@jungjaehoon/mama-os 0.23.0 → 0.24.1

package/dist/agent/agent-loop.js

@@ -45,6 +45,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentLoop = void 0;
+exports.sanitizeLegacyCodexAgentsMd = sanitizeLegacyCodexAgentsMd;
 exports.loadBackendAgentsMd = loadBackendAgentsMd;
 exports.loadComposedSystemPrompt = loadComposedSystemPrompt;
 exports.getGatewayToolsPrompt = getGatewayToolsPrompt;
@@ -92,38 +93,6 @@ const SOURCE_GLOBAL_LANES = {
     // because per-run state is scoped (RunScope), not instance state.
     operator: 'operator',
 };
-function matchCodeActToolPattern(pattern, toolName) {
-    if (pattern === '*') {
-        return true;
-    }
-    if (pattern.endsWith('*')) {
-        return toolName.startsWith(pattern.slice(0, -1));
-    }
-    return pattern === toolName;
-}
-function resolveAllowedCodeActTools(allowedTools, blockedTools) {
-    if (!allowedTools) {
-        if (!blockedTools?.length) {
-            return undefined;
-        }
-        if (blockedTools.includes('*')) {
-            return [];
-        }
-        const registryNames = index_js_1.HostBridge.getToolRegistry().map((meta) => meta.name);
-        return registryNames.filter((toolName) => !blockedTools.some((pattern) => matchCodeActToolPattern(pattern, toolName)));
-    }
-    if (!blockedTools?.length) {
-        return [...allowedTools];
-    }
-    if (blockedTools.includes('*')) {
-        return [];
-    }
-    const registryNames = index_js_1.HostBridge.getToolRegistry().map((meta) => meta.name);
-    const expandedAllowed = allowedTools.includes('*')
-        ? registryNames
-        : registryNames.filter((toolName) => allowedTools.some((pattern) => matchCodeActToolPattern(pattern, toolName)));
-    return expandedAllowed.filter((toolName) => !blockedTools.some((pattern) => matchCodeActToolPattern(pattern, toolName)));
-}
 /**
  * Load CLAUDE.md system prompt
  * Tries multiple paths: project root, ~/.mama, /etc/mama
@@ -163,8 +132,79 @@ function loadSystemPrompt(verbose = false) {
  */
 /**
  * Load backend-specific AGENTS.md from ~/.mama/
- * Maps backend to file: 'claude' → AGENTS.claude.md, 'codex-mcp' → AGENTS.codex.md
+ * Maps backend to file: 'claude' → AGENTS.claude.md, 'codex' → AGENTS.codex.md
  */
+function sanitizeLegacyCodexAgentsMd(content) {
+    const nativeGuidance = [
+        'MAMA exposes the tools permitted for this run as native host tools. Call those tools directly through the model tool interface.',
+        '',
+        'Do not print Markdown tool blocks or JavaScript as a substitute for a tool call. The available native tool set is injected for each run and already reflects the current role and channel permissions.',
+    ].join('\n');
+    const knownLegacySections = [
+        {
+            heading: '## Tool protocol',
+            nextHeading: '## Behavioural traits to know about yourself',
+            signature: 'Gateway tools via `tool_call` JSON blocks:',
+        },
+        {
+            heading: '## Tool Usage',
+            nextHeading: '### Skills',
+            signature: 'Use gateway tools via `tool_call` JSON blocks.',
+        },
+    ];
+    const knownLegacyLines = [
+        '### How to Call Tools',
+        '### Available Gateway Tools',
+        '### Important',
+        '- **mama_search**(query?, type?, limit?) — Search decisions in MAMA memory',
+        '- **mama_save**(type, topic?, decision?, reasoning?) — Save decision or checkpoint',
+        '- **mama_update**(id, outcome, reason?) — Update decision outcome',
+        '- **mama_load_checkpoint**() — Load last checkpoint',
+        '- **discord_send**(channel_id, message?) — Send message to Discord channel',
+        '- **slack_send**(channel_id, message?) — Send message to Slack channel',
+        '- **Read**(path) — Read file',
+        '- **Write**(path, content) — Write file',
+        '- **Bash**(command) — Execute shell command',
+        '- Do NOT use `exec_command` or `apply_patch` — use gateway tools instead',
+        '- Tool calls are executed automatically. No need to use curl or Bash for these.',
+        "Do NOT use `exec_command` or `apply_patch` — those are Codex defaults but bypass MAMA's gateway. Tool calls are executed automatically; do not wrap in `curl` or `Bash`.",
+        '## Available gateway tools',
+        '`mama_search`, `mama_save`, `mama_recall`, `mama_update`, `mama_load_checkpoint`, `discord_send`, `slack_send`, `Read`, `Write`, `Bash`. Check the skill `SKILL.md` for skill-provided extras.',
+    ];
+    const removeExactLine = (section, line) => section
+        .split(/(\r?\n)/)
+        .filter((part) => part !== line)
+        .join('');
+    let sanitized = content;
+    for (const legacy of knownLegacySections) {
+        const start = sanitized.indexOf(legacy.heading);
+        if (start === -1) {
+            continue;
+        }
+        const end = sanitized.indexOf(legacy.nextHeading, start + legacy.heading.length);
+        if (end === -1) {
+            continue;
+        }
+        const section = sanitized.slice(start, end);
+        if (!section.includes(legacy.signature) || !section.includes('```tool_call')) {
+            continue;
+        }
+        let transformed = section.replace(legacy.signature, nativeGuidance);
+        const toolCallExample = [
+            '```tool_call',
+            '{"name": "tool_name", "input": {"param1": "value1"}}',
+            '```',
+        ].join('\n');
+        transformed = transformed
+            .replaceAll(toolCallExample, '')
+            .replaceAll(toolCallExample.replaceAll('\n', '\r\n'), '');
+        for (const line of knownLegacyLines) {
+            transformed = removeExactLine(transformed, line);
+        }
+        sanitized = `${sanitized.slice(0, start)}${transformed}${sanitized.slice(end)}`;
+    }
+    return sanitized;
+}
 function loadBackendAgentsMd(backend, verbose = false) {
     if (!backend) {
         return '';
@@ -172,7 +212,6 @@ function loadBackendAgentsMd(backend, verbose = false) {
     const keyMap = {
         claude: 'claude',
         codex: 'codex',
-        'codex-mcp': 'codex',
     };
     const key = keyMap[backend];
     if (!key) {
@@ -183,7 +222,8 @@ function loadBackendAgentsMd(backend, verbose = false) {
         if (verbose) {
             console.log(`[AgentLoop] Loaded backend AGENTS.md: AGENTS.${key}.md`);
         }
-        return (0, fs_1.readFileSync)(filePath, 'utf-8');
+        const content = (0, fs_1.readFileSync)(filePath, 'utf-8');
+        return key === 'codex' ? sanitizeLegacyCodexAgentsMd(content) : content;
     }
     if (verbose) {
         console.log(`[AgentLoop] Backend AGENTS.md not found: AGENTS.${key}.md`);
@@ -289,6 +329,98 @@ function getGatewayToolsPrompt(disallowed) {
     }
     return filtered;
 }
+const CANONICAL_CODE_ACT_HEADING = '## Code-Act: Gateway Tool Execution via Sandbox';
+const CODE_ACT_MCP_COMPAT_NAME = 'mcp__code-act__code_act';
+const GENERATED_CODE_ACT_START = '<!-- MAMA_GENERATED_CODE_ACT_START -->';
+const GENERATED_CODE_ACT_END = '<!-- MAMA_GENERATED_CODE_ACT_END -->';
+const GENERATED_GATEWAY_TOOLS_START = '<!-- MAMA_GENERATED_GATEWAY_TOOLS_START -->';
+const GENERATED_GATEWAY_TOOLS_END = '<!-- MAMA_GENERATED_GATEWAY_TOOLS_END -->';
+function removePromptSection(systemPrompt, sectionStart, sectionEnd) {
+    const prefix = systemPrompt.slice(0, sectionStart);
+    const separator = prefix.match(/\r?\n\r?\n---[ \t]*\r?\n\r?\n$/);
+    const removalStart = separator?.index ?? sectionStart;
+    return `${systemPrompt.slice(0, removalStart)}${systemPrompt.slice(sectionEnd)}`;
+}
+function stripMarkedPromptSection(systemPrompt, startMarker, endMarker) {
+    let stripped = systemPrompt;
+    let sectionStart = stripped.lastIndexOf(startMarker);
+    while (sectionStart >= 0) {
+        const markerEnd = stripped.indexOf(endMarker, sectionStart + startMarker.length);
+        if (markerEnd < 0) {
+            return stripped;
+        }
+        stripped = removePromptSection(stripped, sectionStart, markerEnd + endMarker.length);
+        sectionStart = stripped.lastIndexOf(startMarker);
+    }
+    return stripped;
+}
+function wrapGeneratedPromptSection(kind, content) {
+    const [start, end] = kind === 'codeAct'
+        ? [GENERATED_CODE_ACT_START, GENERATED_CODE_ACT_END]
+        : [GENERATED_GATEWAY_TOOLS_START, GENERATED_GATEWAY_TOOLS_END];
+    return `${start}\n${content}\n${end}`;
+}
+function stripGenericGatewayToolsCatalog(systemPrompt) {
+    const withoutMarked = stripMarkedPromptSection(systemPrompt, GENERATED_GATEWAY_TOOLS_START, GENERATED_GATEWAY_TOOLS_END);
+    const headingPattern = /^#{1,6}\s+Gateway Tools\s*$/gm;
+    let catalogStart = -1;
+    let match;
+    while ((match = headingPattern.exec(withoutMarked)) !== null) {
+        catalogStart = match.index;
+    }
+    if (catalogStart < 0) {
+        return withoutMarked;
+    }
+    const catalog = withoutMarked.slice(catalogStart);
+    if (!catalog.includes('Call tools via JSON block:') || !catalog.includes('```tool_call')) {
+        return withoutMarked;
+    }
+    const generatedCatalog = getGatewayToolsPrompt();
+    if (withoutMarked.startsWith(generatedCatalog, catalogStart)) {
+        return removePromptSection(withoutMarked, catalogStart, catalogStart + generatedCatalog.length);
+    }
+    const boundedSeparator = catalog.match(/\r?\n\r?\n---[ \t]*\r?\n\r?\n/);
+    const sectionEnd = boundedSeparator?.index ?? catalog.length;
+    return removePromptSection(withoutMarked, catalogStart, catalogStart + sectionEnd);
+}
+function stripTrailingCanonicalCodeActSection(systemPrompt) {
+    const withoutMarked = stripMarkedPromptSection(systemPrompt, GENERATED_CODE_ACT_START, GENERATED_CODE_ACT_END);
+    const sectionStart = withoutMarked.lastIndexOf(CANONICAL_CODE_ACT_HEADING);
+    if (sectionStart < 0) {
+        return withoutMarked;
+    }
+    const section = withoutMarked.slice(sectionStart);
+    const typeFenceStart = section.indexOf('```typescript');
+    if (typeFenceStart >= 0) {
+        const typeFenceEnd = section.indexOf('```', typeFenceStart + '```typescript'.length);
+        if (typeFenceEnd >= 0) {
+            return removePromptSection(withoutMarked, sectionStart, sectionStart + typeFenceEnd + 3);
+        }
+    }
+    const boundedSeparator = section.match(/\r?\n\r?\n---[ \t]*\r?\n\r?\n/);
+    const sectionEnd = boundedSeparator?.index ?? section.length;
+    return removePromptSection(withoutMarked, sectionStart, sectionStart + sectionEnd);
+}
+function stripDisabledCodeActGuidance(systemPrompt) {
+    return stripTrailingCanonicalCodeActSection(systemPrompt).replace(/^- \*\*(?:code_act|mcp__code-act__code_act)\*\*.*$/gm, '');
+}
+function combineCodeActSessionPolicyFingerprint(callerFingerprint, policy) {
+    return JSON.stringify({
+        version: 1,
+        callerFingerprint: callerFingerprint ?? null,
+        codeActPolicy: policy.fingerprintPayload,
+    });
+}
+function roleAllowsOuterCodeAct(role, disallowedTools) {
+    if (!role) {
+        return false;
+    }
+    return tool_registry_js_1.ToolRegistry.getHostToolDefinitions({
+        allowedTools: role.allowedTools,
+        blockedTools: role.blockedTools,
+        disallowedTools: disallowedTools ? [...disallowedTools] : undefined,
+    }).some((tool) => tool.name === index_js_1.CODE_ACT_MARKER);
+}
 function buildAgentToolExecutionContext(options) {
     if (!options ||
         (options.agentContext === undefined &&
@@ -363,7 +495,7 @@ class AgentLoop {
     stopContinuationHandler;
     preCompactHandler;
     // Per-run state (stream callbacks, tier) lives in a RunScope threaded through
-    // runWithContentInternal -> executeTools -> executeCodeAct, NEVER on the
+    // runWithContentInternal -> executeTools, NEVER on the
     // instance: concurrent runs on separate global lanes (operator report/worker
     // overlapping owner chat) would steal each other's callbacks and leak tiers
     // if these were instance fields.
@@ -386,9 +518,17 @@ class AgentLoop {
         // Hybrid mode: Gateway + MCP both enabled
         const useGatewayMode = gatewayTools.includes('*') || gatewayTools.length > 0;
         const useMCPMode = mcpTools.includes('*') || mcpTools.length > 0;
-        this.isGatewayMode = useGatewayMode;
         this.useCodeAct = options.useCodeAct ?? false;
-        this.disallowedTools = options.disallowedTools;
+        this.isGatewayMode = useGatewayMode || (options.backend === 'codex' && this.useCodeAct);
+        this.disallowedTools = this.useCodeAct
+            ? options.disallowedTools
+            : [
+                ...new Set([
+                    ...(options.disallowedTools ?? []),
+                    index_js_1.CODE_ACT_MARKER,
+                    CODE_ACT_MCP_COMPAT_NAME,
+                ]),
+            ];
         if (useGatewayMode && useMCPMode) {
             logger.debug('🔀 Hybrid mode: Gateway + MCP tools enabled');
         }
@@ -459,32 +599,42 @@ class AgentLoop {
             ];
         }
         const backend = options.backend ?? 'claude';
+        if (this.useCodeAct && options.systemPrompt) {
+            promptLayers = [
+                {
+                    name: 'custom',
+                    content: stripTrailingCanonicalCodeActSection(stripGenericGatewayToolsCatalog(options.systemPrompt)),
+                    priority: 1,
+                },
+            ];
+        }
         // Load backend-specific AGENTS.md (e.g., AGENTS.claude.md, AGENTS.codex.md)
         const backendAgentsMd = loadBackendAgentsMd(backend);
         if (backendAgentsMd) {
             promptLayers.push({ name: 'backendAgents', content: backendAgentsMd, priority: 2 });
         }
-        if (useGatewayMode) {
-            if (this.useCodeAct) {
+        if (this.isGatewayMode) {
+            if (this.useCodeAct &&
+                roleAllowsOuterCodeAct(options.agentContext?.role, this.disallowedTools)) {
                 // Code-Act mode: replace verbose gateway tools markdown with compact .d.ts
-                const tierForTypeDefs = options.agentContext?.tier === 1 ||
-                    options.agentContext?.tier === 2 ||
-                    options.agentContext?.tier === 3
-                    ? options.agentContext.tier
-                    : 1;
-                const allowedGatewayTools = resolveAllowedCodeActTools(options.agentContext?.role.allowedTools, options.agentContext?.role.blockedTools);
-                const typeDefs = index_js_1.TypeDefinitionGenerator.generate(tierForTypeDefs, allowedGatewayTools);
-                const codeActBackend = backend === 'codex' || backend === 'codex-mcp' ? 'codex-mcp' : 'claude';
-                const codeActPrompt = (0, index_js_1.getCodeActInstructions)(codeActBackend, allowedGatewayTools) +
-                    '\n```typescript\n' +
-                    typeDefs +
-                    '\n```';
+                const tierForTypeDefs = options.agentContext?.tier ?? 1;
+                const policy = (0, index_js_1.projectCodeActToolPolicy)({
+                    tier: tierForTypeDefs,
+                    role: options.agentContext?.role,
+                    disallowedTools: this.disallowedTools,
+                });
+                const typeDefs = index_js_1.TypeDefinitionGenerator.generate(policy);
+                const codeActPrompt = wrapGeneratedPromptSection('codeAct', (0, index_js_1.getCodeActInstructions)(backend, policy.names) + '\n```typescript\n' + typeDefs + '\n```');
                 promptLayers.push({ name: 'codeAct', content: codeActPrompt, priority: 2 });
             }
-            else {
+            else if (!this.useCodeAct && backend !== 'codex') {
                 const gatewayToolsPrompt = getGatewayToolsPrompt(this.disallowedTools);
                 if (gatewayToolsPrompt) {
-                    promptLayers.push({ name: 'gatewayTools', content: gatewayToolsPrompt, priority: 2 });
+                    promptLayers.push({
+                        name: 'gatewayTools',
+                        content: wrapGeneratedPromptSection('gatewayTools', gatewayToolsPrompt),
+                        priority: 2,
+                    });
                 }
             }
         }
@@ -508,9 +658,9 @@ class AgentLoop {
         this.defaultSystemPrompt = defaultSystemPrompt;
         // Choose backend (default: claude)
         this.backend = backend;
-        if (this.backend === 'codex' || this.backend === 'codex-mcp') {
-            // Codex MCP mode: standard MCP protocol
-            const workspaceDir = (0, path_1.join)((0, os_1.homedir)(), '.mama', 'workspace');
+        if (this.backend === 'codex') {
+            // Codex app-server mode
+            const workspaceDir = options.codexCwd ?? (0, path_1.join)((0, os_1.homedir)(), '.mama', 'workspace');
             // Ensure workspace directory exists
             if (!(0, fs_1.existsSync)(workspaceDir)) {
                 (0, fs_1.mkdirSync)(workspaceDir, { recursive: true });
@@ -518,12 +668,18 @@ class AgentLoop {
             this.agent = new runtime_process_js_1.CodexRuntimeProcess({
                 model: options.model,
                 cwd: workspaceDir,
-                sandbox: 'workspace-write',
+                sandbox: options.codexSandbox ?? 'workspace-write',
                 systemPrompt: defaultSystemPrompt,
+                command: options.codexCommand,
                 requestTimeout: options.timeoutMs,
-                mcpConfigPath: options.mcpConfigPath ?? (useMCPMode ? mcpConfigPath : undefined),
+                codexHome: options.codexHome,
+                isolatedHome: options.codexIsolatedHome,
+                registryRoot: options.codexRegistryRoot,
+                mcpConfigPath: this.useCodeAct
+                    ? undefined
+                    : (options.mcpConfigPath ?? (useMCPMode ? mcpConfigPath : undefined)),
             });
-            logger.debug('Codex MCP backend enabled');
+            logger.debug('Codex app-server backend enabled');
         }
         else {
             // Claude backend: always use PersistentCLI for fast responses (~2-3s vs ~16-30s)
@@ -540,7 +696,7 @@ class AgentLoop {
                 // Gateway tools are processed by GatewayToolExecutor (hybrid with MCP)
                 useGatewayTools: useGatewayMode,
                 // Structurally disallow specific tools (e.g., Bash/Read for restricted agents)
-                disallowedTools: options.disallowedTools,
+                disallowedTools: this.disallowedTools,
                 // Native built-ins cross with text-parsed gateway calls (hallucinated
                 // ToolSearch/Agent, native gathering that bypasses report verification).
                 // Callers opt in per loop; agent-loop-init locks down the main persona.
@@ -705,6 +861,7 @@ class AgentLoop {
      * Set AgentProcessManager for delegate tool (multi-agent delegation)
      */
     setAgentProcessManager(pm) {
+        pm.setGatewayToolExecutor(this.mcpExecutor);
         this.mcpExecutor.setAgentProcessManager(pm);
     }
     /**
@@ -808,7 +965,11 @@ class AgentLoop {
         // Track this run's tier for code-act execution and prompt sizing.
         if (options?.agentContext) {
             const rawTier = options.agentContext.tier ?? 1;
-            runScope.tier = (rawTier === 1 || rawTier === 2 || rawTier === 3 ? rawTier : 1);
+            runScope.tier = this.useCodeAct
+                ? (0, index_js_1.requireCodeActTier)(rawTier)
+                : rawTier === 1 || rawTier === 2 || rawTier === 3
+                    ? rawTier
+                    : 1;
         }
         // Infinite loop prevention
         let consecutiveToolCalls = 0;
@@ -825,7 +986,18 @@ class AgentLoop {
         // Set session ID on the agent
         // Claude PersistentCLI: process alive → CONTINUE (stdin message), process dead → NEW (spawn with --session-id)
         // Codex: threadId alive → CONTINUE (codex-reply), threadId null → NEW (codex tool)
-        const isCodex = this.backend === 'codex' || this.backend === 'codex-mcp';
+        const isCodex = this.backend === 'codex';
+        const codeActPolicy = this.useCodeAct
+            ? (0, index_js_1.projectCodeActToolPolicy)({
+                tier: runScope.tier,
+                role: options?.agentContext?.role,
+                disallowedTools: this.disallowedTools,
+            })
+            : undefined;
+        const outerCodeActAllowed = this.useCodeAct && roleAllowsOuterCodeAct(options?.agentContext?.role, this.disallowedTools);
+        const effectiveSessionPolicyFingerprint = isCodex && codeActPolicy
+            ? combineCodeActSessionPolicyFingerprint(options?.sessionPolicyFingerprint, codeActPolicy)
+            : options?.sessionPolicyFingerprint;
         let resolvedCliSessionId = options?.cliSessionId ?? null;
         const sessionLabel = (isNew) => {
             if (isCodex) {
@@ -848,12 +1020,6 @@ class AgentLoop {
             sessionIsNew = true;
             ownedSession = true;
             resolvedCliSessionId = cliSessionId;
-            if (isCodex) {
-                // Codex MCP manages threadId internally and ignores external session ids
-                // (codex-mcp-process.ts:366-369) - the pool reset does NOT reset the codex
-                // thread, so the stateless guarantee does not hold there. Loud, not silent.
-                console.log('[AgentLoop] freshSession is a pool-level reset only on the codex backend - the codex thread persists (see TODO: codex report thread reset)');
-            }
             console.log(`[AgentLoop] [${isCodex ? 'codex' : 'claude'}] ${channelKey} (FRESH session - stateless lane)`);
         }
         else {
@@ -878,41 +1044,119 @@ class AgentLoop {
                     modelRunId: ownedModelRunId,
                 }), backgroundTasks);
             }
-            let perCallSystemPrompt;
-            if (options?.systemPrompt) {
-                // Skip gateway tools if already embedded in systemPrompt (e.g. by MessageRouter).
-                // '# Gateway Tools' matches both the doc's H1 title and any H2 form -
-                // before this, only the '## Code-Act' section header (gateway-tools.md:87)
-                // was accidentally keeping router-built prompts from double-injection.
-                const alreadyHasTools = options.systemPrompt.includes('# Gateway Tools') ||
-                    options.systemPrompt.includes('# Code Execution') ||
-                    options.systemPrompt.includes('## Code-Act');
+            let nativeToolCallCount = 0;
+            let nativeConsecutiveToolCalls = 0;
+            let nativeLastToolName = '';
+            const hostToolBridge = isCodex && this.isGatewayMode
+                ? {
+                    tools: this.useCodeAct
+                        ? outerCodeActAllowed
+                            ? tool_registry_js_1.ToolRegistry.getHostToolDefinitions({ allowedTools: [index_js_1.CODE_ACT_MARKER] })
+                            : []
+                        : tool_registry_js_1.ToolRegistry.getHostToolDefinitions({
+                            allowedTools: options?.agentContext?.role.allowedTools,
+                            blockedTools: options?.agentContext?.role.blockedTools,
+                            disallowedTools: this.disallowedTools,
+                            viewer: options?.agentContext?.platform === 'viewer',
+                        }),
+                    execute: async (call) => {
+                        const callSignal = call.signal ?? new AbortController().signal;
+                        callSignal.throwIfAborted();
+                        if (nativeToolCallCount >= EMERGENCY_MAX_TURNS) {
+                            return {
+                                content: `Native tool call budget exceeded emergency maximum turns (${EMERGENCY_MAX_TURNS})`,
+                                isError: true,
+                                abort: true,
+                            };
+                        }
+                        const nextConsecutiveCount = call.name === nativeLastToolName ? nativeConsecutiveToolCalls + 1 : 1;
+                        if (nextConsecutiveCount >= MAX_CONSECUTIVE_SAME_TOOL) {
+                            return {
+                                content: `Infinite loop detected: Tool "${call.name}" called ${nextConsecutiveCount} times consecutively`,
+                                isError: true,
+                                abort: true,
+                            };
+                        }
+                        nativeToolCallCount += 1;
+                        nativeConsecutiveToolCalls = nextConsecutiveCount;
+                        nativeLastToolName = call.name;
+                        const toolUse = {
+                            type: 'tool_use',
+                            id: call.callId,
+                            name: call.name,
+                            input: call.input,
+                        };
+                        history.push({ role: 'assistant', content: [toolUse] });
+                        runScope.onTurn?.({
+                            turn,
+                            role: 'assistant',
+                            content: [toolUse],
+                            stopReason: 'tool_use',
+                        });
+                        const callExecutionContext = toolExecutionContext
+                            ? {
+                                ...toolExecutionContext,
+                                gatewayCallId: call.callId,
+                                signal: callSignal,
+                            }
+                            : null;
+                        const [toolResult] = await this.executeTools([toolUse], options?.stopAfterSuccessfulTools ?? [], callExecutionContext, runScope);
+                        callSignal.throwIfAborted();
+                        if (!toolResult) {
+                            return {
+                                content: `Native tool "${call.name}" returned no result`,
+                                isError: true,
+                                abort: true,
+                            };
+                        }
+                        history.push({ role: 'user', content: [toolResult] });
+                        runScope.onTurn?.({
+                            turn,
+                            role: 'user',
+                            content: [toolResult],
+                        });
+                        return {
+                            content: toolResult.content,
+                            isError: toolResult.is_error === true,
+                            stop: toolResult.is_error !== true &&
+                                (options?.stopAfterSuccessfulTools ?? []).includes(call.name),
+                        };
+                    },
+                }
+                : undefined;
+            const prepareSystemPrompt = (requestedSystemPrompt, isResumingSession) => {
+                let baseSystemPrompt = requestedSystemPrompt ?? this.defaultSystemPrompt;
                 let gatewayToolsPrompt = '';
-                const isResumingSession = options?.resumeSession === true;
-                if (this.isGatewayMode && !alreadyHasTools && !isResumingSession) {
-                    if (this.useCodeAct) {
-                        const allowedGatewayTools = resolveAllowedCodeActTools(options.agentContext?.role.allowedTools, options.agentContext?.role.blockedTools);
-                        const typeDefs = index_js_1.TypeDefinitionGenerator.generate(runScope.tier, allowedGatewayTools);
-                        const codeActBackend = this.backend === 'codex' || this.backend === 'codex-mcp'
-                            ? 'codex-mcp'
-                            : 'claude';
-                        gatewayToolsPrompt =
-                            (0, index_js_1.getCodeActInstructions)(codeActBackend, allowedGatewayTools) +
-                                '\n```typescript\n' +
-                                typeDefs +
-                                '\n```';
+                if (this.isGatewayMode && this.useCodeAct) {
+                    baseSystemPrompt = stripTrailingCanonicalCodeActSection(stripGenericGatewayToolsCatalog(baseSystemPrompt));
+                    if (outerCodeActAllowed) {
+                        const policy = codeActPolicy;
+                        const typeDefs = index_js_1.TypeDefinitionGenerator.generate(policy);
+                        gatewayToolsPrompt = wrapGeneratedPromptSection('codeAct', (0, index_js_1.getCodeActInstructions)(isCodex ? 'codex' : 'claude', policy.names) +
+                            '\n```typescript\n' +
+                            typeDefs +
+                            '\n```');
                     }
-                    else {
-                        gatewayToolsPrompt = getGatewayToolsPrompt(this.disallowedTools);
+                }
+                else if (this.isGatewayMode && !isCodex) {
+                    baseSystemPrompt = stripDisabledCodeActGuidance(baseSystemPrompt);
+                    if (!isResumingSession) {
+                        // Non-CodeAct callers may already embed the generic gateway catalog.
+                        const alreadyHasTools = baseSystemPrompt.includes('# Gateway Tools') ||
+                            baseSystemPrompt.includes('# Code Execution') ||
+                            baseSystemPrompt.includes('## Code-Act');
+                        if (!alreadyHasTools) {
+                            gatewayToolsPrompt = wrapGeneratedPromptSection('gatewayTools', getGatewayToolsPrompt(this.disallowedTools));
+                        }
                     }
                 }
                 const fullPrompt = gatewayToolsPrompt
-                    ? `${options.systemPrompt}\n\n---\n\n${gatewayToolsPrompt}`
-                    : options.systemPrompt;
+                    ? `${baseSystemPrompt}\n\n---\n\n${gatewayToolsPrompt}`
+                    : baseSystemPrompt;
                 // Monitor and enforce prompt size
                 const monitor = new prompt_size_monitor_js_1.PromptSizeMonitor();
                 const runLayers = [
-                    { name: 'systemPrompt', content: options.systemPrompt, priority: 1 },
+                    { name: 'systemPrompt', content: baseSystemPrompt, priority: 1 },
                     ...(gatewayToolsPrompt
                         ? [{ name: 'gatewayTools', content: gatewayToolsPrompt, priority: 2 }]
                         : []),
@@ -927,14 +1171,18 @@ class AgentLoop {
                     if (enforceResult.truncatedLayers.length > 0) {
                         console.warn(`[AgentLoop] Truncated layers: ${enforceResult.truncatedLayers.join(', ')}`);
                     }
-                    const tBase = trimmed.find((l) => l.name === 'systemPrompt')?.content || options.systemPrompt;
+                    const tBase = trimmed.find((l) => l.name === 'systemPrompt')?.content || baseSystemPrompt;
                     const tTools = trimmed.find((l) => l.name === 'gatewayTools')?.content || '';
                     effectivePrompt = tTools ? `${tBase}\n\n---\n\n${tTools}` : tBase;
                     console.log(`[AgentLoop] System prompt truncated: ${fullPrompt.length} → ${effectivePrompt.length} chars`);
                 }
-                perCallSystemPrompt = effectivePrompt;
                 console.log(`[AgentLoop] Prepared systemPrompt for this call: ${effectivePrompt.length} chars ` +
-                    `(base: ${options.systemPrompt.length}, tools: ${gatewayToolsPrompt.length})`);
+                    `(base: ${baseSystemPrompt.length}, tools: ${gatewayToolsPrompt.length})`);
+                return effectivePrompt;
+            };
+            let perCallSystemPrompt;
+            if (options?.systemPrompt || (this.isGatewayMode && this.useCodeAct)) {
+                perCallSystemPrompt = prepareSystemPrompt(options?.systemPrompt, options?.resumeSession === true);
             }
             else {
                 perCallSystemPrompt = this.defaultSystemPrompt;
@@ -972,6 +1220,7 @@ class AgentLoop {
                 }
                 let response;
                 const ext = runScope.streamCallbacks;
+                let attemptReportedError;
                 const callbacks = {
                     onDelta: (text) => {
                         ext?.onDelta?.(text);
@@ -986,31 +1235,48 @@ class AgentLoop {
                         ext?.onFinal?.(finalResponse);
                     },
                     onError: (error) => {
-                        ext?.onError?.(error);
+                        // A model runner can emit onError before rejecting. Hold it until
+                        // AgentLoop knows whether the attempt is terminal so a successful
+                        // one-time session recovery does not leak a false failure event.
+                        attemptReportedError = error;
                     },
                 };
                 let piResult;
                 // Claude: First turn → --session-id (inject system prompt), subsequent → --resume
                 // Codex: resumeSession only controls threadId reset (false=new thread, true=continue)
-                const shouldResume = !sessionIsNew || turn > 1;
-                // Both Claude PersistentCLI and Codex MCP preserve context - only send new messages
+                const shouldResume = isCodex
+                    ? turn > 1 || (options?.freshSession === true ? false : (options?.resumeSession ?? true))
+                    : !sessionIsNew || turn > 1;
+                // Both Claude PersistentCLI and Codex app-server preserve context - only send new messages
                 const promptText = this.formatLastMessageOnly(history);
                 const promptStart = Date.now();
+                const throwFinalCliError = (error) => {
+                    const normalizedError = error instanceof Error ? error : new Error(String(error));
+                    this.onMetric?.('prompt_error', 1, {
+                        backend: this.backend,
+                        error_type: 'CLI_ERROR',
+                    });
+                    try {
+                        ext?.onError?.(attemptReportedError ?? normalizedError);
+                    }
+                    catch (callbackError) {
+                        logger.warn(`External onError callback failed: ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`);
+                    }
+                    throw new types_js_1.AgentError(`CLI error: ${normalizedError.message}`, 'CLI_ERROR', normalizedError, true);
+                };
                 try {
                     piResult = await this.agent.prompt(promptText, callbacks, {
                         model: options?.model,
                         resumeSession: shouldResume,
                         systemPrompt: perCallSystemPrompt,
+                        sessionKey: channelKey,
+                        sessionPolicyFingerprint: effectiveSessionPolicyFingerprint,
                         sessionId: resolvedCliSessionId ?? undefined,
+                        // Per-run request timeout (operator worker runs); undefined leaves
+                        // the pool's construction-time default untouched (chat).
+                        requestTimeout: options?.requestTimeoutMs,
+                        hostToolBridge,
                     });
-                    // Emit prompt latency metric
-                    this.onMetric?.('prompt_latency_ms', Date.now() - promptStart, {
-                        backend: this.backend,
-                        turn: String(turn),
-                    });
-                    // After first successful call, mark session as not new for subsequent turns
-                    if (turn === 1)
-                        sessionIsNew = false;
                 }
                 catch (error) {
                     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -1026,42 +1292,83 @@ class AgentLoop {
                         errorMessage.includes('request_too_large') ||
                         errorMessage.includes('context window') ||
                         errorMessage.includes('context_length_exceeded');
-                    if (isSessionNotFound || isSessionInUse || isPromptTooLong) {
-                        const reason = isSessionNotFound
-                            ? 'not found in CLI'
-                            : isSessionInUse
-                                ? 'already in use'
-                                : 'prompt too long (context overflow)';
+                    const isCodexPolicyMismatch = errorMessage.includes('Codex app-server thread policy mismatch; reset the session explicitly');
+                    if ((isCodex && isCodexPolicyMismatch) ||
+                        (!isCodex && (isSessionNotFound || isSessionInUse || isPromptTooLong))) {
+                        const reason = isCodexPolicyMismatch
+                            ? 'policy mismatch'
+                            : isSessionNotFound
+                                ? 'not found in CLI'
+                                : isSessionInUse
+                                    ? 'already in use'
+                                    : 'prompt too long (context overflow)';
                         console.log(`[AgentLoop] Session ${reason}, retrying with new session`);
                         // Reset session in pool so it creates a new one
                         const newSessionId = this.sessionPool.resetSession(channelKey);
+                        options?.onCliSessionReset?.(newSessionId);
                         // Per-call routing: hand the new id to this prompt() and update the
                         // resolved id so later turns follow it - no shared-adapter mutation.
                         resolvedCliSessionId = newSessionId;
-                        // Retry with new session (--session-id instead of --resume)
-                        piResult = await this.agent.prompt(promptText, callbacks, {
-                            model: options?.model,
-                            resumeSession: false, // Force new session
-                            systemPrompt: perCallSystemPrompt,
-                            sessionId: newSessionId,
-                        });
+                        // A policy mismatch can occur on a resumed MessageRouter session,
+                        // whose per-call prompt is intentionally minimal. Rebuild the full
+                        // policy prompt before opening the replacement durable thread.
+                        let resetSystemPrompt = perCallSystemPrompt;
+                        try {
+                            // Discard the recoverable first-attempt error before any reset
+                            // preparation. A prompt rebuild or retry failure must surface
+                            // its own final error, never the mismatch that triggered it.
+                            attemptReportedError = undefined;
+                            if (isCodexPolicyMismatch && options?.freshSessionSystemPrompt) {
+                                resetSystemPrompt = prepareSystemPrompt(await options.freshSessionSystemPrompt(), false);
+                            }
+                            piResult = await this.agent.prompt(promptText, callbacks, {
+                                model: options?.model,
+                                resumeSession: false, // Force new session
+                                systemPrompt: resetSystemPrompt,
+                                sessionKey: channelKey,
+                                sessionPolicyFingerprint: effectiveSessionPolicyFingerprint,
+                                sessionId: newSessionId,
+                                // Carry the per-run timeout onto the reset session too.
+                                requestTimeout: options?.requestTimeoutMs,
+                                hostToolBridge,
+                            });
+                        }
+                        catch (retryError) {
+                            console.error(`[AgentLoop] ${this.backend} reset retry failed:`, retryError instanceof Error ? retryError.message : String(retryError));
+                            // resetSession() creates and locks a replacement pool entry.
+                            // A failed rebuild/retry must remove it entirely; otherwise the
+                            // next MessageRouter turn sees isNew=false and can persist a
+                            // minimal resume prompt as the replacement thread's base policy.
+                            this.sessionPool.invalidateSession(channelKey, newSessionId);
+                            throwFinalCliError(retryError);
+                        }
                         // Prepend reset notice so user knows context was lost
-                        if (isPromptTooLong && piResult.response) {
+                        if (isPromptTooLong && piResult?.response) {
                             piResult.response = `⚠️ Session reset: The previous conversation was too long, starting a new session.\n\n${piResult.response}`;
                         }
                         console.log(`[AgentLoop] Retry successful with new session: ${newSessionId}`);
                     }
                     else {
-                        this.onMetric?.('prompt_error', 1, { backend: this.backend, error_type: 'CLI_ERROR' });
-                        throw new types_js_1.AgentError(`CLI error: ${errorMessage}`, 'CLI_ERROR', error instanceof Error ? error : undefined, true // retryable
-                        );
+                        throwFinalCliError(error);
                     }
                 }
+                if (!piResult) {
+                    return throwFinalCliError(new Error('Model runner returned no prompt result'));
+                }
+                // Emit one terminal metric per prompt turn, including recovered calls.
+                this.onMetric?.('prompt_latency_ms', Date.now() - promptStart, {
+                    backend: this.backend,
+                    turn: String(turn),
+                });
+                // After first successful call, mark session as not new for subsequent turns
+                if (turn === 1) {
+                    sessionIsNew = false;
+                }
                 // Build content blocks - include tool_use blocks if present
                 const contentBlocks = [];
                 let parsedToolCalls = [];
                 // Parse tool_call / code_act blocks from text response (Gateway Tools mode ONLY)
-                if (this.isGatewayMode) {
+                if (this.isGatewayMode && !isCodex) {
                     parsedToolCalls = this.parseToolCallsFromText(piResult.response || '');
                     // Code-Act: parse ```js blocks only if enabled
                     if (this.useCodeAct) {
@@ -1106,11 +1413,8 @@ class AgentLoop {
                     }
                     console.log(`[AgentLoop] Detected ${toolUseBlocks.length} tool calls from MCP`);
                 }
-                // Set stop_reason based on whether tools were requested
-                // In Gateway mode: check parsed tool calls; in MCP mode: check CLI tool blocks
-                const hasToolUse = this.isGatewayMode
-                    ? parsedToolCalls.length > 0
-                    : ('hasToolUse' in piResult ? piResult.hasToolUse : false) || false;
+                // Both parsed gateway calls and native/MCP tool blocks share executeTools.
+                const hasToolUse = contentBlocks.some((block) => block.type === 'tool_use');
                 // eslint-disable-next-line prefer-const
                 response = {
                     id: `msg_${Date.now()}`,
@@ -1142,7 +1446,7 @@ class AgentLoop {
                     }
                 }
                 // Track tokens in session pool for auto-reset at 80% context
-                const tokenBackend = this.backend === 'codex' || this.backend === 'codex-mcp' ? 'codex-mcp' : 'claude';
+                const tokenBackend = this.backend === 'codex' ? 'codex' : 'claude';
                 const tokenStatus = this.sessionPool.updateTokens(channelKey, response.usage.input_tokens, tokenBackend);
                 // PreCompact: inject compaction summary when approaching context limit
                 if (tokenStatus.nearThreshold && this.preCompactHandler && !runScope.preCompactInjected) {
@@ -1342,60 +1646,36 @@ class AgentLoop {
         for (const toolUse of toolUseBlocks) {
             let result;
             let isError = false;
+            const executionToolName = toolUse.name === CODE_ACT_MCP_COMPAT_NAME ? index_js_1.CODE_ACT_MARKER : toolUse.name;
             // Notify stream: tool execution starting
-            runScope.streamCallbacks?.onToolUse?.(toolUse.name, toolUse.input);
+            runScope.streamCallbacks?.onToolUse?.(executionToolName, toolUse.input);
             const toolStart = Date.now();
             try {
-                // Code-Act: execute JS code in sandbox
-                // Match both gateway-parsed 'code_act' and MCP-prefixed 'mcp__code-act__code_act'
-                if (toolUse.name === index_js_1.CODE_ACT_MARKER || toolUse.name === 'mcp__code-act__code_act') {
-                    const codeInput = toolUse.input;
-                    const code = typeof codeInput?.code === 'string' ? codeInput.code : '';
-                    const codeActResult = code
-                        ? await this.executeCodeAct(code, runScope.tier, modelToolContext, runScope)
-                        : {
-                            success: false,
-                            error: {
-                                name: 'ValidationError',
-                                message: 'Missing or invalid "code" field in code_act input',
-                            },
-                            logs: [],
-                            metrics: { durationMs: 0, hostCallCount: 0, memoryUsedBytes: 0 },
-                        };
-                    result = JSON.stringify(codeActResult, null, 2);
-                    if (!codeActResult.success) {
-                        isError = true;
-                    }
-                    runScope.onToolUse?.(toolUse.name, toolUse.input, codeActResult);
-                    runScope.streamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, isError);
+                // PreToolUse: search MAMA for contracts before Write operations
+                let contractContext = '';
+                if (executionToolName === 'Write' && toolUse.input) {
+                    contractContext = await this.searchContractsForTool(executionToolName, toolUse.input, reactiveInternalContext);
                 }
-                else {
-                    // PreToolUse: search MAMA for contracts before Write operations
-                    let contractContext = '';
-                    if (toolUse.name === 'Write' && toolUse.input) {
-                        contractContext = await this.searchContractsForTool(toolUse.name, toolUse.input, reactiveInternalContext);
-                    }
-                    const toolResult = await this.mcpExecutor.execute(toolUse.name, toolUse.input, modelToolContext ?? undefined);
-                    result = JSON.stringify(toolResult, null, 2);
-                    // Check if tool execution failed
-                    const hasSuccess = 'success' in toolResult;
-                    const toolFailed = hasSuccess && !toolResult.success;
-                    if (toolFailed) {
-                        isError = true;
-                    }
-                    if (contractContext) {
-                        result = `${contractContext}\n\n---\n\n${result}`;
-                    }
-                    // Notify tool use callback
-                    runScope.onToolUse?.(toolUse.name, toolUse.input, toolResult);
-                    // PostToolUse: auto-extract contracts (fire-and-forget)
-                    this.postToolHandler?.processInBackground(toolUse.name, toolUse.input, toolResult, reactiveInternalContext);
-                    // Notify stream: tool completed (check actual status)
-                    runScope.streamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, isError);
+                const toolResult = await this.mcpExecutor.execute(executionToolName, toolUse.input, modelToolContext ?? undefined);
+                result = JSON.stringify(toolResult, null, 2);
+                // Check if tool execution failed
+                const hasSuccess = 'success' in toolResult;
+                const toolFailed = hasSuccess && !toolResult.success;
+                if (toolFailed) {
+                    isError = true;
+                }
+                if (contractContext) {
+                    result = `${contractContext}\n\n---\n\n${result}`;
                 }
+                // Notify tool use callback
+                runScope.onToolUse?.(executionToolName, toolUse.input, toolResult);
+                // PostToolUse: auto-extract contracts (fire-and-forget)
+                this.postToolHandler?.processInBackground(executionToolName, toolUse.input, toolResult, reactiveInternalContext);
+                // Notify stream: tool completed (check actual status)
+                runScope.streamCallbacks?.onToolComplete?.(executionToolName, toolUse.id, isError);
                 // Emit tool execution metric
                 this.onMetric?.('tool_duration_ms', Date.now() - toolStart, {
-                    tool: toolUse.name,
+                    tool: executionToolName,
                     error: String(isError),
                 });
             }
@@ -1403,13 +1683,13 @@ class AgentLoop {
                 isError = true;
                 result = error instanceof Error ? error.message : String(error);
                 // Notify tool use callback with error
-                runScope.onToolUse?.(toolUse.name, toolUse.input, { error: result });
+                runScope.onToolUse?.(executionToolName, toolUse.input, { error: result });
                 this.onMetric?.('tool_duration_ms', Date.now() - toolStart, {
-                    tool: toolUse.name,
+                    tool: executionToolName,
                     error: 'true',
                 });
                 // Notify stream: tool completed with error
-                runScope.streamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, true);
+                runScope.streamCallbacks?.onToolComplete?.(executionToolName, toolUse.id, true);
             }
             results.push({
                 type: 'tool_result',
@@ -1417,7 +1697,7 @@ class AgentLoop {
                 content: result,
                 is_error: isError,
             });
-            if (!isError && stopAfterSuccessfulTools.includes(toolUse.name)) {
+            if (!isError && stopAfterSuccessfulTools.includes(executionToolName)) {
                 break;
             }
         }
@@ -1507,50 +1787,6 @@ class AgentLoop {
         }
         return blocks;
     }
-    /**
-     * Execute Code-Act JS code in a sandboxed QuickJS environment
-     */
-    async executeCodeAct(code, tier = 1, executionContext = null, runScope = { tier: 1 }) {
-        try {
-            const sandbox = new index_js_1.CodeActSandbox();
-            const bridgeContext = withExecutionSurface(executionContext, 'code_act');
-            const bridge = new index_js_1.HostBridge(this.mcpExecutor, undefined, bridgeContext);
-            bridge.onToolUse = (toolName, input, result) => {
-                if (result === undefined) {
-                    // Tool starting — surface to stream
-                    runScope.streamCallbacks?.onToolUse?.(toolName, input);
-                }
-                if (result !== undefined) {
-                    // Tool completed — notify callback
-                    runScope.onToolUse?.(toolName, input, result);
-                    const isError = typeof result === 'object' &&
-                        result !== null &&
-                        'success' in result &&
-                        !result.success;
-                    runScope.streamCallbacks?.onToolComplete?.(toolName, `code_act_sub_${Date.now()}`, isError);
-                }
-            };
-            bridge.injectInto(sandbox, tier);
-            const result = await sandbox.execute(code);
-            if (result.logs.length > 0) {
-                console.log(`[CodeAct] console output: ${result.logs.join('\n')}`);
-            }
-            return result;
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(`[CodeAct] Sandbox initialization failed: ${message}`);
-            return {
-                success: false,
-                error: {
-                    name: 'SandboxError',
-                    message: `Failed to initialize Code-Act sandbox: ${message}`,
-                },
-                logs: [],
-                metrics: { durationMs: 0, hostCallCount: 0, memoryUsedBytes: 0 },
-            };
-        }
-    }
     /**
      * Remove tool_call and code_act blocks from text (to avoid duplication in response)
      */
@@ -1685,7 +1921,7 @@ class AgentLoop {
         this.stopped = true;
         try {
             // Stop the model runner
-            this.agent.stop();
+            await this.agent.stop();
             const waitUntil = Date.now() + 5000;
             while (this.laneManager.getTotalQueueSize() > 0 && Date.now() < waitUntil) {
                 await new Promise((resolve) => setTimeout(resolve, 50));