@jpcasabiancai/cayenne 0.5.6 → 0.5.7

package/dist/cli.js

@@ -31,7 +31,7 @@ var init_cloud = __esm({
     CLOUD_SUPABASE_ANON_KEY = assertPublishable(
       "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im5kcXJrcXh3a3p4Z25oa3ZjdW5yIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODg3MTMyNzYsImV4cCI6MjEwNDI4OTI3Nn0.Dlsxw91E1QYZ4eoRDjP80Rf4feY77Z-T-fiIwUDY2k0"
     );
-    CLOUD_APP_ORIGIN = "https://cayenne-pink.vercel.app";
+    CLOUD_APP_ORIGIN = "https://app.cayenne.sh";
   }
 });
 
@@ -2729,13 +2729,16 @@ var init_rpc = __esm({
         }
       }
       dispatch(line) {
-        let frame;
+        let parsed;
         try {
-          frame = JSON.parse(line);
+          parsed = JSON.parse(line);
         } catch {
           return;
         }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
+        const frame = parsed;
         if (frame.id !== void 0 && frame.method === void 0) {
+          if (typeof frame.id !== "number") return;
           const p = this.pending.get(frame.id);
           if (!p) return;
           this.pending.delete(frame.id);
@@ -2748,6 +2751,7 @@ var init_rpc = __esm({
           void (async () => {
             try {
               const result = await this.request_?.({
+                id,
                 method: frame.method,
                 params: frame.params
               });
@@ -2755,7 +2759,11 @@ var init_rpc = __esm({
             } catch (err) {
               this.write({
                 id,
-                error: { code: -32603, message: err instanceof Error ? err.message : String(err) }
+                error: {
+                  // A handler that knows the JSON-RPC code for its refusal says so; else "internal".
+                  code: err instanceof RpcError ? err.code : -32603,
+                  message: err instanceof Error ? err.message : String(err)
+                }
               });
             }
           })();
@@ -2770,6 +2778,17 @@ var init_rpc = __esm({
 // src/codex/detect.ts
 import { execFile as execFile2, spawn } from "child_process";
 import { promisify } from "util";
+async function allModels(request) {
+  const models = [];
+  let cursor;
+  do {
+    const page = await request(cursor ? { cursor } : {});
+    const data = page.data ?? [];
+    models.push(...data);
+    cursor = data.length > 0 && page.nextCursor ? page.nextCursor : void 0;
+  } while (cursor && models.length < MAX_MODELS);
+  return models;
+}
 function findCodexOnPath(env) {
   return findOnPath("codex", env.PATH);
 }
@@ -2798,8 +2817,7 @@ async function listCodexModels(path) {
       clientInfo: { name: "cayenne-runner", title: "Cayenne", version: "0.0.1" }
     });
     rpc.notify("initialized", {});
-    const res = await rpc.request("model/list", {});
-    return res.data ?? [];
+    return await allModels((params) => rpc.request("model/list", params));
   } finally {
     clearTimeout(timer);
     rpc.close();
@@ -2807,7 +2825,7 @@ async function listCodexModels(path) {
   }
 }
 function toProviderModel(m) {
-  const efforts = (m.supportedReasoningEfforts ?? []).map((e) => e.effort).filter((e) => Effort.options.includes(e));
+  const efforts = (m.supportedReasoningEfforts ?? []).map((e) => e.reasoningEffort).filter((e) => Effort.options.includes(e));
   const fallback = Effort.options.includes(m.defaultReasoningEffort) ? m.defaultReasoningEffort : void 0;
   return {
     id: (m.id ?? "").slice(0, MAX_NAME),
@@ -7160,10 +7178,10 @@ async function syncDocuments(deps, pass) {
         if (error2) throw new Error(error2.message);
         const row = data;
         if (!row?.id) throw new Error("the insert returned no row");
-        const failed4 = await publish2(row, doc);
-        if (failed4 !== null) {
+        const failed5 = await publish2(row, doc);
+        if (failed5 !== null) {
           log.warn(
-            { err: failed4, relPath: doc.relPath, sessionId: deps.sessionId },
+            { err: failed5, relPath: doc.relPath, sessionId: deps.sessionId },
             "could not upload a document; removing the row so the next pass retries it"
           );
           await takeBack(row.id, doc.relPath);
@@ -7176,10 +7194,10 @@ async function syncDocuments(deps, pass) {
       const restated = before.status !== "present" || before.title !== doc.title || before.kind !== doc.kind || before.size_bytes !== doc.size;
       if (!rewritten && !restated) continue;
       if (rewritten) {
-        const failed4 = await upload(before.storage_path, doc);
-        if (failed4 !== null) {
+        const failed5 = await upload(before.storage_path, doc);
+        if (failed5 !== null) {
           log.warn(
-            { err: failed4, relPath: doc.relPath, sessionId: deps.sessionId },
+            { err: failed5, relPath: doc.relPath, sessionId: deps.sessionId },
             "could not overwrite a document; its row still describes the bytes in the bucket"
           );
           continue;
@@ -8047,15 +8065,37 @@ ${this.stderrTail.join("\n")}` : "";
 });
 
 // src/codex/normalize.ts
+function moveTarget(kind) {
+  const named = [kind.move_path, kind.movePath].filter((target) => target != null);
+  if (named.length === 0) return void 0;
+  const [first] = named;
+  return typeof first === "string" && named.every((target) => target === first) ? first : "";
+}
+function fileChanges(item) {
+  if (!Array.isArray(item.changes)) return [];
+  return item.changes.map((entry) => {
+    const change = isRecord(entry) ? entry : {};
+    const kind = isRecord(change.kind) ? change.kind : {};
+    const movePath = moveTarget(kind);
+    return {
+      path: typeof change.path === "string" ? change.path : "",
+      ...typeof kind.type === "string" ? { kind: kind.type } : {},
+      ...typeof change.diff === "string" ? { diff: change.diff } : {},
+      ...movePath === void 0 ? {} : { movePath }
+    };
+  });
+}
 function normalizeCodexItem(item, phase) {
   const base = { providerUuid: item.id, parentToolUseId: null, raw: item };
-  if (item.type === "agent_message") {
+  if (item.type === "agentMessage") {
     if (phase !== "completed") return null;
     return { role: "assistant", content: [{ type: "text", text: item.text ?? "" }], ...base };
   }
   if (item.type === "reasoning") {
     if (phase !== "completed") return null;
-    return { role: "assistant", content: [{ type: "thinking", text: item.text ?? "" }], ...base };
+    const text = (Array.isArray(item.summary) ? item.summary : []).join("\n\n");
+    if (!text) return null;
+    return { role: "assistant", content: [{ type: "thinking", text }], ...base };
   }
   const name = toolName(item);
   if (!name) return null;
@@ -8063,12 +8103,11 @@ function normalizeCodexItem(item, phase) {
     const block2 = { type: "tool_use", id: item.id, name, input: toolInput(item) };
     return { role: "assistant", content: [block2], ...base };
   }
-  const isError2 = item.status === "failed" || item.exit_code !== void 0 && item.exit_code !== 0;
   const block = {
     type: "tool_result",
     toolUseId: item.id,
     content: resultText(item),
-    isError: isError2
+    isError: failed4(item)
   };
   return { role: "tool", content: [block], ...base };
 }
@@ -8089,20 +8128,21 @@ function deltaEvents(_itemId, kind, text, first) {
 function stopEvents() {
   return [{ type: "content_block_stop", index: 0 }, { type: "message_stop" }];
 }
-var toolName, toolInput, resultText;
+var isRecord, toolName, toolInput, resultText, failed4;
 var init_normalize2 = __esm({
   "src/codex/normalize.ts"() {
     "use strict";
     init_src();
+    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
     toolName = (item) => {
       switch (item.type) {
-        case "command_execution":
+        case "commandExecution":
           return CODEX_TOOL_NAMES.command;
-        case "file_change":
+        case "fileChange":
           return CODEX_TOOL_NAMES.fileChange;
-        case "web_search":
+        case "webSearch":
           return CODEX_TOOL_NAMES.webSearch;
-        case "mcp_tool_call":
+        case "mcpToolCall":
           return `codex.mcp.${(item.server ?? "server").replace(/[^A-Za-z0-9_.-]/g, "")}.${(item.tool ?? "tool").replace(/[^A-Za-z0-9_.-]/g, "")}`.slice(
             0,
             64
@@ -8113,21 +8153,25 @@ var init_normalize2 = __esm({
     };
     toolInput = (item) => {
       switch (item.type) {
-        case "command_execution":
+        case "commandExecution":
           return { command: item.command ?? "", ...item.cwd ? { cwd: item.cwd } : {} };
-        case "file_change":
-          return { changes: item.changes ?? [] };
-        case "web_search":
+        case "fileChange":
+          return { changes: fileChanges(item) };
+        case "webSearch":
           return { query: item.query ?? "" };
         default:
-          return item.arguments ?? {};
+          if (isRecord(item.arguments)) return item.arguments;
+          return item.arguments === void 0 ? {} : { arguments: item.arguments };
       }
     };
     resultText = (item) => {
-      if (item.type === "command_execution") return item.aggregated_output ?? "";
-      if (item.type === "file_change") return JSON.stringify(item.changes ?? []);
+      if (item.type === "commandExecution") return item.aggregatedOutput ?? "";
+      if (item.type === "fileChange") return JSON.stringify(fileChanges(item));
+      if (item.type === "webSearch") return JSON.stringify(item.action ?? null);
+      if (item.error?.message) return item.error.message;
       return typeof item.result === "string" ? item.result : JSON.stringify(item.result ?? null);
     };
+    failed4 = (item) => item.status === "failed" || item.status === "declined" || Boolean(item.error) || typeof item.exitCode === "number" && item.exitCode !== 0;
   }
 });
 
@@ -8142,6 +8186,9 @@ function sandboxFor(mode, cwd) {
       return { type: "workspaceWrite", writableRoots: [cwd], networkAccess: false };
   }
 }
+function sandboxMode(policy) {
+  return SANDBOX_MODES[policy.type];
+}
 function autoDecide(mode, kind) {
   if (mode === "bypassPermissions") return "accept";
   if (mode === "dontAsk") return "decline";
@@ -8149,9 +8196,15 @@ function autoDecide(mode, kind) {
   if (mode === "acceptEdits" && kind === "file_change") return "accept";
   return "ask";
 }
+var SANDBOX_MODES;
 var init_policy = __esm({
   "src/codex/policy.ts"() {
     "use strict";
+    SANDBOX_MODES = {
+      readOnly: "read-only",
+      workspaceWrite: "workspace-write",
+      dangerFullAccess: "danger-full-access"
+    };
   }
 });
 
@@ -8161,6 +8214,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
 import { chmodSync as chmodSync5, lstatSync as lstatSync7, mkdirSync as mkdirSync8, rmdirSync, rmSync as rmSync8, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname8, join as join22 } from "path";
+import { z as z18 } from "zod";
 function newStop() {
   let resolve6;
   let reject;
@@ -8174,10 +8228,35 @@ function newStop() {
 function removeFiles(files) {
   for (const file of files) rmSync8(file, { force: true });
 }
+function readQuestions(params) {
+  const asked = AskedQuestions.safeParse(params);
+  if (!asked.success) return null;
+  const { questions } = asked.data;
+  const ids = questions.map((q) => q.id);
+  if (new Set(ids).size !== ids.length || questions.some((q) => q.isSecret)) return null;
+  const input = CodexQuestions.safeParse({
+    questions: questions.map((q) => ({
+      text: q.question,
+      ...q.options?.length ? { options: q.options.map((o) => o.label) } : {}
+    }))
+  });
+  return input.success ? { ids, input: input.data } : null;
+}
 function scrubSecrets(text) {
   return SECRET_PATTERNS.reduce((acc, [pattern, to]) => acc.replace(pattern, to), text);
 }
-var STDERR_TAIL_MAX, STOP_WAIT_MS, SIGKILL_AFTER_MS, SECRET_PATTERNS, APPROVAL_METHODS, CodexSession;
+function failureText(error) {
+  const message = error?.message;
+  if (typeof message !== "string" || !message.trim()) return null;
+  let text = message;
+  try {
+    const inner = JSON.parse(message)?.error?.message;
+    if (typeof inner === "string" && inner.trim()) text = inner;
+  } catch {
+  }
+  return scrubSecrets(text).trim().slice(0, TURN_ERROR_MAX);
+}
+var decided, NO_ANSWERS, REFUSALS, METHOD_NOT_FOUND, AskedQuestions, STDERR_TAIL_MAX, STOP_WAIT_MS, TURN_ERROR_MAX, SIGKILL_AFTER_MS, SECRET_PATTERNS, APPROVAL_METHODS, CodexSession;
 var init_session3 = __esm({
   "src/codex/session.ts"() {
     "use strict";
@@ -8187,8 +8266,27 @@ var init_session3 = __esm({
     init_normalize2();
     init_policy();
     init_rpc();
+    decided = (decision) => ({ decision });
+    NO_ANSWERS = { answers: {} };
+    REFUSALS = {
+      "item/permissions/requestApproval": { permissions: {} },
+      "mcpServer/elicitation/request": { action: "decline" },
+      "item/tool/call": { contentItems: [], success: false }
+    };
+    METHOD_NOT_FOUND = -32601;
+    AskedQuestions = z18.object({
+      questions: z18.array(
+        z18.object({
+          id: z18.string().min(1),
+          question: z18.string(),
+          isSecret: z18.boolean().nullish(),
+          options: z18.array(z18.object({ label: z18.string() })).nullish()
+        })
+      )
+    });
     STDERR_TAIL_MAX = 2 * 1024;
     STOP_WAIT_MS = 2e3;
+    TURN_ERROR_MAX = 500;
     SIGKILL_AFTER_MS = 5e3;
     SECRET_PATTERNS = [
       [
@@ -8234,8 +8332,17 @@ var init_session3 = __esm({
       resolvers = /* @__PURE__ */ new Map();
       /** Monotonic, so no two held requests can ever share a local id. */
       approvalSeq = 0;
-      /** How many questions each pending `codex.user_input` asked, so answers can be counted. */
-      questionCounts = /* @__PURE__ */ new Map();
+      /**
+       * The app-server's id of each question a pending `codex.user_input` asked, in the order the
+       * card shows them: an answer goes back under its question's id.
+       */
+      questionIds = /* @__PURE__ */ new Map();
+      /**
+       * The files of each `fileChange` item in progress, by item id. `item/fileChange/requestApproval`
+       * names the item and not its files: those came with `item/started`, which the app-server sends
+       * first (live 2026-10-13), and with any `item/fileChange/patchUpdated` after.
+       */
+      fileChanges = /* @__PURE__ */ new Map();
       start() {
         if (this.child) throw new Error("VALIDATION: session already started");
         const spawnFn = this.opts.spawnFn ?? ((p, a, env) => spawn2(p, a, { stdio: "pipe", env }));
@@ -8255,13 +8362,19 @@ var init_session3 = __esm({
 ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
           const error = this.stopping || code === 0 ? null : `PROVIDER_ERROR: codex exited with ${code}${tail}`;
           this.removeAllFiles();
+          this.withdrawAll();
           this.emit("exit", { error });
         });
         const rpc = new JsonRpc(child.stdin, child.stdout);
         this.rpc = rpc;
-        rpc.onNotification((n) => this.onNotification(n.method, n.params));
-        rpc.onRequest((r) => this.onRequest(r.method, r.params));
+        rpc.onNotification(
+          (n) => this.onNotification(n.method, n.params ?? {})
+        );
+        rpc.onRequest(
+          (r) => this.onRequest(r.id, r.method, r.params ?? {})
+        );
         void this.handshake().catch((err) => {
+          this.withdrawAll();
           this.emit("exit", {
             error: `PROVIDER_ERROR: ${err instanceof Error ? err.message : String(err)}`
           });
@@ -8277,17 +8390,24 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         const params = {
           cwd: this.opts.cwd,
           approvalPolicy: "on-request",
-          sandbox: this.sandbox,
+          // The mode word: opening a thread refuses a policy object (`unknown variant `type``, live
+          // 2026-10-13). The policy itself, with its writable root, goes with every `turn/start`.
+          sandbox: sandboxMode(this.sandbox),
           ...this.pendingModel ? { model: this.pendingModel } : {}
         };
         const res = this.opts.resume ? await rpc.request("thread/resume", {
           threadId: this.opts.resume,
           ...params
-        }) : await rpc.request("thread/start", params);
-        this.providerSessionId = res.threadId ?? this.opts.resume ?? null;
+        }) : await rpc.request("thread/start", {
+          ...params,
+          ...this.opts.ephemeral ? { ephemeral: true } : {}
+        });
+        const threadId = res?.thread?.id;
+        if (!threadId) throw new Error("codex app-server opened no thread");
+        this.providerSessionId = threadId;
         this.emit("init", {
-          providerSessionId: this.providerSessionId ?? "",
-          model: res.model ?? this.pendingModel ?? "",
+          providerSessionId: threadId,
+          model: res?.model ?? this.pendingModel ?? "",
           tools: [],
           slashCommands: [],
           permissionMode: this.mode
@@ -8353,6 +8473,7 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         if (!turn) return;
         this.turn = null;
         removeFiles(turn.files);
+        this.fileChanges.clear();
         turn.stop?.resolve();
       }
       removeAllFiles() {
@@ -8399,7 +8520,11 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             isError: true,
             durationMs: 0,
             numTurns: 1,
-            stopReason: err instanceof Error ? err.message : String(err)
+            // The app-server's own words, broadcast like a failed turn's: scrubbed and kept short.
+            stopReason: scrubSecrets(err instanceof Error ? err.message : String(err)).slice(
+              0,
+              TURN_ERROR_MAX
+            )
           });
         });
       }
@@ -8469,6 +8594,10 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             const item = params.item;
             if (!item) return;
             const phase = method === "item/started" ? "started" : "completed";
+            if (item.type === "fileChange") {
+              if (phase === "started") this.setFiles(item.id, fileChanges(item));
+              else this.fileChanges.delete(item.id);
+            }
             if (phase === "completed" && this.streaming.delete(item.id)) {
               for (const event of stopEvents())
                 this.emit("stream", { event, parentToolUseId: null, uuid: item.id });
@@ -8477,15 +8606,32 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             if (row) this.emit("message", row);
             return;
           }
-          case "turn/completed":
-          case "turn/failed": {
+          case "item/fileChange/patchUpdated":
+            if (typeof params.itemId === "string" && this.fileChanges.has(params.itemId)) {
+              this.setFiles(params.itemId, fileChanges(params));
+            }
+            return;
+          case "serverRequest/resolved":
+            for (const [id, entry] of [...this.approvals]) {
+              if (entry.rpcId === params.requestId) this.withdraw(id);
+            }
+            return;
+          case "turn/completed": {
             this.endTurn();
-            const status = turn?.status ?? params.status ?? (method === "turn/failed" ? "failed" : "completed");
+            const ended = turn?.id ?? params.turnId;
+            for (const [id, entry] of [...this.approvals]) {
+              if (typeof ended !== "string" || entry.turnId === null || entry.turnId === ended) {
+                this.withdraw(id);
+              }
+            }
+            const status = turn?.status ?? params.status ?? "completed";
+            const isError2 = status === "failed";
             this.emit("result", {
-              isError: status === "failed",
+              isError: isError2,
               durationMs: turn?.durationMs ?? params.durationMs ?? 0,
               numTurns: 1,
-              stopReason: status
+              // A failed turn says why, when the app-server did.
+              stopReason: isError2 && failureText(turn?.error) || status
             });
             this.flush();
             return;
@@ -8494,6 +8640,45 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
             return;
         }
       }
+      /**
+       * The files of a `fileChange` item, as last told. A card already up for that item shows the
+       * files as they were, and the roots check passed those: it is withdrawn and the approval
+       * declined, since the patch an answer would now allow is not the one the owner is reading.
+       */
+      setFiles(itemId, changes) {
+        const before = this.fileChanges.get(itemId);
+        this.fileChanges.set(itemId, changes);
+        if (before === void 0 || JSON.stringify(before) === JSON.stringify(changes)) return;
+        for (const [id, entry] of [...this.approvals]) {
+          if (entry.kind === "file_change" && entry.itemId === itemId) this.withdraw(id);
+        }
+      }
+      /**
+       * Take back a held request no answer can reach any more: nobody answered in time, its files
+       * changed under the card, the app-server settled it itself, its turn ended, the session is
+       * stopping, or the app-server is gone. The request is answered with its own refusal (an approval
+       * declines; a question's response is its answers, of which there are none), and
+       * `permissionTimeout` has the manager expire the card's row, after which an answer to it is
+       * refused. One place, so no way of withdrawing can leave behind what another clears.
+       */
+      withdraw(id) {
+        const entry = this.approvals.get(id);
+        if (!entry) return;
+        clearTimeout(entry.timer);
+        this.approvals.delete(id);
+        this.questionIds.delete(id);
+        this.resolvers.get(id)?.(entry.refusal);
+        this.resolvers.delete(id);
+        this.emit("permissionTimeout", { id });
+      }
+      /**
+       * Every held request, when nothing is left to answer: the session is stopping, the app-server
+       * has exited, or it never opened a thread. The refusals are written if there is still a pipe to
+       * write them to; into one that is gone they are dropped, without a throw (`rpc.test.ts`).
+       */
+      withdrawAll() {
+        for (const id of [...this.approvals.keys()]) this.withdraw(id);
+      }
       delta(params, kind, field) {
         const itemId = params.itemId ?? "";
         const text = params[field] ?? "";
@@ -8509,27 +8694,43 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
        * The reply is held until a human answers or the timer fires, which is what makes a Codex chat
        * behave like a Claude one — the SDK's `canUseTool` blocks the same way.
        */
-      onRequest(method, params) {
-        if (method === "tool/requestUserInput") return this.askQuestion(params);
-        const kind = APPROVAL_METHODS[method];
-        if (!kind) return "decline";
-        const toolName2 = kind === "command" ? CODEX_TOOL_NAMES.command : CODEX_TOOL_NAMES.fileChange;
-        const input = kind === "command" ? {
-          command: params.command ?? "",
-          cwd: params.cwd ?? this.opts.cwd,
-          ...params.reason ? { reason: params.reason } : {}
-        } : { changes: params.changes ?? [], ...params.reason ? { reason: params.reason } : {} };
+      onRequest(rpcId, method, params) {
+        const from = { rpcId, turnId: typeof params.turnId === "string" ? params.turnId : null };
+        if (method === "item/tool/requestUserInput") return this.askQuestion(from, params);
+        const kind = Object.hasOwn(APPROVAL_METHODS, method) ? APPROVAL_METHODS[method] : void 0;
+        if (!kind) {
+          if (Object.hasOwn(REFUSALS, method)) return REFUSALS[method];
+          throw new RpcError(METHOD_NOT_FOUND, `cayenne does not handle ${method}`);
+        }
+        const itemId = typeof params.itemId === "string" ? params.itemId : null;
+        const reason = params.reason ? { reason: params.reason } : {};
+        let toolName2;
+        let input;
+        if (kind === "command") {
+          toolName2 = CODEX_TOOL_NAMES.command;
+          const { command, cwd } = params;
+          if ((params.kind ?? "command") !== "command" || params.networkApprovalContext != null || typeof command !== "string" || command.trim() === "" || cwd != null && typeof cwd !== "string") {
+            return decided("decline");
+          }
+          input = { command, cwd: cwd ?? this.opts.cwd, ...reason };
+        } else {
+          toolName2 = CODEX_TOOL_NAMES.fileChange;
+          if (params.grantRoot != null) return decided("decline");
+          const changes = (itemId ? this.fileChanges.get(itemId) : void 0) ?? [];
+          if (changes.length === 0) return decided("decline");
+          input = { changes, ...reason };
+        }
         try {
-          this.opts.checkInput?.(toolName2, input);
+          this.opts.checkInput(toolName2, input);
         } catch {
-          return "decline";
+          return decided("decline");
         }
         const decision = autoDecide(this.mode, kind);
-        if (decision !== "ask") return decision;
-        return this.hold(this.nextApprovalId(kind), kind, "decline", {
+        if (decision !== "ask") return decided(decision);
+        return this.hold(this.nextApprovalId(kind), kind, decided("decline"), from, {
           toolName: toolName2,
           input,
-          toolUseId: params.itemId ?? null
+          toolUseId: itemId
         });
       }
       /**
@@ -8539,15 +8740,20 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
        * same answer RPC. The shape is validated here, before a row exists — a malformed or oversized
        * ask is cancelled rather than rendered, because the questions are text the model produced and
        * the card is the one surface where a human is asked to trust what they read.
-       */
-      askQuestion(params) {
-        const parsed = CodexQuestions.safeParse(params);
-        if (!parsed.success) return Promise.resolve("cancel");
+       *
+       * The app-server's question (`{ id, header, question, options: { label, description }[] }`) is
+       * not the one Cayenne stores (`CodexQuestions`: `{ text, options: string[] }`), and its answer is
+       * keyed by question id where `CodexAnswers` is a list in order. The adapter translates both
+       * ways, so the row, the card and the answer RPC are what they were.
+       */
+      askQuestion(from, params) {
+        const asked = readQuestions(params);
+        if (!asked) return Promise.resolve(NO_ANSWERS);
         const id = this.nextApprovalId("question");
-        this.questionCounts.set(id, parsed.data.questions.length);
-        return this.hold(id, "question", "cancel", {
+        this.questionIds.set(id, asked.ids);
+        return this.hold(id, "question", NO_ANSWERS, from, {
           toolName: CODEX_TOOL_NAMES.userInput,
-          input: parsed.data,
+          input: asked.input,
           toolUseId: null
         });
       }
@@ -8564,20 +8770,21 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         this.approvalSeq += 1;
         return `${kind}-${this.approvalSeq}`;
       }
-      /** Park a server request until a human answers it or the timer gives up on them. */
-      hold(id, kind, onTimeout, req) {
+      /**
+       * Park a server request until a human answers it, the timer gives up on them, or it is
+       * withdrawn (`withdraw`).
+       */
+      hold(id, kind, onTimeout, from, req) {
         if (this.approvals.has(id) || this.resolvers.has(id)) {
           throw new Error(`VALIDATION: approval id ${id} is already held`);
         }
         return new Promise((resolve6) => {
-          const timer = setTimeout(() => {
-            this.approvals.delete(id);
-            this.resolvers.delete(id);
-            this.questionCounts.delete(id);
-            this.emit("permissionTimeout", { id });
-            resolve6(onTimeout);
-          }, this.opts.permissionTimeoutMs ?? PERMISSION_TIMEOUT_MS);
-          this.approvals.set(id, { rpcId: 0, kind, refusal: onTimeout, timer });
+          const timer = setTimeout(
+            () => this.withdraw(id),
+            this.opts.permissionTimeoutMs ?? PERMISSION_TIMEOUT_MS
+          );
+          const itemId = kind === "question" ? null : req.toolUseId;
+          this.approvals.set(id, { ...from, kind, refusal: onTimeout, itemId, timer });
           this.resolvers.set(id, resolve6);
           this.emit("permission", { id, ...req, suggestions: null });
         });
@@ -8588,20 +8795,24 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
         if (!entry || !resolve6) return false;
         let reply;
         if (entry.kind === "question") {
-          if (decision.behavior === "deny") reply = "cancel";
+          if (decision.behavior === "deny") reply = NO_ANSWERS;
           else {
+            const ids = this.questionIds.get(id) ?? [];
             const answers = CodexAnswers.safeParse(decision.updatedInput ?? {});
-            if (!answers.success || answers.data.answers.length !== this.questionCounts.get(id))
-              return false;
-            reply = { answers: answers.data.answers };
+            if (!answers.success || answers.data.answers.length !== ids.length) return false;
+            reply = {
+              answers: Object.fromEntries(
+                ids.map((questionId, n) => [questionId, { answers: [answers.data.answers[n] ?? ""] }])
+              )
+            };
           }
         } else {
-          reply = decision.behavior === "allow" ? "accept" : "decline";
+          reply = decided(decision.behavior === "allow" ? "accept" : "decline");
         }
         clearTimeout(entry.timer);
         this.approvals.delete(id);
         this.resolvers.delete(id);
-        this.questionCounts.delete(id);
+        this.questionIds.delete(id);
         resolve6(reply);
         return true;
       }
@@ -8657,13 +8868,7 @@ ${scrubSecrets(this.stderrTail.join("")).slice(-STDERR_TAIL_MAX)}` : "";
       }
       async stop() {
         this.stopping = true;
-        for (const [id, entry] of [...this.approvals]) {
-          clearTimeout(entry.timer);
-          this.approvals.delete(id);
-          this.resolvers.get(id)?.(entry.refusal);
-          this.resolvers.delete(id);
-          this.emit("permissionTimeout", { id });
-        }
+        this.withdrawAll();
         const stoppable = this.turn?.started && this.turn.id;
         await (stoppable ? this.interrupt().catch(() => void 0) : void 0);
         this.removeAllFiles();
@@ -10071,7 +10276,7 @@ function assertRepoOwner(ownerId, createdBy) {
 }
 function narrowToSession(suggestions) {
   if (!suggestions) return suggestions;
-  return suggestions.map((s) => isRecord(s) ? { ...s, destination: "session" } : s);
+  return suggestions.map((s) => isRecord2(s) ? { ...s, destination: "session" } : s);
 }
 function shrink(event) {
   switch (event.type) {
@@ -10089,7 +10294,7 @@ function shrink(event) {
       return null;
   }
 }
-var READ_ONLY_TEXT, REFRESH_WITHIN_MS, betweenTurns, UNREADABLE_MARK_CREDS, DRAINED_AFTER_MS, roundUsd, UNIQUE_VIOLATION, ROW_WRITE_TIMEOUT_MS, ORPHANED_STATUSES, RESTARTABLE_STATUSES, isAtOrBelow3, DENY_MESSAGE_MAX, EXIT_ERROR_MAX, INITIAL_PROMPT_MAX, TASK_SKILL_LOOKUP_MS, TASK_REFUSED_MODES, OWNER_DRIVEN_KINDS, REPO_OWNER_ONLY, REPO_NO_DUPLICATE, PROVIDER_SESSION_ID, REPO_WORKTREE_GONE, TASK_ASK_TOOLS, MEMORY_PREAMBLE, MEMORY_SOURCE, wrapMemory, PATH_INPUT_TOOLS, PATH_INPUT_KEYS, isRecord, errorCode, SessionManager;
+var READ_ONLY_TEXT, REFRESH_WITHIN_MS, betweenTurns, UNREADABLE_MARK_CREDS, DRAINED_AFTER_MS, roundUsd, UNIQUE_VIOLATION, ROW_WRITE_TIMEOUT_MS, ORPHANED_STATUSES, RESTARTABLE_STATUSES, isAtOrBelow3, DENY_MESSAGE_MAX, EXIT_ERROR_MAX, INITIAL_PROMPT_MAX, TASK_SKILL_LOOKUP_MS, TASK_REFUSED_MODES, OWNER_DRIVEN_KINDS, REPO_OWNER_ONLY, REPO_NO_DUPLICATE, PROVIDER_SESSION_ID, REPO_WORKTREE_GONE, TASK_ASK_TOOLS, MEMORY_PREAMBLE, MEMORY_SOURCE, wrapMemory, PATH_INPUT_TOOLS, PATH_INPUT_KEYS, isRecord2, errorCode, SessionManager;
 var init_manager = __esm({
   "src/sessions/manager.ts"() {
     "use strict";
@@ -10176,7 +10381,7 @@ var init_manager = __esm({
       "LS"
     ]);
     PATH_INPUT_KEYS = ["file_path", "path", "cwd", "notebook_path"];
-    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
     errorCode = (message) => message.startsWith("ROOT_NOT_ALLOWED") ? "ROOT_NOT_ALLOWED" : "VALIDATION";
     SessionManager = class {
       constructor(deps) {
@@ -11173,6 +11378,7 @@ var init_manager = __esm({
         turns.drainedAt = Date.now();
         turns.early = true;
         turns.chased = false;
+        turns.ended += 1;
       }
       /**
        * Put rows on this runner that claim a turn in progress back to `idle`, for the chats that have
@@ -11690,15 +11896,31 @@ var init_manager = __esm({
       /**
        * A tool's path as the provider opens it: relative means relative to the session's cwd. Every
        * judge of a tool's path goes through here (R28's `checkUpdatedInput`, a suggested directory,
-       * Codex's changes and command cwd). A value the Claude CLI would rewrite before it opens it
-       * (surrounding whitespace, a leading `~`, a non-NFC spelling) is refused, not judged: judged as
-       * written, `~/.ssh/id_rsa` was `<cwd>/~/.ssh/id_rsa`, inside any root (security re-review
-       * 2026-09-29).
+       * and Codex's paths by way of `codexPath`, which admits no relative one). A value the Claude CLI
+       * would rewrite before it opens it (surrounding whitespace, a leading `~`, a non-NFC spelling)
+       * is refused, not judged: judged as written, `~/.ssh/id_rsa` was `<cwd>/~/.ssh/id_rsa`, inside
+       * any root (security re-review 2026-09-29).
        */
       fromCwd(cwd, value) {
         if (!isPlainToolPath(value)) throw new Error(notPlainPathRefusal(value));
         return isAbsolute21(value) ? value : `${cwd}${sep17}${value}`;
       }
+      /**
+       * A path Codex named, for the roots check: absolute, or refused. The runner cannot prove what
+       * directory the app-server would resolve a relative one against: a turn's cwd is the
+       * app-server's, and a command can move it. Every live run against codex-cli 0.162 named
+       * absolute paths only, so a relative one is an unknown shape, refused exactly as an
+       * out-of-roots path is. An absolute value still passes through `fromCwd`, which refuses one
+       * that is not a plain path.
+       */
+      codexPath(cwd, value) {
+        if (!isAbsolute21(value)) {
+          throw new Error(
+            `ROOT_NOT_ALLOWED: ${JSON.stringify(value)} is not an absolute path; a Codex change or command names every path by its absolute path`
+          );
+        }
+        return this.fromCwd(cwd, value);
+      }
       /**
        * §2.9: a path in `updatedInput` passes the same boundary the session's `cwd` did, and the
        * SDK receives the canonical path the guard proved rather than the spelling typed (S2). The
@@ -11721,6 +11943,11 @@ var init_manager = __esm({
        * not admit is denied before a row exists: no answer the owner could give would make it
        * acceptable, exactly as R28 reasons for the Claude path.
        *
+       * A change writes its `path` and, when it moves the file, its `movePath`: both are read here,
+       * each as a path of its own, so the card and the auto-accept gate judge the same set. A command
+       * must name its `cwd`: absent, blank or not a string, the command is refused, not passed.
+       * Every path, and that `cwd`, must be absolute (`codexPath`).
+       *
        * When the roots reach the managed root (D50: an allowed root such as `~`), a file change is
        * also held to the managed `.git` guard Claude sessions get: a change under a managed clone's
        * git dir, or to a worktree's `.git` file, is refused with the same text. In `acceptEdits` or
@@ -11733,19 +11960,30 @@ var init_manager = __esm({
             throw new Error("VALIDATION: codex file change carries no changes to check");
           }
           const guarded = this.reachesManagedRoot(roots);
+          const check = (path) => {
+            assertInsideRootsOrAncestor(this.codexPath(cwd, path), roots);
+            if (guarded && writesManagedGit(path, this.deps.managedRoot, cwd)) {
+              throw new Error(MANAGED_GIT_REFUSAL);
+            }
+          };
           for (const change of changes) {
-            if (!isRecord(change) || typeof change.path !== "string" || change.path.trim() === "") {
+            if (!isRecord2(change) || typeof change.path !== "string" || change.path.trim() === "") {
               throw new Error("VALIDATION: codex file change entry names no path to check");
             }
-            assertInsideRootsOrAncestor(this.fromCwd(cwd, change.path), roots);
-            if (guarded && writesManagedGit(change.path, this.deps.managedRoot, cwd)) {
-              throw new Error(MANAGED_GIT_REFUSAL);
+            check(change.path);
+            if (change.movePath === void 0) continue;
+            if (typeof change.movePath !== "string" || change.movePath.trim() === "") {
+              throw new Error("VALIDATION: codex file change entry names no move target to check");
             }
+            check(change.movePath);
           }
           return;
         }
-        if (toolName2 === CODEX_TOOL_NAMES.command && typeof input.cwd === "string") {
-          assertInsideRoots(this.fromCwd(cwd, input.cwd), roots);
+        if (toolName2 === CODEX_TOOL_NAMES.command) {
+          if (typeof input.cwd !== "string" || input.cwd.trim() === "") {
+            throw new Error("VALIDATION: codex command names no cwd to check");
+          }
+          assertInsideRoots(this.codexPath(cwd, input.cwd), roots);
         }
       }
       /**
@@ -11818,7 +12056,7 @@ var init_manager = __esm({
       checkUpdatedPermissions(live, entry, updates) {
         if (!updates) return void 0;
         return updates.map((update) => {
-          if (!isRecord(update))
+          if (!isRecord2(update))
             throw new Error("VALIDATION: updatedPermissions entry is not an object");
           if (update.destination !== "session") {
             throw new Error(
@@ -12004,9 +12242,19 @@ var init_manager = __esm({
           status: "starting",
           echoed: /* @__PURE__ */ new Set(),
           permissions: /* @__PURE__ */ new Map(),
+          permissionsInFlight: /* @__PURE__ */ new Set(),
+          permissionsWithdrawn: /* @__PURE__ */ new Set(),
           cwd: opts.cwd,
           stopping: false,
-          turns: { owed: 0, begun: false, drainedAt: null, stops: 0, early: false, chased: false },
+          turns: {
+            owed: 0,
+            begun: false,
+            drainedAt: null,
+            stops: 0,
+            early: false,
+            chased: false,
+            ended: 0
+          },
           dropping: null,
           inflight: /* @__PURE__ */ new Set(),
           writes: Promise.resolve(),
@@ -12089,7 +12337,7 @@ var init_manager = __esm({
        */
       watchWorkingCopy(sessionId, live) {
         const factory = this.deps.watch ?? ((cwd, onChange2, onError2) => watchChanges(cwd, onChange2, CHANGES_DEBOUNCE_MS, onError2));
-        let failed4 = false;
+        let failed5 = false;
         let built = null;
         const closeFailed = (watcher) => {
           if (live.watcher === watcher) live.watcher = null;
@@ -12098,8 +12346,8 @@ var init_manager = __esm({
           );
         };
         const onError = (err) => {
-          if (failed4) return;
-          failed4 = true;
+          if (failed5) return;
+          failed5 = true;
           this.deps.log.warn(
             { err, sessionId },
             "working-copy watcher error; live change refresh stopped"
@@ -12107,7 +12355,7 @@ var init_manager = __esm({
           if (built) closeFailed(built);
         };
         const onChange = () => {
-          if (failed4 || this.live.get(sessionId) !== live) return;
+          if (failed5 || this.live.get(sessionId) !== live) return;
           this.bumpChanges(sessionId, live);
         };
         try {
@@ -12116,7 +12364,7 @@ var init_manager = __esm({
           this.deps.log.warn({ err, sessionId }, "working-copy watcher failed to start");
           return null;
         }
-        if (failed4) {
+        if (failed5) {
           closeFailed(built);
           return null;
         }
@@ -12218,89 +12466,95 @@ var init_manager = __esm({
             );
           })();
         });
+        const raise = async (rawReq) => {
+          const req = { ...rawReq, suggestions: narrowToSession(rawReq.suggestions) };
+          try {
+            this.checkUpdatedInput(live, req.toolName, req.input);
+            this.checkCodexInput(live.cwd, live.roots, req.toolName, req.input);
+          } catch (err) {
+            const message = this.cap(err instanceof Error ? err.message : String(err));
+            session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
+            this.deps.log.warn(
+              { sessionId, tool: req.toolName, err: message },
+              "permission request refused before a row existed"
+            );
+            await this.broadcast(sessionId, { type: "error", code: errorCode(message), message });
+            return;
+          }
+          const input = this.secrets.redact(req.input);
+          const suggestions = this.secrets.redact(req.suggestions);
+          const { data, error } = await this.deps.db.from("permission_requests").insert({
+            session_id: sessionId,
+            workspace_id: this.deps.workspaceId,
+            tool_use_id: req.toolUseId,
+            tool_name: req.toolName,
+            input,
+            suggestions
+          }).select("*").single();
+          if (error || !data) {
+            const message = this.cap(
+              `VALIDATION: could not persist the permission request for ${req.toolName}: ${error?.message ?? "no row"}`
+            );
+            session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
+            await this.broadcast(sessionId, { type: "error", code: "VALIDATION", message });
+            throw new Error(message);
+          }
+          if (live.permissionsWithdrawn.has(req.id)) {
+            await this.expirePermission(sessionId, data.id);
+            return;
+          }
+          live.permissions.set(data.id, {
+            localId: req.id,
+            toolName: req.toolName,
+            input,
+            suggestions
+          });
+          await this.setStatus(sessionId, "awaiting_permission");
+          if (!live.permissions.has(data.id)) return;
+          try {
+            await this.broadcast(sessionId, {
+              type: "permission.request",
+              request: data
+            });
+          } catch (err) {
+            if (!(err instanceof Error) || !err.message.startsWith("VALIDATION:")) throw err;
+            this.deps.log.warn(
+              { sessionId, requestId: data.id, err: err.message },
+              "permission request too large to broadcast; clients reconcile from the row"
+            );
+            await this.broadcast(sessionId, {
+              type: "error",
+              code: "VALIDATION",
+              message: err.message
+            });
+          }
+        };
         session.on(
           "permission",
           (rawReq) => guard(async () => {
-            const req = { ...rawReq, suggestions: narrowToSession(rawReq.suggestions) };
+            live.permissionsInFlight.add(rawReq.id);
             try {
-              this.checkUpdatedInput(live, req.toolName, req.input);
-              this.checkCodexInput(live.cwd, live.roots, req.toolName, req.input);
-            } catch (err) {
-              const message = this.cap(err instanceof Error ? err.message : String(err));
-              session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
-              this.deps.log.warn(
-                { sessionId, tool: req.toolName, err: message },
-                "permission request refused before a row existed"
-              );
-              await this.broadcast(sessionId, { type: "error", code: errorCode(message), message });
-              return;
-            }
-            const input = this.secrets.redact(req.input);
-            const suggestions = this.secrets.redact(req.suggestions);
-            const { data, error } = await this.deps.db.from("permission_requests").insert({
-              session_id: sessionId,
-              workspace_id: this.deps.workspaceId,
-              tool_use_id: req.toolUseId,
-              tool_name: req.toolName,
-              input,
-              suggestions
-            }).select("*").single();
-            if (error || !data) {
-              const message = this.cap(
-                `VALIDATION: could not persist the permission request for ${req.toolName}: ${error?.message ?? "no row"}`
-              );
-              session.respondPermission(req.id, { behavior: "deny", message, interrupt: false });
-              await this.broadcast(sessionId, { type: "error", code: "VALIDATION", message });
-              throw new Error(message);
-            }
-            live.permissions.set(data.id, {
-              localId: req.id,
-              toolName: req.toolName,
-              input,
-              suggestions
-            });
-            await this.setStatus(sessionId, "awaiting_permission");
-            try {
-              await this.broadcast(sessionId, {
-                type: "permission.request",
-                request: data
-              });
-            } catch (err) {
-              if (!(err instanceof Error) || !err.message.startsWith("VALIDATION:")) throw err;
-              this.deps.log.warn(
-                { sessionId, requestId: data.id, err: err.message },
-                "permission request too large to broadcast; clients reconcile from the row"
-              );
-              await this.broadcast(sessionId, {
-                type: "error",
-                code: "VALIDATION",
-                message: err.message
-              });
+              await raise(rawReq);
+            } finally {
+              live.permissionsInFlight.delete(rawReq.id);
+              live.permissionsWithdrawn.delete(rawReq.id);
             }
           })()
         );
         session.on(
           "permissionTimeout",
           ({ id }) => guard(async () => {
+            const ended = live.turns.ended;
             const requestId = [...live.permissions.entries()].find(
               ([, entry]) => entry.localId === id
             )?.[0];
-            if (!requestId) return;
-            live.permissions.delete(requestId);
-            const { data, error } = await this.deps.db.from("permission_requests").update({ status: "expired" }).eq("id", requestId).eq("status", "pending").select("id");
-            if (error) {
-              this.deps.log.warn(
-                { requestId, err: error.message },
-                "could not expire permission request"
-              );
-            } else if (data && data.length > 0) {
-              await this.broadcast(sessionId, {
-                type: "permission.resolved",
-                requestId,
-                status: "expired"
-              });
+            if (!requestId) {
+              if (live.permissionsInFlight.has(id)) live.permissionsWithdrawn.add(id);
+              return;
             }
-            if (live.permissions.size === 0 && !live.stopping) {
+            live.permissions.delete(requestId);
+            await this.expirePermission(sessionId, requestId);
+            if (live.permissions.size === 0 && !live.stopping && live.status === "awaiting_permission" && live.turns.ended === ended) {
               await this.setStatus(sessionId, "running");
             }
           })()
@@ -12343,6 +12597,26 @@ var init_manager = __esm({
           })();
         });
       }
+      /**
+       * Expire a request the session settled itself, and say so when this write is what settled the
+       * row. `permissions_expire_by_runner` is the one transition the runner may write. Filtered on
+       * status = 'pending' so an owner answer in the same instant wins: the row is then terminal and
+       * this matches nothing rather than failing. A write that fails is logged, never thrown.
+       */
+      async expirePermission(sessionId, requestId) {
+        const { data, error } = await this.deps.db.from("permission_requests").update({ status: "expired" }).eq("id", requestId).eq("status", "pending").select("id");
+        if (error) {
+          this.deps.log.warn({ requestId, err: error.message }, "could not expire permission request");
+          return;
+        }
+        if (data && data.length > 0) {
+          await this.broadcast(sessionId, {
+            type: "permission.resolved",
+            requestId,
+            status: "expired"
+          });
+        }
+      }
       /**
        * Forget `live` and release its channel — once, and only if it is still the current entry.
        *
@@ -15418,7 +15692,7 @@ var configForWrite = () => {
   });
   return cfg;
 };
-var WEB_URL = "https://cayenne-pink.vercel.app";
+var WEB_URL = "https://app.cayenne.sh";
 var PKG = "@jpcasabiancai/cayenne";
 var service = () => {
   const exec4 = nodeExec();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jpcasabiancai/cayenne",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "files": [
     "dist/cli.js"
   ],