens ?? 0) as number,
-            output: (usage.outputTokens ?? usage.output_tokens ?? 0) as number,
-          }
-        : undefined;
-      this._turnDone?.resolve(tokens);
+    if (method === 'account/rateLimits/updated') {
+      const snapshot = codexLimitSnapshot(msg.params, 'stream');
+      return snapshot ? [this._observeLimits(snapshot)] : [];
+    }
+    const params = object(msg.params),
+      turn = this._turn(params?.turn),
+      item = object(params?.item);
+    const str = (value: unknown) => (typeof value === 'string' && value ? value : undefined);
+    const threadId = str(params?.threadId),
+      turnId = turn?.id ?? str(params?.turnId),
+      itemId = str(item?.id) ?? str(params?.itemId);
+    const unowned = (reason: NonNullable<SessionEvent['unattributedReason']>): SessionEvent[] => [
+      {
+        kind: 'native_status',
+        timestamp: Date.now(),
+        threadId,
+        turnId,
+        itemId,
+        correlation: 'unknown',
+        unattributedReason: reason,
+        raw: {
+          method: [
+            'turn/started',
+            'turn/completed',
+            'item/started',
+            'item/completed',
+            'thread/tokenUsage/updated',
+            'item/agentMessage/delta',
+            'item/commandExecution/outputDelta',
+          ].includes(method)
+            ? method
+            : 'unrecognized',
+          ...(item
+            ? {
+                itemType: ['agentMessage', 'commandExecution', 'reasoning', 'mcpToolCall'].includes(
+                  String(item.type),
+                )
+                  ? item.type
+                  : 'unsupported',
+              }
+            : {}),
+        },
+      },
+    ];
+    const a = this._inflight?.evidence;
+    if (!threadId || threadId !== this._externalSessionId) return unowned('foreign-session');
+    if (!a || this._appAdmission !== a.admissionId) return unowned('no-admission');
+    if (turnId && this._seenTerminals.has(turnId))
+      return unowned(method === 'turn/completed' ? 'duplicate-terminal' : 'after-terminal');
+    if (method === 'turn/started' && turn?.status === 'inProgress' && !a.identity.turnId)
+      a.identity = { ...a.identity, threadId, turnId: turn.id, correlation: 'native-turn' };
+    if (!turnId || turnId !== a.identity.turnId) return unowned('foreign-turn');
+    const identity = { ...a.identity, threadId, turnId, ...(itemId ? { itemId } : {}) };
+    const status = (): SessionEvent[] => [
+      { ...identity, kind: 'native_status', timestamp: Date.now(), raw: { method } },
+    ];
+    if (method === 'turn/completed') {
+      if (!turn || turn.status === 'inProgress') return unowned('unrecognized-event');
+      const error = object(turn.error);
+      if (turn.error != null && typeof error?.message !== 'string')
+        return unowned('unrecognized-event');
+      this._seenTerminals.add(turnId);
+      this._turnDone?.();
       this._turnDone = undefined;
-      // Note: no `tokens` on this event — _sendTurn returns them to _dispatchTurn,
-      // which does the accounting once. Putting tokens here too would double-count.
-      return [{ kind: "result", timestamp: Date.now(), text: this._resultText, raw: msg }];
+      return [
+        {
+          ...identity,
+          kind: 'result',
+          timestamp: Date.now(),
+          text: a.content,
+          nativeOutcome: turn.status === 'completed' && !error ? 'completed' : 'failed',
+          terminal: {
+            type: method,
+            turnId,
+            subtype: turn.status,
+            ...(error ? { reason: error.message as string } : {}),
+          },
+        },
+      ];
     }
-
-    if (method === "item/completed" || method === "item/started") {
-      const item = (params.item ?? params) as Record<string, unknown>;
-      return classifyCodexEvent(item, "type");
+    if (method === 'thread/tokenUsage/updated') {
+      const last = object(object(params?.tokenUsage)?.last);
+      if (
+        typeof last?.inputTokens !== 'number' ||
+        typeof last?.outputTokens !== 'number' ||
+        !Number.isSafeInteger(last.inputTokens) ||
+        !Number.isSafeInteger(last.outputTokens) ||
+        last.inputTokens < 0 ||
+        last.outputTokens < 0
+      )
+        return unowned('unrecognized-event');
+      // `last` is a snapshot, not an additive delta. Total accounting happens once
+      // when the original native turn and RPC settle; absent usage stays absent.
+      a.tokens = { input: last.inputTokens, output: last.outputTokens };
+      return status();
     }
-
-    // turn/started and other lifecycle notifications carry no turn content.
-    return [];
+    if (method === 'item/agentMessage/delta' || method === 'item/commandExecution/outputDelta') {
+      if (!itemId || typeof params?.delta !== 'string') return unowned('unrecognized-event');
+      const prior = this._items.get(itemId);
+      if (prior?.completed) return unowned('after-terminal');
+      if (method === 'item/agentMessage/delta') {
+        if (prior && prior.type !== 'agentMessage') return unowned('unmatched-tool');
+        this._items.set(itemId, {
+          type: 'agentMessage',
+          completed: false,
+          text: (prior?.text ?? '') + params.delta,
+        });
+        return [{ ...identity, kind: 'text_delta', timestamp: Date.now(), text: params.delta }];
+      }
+      if (prior?.type !== 'commandExecution') return unowned('unmatched-tool');
+      return [
+        {
+          ...identity,
+          kind: 'native_status',
+          timestamp: Date.now(),
+          toolName: 'shell',
+          text: params.delta,
+        },
+      ];
+    }
+    if (method === 'item/completed' || method === 'item/started') {
+      if (!itemId || !item || typeof item.type !== 'string') return unowned('unrecognized-event');
+      if (item.type === 'agentMessage') {
+        if (method !== 'item/completed') return status();
+        if (this._items.get(itemId)?.completed) return unowned('after-terminal');
+        if (
+          typeof item.text !== 'string' ||
+          (item.phase != null && !['commentary', 'final_answer'].includes(String(item.phase)))
+        )
+          return unowned('unrecognized-event');
+        this._items.set(itemId, { type: item.type, completed: true });
+        return [{ ...identity, kind: 'text', timestamp: Date.now(), text: item.text }];
+      }
+      if (item.type === 'commandExecution') {
+        if (typeof item.command !== 'string') return unowned('malformed-tool');
+        const prior = this._items.get(itemId);
+        if (method === 'item/started') {
+          if (prior) return unowned('duplicate-tool');
+          this._items.set(itemId, { type: item.type, input: item.command, completed: false });
+          return [
+            {
+              ...identity,
+              kind: 'tool_use',
+              timestamp: Date.now(),
+              toolName: 'shell',
+              toolInput: { command: item.command },
+            },
+          ];
+        }
+        if (!prior || prior.type !== item.type || prior.input !== item.command)
+          return unowned('unmatched-tool');
+        if (prior.completed) return unowned('duplicate-tool');
+        if (!['completed', 'failed', 'declined'].includes(String(item.status)))
+          return unowned('malformed-tool');
+        prior.completed = true;
+        return [
+          {
+            ...identity,
+            kind: 'tool_result',
+            timestamp: Date.now(),
+            toolName: 'shell',
+            ...(typeof item.aggregatedOutput === 'string'
+              ? { toolOutput: item.aggregatedOutput }
+              : { toolOutputOmitted: true }),
+            toolError:
+              item.status !== 'completed' ||
+              (typeof item.exitCode === 'number' && item.exitCode !== 0),
+          },
+        ];
+      }
+      if (item.type === 'mcpToolCall') {
+        if (
+          typeof item.server !== 'string' ||
+          !item.server ||
+          typeof item.tool !== 'string' ||
+          !item.tool
+        )
+          return unowned('malformed-tool');
+        const prior = this._items.get(itemId);
+        const tool = {
+          toolServer: item.server,
+          toolMethod: item.tool,
+          toolName: `mcp__${item.server}__${item.tool}`,
+        };
+        if (method === 'item/started') {
+          if (prior) return unowned('duplicate-tool');
+          if (item.status !== 'inProgress') return unowned('malformed-tool');
+          this._items.set(itemId, {
+            type: item.type,
+            server: item.server,
+            tool: item.tool,
+            input: retainEvidence(item.arguments),
+            completed: false,
+          });
+          return [
+            {
+              ...identity,
+              ...tool,
+              kind: 'tool_use',
+              timestamp: Date.now(),
+              ...publicMcpArguments(item.arguments),
+            },
+          ];
+        }
+        if (
+          !prior ||
+          prior.type !== item.type ||
+          prior.server !== item.server ||
+          prior.tool !== item.tool ||
+          !isDeepStrictEqual(prior.input, item.arguments)
+        )
+          return unowned('unmatched-tool');
+        if (prior.completed) return unowned('duplicate-tool');
+        if (!['completed', 'failed'].includes(String(item.status)))
+          return unowned('malformed-tool');
+        const error = object(item.error),
+          result = object(item.result);
+        const output = result ? publicMcpResult({ Ok: { content: result.content } }) : undefined;
+        if (item.error != null && typeof error?.message !== 'string')
+          return unowned('malformed-tool');
+        prior.completed = true;
+        return [
+          {
+            ...identity,
+            ...tool,
+            kind: 'tool_result',
+            timestamp: Date.now(),
+            ...(output ??
+              (error ? { toolOutput: error.message as string } : { toolOutputOmitted: true })),
+            toolError: item.status === 'failed' || !!error,
+            ...(result && Object.keys(result).some((k) => k !== 'content' && result[k] != null)
+              ? { toolOutputOmitted: true }
+              : {}),
+          },
+        ];
+      }
+      // Reasoning and unsupported items retain safe identity/type diagnostics only.
+      return unowned('unrecognized-event');
+    }
+    return method === 'turn/started' ? status() : unowned('unrecognized-event');
   }
 }
 
@@ -838,58 +1839,135 @@ export class CodexAppServerSession extends BaseCodexSession {
 //   command_execution / commandExecution → tool_use (+ tool_result when done)
 //   token_count / usage              → tokens (attached to a result event)
 
-function classifyCodexEvent(
-  ev: Record<string, unknown>,
-  tag: string,
-): SessionEvent[] {
+const object = (value: unknown): Record<string, unknown> | undefined =>
+  value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+
+function publicMcpArguments(value: unknown): Pick<SessionEvent, 'toolInput' | 'toolInputOmitted'> {
+  if (!object(value)) return { toolInputOmitted: 'Native arguments absent or not an object' };
+  let omitted = false;
+  const clean = (v: unknown, depth = 0): unknown => {
+    if (depth > 32) {
+      omitted = true;
+      return null;
+    }
+    if (v === null || ['string', 'number', 'boolean'].includes(typeof v)) return v;
+    if (Array.isArray(v)) return v.map((x) => clean(x, depth + 1));
+    if (!object(v)) {
+      omitted = true;
+      return null;
+    }
+    return Object.fromEntries(
+      Object.entries(v as Record<string, unknown>).flatMap(([key, item]) => {
+        if (
+          /^(?:__proto__|constructor|prototype|env|environment|authorization|credentials?|api[-_]?key|access[-_]?token|refresh[-_]?token|password|secret|reasoning|thinking)$/i.test(
+            key,
+          )
+        ) {
+          omitted = true;
+          return [];
+        }
+        return [[key, clean(item, depth + 1)]];
+      }),
+    );
+  };
+  const toolInput = clean(value) as Record<string, unknown>;
+  return {
+    toolInput,
+    ...(omitted ? { toolInputOmitted: 'Non-public or unsupported argument fields omitted' } : {}),
+  };
+}
+
+/** Rust Result<CallToolResult,String> from protocol.rs. This is legacy event
+ * normalization, not the app-server ThreadItem schema. Keep all public text
+ * blocks (including the bridge's JSON receipt), not arbitrary envelope fields. */
+function publicMcpResult(
+  value: unknown,
+): Pick<SessionEvent, 'toolOutput' | 'toolError' | 'toolOutputOmitted'> | undefined {
+  const result = object(value);
+  if (!result || Object.keys(result).length !== 1) return;
+  if (typeof result.Err === 'string') return { toolOutput: result.Err, toolError: true };
+  const ok = object(result.Ok);
+  if (
+    !ok ||
+    !Array.isArray(ok.content) ||
+    (ok.isError !== undefined && typeof ok.isError !== 'boolean')
+  )
+    return;
+  let omitted = Object.keys(ok).some((k) => k !== 'content' && k !== 'isError');
+  const content = ok.content.map((value) => {
+    const block = object(value);
+    if (block?.type === 'text' && typeof block.text === 'string') {
+      if (Object.keys(block).some((k) => k !== 'type' && k !== 'text')) omitted = true;
+      return { type: 'text', text: block.text };
+    }
+    omitted = true;
+    // Unknown shape values are not safe labels. Known non-text types retain type only.
+    return {
+      type: ['image', 'audio', 'resource', 'resource_link'].includes(String(block?.type))
+        ? block!.type
+        : 'unsupported',
+    };
+  });
+  return {
+    toolOutput: JSON.stringify({
+      content,
+      ...(ok.isError !== undefined ? { isError: ok.isError } : {}),
+    }),
+    ...(ok.isError !== undefined ? { toolError: ok.isError as boolean } : {}),
+    ...(omitted ? { toolOutputOmitted: true } : {}),
+  };
+}
+
+function classifyCodexEvent(ev: Record<string, unknown>, tag: string): SessionEvent[] {
   const ts = Date.now();
-  const type = String(ev[tag] ?? "").toLowerCase();
+  const type = String(ev[tag] ?? '').toLowerCase();
   const events: SessionEvent[] = [];
 
   // Agent message → text.
-  if (type === "agent_message" || type === "agentmessage" || type === "agent_message_delta") {
+  if (type === 'agent_message' || type === 'agentmessage' || type === 'agent_message_delta') {
     const text = (ev.message ?? ev.text ?? ev.delta) as string | undefined;
-    if (text) events.push({ kind: "text", timestamp: ts, text, raw: ev });
+    if (text) events.push({ kind: 'text', timestamp: ts, text, raw: ev });
     return events;
   }
 
   // Reasoning → thinking.
   if (
-    type === "reasoning" ||
-    type === "agent_reasoning" ||
-    type === "agentreasoning" ||
-    type === "agent_reasoning_delta"
+    type === 'reasoning' ||
+    type === 'agent_reasoning' ||
+    type === 'agentreasoning' ||
+    type === 'agent_reasoning_delta'
   ) {
     const text = (ev.text ?? ev.reasoning ?? ev.delta ?? ev.summary) as string | undefined;
-    if (text) events.push({ kind: "thinking", timestamp: ts, text, raw: ev });
+    if (text) events.push({ kind: 'thinking', timestamp: ts, text, raw: ev });
     return events;
   }
 
   // Command execution → tool_use, plus tool_result if output is present.
   if (
-    type === "command_execution" ||
-    type === "commandexecution" ||
-    type === "exec_command_begin" ||
-    type === "exec_command_end"
+    type === 'command_execution' ||
+    type === 'commandexecution' ||
+    type === 'exec_command_begin' ||
+    type === 'exec_command_end'
   ) {
     const command = (ev.command ?? ev.cmd) as string | string[] | undefined;
-    const cmdStr = Array.isArray(command) ? command.join(" ") : command;
-    events.push({
-      kind: "tool_use",
-      timestamp: ts,
-      toolName: "shell",
-      toolInput: cmdStr ? { command: cmdStr } : (ev as Record<string, unknown>),
-      raw: ev,
-    });
-    const output = (ev.output ?? ev.stdout ?? ev.aggregated_output) as
-      | string
-      | undefined;
+    const cmdStr = Array.isArray(command) ? command.join(' ') : command;
+    if (type !== 'exec_command_end')
+      events.push({
+        kind: 'tool_use',
+        timestamp: ts,
+        toolName: 'shell',
+        toolInput: cmdStr ? { command: cmdStr } : (ev as Record<string, unknown>),
+        raw: ev,
+      });
+    const output = (ev.output ?? ev.stdout ?? ev.aggregated_output) as string | undefined;
     const exitCode = (ev.exit_code ?? ev.exitCode) as number | undefined;
     if (output !== undefined || exitCode !== undefined) {
       events.push({
-        kind: "tool_result",
+        kind: 'tool_result',
         timestamp: ts,
-        toolOutput: output ?? "",
+        toolOutput: output ?? '',
         toolError: exitCode !== undefined && exitCode !== 0,
         raw: ev,
       });
@@ -899,19 +1977,17 @@ function classifyCodexEvent(
 
   // Token usage → carried on a result-less event so accounting picks it up.
   if (
-    type === "token_count" ||
-    type === "token_usage" ||
-    type === "usage" ||
-    type === "tokenusage"
+    type === 'token_count' ||
+    type === 'token_usage' ||
+    type === 'usage' ||
+    type === 'tokenusage'
   ) {
     const u = (ev.info ?? ev.usage ?? ev) as Record<string, unknown>;
-    const input =
-      (u.input_tokens ?? u.inputTokens ?? u.total_input_tokens ?? 0) as number;
-    const output =
-      (u.output_tokens ?? u.outputTokens ?? u.total_output_tokens ?? 0) as number;
+    const input = (u.input_tokens ?? u.inputTokens ?? u.total_input_tokens ?? 0) as number;
+    const output = (u.output_tokens ?? u.outputTokens ?? u.total_output_tokens ?? 0) as number;
     if (input || output) {
       events.push({
-        kind: "result",
+        kind: 'result',
         timestamp: ts,
         tokens: { input, output },
         raw: ev,
@@ -921,9 +1997,9 @@ function classifyCodexEvent(
   }
 
   // Errors.
-  if (type === "error" || type === "stream_error") {
+  if (type === 'error' || type === 'stream_error') {
     events.push({
-      kind: "error",
+      kind: 'error',
       timestamp: ts,
       text: (ev.message ?? ev.error ?? JSON.stringify(ev)) as string,
       raw: ev,