@jingyi0605/codingns4dsh 0.2.0-beta.1 → 0.2.0-rc.2

package/data/build/dist/host/cli-adapters/codex-driver.js

@@ -8,10 +8,14 @@ import { CODEX_CATALOG, isProviderDefaultModel } from './model-catalog.js';
 import { probeStoredSession, readFirstJsonRecord } from './session-probe.js';
 import { firstToolText, normalizeToolStatus, serializeToolValue } from './tool-observation.js';
 import { isQuestionEvent, questionAnswersRecord, readAgentQuestions } from './interaction-events.js';
+import { codexBridgeArgs, codexBridgeDeveloperInstructions } from '../cli-bridge/injections.js';
 // 只有 Provider 已明确报告超过窗口时才主动压缩；接近上限仍交给 Codex
 // 自身的 auto-compact，避免对正常的高占用回合重复发起压缩。
 const CODEX_COMPACTION_THRESHOLD = 1;
 const CODEX_COMPACTION_TIMEOUT_MS = 60_000;
+// Codex CLI 默认会启用 computer_use；DSH 没有对应的桌面控制宿主，必须在
+// app-server 进程启动时关闭该 feature，避免模型进入无法完成的控制回合。
+const CODEX_APP_SERVER_ARGS = ['app-server', '--disable', 'computer_use'];
 /** Codex app-server 的 JSON-RPC 驱动，Host 只暴露统一文本流，不暴露线程和 token。 */
 export class CodexAppServerDriver {
     descriptor = { id: 'codex', name: 'Codex', protocol: 'json-rpc', capabilities: ['models', 'stream', 'resume', 'interrupt', 'tool-events', 'reasoning', 'usage', 'permission', 'questions', 'steer'] };
@@ -42,7 +46,7 @@ export class CodexAppServerDriver {
         const command = this.cachedBinary ?? (await this.detect()).command;
         if (command === null)
             return emptyCatalog();
-        const rpc = new JsonRpcProcess({ command, args: ['app-server'], spawn: this.runSpawn });
+        const rpc = new JsonRpcProcess({ command, args: CODEX_APP_SERVER_ARGS, spawn: this.runSpawn });
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), 12_000);
         try {
@@ -88,12 +92,15 @@ export class CodexAppServerDriver {
         const rpc = session.rpc;
         try {
             if (session.threadId === '') {
+                const threadParams = codexThreadParams(input);
                 const thread = input.providerSessionId
-                    ? await rpc.request('thread/resume', { threadId: input.providerSessionId, cwd: input.cwd ?? process.cwd(), ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}) }, { signal: input.signal, killOnAbort: false })
-                    : await rpc.request('thread/start', { cwd: input.cwd ?? process.cwd(), ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}) }, { signal: input.signal, killOnAbort: false });
+                    ? await rpc.request('thread/resume', { threadId: input.providerSessionId, ...threadParams }, { signal: input.signal, killOnAbort: false })
+                    : await rpc.request('thread/start', threadParams, { signal: input.signal, killOnAbort: false });
                 session.threadId = readId(thread) ?? input.providerSessionId ?? input.sessionId;
                 session.providerSessionId = session.threadId;
+                session.threadModelId = readThreadModel(thread);
             }
+            await this.alignThreadModel(session, input);
             await this.ensureContextCapacity(session, input);
             yield* drainCompactionEvents(session);
             yield { type: 'session-binding', providerSessionId: session.providerSessionId };
@@ -102,6 +109,7 @@ export class CodexAppServerDriver {
             let turnStartResolved = false;
             const notificationsBeforeTurnStart = [];
             let terminalReason = null;
+            let failure;
             let sawMeaningfulEvent = false;
             const acceptNotification = (message, allowUnidentifiedTool) => {
                 // Codex 自动压缩可能在独立的内部 turn 中运行。它不属于当前用户 turn，
@@ -127,6 +135,8 @@ export class CodexAppServerDriver {
                 const reason = readCodexTerminalReason(message);
                 if (reason !== null) {
                     terminalReason = reason;
+                    if (reason === 'error')
+                        failure = codexFailure(message);
                     eventQueue.close();
                 }
             };
@@ -175,10 +185,11 @@ export class CodexAppServerDriver {
                     const rawChunk = codexMessageToChunk(message);
                     if (rawChunk === null)
                         continue;
-                    if (rawChunk.type !== 'finish')
-                        sawMeaningfulEvent = true;
-                    const chunk = stabilizeCodexEvent(session, rawChunk);
-                    yield chunk;
+                    for (const chunk of expandCodexCompactionChunk(session, rawChunk)) {
+                        if (chunk.type !== 'finish')
+                            sawMeaningfulEvent = true;
+                        yield stabilizeCodexEvent(session, chunk);
+                    }
                 }
                 if (input.signal?.aborted)
                     await this.interrupt(input.sessionId);
@@ -196,12 +207,16 @@ export class CodexAppServerDriver {
             // 终态 chunk 之后调用方不会再拉动本迭代器，turnId 必须在产出 finish
             // 前复位，否则下一轮 steer/interrupt 会指向已经结束的 turn。
             session.turnId = null;
+            const danglingCompaction = closeDanglingAutoCompaction(session);
+            if (danglingCompaction !== undefined)
+                yield stabilizeCodexEvent(session, danglingCompaction);
             if (!input.signal?.aborted && terminalReason !== 'cancel' && !sawMeaningfulEvent) {
                 yield { type: 'text-delta', text: 'CODINGNS_PROVIDER_EMPTY_RESPONSE: Codex Provider 未返回任何有效事件。' };
-                yield { type: 'finish', reason: 'error' };
+                yield { type: 'finish', reason: 'error', ...(failure === undefined ? {} : { failure }) };
             }
             else {
-                yield { type: 'finish', reason: input.signal?.aborted ? 'cancel' : terminalReason ?? 'stop' };
+                const reason = input.signal?.aborted ? 'cancel' : terminalReason ?? 'stop';
+                yield { type: 'finish', reason };
             }
         }
         finally { /* app-server 在会话结束前保持连接。 */ }
@@ -219,11 +234,13 @@ export class CodexAppServerDriver {
         let active;
         try {
             if (session.threadId === '') {
+                const threadParams = codexThreadParams(input);
                 const thread = input.providerSessionId
-                    ? await rpc.request('thread/resume', { threadId: input.providerSessionId, cwd: input.cwd ?? process.cwd(), ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}) }, { signal: input.signal, killOnAbort: false })
-                    : await rpc.request('thread/start', { cwd: input.cwd ?? process.cwd(), ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}) }, { signal: input.signal, killOnAbort: false });
+                    ? await rpc.request('thread/resume', { threadId: input.providerSessionId, ...threadParams }, { signal: input.signal, killOnAbort: false })
+                    : await rpc.request('thread/start', threadParams, { signal: input.signal, killOnAbort: false });
                 session.threadId = readId(thread) ?? input.providerSessionId ?? input.sessionId;
                 session.providerSessionId = session.threadId;
+                session.threadModelId = readThreadModel(thread);
             }
             // 只有 Host 显式声明续段时才复用挂起的 Provider 运行。新用户回合、注入
             // 失败或取消后的下一次执行必须丢弃旧段：旧段要么已经跑完，要么其队列
@@ -236,8 +253,11 @@ export class CodexAppServerDriver {
             if (suspended === undefined && session.segmentedTurn !== undefined) {
                 this.closeSegmentedTurn(session, session.segmentedTurn);
             }
-            // 分段 step 仍属于同一个 Provider turn；恢复它时不能插入 compact turn。
+            // 分段 step 仍属于同一个 Provider turn；恢复它时不能插入 compact turn，
+            // 也不能改写线程模型（同一个 Provider turn 中途换模型会被 Codex 拒绝）。
             const hasSuspendedTurn = suspended !== undefined;
+            if (!hasSuspendedTurn)
+                await this.alignThreadModel(session, input);
             if (!hasSuspendedTurn)
                 await this.ensureContextCapacity(session, input);
             if (!hasSuspendedTurn)
@@ -271,6 +291,7 @@ export class CodexAppServerDriver {
             queue: eventQueue,
             removeNotificationListener: () => undefined,
             terminalReason: null,
+            failure: undefined,
             done: false,
             pendingChunk: undefined,
             currentAssistantMessageId: undefined,
@@ -298,6 +319,8 @@ export class CodexAppServerDriver {
             const reason = readCodexTerminalReason(message);
             if (reason !== null) {
                 active.terminalReason = reason;
+                if (reason === 'error')
+                    active.failure = codexFailure(message);
                 eventQueue.close();
             }
         };
@@ -358,7 +381,11 @@ export class CodexAppServerDriver {
                         session.segmentedTurn = undefined;
                     active.removeAbortListener();
                     active.removeNotificationListener();
-                    yield { type: 'finish', reason: active.terminalReason ?? 'stop' };
+                    const danglingCompaction = closeDanglingAutoCompaction(session);
+                    if (danglingCompaction !== undefined)
+                        yield stabilizeCodexEvent(session, danglingCompaction);
+                    const reason = active.terminalReason ?? 'stop';
+                    yield { type: 'finish', reason, ...(reason === 'error' && active.failure !== undefined ? { failure: active.failure } : {}) };
                     return;
                 }
                 if (input.signal?.aborted)
@@ -367,27 +394,29 @@ export class CodexAppServerDriver {
             }
             if (chunk === null)
                 continue;
-            // 一个 assistant item 可能在多个工具调用之间切换。把新 item 的首个
-            // 正文留给下一次 llm/stream，当前流只返回边界，确保 DSH 先创建新 step。
-            if ((chunk.type === 'text-delta' || chunk.type === 'reasoning-delta')
-                && chunk.messageId !== undefined) {
-                const previousMessageId = active.currentAssistantMessageId;
-                if (previousMessageId !== undefined
-                    && previousMessageId !== chunk.messageId
-                    && active.sawCompletedTool) {
-                    active.pendingChunk = chunk;
-                    active.currentAssistantMessageId = chunk.messageId;
-                    active.sawCompletedTool = false;
-                    yield { type: 'step-boundary' };
-                    return;
+            for (const part of expandCodexCompactionChunk(session, chunk)) {
+                // 一个 assistant item 可能在多个工具调用之间切换。把新 item 的首个
+                // 正文留给下一次 llm/stream，当前流只返回边界，确保 DSH 先创建新 step。
+                if ((part.type === 'text-delta' || part.type === 'reasoning-delta')
+                    && part.messageId !== undefined) {
+                    const previousMessageId = active.currentAssistantMessageId;
+                    if (previousMessageId !== undefined
+                        && previousMessageId !== part.messageId
+                        && active.sawCompletedTool) {
+                        active.pendingChunk = part;
+                        active.currentAssistantMessageId = part.messageId;
+                        active.sawCompletedTool = false;
+                        yield { type: 'step-boundary' };
+                        return;
+                    }
+                    active.currentAssistantMessageId = part.messageId;
                 }
-                active.currentAssistantMessageId = chunk.messageId;
-            }
-            const stabilizedChunk = stabilizeCodexEvent(session, chunk);
-            if (stabilizedChunk.type === 'tool-event' && (stabilizedChunk.status === 'completed' || stabilizedChunk.status === 'failed')) {
-                active.sawCompletedTool = true;
+                const stabilizedChunk = stabilizeCodexEvent(session, part);
+                if (stabilizedChunk.type === 'tool-event' && (stabilizedChunk.status === 'completed' || stabilizedChunk.status === 'failed')) {
+                    active.sawCompletedTool = true;
+                }
+                yield stabilizedChunk;
             }
-            yield stabilizedChunk;
         }
     }
     closeSegmentedTurn(session, active) {
@@ -398,6 +427,34 @@ export class CodexAppServerDriver {
         if (session.segmentedTurn === active)
             session.segmentedTurn = undefined;
     }
+    /**
+     * 让线程真正生效的模型与 DSH 当前选择的模型保持一致。
+     *
+     * Codex 只在 `thread/start` 时决定线程模型，同一 app-server 进程内再次
+     * `thread/resume` 不会改写已持久化的模型。用户在 DSH 里切换模型后，如果不
+     * 显式纠正，后续 turn 仍会沿用旧模型；而线程一旦被写入错误模型（例如历史
+     * 路由把 DSH 主模型泄漏给 Codex），会话就会持续以 404 失败且无法自愈。
+     * 这里只在两者确实不同时下发一次纠正，避免每个 step 都产生额外 RPC。
+     */
+    async alignThreadModel(session, input) {
+        if (session.threadId === '' || session.threadModelCorrectionUnsupported)
+            return;
+        const desired = isProviderDefaultModel(input.modelId) ? undefined : input.modelId?.trim();
+        if (desired === undefined || desired === '')
+            return;
+        if (session.threadModelId === desired)
+            return;
+        try {
+            const response = await session.rpc.request('thread/settings/update', { threadId: session.threadId, model: desired }, { signal: input.signal, killOnAbort: false });
+            session.threadModelId = readThreadModel(response) ?? desired;
+        }
+        catch (error) {
+            // 旧版 Codex 可能没有该方法；纠正失败不能阻断本轮，模型仍由 turn 自身决定。
+            // 只有“方法不存在”才永久关闭纠正，避免网络类瞬时失败让会话再也无法换模型。
+            if (isMethodNotFound(error))
+                session.threadModelCorrectionUnsupported = true;
+        }
+    }
     /** 在下一轮开始前主动压缩，避免把已满的线程直接交给 turn/start。 */
     async ensureContextCapacity(session, input) {
         if (session.contextWindow === undefined || session.contextTokens === undefined)
@@ -579,6 +636,13 @@ export class CodexAppServerDriver {
         else if (pending.response === 'command') {
             pending.resolve({ decision: response.approved ? 'accept' : 'decline' });
         }
+        else if (pending.response === 'permissions') {
+            // `item/permissions/requestApproval` 的应答形状是 {permissions, scope}，
+            // 不是 {approved}。批准回显请求画像；拒绝给空画像，语义等价于“不授予额外权限”。
+            pending.resolve(response.approved
+                ? { permissions: grantedPermissionProfile(pending.requested), scope: 'turn' }
+                : { permissions: {}, scope: 'turn' });
+        }
         else {
             pending.resolve({
                 approved: response.approved,
@@ -618,7 +682,9 @@ export class CodexAppServerDriver {
         if (previous?.segmentedTurn !== undefined)
             this.closeSegmentedTurn(previous, previous.segmentedTurn);
         previous?.rpc.dispose();
-        const rpc = new JsonRpcProcess({ command, args: ['app-server'], cwd: input.cwd, spawn: this.runSpawn });
+        // 子代理托管开启时用 `-c` 覆盖注入 MCP 替身工具；工具由桥接转投成 DSH 原生子会话。
+        const bridgeArgs = codexBridgeArgs(input.sessionId, this.descriptor.id);
+        const rpc = new JsonRpcProcess({ command, args: [...CODEX_APP_SERVER_ARGS, ...bridgeArgs], cwd: input.cwd, spawn: this.runSpawn });
         const session = {
             rpc,
             cwd: input.cwd,
@@ -626,6 +692,8 @@ export class CodexAppServerDriver {
             contextWindow: undefined,
             contextTokens: undefined,
             threadId: '',
+            threadModelId: undefined,
+            threadModelCorrectionUnsupported: false,
             turnId: null,
             providerSessionId: input.providerSessionId ?? input.sessionId,
             pendingPermissions: new Map(),
@@ -635,6 +703,7 @@ export class CodexAppServerDriver {
             suppressCompactionNotifications: false,
             suppressedCompactionTurnIds: new Set(),
             pendingCompactionEvents: [],
+            autoCompaction: undefined,
         };
         this.processes.add(rpc);
         this.sessions.set(input.sessionId, session);
@@ -648,12 +717,23 @@ export class CodexAppServerDriver {
             const item = isRecord(params.item) ? params.item : params;
             const method = typeof request.method === 'string' ? request.method : '';
             const type = typeof item.type === 'string' ? item.type : '';
+            // 动态工具服务端请求要求客户端执行任意工具。
+            // DSH 适配器只负责观察 Codex 已执行的工具，不具备安全执行任意动态工具
+            // 的能力；必须显式回绝请求，不能把它挂进权限等待表，否则 Provider 会永久等待。
+            if (method === ['item', 'tool', 'call'].join('/')) {
+                return {
+                    success: false,
+                    contentItems: [{ type: 'inputText', text: 'CodingNS 不支持由 Codex 反向调用动态工具' }],
+                };
+            }
             if (isQuestionEvent(`${method} ${type}`)) {
                 return new Promise((resolve) => session.pendingQuestions.set(requestId, resolve));
             }
+            const kind = permissionResponseKind(method, params);
             return new Promise((resolve) => session.pendingPermissions.set(requestId, {
                 resolve,
-                response: permissionResponseKind(method, params),
+                response: kind,
+                ...(kind === 'permissions' ? { requested: params.permissions } : {}),
             }));
         });
         return session;
@@ -845,6 +925,68 @@ function* drainCompactionEvents(session) {
             yield event;
     }
 }
+/**
+ * 把自动压缩的 item 生命周期展开成闭合的 start/summary/end 事务。
+ *
+ * Codex 0.158 起，压缩只通过 contextCompaction item 的 started/completed 通知
+ * 发布，`thread/compacted`（ContextCompactedNotification）已废弃且不再发送。
+ * 而 DSH 会话格式要求每个 compaction/start 必须由 compaction/end 闭合，否则
+ * 历史加载会以 "turn/end crosses an open compaction" 失败。这里在 item/completed
+ * 之后合成 end，同时兼容旧版 Codex 仍会发送的 thread/compacted 完成信号。
+ */
+function* expandCodexCompactionChunk(session, chunk) {
+    if (chunk.type !== 'context-compaction') {
+        yield chunk;
+        return;
+    }
+    if (chunk.phase === 'start') {
+        if (session.autoCompaction?.open === true && session.autoCompaction.compactionId === chunk.compactionId) {
+            yield chunk;
+            return;
+        }
+        session.autoCompaction = { compactionId: chunk.compactionId, open: true };
+        yield chunk;
+        return;
+    }
+    if (chunk.phase === 'summary') {
+        yield chunk;
+        const pending = session.autoCompaction;
+        if (pending !== undefined && pending.open) {
+            pending.open = false;
+            yield {
+                type: 'context-compaction',
+                phase: 'end',
+                ...(chunk.compactionId === undefined ? {} : { compactionId: chunk.compactionId }),
+            };
+        }
+        return;
+    }
+    const pending = session.autoCompaction;
+    if (pending !== undefined) {
+        if (pending.open) {
+            // item/started 之后直接收到完成信号（旧版 Codex 的 thread/compacted）：
+            // 由该信号闭合事务。
+            pending.open = false;
+            yield chunk;
+        }
+        // 已经由 item/completed 合成过 end 的重复完成信号不再下发；桥接层虽然
+        // 对重复 end 幂等，但重复通知没有新的语义。
+        return;
+    }
+    yield chunk;
+}
+/** 流终结时为未收到完成通知的自动压缩补一个 end，避免会话日志残留未闭合事务。 */
+function closeDanglingAutoCompaction(session) {
+    const pending = session.autoCompaction;
+    if (pending === undefined || !pending.open)
+        return undefined;
+    session.autoCompaction = undefined;
+    return {
+        type: 'context-compaction',
+        phase: 'end',
+        ...(pending.compactionId === undefined ? {} : { compactionId: pending.compactionId }),
+    };
+}
 function compactionDetails(value) {
     if (!isRecord(value))
         return {};
@@ -866,21 +1008,45 @@ function isContextCompactionTurn(value) {
 }
 function codexPermissionDetails(method, params, item) {
     const fileChange = method.includes('fileChange') || method.includes('file_change') || String(item.type ?? '').toLowerCase() === 'filechange';
+    // 沙箱提权请求没有 command/grantRoot，只有一个待授予的权限画像；
+    // 必须把画像摘要带进 detail，否则审批弹窗只会显示一个空理由。
+    const permissions = method.includes('permissions') && method.includes('Approval') ? params.permissions : undefined;
     const command = typeof params.command === 'string' ? params.command : typeof item.command === 'string' ? item.command : undefined;
     const reason = typeof params.reason === 'string' ? params.reason : typeof params.description === 'string' ? params.description : undefined;
     const grantRoot = typeof params.grantRoot === 'string' ? params.grantRoot : undefined;
     const paths = permissionPaths(params.fileChanges ?? params.file_changes ?? item.changes);
     const callId = firstToolText(params.callId, params.call_id, params.itemId, item.id);
-    const detail = [reason, command, paths.length > 0 ? `文件: ${paths.join(', ')}` : undefined, grantRoot ? `允许写入: ${grantRoot}` : undefined]
+    const detail = [reason, command, paths.length > 0 ? `文件: ${paths.join(', ')}` : undefined, grantRoot ? `允许写入: ${grantRoot}` : undefined, permissionProfileSummary(permissions)]
         .filter((value) => value !== undefined && value.trim() !== '')
         .join('；');
     return {
-        kind: typeof params.kind === 'string' ? params.kind : fileChange ? 'file_change' : 'command',
+        kind: permissions !== undefined ? 'permissions' : typeof params.kind === 'string' ? params.kind : fileChange ? 'file_change' : 'command',
         ...(fileChange ? { toolName: 'edit' } : {}),
         ...(callId === undefined ? {} : { callId }),
         ...(detail === '' ? {} : { detail }),
     };
 }
+/** 把权限画像压成一句可读摘要；未知形状返回 undefined，不猜测语义。 */
+function permissionProfileSummary(value) {
+    const profile = isRecord(value) ? value : null;
+    if (profile === null)
+        return undefined;
+    const fileSystem = isRecord(profile.fileSystem) ? profile.fileSystem : null;
+    const network = isRecord(profile.network) ? profile.network : null;
+    const parts = [];
+    const write = stringList(fileSystem?.write);
+    const read = stringList(fileSystem?.read);
+    if (write.length > 0)
+        parts.push(`请求写入: ${write.join(', ')}`);
+    if (read.length > 0)
+        parts.push(`请求读取: ${read.join(', ')}`);
+    if (network?.enabled === true)
+        parts.push('请求网络访问');
+    return parts.length === 0 ? undefined : parts.join('；');
+}
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string' && entry.trim() !== '') : [];
+}
 function permissionPaths(value) {
     if (Array.isArray(value))
         return value.flatMap((entry) => permissionPaths(entry));
@@ -1054,6 +1220,27 @@ function isContextWindowError(error) {
         return hasContextWindowError(error.data);
     return hasContextWindowError(error);
 }
+/**
+ * 判断 RPC 失败是否表示“服务端不认识这个方法”。
+ *
+ * 旧版 Codex app-server 没有 `thread/settings/update`。只有这种情况才应永久
+ * 关闭模型纠正；进程退出、超时等瞬时失败必须保留重试机会，否则一次抖动就会让
+ * 该会话再也无法切换模型。
+ */
+function isMethodNotFound(error) {
+    if (error instanceof JsonRpcRequestError) {
+        if (error.code === -32601)
+            return true;
+        const data = isRecord(error.data) ? error.data : null;
+        if (data?.code === -32601)
+            return true;
+        return typeof data?.message === 'string' && /method\s*not\s*found|unknown method/iu.test(data.message);
+    }
+    if (isRecord(error) && error.code === -32601)
+        return true;
+    const message = error instanceof Error ? error.message : typeof error === 'string' ? error : '';
+    return /method\s*not\s*found|unknown method/iu.test(message);
+}
 function hasContextWindowError(value) {
     if (typeof value === 'string')
         return /context[_-]?window[_-]?exceeded|context window exceeded/iu.test(value);
@@ -1062,11 +1249,12 @@ function hasContextWindowError(value) {
     return Object.entries(value).some(([key, child]) => /context.?window.?exceeded/iu.test(key) || hasContextWindowError(child));
 }
 function readCodexTerminalReason(message) {
-    if (message.method === 'error') {
+    const method = message.method ?? '';
+    if (method === 'error') {
         const params = isRecord(message.params) ? message.params : null;
         return params?.willRetry === true ? null : 'error';
     }
-    if (message.method !== 'turn/completed')
+    if (!isCodexTerminalMethod(method))
         return null;
     const params = isRecord(message.params) ? message.params : null;
     const turn = isRecord(params?.turn) ? params.turn : null;
@@ -1074,8 +1262,36 @@ function readCodexTerminalReason(message) {
         return 'error';
     if (turn?.status === 'interrupted' || turn?.status === 'cancelled')
         return 'cancel';
+    if (method === 'turn/failed' || method === 'turn/error')
+        return 'error';
+    if (method === 'turn/interrupted' || method === 'turn/cancelled' || method === 'turn/aborted')
+        return 'cancel';
     return 'stop';
 }
+function codexFailure(message) {
+    const params = isRecord(message.params) ? message.params : message;
+    const turn = isRecord(params.turn) ? params.turn : params;
+    const error = isRecord(turn.error) ? turn.error : turn.error ?? params.error;
+    const detail = textValue(isRecord(error) ? error.message ?? error.detail ?? error.description : error)
+        ?? (isRecord(error) ? textValue(error.type) : null)
+        ?? 'Codex Provider 未返回具体失败信息。';
+    const codeValue = isRecord(error) ? error.code ?? error.errorCode ?? error.error_code ?? error.type ?? error.status ?? error.statusCode : undefined;
+    const code = typeof codeValue === 'number' && Number.isFinite(codeValue)
+        ? String(codeValue)
+        : typeof codeValue === 'string' && codeValue.trim() !== ''
+            ? codeValue.trim()
+            : undefined;
+    return code === undefined ? { message: detail } : { message: detail, code };
+}
+/** Codex 版本间曾使用不同的 turn 终态通知名，统一收敛到同一结束路径。 */
+function isCodexTerminalMethod(method) {
+    return method === 'turn/completed'
+        || method === 'turn/failed'
+        || method === 'turn/error'
+        || method === 'turn/interrupted'
+        || method === 'turn/cancelled'
+        || method === 'turn/aborted';
+}
 /** 将 turn/start 响应里的终态归一化成父仓库使用的 turn/completed 通知。 */
 function buildCodexCompletionNotification(value, threadId) {
     if (!isRecord(value) || !isRecord(value.turn))
@@ -1100,26 +1316,83 @@ function isCodexToolEvent(method, type) {
     const normalized = type.replace(/[_-]/gu, '').toLowerCase();
     return ['commandexecution', 'filechange', 'mcptoolcall', 'functioncall', 'customtoolcall', 'dynamictoolcall'].includes(normalized);
 }
+/**
+ * `thread/start` 与 `thread/resume` 共用的线程参数。
+ *
+ * 权限必须在这里就与 `turn/start` 保持一致：Codex 的线程级沙箱会成为后续回合
+ * 的默认值，只在 turn 上覆盖会让首次工具调用落到与 DSH 不同的模式。
+ */
+function codexThreadParams(input) {
+    const developerInstructions = codexBridgeDeveloperInstructions(input.sessionId);
+    return {
+        cwd: input.cwd ?? process.cwd(),
+        sandbox: codexSandboxMode(input),
+        approvalPolicy: codexApprovalPolicy(input),
+        ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}),
+        ...(developerInstructions === undefined ? {} : { developerInstructions }),
+    };
+}
 function codexTurnStartParams(input, threadId) {
     const cwd = resolve(input.cwd ?? process.cwd());
+    const inputBlocks = [];
+    const attachments = input.attachments ?? [];
+    if (input.prompt.trim() !== '' || attachments.length === 0)
+        inputBlocks.push({ type: 'text', text: input.prompt });
+    for (const attachment of attachments) {
+        if (attachment.kind === 'image')
+            inputBlocks.push({ type: 'localImage', path: attachment.path });
+    }
     return {
         threadId,
-        input: [{ type: 'text', text: input.prompt }],
+        input: inputBlocks,
         cwd,
-        // DSH 的 workspace-write 只约束自身工具沙箱，不会自动传递给 Codex
-        // app-server。显式声明当前工作区，避免 Codex 将文件编辑误判为只读越权。
-        sandboxPolicy: {
-            type: 'workspaceWrite',
-            writableRoots: [cwd],
-            networkAccess: false,
-            excludeTmpdirEnvVar: false,
-            excludeSlashTmp: false,
-        },
-        approvalPolicy: 'on-request',
+        sandboxPolicy: codexSandboxPolicy(input, cwd),
+        approvalPolicy: codexApprovalPolicy(input),
         ...(input.effortId ? { effort: input.effortId } : {}),
     };
 }
+/**
+ * 由 DSH 会话权限状态派生 Codex 原生沙箱模式。
+ *
+ * `permission` 缺省表示 Host **还没读到**权限事实，此时沿用旧的保守默认
+ * （工作区可写），不能推断为完全权限。三个字段必须来自同一份状态。
+ */
+function codexSandboxMode(input) {
+    return input.permission?.sandboxMode ?? 'workspace-write';
+}
+function codexSandboxPolicy(input, cwd) {
+    const mode = codexSandboxMode(input);
+    // danger-full-access 必须映射成 Codex 自己的 bypass 形状；继续下发
+    // workspaceWrite 会让 DSH 声明完全权限、Codex 实际只读，两侧语义分叉。
+    if (mode === 'danger-full-access')
+        return { type: 'dangerFullAccess' };
+    if (mode === 'read-only')
+        return { type: 'readOnly', networkAccess: false };
+    // DSH 的 workspace-write 只约束自身工具沙箱，不会自动传递给 Codex
+    // app-server。显式声明当前工作区，避免 Codex 将文件编辑误判为只读越权。
+    return {
+        type: 'workspaceWrite',
+        writableRoots: [cwd],
+        networkAccess: false,
+        excludeTmpdirEnvVar: false,
+        excludeSlashTmp: false,
+    };
+}
+/**
+ * 由同一份权限状态派生审批策略。
+ *
+ * DSH 的 `never` 表示“需要审批的动作会被自动拒绝”，因此绝不能同时向 Codex
+ * 声明 `on-request`：那会让 Codex 发起注定被自动拒绝的审批，模型还会误以为
+ * 用户拒绝了它。`ask` 才映射为 Codex 的 `on-request`。
+ */
+function codexApprovalPolicy(input) {
+    return input.permission?.approvalPolicy === 'never' ? 'never' : 'on-request';
+}
 function permissionResponseKind(method, params) {
+    // 沙箱提权请求的应答是 {permissions, scope}，必须在识别 fileChange/command 之前
+    // 判定，否则会落到 legacy 分支返回 {approved}，形状不符。
+    if (method.includes('permissions') && method.includes('Approval'))
+        return 'permissions';
     if (method.includes('fileChange') || method.includes('file_change'))
         return 'file-change';
     // 新版 Codex 带 threadId/turnId/itemId，并要求 decision；旧版测试和旧
@@ -1128,6 +1401,21 @@ function permissionResponseKind(method, params) {
         return 'command';
     return 'legacy';
 }
+/**
+ * 把 Codex 请求的权限画像转成可回传的授予画像。
+ *
+ * `RequestPermissionProfile` 与 `GrantedPermissionProfile` 同形，但缺省字段在
+ * 授予侧是可选的；这里只保留实际存在的部分，避免回传 null 触发 schema 拒绝。
+ */
+function grantedPermissionProfile(requested) {
+    const profile = isRecord(requested) ? requested : null;
+    const fileSystem = isRecord(profile?.fileSystem) ? profile.fileSystem : undefined;
+    const network = isRecord(profile?.network) ? profile.network : undefined;
+    return {
+        ...(fileSystem === undefined ? {} : { fileSystem }),
+        ...(network === undefined ? {} : { network }),
+    };
+}
 function readId(value) {
     if (!isRecord(value))
         return null;
@@ -1139,4 +1427,19 @@ function readId(value) {
         return value.thread.id;
     return null;
 }
+/**
+ * 读取线程当前生效的模型。
+ *
+ * `thread/start`、`thread/resume` 的响应都在顶层返回 `model`；旧版协议把它嵌在
+ * `thread.model` 中。读不到时返回 undefined，调用方按“未知”处理并自行纠正。
+ */
+function readThreadModel(value) {
+    if (!isRecord(value))
+        return undefined;
+    const direct = value.model;
+    if (typeof direct === 'string' && direct.trim() !== '')
+        return direct.trim();
+    const nested = isRecord(value.thread) ? value.thread.model : undefined;
+    return typeof nested === 'string' && nested.trim() !== '' ? nested.trim() : undefined;
+}
 //# sourceMappingURL=codex-driver.js.map