@linzumi/cli 0.0.37-beta → 0.0.39-beta

package/dist/index.js

@@ -149,19 +149,34 @@ function senderAllowed(listenUser, event, runnerIdentity) {
   return runnerIdentity.actorUsername?.toLocaleLowerCase() === normalized && runnerIdentity.actorUserId !== undefined && event.actorUserId === runnerIdentity.actorUserId;
 }
 function identityFromAccessToken(token) {
+  const decoded = decodeAccessTokenPayload(token);
+  if (decoded === undefined) {
+    return { actorUserId: undefined, actorUsername: undefined };
+  }
+  const actorUserId = integerValue(decoded.actor_id) ?? integerValue(decoded.sub);
+  return {
+    actorUserId,
+    actorUsername: stringValue(decoded.actor_username)
+  };
+}
+function singleWorkspaceScopeFromAccessToken(token) {
+  const decoded = decodeAccessTokenPayload(token);
+  const workspaceScope = (arrayValue(decoded?.workspace_scope) ?? []).flatMap((value) => {
+    const workspace = stringValue(value)?.trim();
+    return workspace === undefined || workspace === "" ? [] : [workspace];
+  });
+  return workspaceScope.length === 1 ? workspaceScope[0] : undefined;
+}
+function decodeAccessTokenPayload(token) {
   const [, payload] = token.split(".");
   if (payload === undefined) {
-    return { actorUserId: undefined, actorUsername: undefined };
+    return;
   }
   try {
     const decoded = JSON.parse(Buffer.from(base64UrlToBase64(payload), "base64").toString("utf8"));
-    const actorUserId = integerValue(decoded.actor_id) ?? integerValue(decoded.sub);
-    return {
-      actorUserId,
-      actorUsername: stringValue(decoded.actor_username)
-    };
+    return isJsonObject(decoded) ? decoded : undefined;
   } catch (_error) {
-    return { actorUserId: undefined, actorUsername: undefined };
+    return;
   }
 }
 function detectCodexVersion(codexBin, cwd) {
@@ -801,6 +816,203 @@ function fuseQueuedMessages(selected) {
   };
 }
 
+// src/reconnectContext.ts
+var recentVerbatimMessageCount = 5;
+var reconnectContextModel = "openai/gpt-oss-120b";
+var noiseLocalRunnerEventTypes = new Set([
+  "availability",
+  "port_forward_requested",
+  "port_forward_ready",
+  "port_forward_resolved",
+  "settings",
+  "status",
+  "local_runner_config_seeded",
+  "local_runner_config_updated"
+]);
+function parseReconnectContextMessages(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.flatMap(messageFromWirePayload);
+}
+function filterReconnectContextMessages(messages) {
+  return messages.filter((message) => {
+    const trimmed = message.body.trim();
+    if (trimmed === "") {
+      return false;
+    }
+    if (message.actorKind === "system") {
+      return false;
+    }
+    const eventType = localRunnerEventType2(message.payload);
+    if (eventType !== undefined && eventType !== "codex_output") {
+      return false;
+    }
+    if (looksLikeLegacyRunnerNoise(message)) {
+      return false;
+    }
+    return true;
+  });
+}
+async function buildReconnectContextInjection(messages, summarizer = createConfiguredReconnectContextSummarizer()) {
+  const filtered = filterReconnectContextMessages(messages);
+  if (filtered.length === 0) {
+    throw new Error("durable Linzumi thread history did not include user-visible context");
+  }
+  const older = filtered.slice(0, Math.max(0, filtered.length - recentVerbatimMessageCount));
+  const recent = filtered.slice(-recentVerbatimMessageCount);
+  const summary = older.length === 0 ? undefined : await summarizeOlderReconnectContext(older, summarizer);
+  const sections = [
+    "Reconnected Linzumi thread context",
+    "",
+    "The local Codex app-server thread was restarted, so this durable Linzumi thread history is being injected before retrying the latest user message.",
+    "",
+    ...summary === undefined ? [] : ["Summary of earlier messages:", summary, ""],
+    "Last five user-visible messages verbatim:",
+    recent.map(formatReconnectContextMessage).join(`
+
+---
+
+`)
+  ];
+  return { type: "text", text: sections.join(`
+`) };
+}
+function createConfiguredReconnectContextSummarizer(fetchImpl = globalThis.fetch) {
+  return {
+    summarize: (messages) => summarizeWithOpenAiCompatibleProvider(fetchImpl, messages)
+  };
+}
+async function summarizeOlderReconnectContext(messages, summarizer) {
+  const summary = (await summarizer.summarize(messages)).trim();
+  if (summary === "") {
+    throw new Error("reconnect context summarizer returned an empty summary");
+  }
+  return summary;
+}
+async function summarizeWithOpenAiCompatibleProvider(fetchImpl, messages) {
+  const provider = configuredReconnectContextProvider();
+  if (provider === undefined) {
+    throw new Error("Reconnect context summarization requires LINZUMI_RECONNECT_CONTEXT_API_KEY, GROQ_API_KEY, or OPENROUTER_API_KEY");
+  }
+  const model = envString("LINZUMI_RECONNECT_CONTEXT_MODEL") ?? envString("KANDAN_AGENT_PROGRESS_SUMMARY_MODEL") ?? reconnectContextModel;
+  const response = await fetchImpl(`${provider.baseUrl.replace(/\/$/, "")}/chat/completions`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${provider.apiKey}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      model,
+      temperature: 0,
+      messages: [
+        {
+          role: "system",
+          content: "Summarize durable Linzumi thread history for a restarted local Codex coding agent. Preserve concrete user requests, constraints, file/module names, and decisions. Do not mention local runner availability, reconnect status, or port-forward noise."
+        },
+        {
+          role: "user",
+          content: messages.map(formatReconnectContextMessage).join(`
+
+---
+
+`)
+        }
+      ]
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`reconnect context summarization failed: ${response.status} ${response.statusText}`);
+  }
+  const parsed = await response.json();
+  if (!isJsonObject(parsed)) {
+    throw new Error("reconnect context summarizer returned non-object JSON");
+  }
+  const choices = parsed.choices;
+  if (!Array.isArray(choices)) {
+    throw new Error("reconnect context summarizer response did not include choices");
+  }
+  const first = choices.find(isJsonObject);
+  const message = objectValue(first?.message);
+  const content = stringValue(message?.content)?.trim();
+  if (content === undefined || content === "") {
+    throw new Error("reconnect context summarizer response did not include message content");
+  }
+  return content;
+}
+function configuredReconnectContextProvider() {
+  const linzumiApiKey = envString("LINZUMI_RECONNECT_CONTEXT_API_KEY");
+  if (linzumiApiKey !== undefined) {
+    return {
+      apiKey: linzumiApiKey,
+      baseUrl: envString("LINZUMI_RECONNECT_CONTEXT_BASE_URL") ?? "https://api.groq.com/openai/v1"
+    };
+  }
+  const groqApiKey = envString("GROQ_API_KEY");
+  if (groqApiKey !== undefined) {
+    return {
+      apiKey: groqApiKey,
+      baseUrl: envString("GROQ_BASE_URL") ?? "https://api.groq.com/openai/v1"
+    };
+  }
+  const openRouterApiKey = envString("OPENROUTER_API_KEY");
+  if (openRouterApiKey !== undefined) {
+    return {
+      apiKey: openRouterApiKey,
+      baseUrl: envString("OPENROUTER_BASE_URL") ?? "https://openrouter.ai/api/v1"
+    };
+  }
+  return;
+}
+function messageFromWirePayload(value) {
+  if (!isJsonObject(value)) {
+    return [];
+  }
+  const seq = integerValue(value.seq);
+  const payload = objectValue(value.payload) ?? {};
+  const body = stringValue(value.body) ?? stringValue(payload.body) ?? stringValue(payload.text);
+  const type = stringValue(value.type) ?? "thread.message";
+  if (seq === undefined || body === undefined) {
+    return [];
+  }
+  const actor = objectValue(value.actor) ?? {};
+  return [
+    {
+      seq,
+      type,
+      actorKind: stringValue(actor.kind) ?? "unknown",
+      actorSlug: stringValue(actor.slug),
+      actorUserId: integerValue(value.actor_user_id),
+      body,
+      payload
+    }
+  ];
+}
+function formatReconnectContextMessage(message) {
+  const sender = message.actorSlug?.trim() === "" || message.actorSlug === undefined ? message.actorKind : message.actorSlug;
+  const userId = message.actorUserId === undefined ? "unknown" : message.actorUserId.toString();
+  return [
+    `Linzumi durable message seq=${message.seq} from ${sender} (kind=${message.actorKind}, user_id=${userId}):`,
+    "",
+    message.body
+  ].join(`
+`);
+}
+function localRunnerEventType2(payload) {
+  const metadata = objectValue(payload.metadata);
+  const localRunner = objectValue(metadata?.local_codex_runner);
+  const eventType = stringValue(localRunner?.event_type);
+  return eventType === undefined || eventType.trim() === "" ? undefined : eventType.trim();
+}
+function looksLikeLegacyRunnerNoise(message) {
+  const body = message.body.trim();
+  return body.startsWith("Codex reconnected.") || body.startsWith("[codex reconnected") || body.startsWith("Codex is ready.") || /^Runner port \d+ is open in (Kandan|Linzumi):/.test(body) || /^.+ on port \d+ is ready in Linzumi\. \[Open\]\(/.test(body);
+}
+function envString(name) {
+  const value = process.env[name];
+  return value === undefined || value.trim() === "" ? undefined : value.trim();
+}
+
 // src/localCodexMessageState.ts
 function codexApprovalMessageState(request) {
   const params = objectValue(request.params) ?? {};
@@ -843,7 +1055,11 @@ function processingReasonForCodexNotification(method, params) {
 function processingMessageStateFromActive(state) {
   switch (state.reason) {
     case "awaiting approval":
-      return { status: "processing", reason: state.reason, approval: state.approval };
+      return {
+        status: "processing",
+        reason: state.reason,
+        approval: state.approval
+      };
     case "starting turn":
     case "streaming response":
     case "running terminal command":
@@ -1151,14 +1367,17 @@ var defaultIntervalMs = 2000;
 var defaultDebounceMs = 750;
 function startPortForwardWatcher(options) {
   const rootPid = options.rootPid ?? process.pid;
+  const rootCwd = normalizeCwd(options.rootCwd);
   const intervalMs = options.intervalMs ?? defaultIntervalMs;
   const debounceMs = options.debounceMs ?? defaultDebounceMs;
+  const lostDebounceMs = options.lostDebounceMs ?? intervalMs * 2 + debounceMs;
   const scanProcesses = options.scanProcesses ?? readProcessRows;
   const scanListenSockets = options.scanListenSockets ?? readListenSocketRows;
   const scanProcessCwds = options.scanProcessCwds ?? readProcessCwdRows;
   const nowMs = options.nowMs ?? Date.now;
   const candidateStabilityByPort = new Map;
   const emittedByPort = new Map;
+  const missingByPort = new Map;
   const inFlight = { value: false };
   const scan = () => {
     if (inFlight.value) {
@@ -1168,18 +1387,26 @@ function startPortForwardWatcher(options) {
     Promise.resolve().then(async () => {
       const descendants = descendantPidSet(scanProcesses(), rootPid);
       const sockets = scanListenSockets();
-      const candidatePids = sockets.filter((socket) => descendants.has(socket.pid)).map((socket) => socket.pid);
-      const candidates = detectedForwardCandidates(sockets, descendants, scanProcessCwds(candidatePids));
-      const stable = stableForwardCandidates(candidateStabilityByPort, candidates, nowMs(), debounceMs);
-      const changes = changedForwardCandidates(emittedByPort, stable.stableCandidates);
+      const candidatePids = rootCwd === undefined ? sockets.filter((socket) => descendants.has(socket.pid)).map((socket) => socket.pid) : sockets.map((socket) => socket.pid);
+      const candidates = detectedForwardCandidates(sockets, descendants, scanProcessCwds(candidatePids), { rootCwd });
+      const scanTimeMs = nowMs();
+      const stable = stableForwardCandidates(candidateStabilityByPort, candidates, scanTimeMs, debounceMs);
+      const changes = debouncedForwardCandidateChanges(emittedByPort, missingByPort, stable.stableCandidates, scanTimeMs, lostDebounceMs);
       candidateStabilityByPort.clear();
       emittedByPort.clear();
+      missingByPort.clear();
       for (const [port, observed] of stable.nextObservedByPort) {
         candidateStabilityByPort.set(port, observed);
       }
       for (const [port, candidate] of changes.nextObservedByPort) {
         emittedByPort.set(port, candidate);
       }
+      for (const [port, missing] of changes.nextMissingByPort) {
+        missingByPort.set(port, missing);
+      }
+      for (const candidate of changes.lostCandidates) {
+        await options.onCandidateLost?.(candidate);
+      }
       for (const candidate of changes.changedCandidates) {
         await options.onCandidate(candidate);
       }
@@ -1195,9 +1422,11 @@ function startPortForwardWatcher(options) {
     close: () => clearInterval(interval)
   };
 }
-function changedForwardCandidates(previousObservedByPort, candidates) {
+function debouncedForwardCandidateChanges(previousObservedByPort, previousMissingByPort, candidates, nowMs, lostDebounceMs) {
   const nextObservedByPort = new Map;
+  const nextMissingByPort = new Map;
   const changedCandidates = [];
+  const lostCandidates = [];
   for (const candidate of candidates) {
     nextObservedByPort.set(candidate.port, candidate);
     const previous = previousObservedByPort.get(candidate.port);
@@ -1205,7 +1434,28 @@ function changedForwardCandidates(previousObservedByPort, candidates) {
       changedCandidates.push(candidate);
     }
   }
-  return { nextObservedByPort, changedCandidates };
+  for (const previous of previousObservedByPort.values()) {
+    if (nextObservedByPort.has(previous.port)) {
+      continue;
+    }
+    const previousMissing = previousMissingByPort.get(previous.port);
+    const firstMissingAtMs = previousMissing !== undefined && sameForwardCandidate(previousMissing.candidate, previous) ? previousMissing.firstMissingAtMs : nowMs;
+    if (lostDebounceMs <= 0 || nowMs - firstMissingAtMs >= lostDebounceMs) {
+      lostCandidates.push(previous);
+      continue;
+    }
+    nextObservedByPort.set(previous.port, previous);
+    nextMissingByPort.set(previous.port, {
+      candidate: previous,
+      firstMissingAtMs
+    });
+  }
+  return {
+    nextObservedByPort,
+    nextMissingByPort,
+    changedCandidates,
+    lostCandidates
+  };
 }
 function stableForwardCandidates(previousObservedByPort, candidates, nowMs, debounceMs) {
   const nextObservedByPort = new Map;
@@ -1242,8 +1492,17 @@ function descendantPidSet(rows, rootPid) {
   }
   return descendants;
 }
-function detectedForwardCandidates(sockets, descendantPids, processCwds = new Map) {
-  return sockets.filter((socket) => descendantPids.has(socket.pid)).filter((socket) => socket.port > 0 && socket.port < 65536).sort((left, right) => left.port - right.port).map((socket) => {
+function detectedForwardCandidates(sockets, descendantPids, processCwds = new Map, options = {}) {
+  const rootCwd = normalizeCwd(options.rootCwd);
+  return sockets.filter((socket) => {
+    if (descendantPids.has(socket.pid)) {
+      return true;
+    }
+    if (rootCwd === undefined) {
+      return false;
+    }
+    return cwdMatchesRoot(processCwds.get(socket.pid), rootCwd);
+  }).filter((socket) => socket.port > 0 && socket.port < 65536).sort((left, right) => left.port - right.port).map((socket) => {
     const cwd = processCwds.get(socket.pid);
     return {
       port: socket.port,
@@ -1253,6 +1512,20 @@ function detectedForwardCandidates(sockets, descendantPids, processCwds = new Ma
     };
   });
 }
+function normalizeCwd(cwd) {
+  if (cwd === undefined) {
+    return;
+  }
+  const normalized = cwd.trim().replace(/\/+$/, "");
+  return normalized === "" ? undefined : normalized;
+}
+function cwdMatchesRoot(candidateCwd, rootCwd) {
+  const normalizedCandidate = normalizeCwd(candidateCwd);
+  if (normalizedCandidate === undefined) {
+    return false;
+  }
+  return normalizedCandidate === rootCwd || normalizedCandidate.startsWith(`${rootCwd}/`);
+}
 function parseProcessRows(output) {
   return output.split(`
 `).map((line) => line.trim()).filter((line) => line !== "").map((line) => {
@@ -1329,7 +1602,9 @@ function readProcessRows() {
   return parseProcessRows(result.stdout);
 }
 function readListenSocketRows() {
-  const result = spawnSync2("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-FpPcn"], { encoding: "utf8" });
+  const result = spawnSync2("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-FpPcn"], {
+    encoding: "utf8"
+  });
   if (result.error !== undefined) {
     throw result.error;
   }
@@ -1430,22 +1705,6 @@ function approvedTargetFromRequest(request) {
 function portForwardPromptLabel(candidate) {
   return commandLabel(candidate.command);
 }
-function portForwardPromptBody(candidate, requestId) {
-  const label = portForwardPromptLabel(candidate);
-  const cwdLine = candidate.cwd === undefined ? undefined : `Working directory: ${candidate.cwd}`;
-  return [
-    `Detected ${label} listening from a descendant process.`,
-    `Port: ${candidate.port}`,
-    `PID: ${candidate.pid}`,
-    `Command: ${candidate.command}`,
-    ...cwdLine === undefined ? [] : [cwdLine],
-    "Kandan can open this as an authenticated HTTP, HTTPS, or WebSocket preview. It does not expose arbitrary TCP or UDP protocols.",
-    "Open this preview in Kandan?",
-    "",
-    `Fallback commands: ${portForwardDecisionCommand("approve", requestId)} or ${portForwardDecisionCommand("deny", requestId)}`
-  ].join(`
-`);
-}
 function portForwardPromptReason(candidate) {
   return [
     `Port ${candidate.port}`,
@@ -1455,15 +1714,16 @@ function portForwardPromptReason(candidate) {
     "preview protocols: HTTP, HTTPS, WebSocket"
   ].join(" / ");
 }
-function portForwardDecisionCommand(decision, requestId) {
-  return `/kandan ${decision}-port-forward ${requestId}`;
-}
 function forwardPreviewPath(runnerId, port) {
   return `/local-codex-runners/${encodeURIComponent(runnerId)}/forwards/${port}/preview`;
 }
 function revocationCapabilities(capabilities, port) {
+  const existingAllowedPorts = Array.isArray(capabilities?.allowedPorts) ? capabilities.allowedPorts.filter((value) => typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535) : [];
+  const allowedPorts = existingAllowedPorts.filter((allowedPort) => allowedPort !== port);
   return {
     ...capabilities ?? {},
+    portForwarding: allowedPorts.length > 0,
+    allowedPorts,
     revokedPorts: [port]
   };
 }
@@ -1474,6 +1734,608 @@ function isInternalCodexProcess(candidate) {
   return commandLabel(candidate.command) === "codex";
 }
 
+// src/processNameCatalog.ts
+var processCatalogEntries = [
+  { appName: "Bun", iconKey: "bun", names: ["bun", "bunx"] },
+  {
+    appName: "Node.js",
+    iconKey: "nodejs",
+    names: ["node", "nodejs", "node.exe"]
+  },
+  { appName: "npm", iconKey: "npm", names: ["npm", "npm-cli.js", "npx"] },
+  { appName: "pnpm", iconKey: "pnpm", names: ["pnpm", "pnpx"] },
+  { appName: "Yarn", iconKey: "yarn", names: ["yarn", "yarnpkg", "yarn.js"] },
+  { appName: "Corepack", iconKey: "corepack", names: ["corepack"] },
+  { appName: "Deno", iconKey: "deno", names: ["deno"] },
+  { appName: "Vite", iconKey: "vite", names: ["vite", "vite-node"] },
+  { appName: "Vitest", iconKey: "vitest", names: ["vitest"] },
+  { appName: "Next.js", iconKey: "nextjs", names: ["next", "next-server"] },
+  { appName: "Nuxt", iconKey: "nuxt", names: ["nuxt", "nuxi"] },
+  { appName: "Astro", iconKey: "astro", names: ["astro"] },
+  {
+    appName: "SvelteKit",
+    iconKey: "svelte",
+    names: ["svelte-kit", "sveltekit"]
+  },
+  { appName: "Remix", iconKey: "remix", names: ["remix"] },
+  { appName: "Expo", iconKey: "expo", names: ["expo", "expo-cli"] },
+  { appName: "React Native", iconKey: "react", names: ["react-native"] },
+  {
+    appName: "Metro",
+    iconKey: "metro",
+    names: ["metro", "metro-inspector-proxy"]
+  },
+  {
+    appName: "Webpack",
+    iconKey: "webpack",
+    names: ["webpack", "webpack-dev-server", "webpack-cli"]
+  },
+  { appName: "Parcel", iconKey: "parcel", names: ["parcel"] },
+  { appName: "Rollup", iconKey: "rollup", names: ["rollup"] },
+  { appName: "esbuild", iconKey: "esbuild", names: ["esbuild"] },
+  { appName: "SWC", iconKey: "swc", names: ["swc"] },
+  {
+    appName: "TypeScript",
+    iconKey: "typescript",
+    names: ["tsc", "tsserver", "tsx", "ts-node", "typescript-language-server"]
+  },
+  { appName: "ESLint", iconKey: "eslint", names: ["eslint", "eslint_d"] },
+  { appName: "Prettier", iconKey: "prettier", names: ["prettier"] },
+  { appName: "Biome", iconKey: "biome", names: ["biome"] },
+  {
+    appName: "Storybook",
+    iconKey: "storybook",
+    names: ["storybook", "start-storybook"]
+  },
+  { appName: "Playwright", iconKey: "playwright", names: ["playwright"] },
+  { appName: "Cypress", iconKey: "cypress", names: ["cypress"] },
+  { appName: "Jest", iconKey: "jest", names: ["jest"] },
+  {
+    appName: "Python",
+    iconKey: "python",
+    names: [
+      "python",
+      "python2",
+      "python3",
+      "python3.9",
+      "python3.10",
+      "python3.11",
+      "python3.12",
+      "python3.13",
+      "pypy",
+      "pypy3"
+    ]
+  },
+  { appName: "pip", iconKey: "python", names: ["pip", "pip2", "pip3"] },
+  { appName: "pipx", iconKey: "python", names: ["pipx"] },
+  { appName: "uv", iconKey: "python", names: ["uv", "uvx"] },
+  { appName: "Poetry", iconKey: "poetry", names: ["poetry"] },
+  { appName: "Pipenv", iconKey: "python", names: ["pipenv"] },
+  {
+    appName: "Conda",
+    iconKey: "conda",
+    names: ["conda", "mamba", "micromamba"]
+  },
+  {
+    appName: "Django",
+    iconKey: "django",
+    names: ["django-admin", "django-admin.py", "manage.py"]
+  },
+  { appName: "Flask", iconKey: "flask", names: ["flask"] },
+  { appName: "Uvicorn", iconKey: "uvicorn", names: ["uvicorn"] },
+  { appName: "Gunicorn", iconKey: "gunicorn", names: ["gunicorn"] },
+  { appName: "Hypercorn", iconKey: "python", names: ["hypercorn"] },
+  { appName: "Celery", iconKey: "celery", names: ["celery"] },
+  {
+    appName: "Jupyter",
+    iconKey: "jupyter",
+    names: ["jupyter", "jupyter-lab", "jupyter-notebook", "ipython"]
+  },
+  { appName: "Ruby", iconKey: "ruby", names: ["ruby", "erb", "irb"] },
+  { appName: "Bundler", iconKey: "ruby", names: ["bundle", "bundler"] },
+  { appName: "Rails", iconKey: "rails", names: ["rails", "bin/rails"] },
+  { appName: "Rack", iconKey: "ruby", names: ["rackup"] },
+  { appName: "Puma", iconKey: "puma", names: ["puma"] },
+  { appName: "Sidekiq", iconKey: "sidekiq", names: ["sidekiq"] },
+  { appName: "RSpec", iconKey: "ruby", names: ["rspec"] },
+  { appName: "Go", iconKey: "go", names: ["go", "gofmt", "gopls", "air"] },
+  { appName: "Delve", iconKey: "go", names: ["dlv"] },
+  {
+    appName: "Rust",
+    iconKey: "rust",
+    names: ["rustc", "rustup", "cargo", "rust-analyzer"]
+  },
+  {
+    appName: "Java",
+    iconKey: "java",
+    names: ["java", "javac", "jar", "jshell", "jwebserver"]
+  },
+  { appName: "Gradle", iconKey: "gradle", names: ["gradle", "gradlew"] },
+  { appName: "Maven", iconKey: "maven", names: ["mvn", "mvnw"] },
+  {
+    appName: "Spring Boot",
+    iconKey: "spring",
+    names: ["spring", "spring-boot"]
+  },
+  {
+    appName: "Kotlin",
+    iconKey: "kotlin",
+    names: ["kotlin", "kotlinc", "kotlin-language-server"]
+  },
+  {
+    appName: "Scala",
+    iconKey: "scala",
+    names: ["scala", "scalac", "sbt", "metals"]
+  },
+  {
+    appName: "Clojure",
+    iconKey: "clojure",
+    names: ["clojure", "clj", "lein", "boot"]
+  },
+  {
+    appName: "PHP",
+    iconKey: "php",
+    names: ["php", "php-fpm", "php-cgi", "composer"]
+  },
+  { appName: "Laravel", iconKey: "laravel", names: ["artisan", "laravel"] },
+  { appName: "Symfony", iconKey: "symfony", names: ["symfony"] },
+  { appName: "Elixir", iconKey: "elixir", names: ["elixir", "iex", "mix"] },
+  {
+    appName: "Erlang",
+    iconKey: "erlang",
+    names: ["erl", "beam.smp", "beam", "epmd", "rebar3"]
+  },
+  { appName: "Phoenix", iconKey: "phoenix", names: ["phx.server", "phoenix"] },
+  {
+    appName: "PostgreSQL",
+    iconKey: "postgresql",
+    names: ["postgres", "postmaster", "pg_ctl", "psql", "pg_isready"]
+  },
+  {
+    appName: "Redis",
+    iconKey: "redis",
+    names: ["redis-server", "redis-cli", "redis-sentinel"]
+  },
+  {
+    appName: "MySQL",
+    iconKey: "mysql",
+    names: ["mysql", "mysqld", "mysqladmin"]
+  },
+  {
+    appName: "MariaDB",
+    iconKey: "mariadb",
+    names: ["mariadb", "mariadbd", "mariadb-admin"]
+  },
+  { appName: "SQLite", iconKey: "sqlite", names: ["sqlite3", "sqlite"] },
+  {
+    appName: "MongoDB",
+    iconKey: "mongodb",
+    names: ["mongod", "mongosh", "mongo"]
+  },
+  {
+    appName: "Elasticsearch",
+    iconKey: "elasticsearch",
+    names: ["elasticsearch"]
+  },
+  { appName: "OpenSearch", iconKey: "opensearch", names: ["opensearch"] },
+  { appName: "Solr", iconKey: "solr", names: ["solr"] },
+  {
+    appName: "Kafka",
+    iconKey: "kafka",
+    names: [
+      "kafka-server-start",
+      "kafka-console-consumer",
+      "kafka-console-producer"
+    ]
+  },
+  {
+    appName: "ZooKeeper",
+    iconKey: "zookeeper",
+    names: ["zookeeper-server-start", "zkserver"]
+  },
+  {
+    appName: "RabbitMQ",
+    iconKey: "rabbitmq",
+    names: ["rabbitmq-server", "rabbitmqctl"]
+  },
+  { appName: "NATS", iconKey: "nats", names: ["nats-server", "nats"] },
+  {
+    appName: "Docker",
+    iconKey: "docker",
+    names: [
+      "docker",
+      "dockerd",
+      "docker-compose",
+      "docker-proxy",
+      "com.docker.backend"
+    ]
+  },
+  { appName: "Podman", iconKey: "podman", names: ["podman", "podman-compose"] },
+  {
+    appName: "Kubernetes",
+    iconKey: "kubernetes",
+    names: ["kubectl", "kube-apiserver", "kubelet", "minikube", "kind"]
+  },
+  { appName: "Helm", iconKey: "helm", names: ["helm"] },
+  { appName: "Tilt", iconKey: "tilt", names: ["tilt"] },
+  { appName: "nginx", iconKey: "nginx", names: ["nginx"] },
+  { appName: "Caddy", iconKey: "caddy", names: ["caddy"] },
+  {
+    appName: "Apache HTTP Server",
+    iconKey: "apache",
+    names: ["httpd", "apache2", "apachectl"]
+  },
+  { appName: "HAProxy", iconKey: "haproxy", names: ["haproxy"] },
+  { appName: "Traefik", iconKey: "traefik", names: ["traefik"] },
+  { appName: "Envoy", iconKey: "envoy", names: ["envoy"] },
+  {
+    appName: "Tailscale",
+    iconKey: "tailscale",
+    names: ["tailscale", "tailscaled"]
+  },
+  {
+    appName: "Cloudflare Tunnel",
+    iconKey: "cloudflare",
+    names: ["cloudflared"]
+  },
+  { appName: "ngrok", iconKey: "ngrok", names: ["ngrok"] },
+  { appName: "localtunnel", iconKey: "terminal", names: ["lt", "localtunnel"] },
+  { appName: "SSH", iconKey: "ssh", names: ["ssh", "sshd", "scp", "sftp"] },
+  {
+    appName: "Git",
+    iconKey: "git",
+    names: ["git", "git-lfs", "git-upload-pack", "git-receive-pack"]
+  },
+  { appName: "GitHub CLI", iconKey: "github", names: ["gh"] },
+  { appName: "GitLab CLI", iconKey: "gitlab", names: ["glab"] },
+  { appName: "Subversion", iconKey: "subversion", names: ["svn"] },
+  { appName: "Mercurial", iconKey: "mercurial", names: ["hg"] },
+  { appName: "AWS CLI", iconKey: "aws", names: ["aws", "aws-vault", "sam"] },
+  { appName: "Azure CLI", iconKey: "azure", names: ["az"] },
+  {
+    appName: "Google Cloud CLI",
+    iconKey: "google-cloud",
+    names: ["gcloud", "gsutil", "bq"]
+  },
+  { appName: "Terraform", iconKey: "terraform", names: ["terraform"] },
+  { appName: "OpenTofu", iconKey: "opentofu", names: ["tofu"] },
+  {
+    appName: "Ansible",
+    iconKey: "ansible",
+    names: ["ansible", "ansible-playbook"]
+  },
+  { appName: "Pulumi", iconKey: "pulumi", names: ["pulumi"] },
+  { appName: "Nomad", iconKey: "nomad", names: ["nomad"] },
+  { appName: "Vault", iconKey: "vault", names: ["vault"] },
+  { appName: "Consul", iconKey: "consul", names: ["consul"] },
+  { appName: "Make", iconKey: "make", names: ["make", "gmake"] },
+  { appName: "CMake", iconKey: "cmake", names: ["cmake", "ctest", "cpack"] },
+  { appName: "Ninja", iconKey: "ninja", names: ["ninja"] },
+  { appName: "Bazel", iconKey: "bazel", names: ["bazel", "bazelisk"] },
+  { appName: "Buck", iconKey: "buck", names: ["buck", "buck2"] },
+  { appName: "Clang", iconKey: "clang", names: ["clang", "clang++", "clangd"] },
+  { appName: "GCC", iconKey: "gcc", names: ["gcc", "g++", "cc", "c++"] },
+  { appName: "LLDB", iconKey: "terminal", names: ["lldb"] },
+  { appName: "GDB", iconKey: "terminal", names: ["gdb"] },
+  {
+    appName: "Swift",
+    iconKey: "swift",
+    names: ["swift", "swiftc", "sourcekit-lsp"]
+  },
+  {
+    appName: "Xcode",
+    iconKey: "xcode",
+    names: ["xcodebuild", "xcrun", "simctl"]
+  },
+  { appName: "Zig", iconKey: "zig", names: ["zig"] },
+  {
+    appName: "Lua",
+    iconKey: "lua",
+    names: ["lua", "luajit", "lua-language-server"]
+  },
+  { appName: "Perl", iconKey: "perl", names: ["perl"] },
+  {
+    appName: "R",
+    iconKey: "r",
+    names: ["r", "rscript", "rserver", "rsession"]
+  },
+  { appName: "Julia", iconKey: "julia", names: ["julia"] },
+  {
+    appName: "Haskell",
+    iconKey: "haskell",
+    names: ["ghc", "ghci", "cabal", "stack", "haskell-language-server-wrapper"]
+  },
+  {
+    appName: "OCaml",
+    iconKey: "ocaml",
+    names: ["ocaml", "ocamlc", "dune", "opam"]
+  },
+  { appName: "F#", iconKey: "fsharp", names: ["fsharpi", "fsautocomplete"] },
+  {
+    appName: ".NET",
+    iconKey: "dotnet",
+    names: ["dotnet", "csharp-ls", "omnisharp"]
+  },
+  {
+    appName: "PowerShell",
+    iconKey: "powershell",
+    names: ["pwsh", "powershell"]
+  },
+  { appName: "Bash", iconKey: "terminal", names: ["bash"] },
+  { appName: "Zsh", iconKey: "terminal", names: ["zsh"] },
+  { appName: "fish", iconKey: "terminal", names: ["fish"] },
+  { appName: "tmux", iconKey: "terminal", names: ["tmux"] },
+  { appName: "GNU Screen", iconKey: "terminal", names: ["screen"] },
+  { appName: "direnv", iconKey: "terminal", names: ["direnv"] },
+  {
+    appName: "Nix",
+    iconKey: "nix",
+    names: ["nix", "nix-shell", "nix-daemon", "nix-build", "nix develop"]
+  },
+  { appName: "Homebrew", iconKey: "homebrew", names: ["brew"] },
+  { appName: "mise", iconKey: "terminal", names: ["mise"] },
+  { appName: "asdf", iconKey: "terminal", names: ["asdf"] },
+  { appName: "Volta", iconKey: "volta", names: ["volta"] },
+  { appName: "fnm", iconKey: "nodejs", names: ["fnm"] },
+  { appName: "nvm", iconKey: "nodejs", names: ["nvm"] },
+  { appName: "curl", iconKey: "terminal", names: ["curl"] },
+  { appName: "HTTPie", iconKey: "httpie", names: ["http", "https", "httpie"] },
+  { appName: "wget", iconKey: "terminal", names: ["wget"] },
+  { appName: "jq", iconKey: "terminal", names: ["jq"] },
+  { appName: "ripgrep", iconKey: "terminal", names: ["rg", "ripgrep"] },
+  { appName: "fd", iconKey: "terminal", names: ["fd"] },
+  { appName: "fzf", iconKey: "terminal", names: ["fzf"] },
+  { appName: "bat", iconKey: "terminal", names: ["bat"] },
+  { appName: "eza", iconKey: "terminal", names: ["eza", "exa"] },
+  { appName: "htop", iconKey: "terminal", names: ["htop", "top", "btop"] },
+  { appName: "Vim", iconKey: "vim", names: ["vim", "view", "vimdiff"] },
+  { appName: "Neovim", iconKey: "neovim", names: ["nvim", "nvim-qt"] },
+  { appName: "Emacs", iconKey: "emacs", names: ["emacs", "emacsclient"] },
+  {
+    appName: "Visual Studio Code",
+    iconKey: "vscode",
+    names: [
+      "code",
+      "code-insiders",
+      "vscode",
+      "visual studio code",
+      "visual studio code - insiders"
+    ]
+  },
+  { appName: "code-server", iconKey: "vscode", names: ["code-server"] },
+  { appName: "Cursor", iconKey: "cursor", names: ["cursor"] },
+  { appName: "Zed", iconKey: "zed", names: ["zed"] },
+  {
+    appName: "Sublime Text",
+    iconKey: "sublime-text",
+    names: ["subl", "sublime_text", "sublime text"]
+  },
+  { appName: "Atom", iconKey: "atom", names: ["atom"] },
+  {
+    appName: "IntelliJ IDEA",
+    iconKey: "intellij-idea",
+    names: ["idea", "idea.sh", "intellij idea", "idea64.exe"]
+  },
+  {
+    appName: "WebStorm",
+    iconKey: "webstorm",
+    names: ["webstorm", "webstorm.sh"]
+  },
+  { appName: "PyCharm", iconKey: "pycharm", names: ["pycharm", "pycharm.sh"] },
+  {
+    appName: "RubyMine",
+    iconKey: "rubymine",
+    names: ["rubymine", "rubymine.sh"]
+  },
+  { appName: "GoLand", iconKey: "goland", names: ["goland", "goland.sh"] },
+  { appName: "CLion", iconKey: "clion", names: ["clion", "clion.sh"] },
+  {
+    appName: "DataGrip",
+    iconKey: "datagrip",
+    names: ["datagrip", "datagrip.sh"]
+  },
+  { appName: "Rider", iconKey: "rider", names: ["rider", "rider.sh"] },
+  {
+    appName: "Android Studio",
+    iconKey: "android-studio",
+    names: ["studio", "studio.sh", "android studio"]
+  },
+  { appName: "Xcode", iconKey: "xcode", names: ["xcode", "xcode.app"] },
+  { appName: "Postman", iconKey: "postman", names: ["postman"] },
+  { appName: "Insomnia", iconKey: "insomnia", names: ["insomnia"] },
+  { appName: "Hoppscotch", iconKey: "hoppscotch", names: ["hoppscotch"] },
+  { appName: "TablePlus", iconKey: "tableplus", names: ["tableplus"] },
+  { appName: "DBeaver", iconKey: "dbeaver", names: ["dbeaver"] },
+  { appName: "RedisInsight", iconKey: "redis", names: ["redisinsight"] },
+  { appName: "Prisma", iconKey: "prisma", names: ["prisma"] },
+  { appName: "Drizzle Kit", iconKey: "drizzle", names: ["drizzle-kit"] },
+  { appName: "Supabase", iconKey: "supabase", names: ["supabase"] },
+  { appName: "Firebase", iconKey: "firebase", names: ["firebase"] },
+  { appName: "Vercel", iconKey: "vercel", names: ["vercel"] },
+  { appName: "Netlify", iconKey: "netlify", names: ["netlify", "ntl"] },
+  { appName: "Fly.io", iconKey: "fly", names: ["fly", "flyctl"] },
+  { appName: "Heroku", iconKey: "heroku", names: ["heroku"] },
+  { appName: "Stripe CLI", iconKey: "stripe", names: ["stripe"] },
+  { appName: "Twilio CLI", iconKey: "twilio", names: ["twilio"] },
+  { appName: "Mailpit", iconKey: "mail", names: ["mailpit"] },
+  { appName: "MailHog", iconKey: "mail", names: ["mailhog"] },
+  { appName: "OpenSSL", iconKey: "openssl", names: ["openssl"] },
+  { appName: "mkcert", iconKey: "certificate", names: ["mkcert"] },
+  { appName: "mkdocs", iconKey: "markdown", names: ["mkdocs"] },
+  { appName: "Hugo", iconKey: "hugo", names: ["hugo"] },
+  { appName: "Jekyll", iconKey: "jekyll", names: ["jekyll"] },
+  { appName: "Eleventy", iconKey: "eleventy", names: ["eleventy", "11ty"] },
+  { appName: "Docusaurus", iconKey: "docusaurus", names: ["docusaurus"] },
+  { appName: "Trunk", iconKey: "rust", names: ["trunk"] },
+  { appName: "wasm-pack", iconKey: "webassembly", names: ["wasm-pack"] },
+  { appName: "wasmtime", iconKey: "webassembly", names: ["wasmtime"] },
+  {
+    appName: "Language Server",
+    iconKey: "language-server",
+    names: [
+      "lua-language-server",
+      "yaml-language-server",
+      "vscode-json-language-server",
+      "docker-langserver",
+      "bash-language-server",
+      "marksman",
+      "taplo"
+    ]
+  }
+];
+var executableNameLookup = new Map;
+for (const entry of processCatalogEntries) {
+  for (const name of entry.names) {
+    executableNameLookup.set(normalizeProcessName(name), {
+      appName: entry.appName,
+      iconKey: entry.iconKey
+    });
+  }
+}
+var processNameCatalogSize = executableNameLookup.size;
+function canonicalizeProcessName(processName) {
+  const executableName = executableNameFromPathOrName(processName);
+  if (executableName === undefined) {
+    return;
+  }
+  const directMatch = lookupCanonicalProcess(executableName);
+  if (directMatch !== undefined) {
+    return directMatch;
+  }
+  const pathMatch = lookupCanonicalPathHint(processName);
+  if (pathMatch !== undefined) {
+    return pathMatch;
+  }
+  return;
+}
+function guessCanonicalProcessFromCommand(command) {
+  const tokens = shellCommandTokens(command);
+  const executable = executableTokenFromCommandTokens(tokens);
+  if (executable === undefined) {
+    return;
+  }
+  return canonicalizeProcessName(executable);
+}
+function lookupCanonicalProcess(processName) {
+  const normalized = normalizeProcessName(processName);
+  const identity = executableNameLookup.get(normalized);
+  if (identity === undefined) {
+    return;
+  }
+  return {
+    ...identity,
+    executableName: processName,
+    matchedName: normalized
+  };
+}
+function lookupCanonicalPathHint(processPath) {
+  const normalizedPath = normalizeProcessName(processPath);
+  const pathParts = normalizedPath.split("/").map((part) => trimExecutableExtension(part)).filter((part) => part.length > 0);
+  for (const pathPart of pathParts.reverse()) {
+    const pathHint = executableNameLookup.get(pathPart);
+    if (pathHint !== undefined) {
+      return {
+        ...pathHint,
+        executableName: executableNameFromPathOrName(processPath) ?? processPath,
+        matchedName: pathPart
+      };
+    }
+  }
+  return;
+}
+function executableTokenFromCommandTokens(tokens) {
+  const [firstToken, ...remainingTokens] = tokens;
+  switch (firstToken) {
+    case undefined:
+      return;
+    case "env":
+    case "/usr/bin/env":
+      return executableTokenFromCommandTokens(remainingTokens.filter((token) => !isEnvironmentAssignment(token)));
+    case "sudo":
+    case "command":
+    case "exec":
+    case "nohup":
+      return executableTokenFromCommandTokens(remainingTokens.filter((token) => !token.startsWith("-")));
+    default:
+      switch (isEnvironmentAssignment(firstToken)) {
+        case true:
+          return executableTokenFromCommandTokens(remainingTokens);
+        case false:
+          return firstToken;
+      }
+  }
+}
+function executableNameFromPathOrName(processName) {
+  const trimmed = processName.trim();
+  if (trimmed.length === 0) {
+    return;
+  }
+  const normalizedSeparators = trimmed.replaceAll("\\", "/");
+  const [lastPathPart] = normalizedSeparators.split("/").filter((part) => part.length > 0).slice(-1);
+  switch (lastPathPart) {
+    case undefined:
+      return;
+    default:
+      return trimExecutableExtension(lastPathPart);
+  }
+}
+function trimExecutableExtension(executableName) {
+  const normalized = executableName.toLowerCase();
+  switch (true) {
+    case normalized.endsWith(".app"):
+      return executableName.slice(0, -4);
+    case normalized.endsWith(".exe"):
+      return executableName.slice(0, -4);
+    case normalized.endsWith(".cmd"):
+    case normalized.endsWith(".bat"):
+      return executableName.slice(0, -4);
+    default:
+      return executableName;
+  }
+}
+function normalizeProcessName(processName) {
+  return trimExecutableExtension(processName.trim().replaceAll("\\", "/").toLowerCase());
+}
+function isEnvironmentAssignment(token) {
+  return /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
+}
+function shellCommandTokens(command) {
+  const tokens = [];
+  let currentToken = "";
+  let quote = undefined;
+  let escaping = false;
+  for (const character of command.trim()) {
+    switch (true) {
+      case escaping:
+        currentToken = `${currentToken}${character}`;
+        escaping = false;
+        break;
+      case character === "\\":
+        escaping = true;
+        break;
+      case (quote === undefined && (character === '"' || character === "'")):
+        quote = character;
+        break;
+      case quote === character:
+        quote = undefined;
+        break;
+      case (quote === undefined && /\s/.test(character)):
+        if (currentToken.length > 0) {
+          tokens.push(currentToken);
+          currentToken = "";
+        }
+        break;
+      default:
+        currentToken = `${currentToken}${character}`;
+        break;
+    }
+  }
+  if (currentToken.length > 0) {
+    tokens.push(currentToken);
+  }
+  return tokens;
+}
+
 // src/channelSession.ts
 var codexTypingHeartbeatMs = 5000;
 var defaultStreamFlushIntervalMs = 150;
@@ -1534,7 +2396,7 @@ async function attachChannelSession(args) {
         }
         switch (method) {
           case "turn/started":
-            if (turnId !== undefined) {
+            if (threadId !== undefined && turnId !== undefined) {
               rememberLocalTuiTurnIfNeeded(args, state, threadId, turnId);
             }
             break;
@@ -1669,12 +2531,15 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     forwardedTerminalInputKeys: new Set,
     webSearchProgressOutputs: createBoundedCache(maxForwardedTurnIds),
     pendingApprovalRequests: new Map,
+    approvalPromptChain: Promise.resolve(),
     pendingPortForwardRequests: new Map,
+    queuedPortForwardCandidates: new Map,
     approvedForwardPorts: new Set,
     approvedForwardTargets: new Map,
     dismissedForwardTargets: new Map,
     portForwardWatcher: undefined,
     activeProcessingState: undefined,
+    pendingReconnectContextInjection: undefined,
     terminalInputForwardChain: Promise.resolve(),
     webSearchProgressForwardChain: Promise.resolve(),
     typingHeartbeat: undefined,
@@ -1682,8 +2547,25 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     runtimeSettings: runtimeSettingsFromOptions(options)
   };
 }
+async function handleLostPortForwardCandidate(args, state, payloadContext, candidate) {
+  dropLostQueuedPortForwardCandidate(args, state, candidate);
+  await expireLostPendingPortForwardRequest(args, state, payloadContext, candidate);
+  await revokeLostApprovedForwardPort(args, state, candidate);
+}
+function dropLostQueuedPortForwardCandidate(args, state, candidate) {
+  const queued = state.queuedPortForwardCandidates.get(candidate.port);
+  if (queued === undefined || !sameForwardCandidate(queued, candidate)) {
+    return;
+  }
+  state.queuedPortForwardCandidates.delete(candidate.port);
+  args.log("port_forward.queued_request_dropped", {
+    port: candidate.port,
+    pid: candidate.pid,
+    reason: "listener_exited"
+  });
+}
 function startPortForwardWatchIfEnabled(args, state, payloadContext) {
-  if (args.options.enablePortForwardWatch !== true || state.portForwardWatcher !== undefined) {
+  if (args.options.enablePortForwardWatch !== true || state.portForwardWatcher !== undefined || state.kandanThreadId === undefined || state.codexThreadId === undefined) {
     return;
   }
   const { start: configuredStart, ...watchOptions } = args.options.portForwardWatcher ?? {};
@@ -1692,8 +2574,10 @@ function startPortForwardWatchIfEnabled(args, state, payloadContext) {
     state.approvedForwardPorts.add(port);
   }
   state.portForwardWatcher = start({
+    rootCwd: watchOptions.rootCwd ?? args.options.cwd,
     ...watchOptions,
     onCandidate: (candidate) => publishPortForwardPrompt(args, state, payloadContext, candidate),
+    onCandidateLost: (candidate) => handleLostPortForwardCandidate(args, state, payloadContext, candidate),
     onError: (error) => args.log("port_forward.watch_failed", { message: error.message })
   });
 }
@@ -1715,13 +2599,6 @@ async function bindChannelSession(args, state, payloadContext) {
     }
   } else if (state.codexThreadId !== undefined) {
     await bindCurrentCodexThread(args, state);
-    switch (state.rootSeq) {
-      case undefined:
-        await postBoundThreadAvailability(args, state, payloadContext, codexVersion);
-        break;
-      default:
-        break;
-    }
   } else {
     const resolved = await pushOk(args.kandan, args.topic, "session:resolve_thread_session", {
       workspace: session.workspaceSlug,
@@ -1733,22 +2610,9 @@ async function bindChannelSession(args, state, payloadContext) {
     if (state.codexThreadId === undefined) {
       throw new Error("Kandan thread root metadata did not include a Codex thread id");
     }
-    await postBoundThreadAvailability(args, state, payloadContext, codexVersion);
+    await bindCurrentCodexThread(args, state);
   }
 }
-async function postBoundThreadAvailability(args, state, payloadContext, codexVersion) {
-  if (state.kandanThreadId === undefined || state.codexThreadId === undefined) {
-    throw new Error("cannot post local Codex availability before thread binding");
-  }
-  const session = args.options.channelSession;
-  await pushOk(args.kandan, args.topic, "session:post_thread_message", {
-    workspace: session.workspaceSlug,
-    channel: session.channelSlug,
-    thread_id: state.kandanThreadId,
-    body: availabilityMessage(args.options, codexVersion, state.codexThreadId),
-    payload: localRunnerPayload(args.options, args.instanceId, "availability", state.codexThreadId, payloadContext)
-  });
-}
 async function handleChannelSessionControl(args, state, payloadContext, control) {
   if (control.type === "update_session_settings") {
     return updateSessionSettings(args, state, control);
@@ -1766,7 +2630,11 @@ async function handleChannelSessionControl(args, state, payloadContext, control)
     return;
   }
   if (state.codexThreadId === undefined || state.kandanThreadId === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "thread_not_bound" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "thread_not_bound"
+    };
   }
   const interrupted = interruptPendingKandanMessages(state.queue, control.throughSeq);
   const activeQueuedSeq = interruptibleQueuedSeq(state.turn);
@@ -1819,7 +2687,11 @@ function updateSessionSettings(args, state, control) {
     return;
   }
   if (state.codexThreadId === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "thread_not_bound" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "thread_not_bound"
+    };
   }
   state.runtimeSettings = mergeRuntimeSettings(state.runtimeSettings, control);
   publishRuntimeSettings(args, state).catch((error) => {
@@ -1849,16 +2721,27 @@ async function resolvePendingCodexApprovalRequest(args, state, control) {
     return;
   }
   if (state.codexThreadId === undefined || state.kandanThreadId === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "thread_not_bound" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "thread_not_bound"
+    };
   }
   const approval = state.pendingApprovalRequests.get(approvalRequestKey(control.requestId, control.sourceSeq));
   if (approval === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "approval_request_not_found" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "approval_request_not_found"
+    };
   }
   state.pendingApprovalRequests.delete(approvalRequestKey(control.requestId, control.sourceSeq));
   const codexDecision = control.decision === "approve" ? "accept" : "decline";
   approval.resolve({ decision: codexDecision });
-  state.activeProcessingState = { seq: approval.sourceSeq, reason: "streaming response" };
+  state.activeProcessingState = {
+    seq: approval.sourceSeq,
+    reason: "streaming response"
+  };
   await publishMessageState(args, state.kandanThreadId, approval.sourceSeq, {
     status: "processing",
     reason: "streaming response"
@@ -1871,6 +2754,17 @@ async function resolvePendingCodexApprovalRequest(args, state, control) {
   });
   return { instanceId: args.instanceId, ok: true };
 }
+async function drainQueuedPortForwardPrompt(args, state, payloadContext) {
+  if (state.pendingPortForwardRequests.size > 0 || state.queuedPortForwardCandidates.size === 0) {
+    return;
+  }
+  const next = Array.from(state.queuedPortForwardCandidates.values()).sort((left, right) => left.port - right.port)[0];
+  if (next === undefined) {
+    return;
+  }
+  state.queuedPortForwardCandidates.delete(next.port);
+  await publishPortForwardPrompt(args, state, payloadContext, next);
+}
 async function resolvePendingPortForwardRequest(args, state, payloadContext, control) {
   const request = state.pendingPortForwardRequests.get(control.requestId);
   if (request === undefined) {
@@ -1883,7 +2777,11 @@ async function resolvePendingPortForwardRequest(args, state, payloadContext, con
       actor_user_id: control.actorUserId ?? null,
       reason: "sender_not_allowed"
     });
-    return { instanceId: args.instanceId, ok: false, error: "sender_not_allowed" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "sender_not_allowed"
+    };
   }
   state.pendingPortForwardRequests.delete(control.requestId);
   if (control.decision === "deny") {
@@ -1894,14 +2792,18 @@ async function resolvePendingPortForwardRequest(args, state, payloadContext, con
       port: request.port,
       pid: request.pid
     });
+    await drainQueuedPortForwardPrompt(args, state, payloadContext);
     return { instanceId: args.instanceId, ok: true };
   }
   state.approvedForwardPorts.add(request.port);
   state.approvedForwardTargets.set(request.port, approvedTargetFromRequest(request));
+  const processIdentity = guessCanonicalProcessFromCommand(request.command);
   const capabilities = args.options.onForwardPortApproved?.(request.port, {
     kandanThreadId: state.kandanThreadId ?? null,
     codexThreadId: state.codexThreadId ?? null,
-    channelSlug: args.options.channelSession.channelSlug ?? null
+    channelSlug: args.options.channelSession.channelSlug ?? null,
+    processName: processIdentity?.appName ?? null,
+    processIconKey: processIdentity?.iconKey ?? null
   });
   await publishForwardPortResolvedEvent(args, request, capabilities);
   await publishMessageStateForPortForwardResult(args, state, request, "processed");
@@ -1911,6 +2813,7 @@ async function resolvePendingPortForwardRequest(args, state, payloadContext, con
     port: request.port,
     pid: request.pid
   });
+  await drainQueuedPortForwardPrompt(args, state, payloadContext);
   return { instanceId: args.instanceId, ok: true, port: request.port };
 }
 function portForwardControlSenderAllowed(args, payloadContext, control) {
@@ -1947,37 +2850,39 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
       state.approvedForwardTargets.set(review.target.port, review.target);
       return;
     case "revoke_and_prompt":
+      if (state.pendingPortForwardRequests.size > 0) {
+        state.queuedPortForwardCandidates.set(candidate.port, candidate);
+        args.log("port_forward.request_queued", {
+          port: candidate.port,
+          pid: candidate.pid,
+          pending_count: state.pendingPortForwardRequests.size
+        });
+        return;
+      }
       await revokeApprovedForwardPort(args, state, review.revoked, review.reason);
       break;
     case "prompt":
+      if (state.pendingPortForwardRequests.size > 0) {
+        state.queuedPortForwardCandidates.set(candidate.port, candidate);
+        args.log("port_forward.request_queued", {
+          port: candidate.port,
+          pid: candidate.pid,
+          pending_count: state.pendingPortForwardRequests.size
+        });
+        return;
+      }
       break;
   }
   const requestId = `port-forward-${randomUUID()}`;
   const label = portForwardPromptLabel(candidate);
-  const body = portForwardPromptBody(candidate, requestId);
-  const payload = {
-    ...localRunnerPayload(args.options, args.instanceId, "port_forward_request", state.codexThreadId, payloadContext),
-    reply_to_seq: state.rootSeq ?? null,
-    structured: {
-      kind: "local_runner_port_forward_request",
-      request_id: requestId,
+  const sourceSeq = portForwardApprovalSourceSeq(state);
+  if (sourceSeq === undefined) {
+    args.log("port_forward.prompt_skipped", {
       port: candidate.port,
       pid: candidate.pid,
-      command: candidate.command,
-      ...candidate.cwd === undefined ? {} : { cwd: candidate.cwd },
-      command_label: label
-    }
-  };
-  const reply = await pushOk(args.kandan, args.topic, "session:post_thread_message", {
-    workspace: args.options.channelSession.workspaceSlug,
-    channel: args.options.channelSession.channelSlug,
-    thread_id: state.kandanThreadId,
-    body,
-    payload
-  });
-  const sourceSeq = integerValue(reply.seq);
-  if (sourceSeq === undefined) {
-    throw new Error("port forward prompt did not return a Kandan message seq");
+      reason: "source_seq_missing"
+    });
+    return;
   }
   const request = pendingRequestFromCandidate({
     requestId,
@@ -1985,6 +2890,9 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
     candidate
   });
   state.pendingPortForwardRequests.set(requestId, request);
+  const processIdentity = guessCanonicalProcessFromCommand(candidate.command);
+  const processIconPath = processIdentity?.iconKey === undefined ? undefined : `/web/process-icons/${processIdentity.iconKey}.png`;
+  const processName = processIdentity?.appName ?? label;
   await publishForwardPortRequestedEvent(args, request);
   await publishMessageState(args, state.kandanThreadId, sourceSeq, {
     status: "processing",
@@ -1992,13 +2900,20 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
     approval: {
       requestId,
       kind: "local_runner_port_forward",
-      summary: `Open runner port ${candidate.port} from ${label}`,
+      summary: `Make ${processName} on port ${candidate.port} accessible on Linzumi?`,
       reason: portForwardPromptReason(candidate),
+      port: candidate.port,
+      pid: candidate.pid,
+      command: candidate.command,
+      ...candidate.cwd === undefined ? {} : { cwd: candidate.cwd },
+      ...processIdentity?.appName === undefined ? {} : { processName },
+      ...processIdentity?.iconKey === undefined ? {} : { processIconKey: processIdentity.iconKey },
+      ...processIconPath === undefined ? {} : { processIconPath },
       choices: [
         {
           decision: "approve",
-          label: "Open preview",
-          description: `Allow Kandan to proxy HTTP, HTTPS, and WebSocket traffic for runner port ${candidate.port}.`
+          label: "Enable",
+          description: `Allow Linzumi to proxy HTTP, HTTPS, and WebSocket traffic for runner port ${candidate.port}.`
         },
         {
           decision: "deny",
@@ -2016,6 +2931,9 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
     pid: candidate.pid
   });
 }
+function portForwardApprovalSourceSeq(state) {
+  return state.activeProcessingState?.seq ?? state.rootSeq;
+}
 async function revokeApprovedForwardPort(args, state, target, reason) {
   state.approvedForwardPorts.delete(target.port);
   state.approvedForwardTargets.delete(target.port);
@@ -2035,30 +2953,58 @@ async function revokeApprovedForwardPort(args, state, target, reason) {
     reason
   });
 }
+async function revokeLostApprovedForwardPort(args, state, candidate) {
+  if (!state.approvedForwardPorts.has(candidate.port)) {
+    return;
+  }
+  await revokeApprovedForwardPort(args, state, state.approvedForwardTargets.get(candidate.port) ?? candidate, "listener_exited");
+}
+async function expireLostPendingPortForwardRequest(args, state, payloadContext, candidate) {
+  const request = Array.from(state.pendingPortForwardRequests.values()).find((request2) => sameForwardCandidate(approvedTargetFromRequest(request2), candidate));
+  if (request === undefined) {
+    return;
+  }
+  state.pendingPortForwardRequests.delete(request.requestId);
+  await publishMessageStateForPortForwardResult(args, state, request, "failed", "port_forward_listener_exited");
+  args.log("port_forward.pending_request_expired", {
+    request_id: request.requestId,
+    port: request.port,
+    pid: request.pid,
+    reason: "listener_exited"
+  });
+  await drainQueuedPortForwardPrompt(args, state, payloadContext);
+}
 async function publishPortForwardReadyMessage(args, state, payloadContext, request) {
   if (state.kandanThreadId === undefined || state.codexThreadId === undefined) {
     return;
   }
   const path = forwardPreviewPath(args.options.runnerId, request.port);
+  const processIdentity = guessCanonicalProcessFromCommand(request.command);
+  const processIconPath = processIdentity?.iconKey === undefined ? undefined : `/web/process-icons/${processIdentity.iconKey}.png`;
+  const processName = processIdentity?.appName ?? `Port ${request.port}`;
+  const readySummary = `${processName} on port ${request.port} is ready in Linzumi.`;
   await pushOptional(args.kandan, args.topic, "session:post_thread_message", {
     workspace: args.options.channelSession.workspaceSlug,
     channel: args.options.channelSession.channelSlug,
     thread_id: state.kandanThreadId,
-    body: `Runner port ${request.port} is open in Kandan: [Open preview](${path})`,
+    body: `${readySummary} [Open](${path})`,
     payload: {
       ...localRunnerPayload(args.options, args.instanceId, "port_forward_ready", state.codexThreadId, payloadContext),
       ...state.rootSeq === undefined ? {} : { reply_to_seq: state.rootSeq },
       structured: {
         kind: "local_runner_port_forward_ready",
         status: "ready",
-        summary: `Runner port ${request.port} is open in Kandan.`,
+        summary: readySummary,
         next_action: "Open HTTP/HTTPS/WebSocket preview",
         source_path: path,
-        link_label: "Open preview",
+        link_label: "Open",
         request_id: request.requestId,
         port: request.port,
         pid: request.pid,
         command: request.command,
+        ...processIdentity?.appName === undefined ? {} : { process_name: processIdentity.appName },
+        ...processIdentity?.iconKey === undefined ? {} : { process_icon_key: processIdentity.iconKey },
+        ...processIconPath === undefined ? {} : { process_icon_path: processIconPath },
         ...request.cwd === undefined ? {} : { cwd: request.cwd },
         url: path
       }
@@ -2087,10 +3033,15 @@ async function publishForwardPortResolvedEvent(args, request, capabilities) {
     ...capabilities === undefined ? {} : { capabilities }
   }, args.log);
 }
-async function publishMessageStateForPortForwardResult(args, state, request, status) {
+async function publishMessageStateForPortForwardResult(args, state, request, status, failedReason = "port_forward_denied") {
   if (state.kandanThreadId === undefined) {
     return;
   }
+  const activeProcessingState = state.activeProcessingState;
+  if (activeProcessingState !== undefined && activeProcessingState.seq === request.sourceSeq) {
+    await publishMessageState(args, state.kandanThreadId, request.sourceSeq, processingMessageStateFromActive(activeProcessingState), undefined, undefined, state.codexThreadId);
+    return;
+  }
   switch (status) {
     case "processed":
       await publishMessageState(args, state.kandanThreadId, request.sourceSeq, {
@@ -2100,7 +3051,7 @@ async function publishMessageStateForPortForwardResult(args, state, request, sta
     case "failed":
       await publishMessageState(args, state.kandanThreadId, request.sourceSeq, {
         status: "failed",
-        reason: "port_forward_denied"
+        reason: failedReason
       });
       break;
   }
@@ -2171,7 +3122,12 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
       actorUserId: event.actorUserId,
       actorSlug: event.actorSlug
     });
-    if (result.ok === true) {
+    if (result === undefined) {
+      await publishKandanMessageState(args, event, {
+        status: "failed",
+        reason: "port_forward_decision_missing"
+      });
+    } else if (result.ok === true) {
       await publishKandanMessageState(args, event, { status: "processed" });
     } else {
       await publishKandanMessageState(args, event, {
@@ -2201,6 +3157,7 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
       state.kandanThreadId = event.threadId;
     }
   }
+  startPortForwardWatchIfEnabled(args, state, payloadContext);
   if (event.threadId !== state.kandanThreadId) {
     args.log("kandan.message_ignored", {
       seq: event.seq,
@@ -2324,7 +3281,11 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
   if (next === undefined) {
     return;
   }
-  state.turn = { status: "starting", queuedSeq: next.seq, interruptAfterStart: false };
+  state.turn = {
+    status: "starting",
+    queuedSeq: next.seq,
+    interruptAfterStart: false
+  };
   state.activeProcessingState = { seq: next.seq, reason: "starting turn" };
   args.log("codex.turn_starting", {
     queued_seq: next.seq,
@@ -2347,10 +3308,11 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
     }
     const started = await args.codex.request("turn/start", {
       threadId: codexThreadId,
-      input: await codexInputItemsForQueuedKandanMessage(args, next),
+      input: await codexInputItemsForQueuedKandanMessage(args, next, state.pendingReconnectContextInjection),
       ...codexTurnRuntimeOverrides(runtimeOptionsForSettings(args.options, state.runtimeSettings))
     });
     const turnId = extractTurnIdFromResponse(started);
+    state.pendingReconnectContextInjection = undefined;
     const interruptAfterStart = state.turn.status === "starting" && state.turn.interruptAfterStart;
     state.turn = { status: "active", turnId, queuedSeq: next.seq };
     rememberTurnReplyTarget(state, turnId, next.seq);
@@ -2376,12 +3338,14 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
         await stopCodexTyping(args, state);
         const newCodexThreadId = await startCodexThread(args.codex, args.options);
         state.codexThreadId = newCodexThreadId;
+        await bindCurrentCodexThread(args, state);
         args.log("codex.thread_rebound", {
           kandan_thread_id: state.kandanThreadId,
           old_codex_thread_id: oldCodexThreadId ?? null,
           new_codex_thread_id: newCodexThreadId
         });
         await postCodexThreadReboundMessage(args, state, payloadContext, oldCodexThreadId, newCodexThreadId);
+        state.pendingReconnectContextInjection = await fetchReconnectContextInjection(args, state);
         requeuePendingKandanMessageFront(state.queue, next);
         state.turn = { status: "idle" };
         await drainKandanMessageQueue(args, state, payloadContext);
@@ -2407,6 +3371,26 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
     });
   }
 }
+async function fetchReconnectContextInjection(args, state) {
+  if (state.kandanThreadId === undefined) {
+    throw new Error("cannot fetch reconnect context without a Linzumi thread id");
+  }
+  const session = args.options.channelSession;
+  const reply = await pushOk(args.kandan, args.topic, "session:thread_context", {
+    workspace: session.workspaceSlug,
+    channel: session.channelSlug,
+    thread_id: state.kandanThreadId
+  });
+  const messages = parseReconnectContextMessages(reply.messages);
+  const summarizer = args.options.reconnectContextSummarizer ?? createConfiguredReconnectContextSummarizer();
+  const injection = await buildReconnectContextInjection(messages, summarizer);
+  args.log("codex.thread_reconnect_context_prepared", {
+    codex_thread_id: state.codexThreadId ?? null,
+    kandan_thread_id: state.kandanThreadId,
+    context_message_count: messages.length
+  });
+  return injection;
+}
 async function handleCodexServerRequest(args, state, payloadContext, request) {
   const params = objectValue(request.params) ?? {};
   const turnId = codexNotificationTurnId(params);
@@ -2444,35 +3428,48 @@ function codexApprovalRequestCanSurface(method) {
   return method === "item/commandExecution/requestApproval" || method === "item/fileChange/requestApproval";
 }
 async function requestKandanApproval(args, state, request, turnId, payloadContext) {
-  const sourceSeq = activeQueuedSeqForTurn(state.turn, turnId);
-  if (sourceSeq === undefined || state.kandanThreadId === undefined) {
-    const message = `Codex approval request has no active Kandan source message: ${request.method}`;
-    await failActiveCodexTurn(args, state, turnId, message, payloadContext);
-    throw new Error(message);
-  }
-  const approval = codexApprovalMessageState(request);
-  state.activeProcessingState = { seq: sourceSeq, reason: "awaiting approval", approval };
-  await publishMessageState(args, state.kandanThreadId, sourceSeq, {
-    status: "processing",
-    reason: "awaiting approval",
-    approval
-  }, undefined, undefined, state.codexThreadId);
-  args.log("codex.approval_request_pending", {
-    request_id: approval.requestId,
-    source_seq: sourceSeq,
-    turn_id: turnId,
-    method: request.method
-  });
-  return new Promise((resolve2, reject) => {
-    const request2 = {
-      requestId: approval.requestId,
-      sourceSeq,
-      turnId,
-      resolve: resolve2,
-      reject
+  const approvalResult = state.approvalPromptChain.then(async () => {
+    const sourceSeq = activeQueuedSeqForTurn(state.turn, turnId);
+    if (sourceSeq === undefined || state.kandanThreadId === undefined) {
+      const message = `Codex approval request has no active Kandan source message: ${request.method}`;
+      await failActiveCodexTurn(args, state, turnId, message, payloadContext);
+      throw new Error(message);
+    }
+    const approval = codexApprovalMessageState(request);
+    state.activeProcessingState = {
+      seq: sourceSeq,
+      reason: "awaiting approval",
+      approval
     };
-    state.pendingApprovalRequests.set(approvalRequestKey(request2.requestId, request2.sourceSeq), request2);
+    const approvalPromise = new Promise((resolve2, reject) => {
+      const pendingRequest = {
+        requestId: approval.requestId,
+        sourceSeq,
+        turnId,
+        resolve: resolve2,
+        reject
+      };
+      state.pendingApprovalRequests.set(approvalRequestKey(pendingRequest.requestId, pendingRequest.sourceSeq), pendingRequest);
+    });
+    await publishMessageState(args, state.kandanThreadId, sourceSeq, {
+      status: "processing",
+      reason: "awaiting approval",
+      approval
+    }, undefined, undefined, state.codexThreadId);
+    args.log("codex.approval_request_pending", {
+      request_id: approval.requestId,
+      source_seq: sourceSeq,
+      turn_id: turnId,
+      method: request.method
+    });
+    return approvalPromise;
   });
+  state.approvalPromptChain = approvalResult.then(() => {
+    return;
+  }, () => {
+    return;
+  });
+  return approvalResult;
 }
 function rejectPendingApprovalRequests(state, error) {
   const pendingApprovals = [...state.pendingApprovalRequests.values()];
@@ -2498,7 +3495,11 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
   const completingActiveTurn = completingQueuedSeq !== undefined;
   const completingLocalTuiTurn = isLocalTuiTurn(state, turnId);
   if (completingQueuedSeq !== undefined) {
-    state.turn = { status: "completing", turnId, queuedSeq: completingQueuedSeq };
+    state.turn = {
+      status: "completing",
+      turnId,
+      queuedSeq: completingQueuedSeq
+    };
   }
   await waitForPendingTuiInputMirror(state, turnId);
   await waitForStreamingForwardChains(args, state, payloadContext);
@@ -2860,7 +3861,10 @@ async function forwardReasoningDeltaPayload(args, state, delta, payloadContext)
     }
   } else {
     await editCodexStructuredOutput(args, state, existing.seq, nextContent, codexReasoningStructuredMessage(delta.itemKey, nextContent, "streaming"));
-    rememberStreamingReasoningOutput(state, { ...existing, content: nextContent });
+    rememberStreamingReasoningOutput(state, {
+      ...existing,
+      content: nextContent
+    });
   }
   args.log("kandan.codex_reasoning_delta_forwarded", {
     item_key: delta.itemKey,
@@ -3417,7 +4421,10 @@ function rememberLocalTuiTurnIfNeeded(args, state, threadId, turnId) {
   if (state.kandanThreadId !== undefined) {
     startCodexTypingHeartbeat(args, state, state.kandanThreadId);
   }
-  args.log("codex.tui_turn_started", { turn_id: turnId, codex_thread_id: threadId });
+  args.log("codex.tui_turn_started", {
+    turn_id: turnId,
+    codex_thread_id: threadId
+  });
 }
 function isLocalTuiTurn(state, turnId) {
   return state.localTuiTurnIds.has(turnId);
@@ -3484,7 +4491,10 @@ function clearPendingStreamFlushTimers(state) {
   clearStreamDeltaFlushTimer(state.fileChangeQueue);
 }
 function rememberTurnReplyTarget(state, turnId, replyToSeq) {
-  rememberBoundedCacheValue(state.turnReplyTargets, turnId, { turnId, replyToSeq });
+  rememberBoundedCacheValue(state.turnReplyTargets, turnId, {
+    turnId,
+    replyToSeq
+  });
 }
 function sourceMessageSeqForTurn(state, turnId) {
   return getBoundedCacheValue(state.turnReplyTargets, turnId)?.replyToSeq;
@@ -3493,20 +4503,12 @@ function fileChangePaths(structured) {
   const changes = arrayValue(structured.changes) ?? [];
   return changes.filter(isJsonObject).map((change) => stringValue(change.path) ?? "").filter((path) => path.trim() !== "");
 }
-async function postCodexThreadReboundMessage(args, state, payloadContext, oldCodexThreadId, newCodexThreadId) {
+async function postCodexThreadReboundMessage(args, state, payloadContext, _oldCodexThreadId, newCodexThreadId) {
   if (state.kandanThreadId === undefined) {
     return;
   }
   const session = args.options.channelSession;
-  const body = [
-    "Codex reconnected.",
-    "",
-    "The previous local Codex app-server thread was not available in this process, so this runner started a new local Codex thread for this Kandan thread.",
-    "",
-    `Previous Codex thread: ${oldCodexThreadId ?? "unknown"}`,
-    `New Codex thread: ${newCodexThreadId}`
-  ].join(`
-`);
+  const body = "[codex reconnected to new thread]";
   await pushOk(args.kandan, args.topic, "session:post_thread_message", {
     workspace: session.workspaceSlug,
     channel: session.channelSlug,
@@ -3641,10 +4643,19 @@ async function publishMessageState(args, threadId, seq, state, actorSlug, actorU
       approval_request_id: state.approval.requestId,
       approval_kind: state.approval.kind,
       approval_summary: state.approval.summary,
+      ...state.approval.port === undefined ? {} : { approval_port: state.approval.port },
+      ...state.approval.pid === undefined ? {} : { approval_pid: state.approval.pid },
+      ...state.approval.command === undefined ? {} : { approval_command: state.approval.command },
+      ...state.approval.cwd === undefined ? {} : { approval_cwd: state.approval.cwd },
+      ...state.approval.processName === undefined ? {} : { approval_process_name: state.approval.processName },
+      ...state.approval.processIconKey === undefined ? {} : { approval_process_icon_key: state.approval.processIconKey },
+      ...state.approval.processIconPath === undefined ? {} : { approval_process_icon_path: state.approval.processIconPath },
       ...state.approval.reason === undefined ? {} : { approval_reason: state.approval.reason },
       ...state.approval.choices === undefined ? {} : { approval_choices: state.approval.choices },
       ...state.approval.allowedActorSlug === undefined ? {} : { approval_allowed_actor_slug: state.approval.allowedActorSlug },
-      ...state.approval.allowedActorUserId === undefined ? {} : { approval_allowed_actor_user_id: state.approval.allowedActorUserId }
+      ...state.approval.allowedActorUserId === undefined ? {} : {
+        approval_allowed_actor_user_id: state.approval.allowedActorUserId
+      }
     } : {},
     ...actorSlug === undefined ? {} : { actor_slug: actorSlug },
     ...actorUserId === undefined ? {} : { actor_user_id: actorUserId }
@@ -3698,11 +4709,15 @@ function clearActiveProcessingState(state, seq) {
     state.activeProcessingState = undefined;
   }
 }
-async function codexInputItemsForQueuedKandanMessage(args, message) {
+async function codexInputItemsForQueuedKandanMessage(args, message, reconnectContextInjection = undefined) {
   const attachments = await downloadQueuedKandanAttachments(args, message);
   const text = appendDownloadedAttachmentContext(codexInputForQueuedKandanMessage(message), attachments);
   const imageItems = attachments.flatMap((attachment) => attachment.isImage ? [{ type: "localImage", path: attachment.path }] : []);
-  return [{ type: "text", text }, ...imageItems];
+  return [
+    ...reconnectContextInjection === undefined ? [] : [reconnectContextInjection],
+    { type: "text", text },
+    ...imageItems
+  ];
 }
 async function downloadQueuedKandanAttachments(args, message) {
   if (message.attachments.length === 0) {
@@ -3835,10 +4850,11 @@ async function uploadedFileIdsForCodexOutput(args, body, structured) {
       throw new Error("Kandan attachment prepare response missing upload_url");
     }
     const bytes = await readFile(file.path);
+    const uploadBody = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
     const response = await fetch(resolveKandanAttachmentUrl(args.options.kandanUrl, uploadUrl), {
       method: uploadMethod,
       headers: { "content-type": file.contentType },
-      body: bytes
+      body: uploadBody
     });
     if (!response.ok) {
       throw new Error(`Kandan attachment upload failed for ${file.fileName}: ${response.status} ${response.statusText}`);
@@ -4078,7 +5094,7 @@ function defaultCliAuditLogFile() {
   return override === undefined || override === "" ? join2(homedir(), ".linzumi", "logs", "command-events.jsonl") : override;
 }
 function redactForCliLog(value) {
-  return redactValue(value, undefined);
+  return redactObject(value);
 }
 function redactValue(value, key) {
   if (sensitiveKey(key)) {
@@ -4223,8 +5239,10 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
   const child = spawn(codexBin, args, {
     cwd,
     env: process.env,
-    stdio: ["ignore", "inherit", "inherit"]
+    stdio: ["ignore", "inherit", "inherit"],
+    detached: true
   });
+  const stop = () => stopCodexAppServerProcess(child);
   writeCliAuditEvent("process.spawned", {
     command: codexBin,
     args,
@@ -4250,33 +5268,57 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
   try {
     await waitForReadyz(url, child);
   } catch (error) {
-    child.kill("SIGINT");
+    stop();
     throw error;
   }
-  return { url, process: child };
+  return { url, process: child, stop };
+}
+function stopCodexAppServerProcess(child, killProcess = process.kill) {
+  if (child.pid !== undefined) {
+    try {
+      killProcess(-child.pid, "SIGINT");
+      return;
+    } catch (error) {
+      logProcessGroupSignalFailure(child.pid, error);
+    }
+  }
+  child.kill("SIGINT");
+}
+function logProcessGroupSignalFailure(pid, error) {
+  const code = processSignalErrorCode(error);
+  const message = error instanceof Error ? error.message : String(error);
+  const event = code === "EPERM" ? "process.group_signal_denied" : code === "ESRCH" ? "process.group_signal_missing" : "process.group_signal_failed";
+  writeCliAuditEvent(event, {
+    pid,
+    signal: "SIGINT",
+    code,
+    message,
+    fallback: "child_signal",
+    purpose: "codex.app_server"
+  });
+  if (code === "EPERM") {
+    process.stderr.write(`codex app-server process-group SIGINT denied for pid ${pid}; falling back to direct child SIGINT
+`);
+  }
+}
+function processSignalErrorCode(error) {
+  if (error !== null && typeof error === "object" && "code" in error) {
+    const code = error.code;
+    return typeof code === "string" ? code : undefined;
+  }
+  return;
 }
 function codexAppServerArgs(listenUrl, options = {}) {
-  return [
-    "app-server",
-    ...codexConfigArgs(options),
-    "--listen",
-    listenUrl
-  ];
+  return ["app-server", ...codexConfigArgs(options), "--listen", listenUrl];
 }
 function codexConfigArgs(options) {
   return [
-    ...options.model === undefined ? [] : [
-      "-c",
-      `model=${JSON.stringify(options.model)}`
-    ],
+    ...options.model === undefined ? [] : ["-c", `model=${JSON.stringify(options.model)}`],
     ...options.reasoningEffort === undefined ? [] : [
       "-c",
       `model_reasoning_effort=${JSON.stringify(options.reasoningEffort)}`
     ],
-    ...options.fast === true ? [
-      "-c",
-      `service_tier=${JSON.stringify("fast")}`
-    ] : []
+    ...options.fast === true ? ["-c", `service_tier=${JSON.stringify("fast")}`] : []
   ];
 }
 async function connectCodexAppServer(websocketUrl, socketFactory = (url) => new WebSocket(url)) {
@@ -4630,7 +5672,9 @@ async function handleForwardHttpRequest(control, allowedPorts) {
       method: control.method,
       headers: requestHeaders(control.headers),
       redirect: "manual",
-      ...bodyDecision.body === undefined ? {} : { body: bodyDecision.body }
+      ...bodyDecision.body === undefined ? {} : {
+        body: bodyDecision.body.buffer.slice(bodyDecision.body.byteOffset, bodyDecision.body.byteOffset + bodyDecision.body.byteLength)
+      }
     };
     const response = await fetchWithHttpsFallback(control.port, control.path, control.queryString, request);
     const upstreamBuffer = Buffer.from(await response.arrayBuffer());
@@ -5100,10 +6144,12 @@ function prepareCodeServerProfile(collaboration, editorRuntime) {
     const userDataDir = mkdtempSync(join4(tmpdir(), "kandan-local-editor-"));
     const extensionsDir = join4(userDataDir, "extensions");
     const collaborationServerDir = join4(userDataDir, "collaboration-server");
+    const tempDir = join4(userDataDir, "tmp");
     const userSettingsDir = join4(userDataDir, "User");
     mkdirSync3(userSettingsDir, { recursive: true });
     mkdirSync3(extensionsDir, { recursive: true });
     mkdirSync3(collaborationServerDir, { recursive: true });
+    mkdirSync3(tempDir, { recursive: true });
     if (editorRuntime !== undefined) {
       installDirectory(editorRuntime.assets.documentStateExtensionDir, join4(extensionsDir, "kandan.document-state-telemetry"));
     }
@@ -5136,6 +6182,12 @@ function prepareCodeServerLaunch(options) {
       "-p",
       codeServerSandboxProfile(options, codeServerExecutable.directory),
       "--",
+      "/bin/sh",
+      "-c",
+      'export HOME="$1"; export PWD="$1"; export TMPDIR="$2"; export TMP="$2"; export TEMP="$2"; shift 2; exec "$@"',
+      "kandan-code-server-env",
+      options.cwd,
+      join4(options.userDataDir, "tmp"),
       codeServerExecutable.command,
       ...codeServerArgs(options.port, options.cwd, options.userDataDir, options.extensionsDir)
     ]
@@ -5416,10 +6468,14 @@ function installDirectory(sourceDir, destinationDir) {
 }
 function codeServerEnv(env, cwd, userDataDir, collaboration) {
   const { PORT: _port, ...hostEnv } = env;
+  const tempDir = join4(userDataDir, "tmp");
   const base = {
     ...hostEnv,
     HOME: cwd,
     PWD: cwd,
+    TMPDIR: tempDir,
+    TMP: tempDir,
+    TEMP: tempDir,
     XDG_CACHE_HOME: join4(userDataDir, "xdg-cache"),
     XDG_CONFIG_HOME: join4(userDataDir, "xdg-config"),
     XDG_DATA_HOME: join4(userDataDir, "xdg-data")
@@ -5808,7 +6864,7 @@ async function exchangeCodeForToken(args) {
   };
 }
 function stringBodyField(body, key) {
-  const value = key in body ? body[key] : undefined;
+  const value = body[key];
   return typeof value === "string" && value.trim() !== "" ? value : undefined;
 }
 function startCallbackServer(args) {
@@ -5878,7 +6934,9 @@ function isTcpAddress(address) {
   return typeof address === "object" && address !== null && typeof address.port === "number";
 }
 function writeOauthResult(response, args) {
-  response.writeHead(args.status, { "content-type": "text/html; charset=utf-8" });
+  response.writeHead(args.status, {
+    "content-type": "text/html; charset=utf-8"
+  });
   response.end(oauthResultHtml(args));
 }
 function oauthResultHtml(args) {
@@ -6493,7 +7551,7 @@ function assertStartDependencies(status) {
     throw new Error(`Codex is not available at ${status.codex.command}. Install Codex or pass --codex-bin <path>.`);
   }
   if (status.editorRuntime?.status === "unavailable" || status.codeServer?.available === false && status.codeServer.reason !== "not_configured") {
-    throw new Error("The Kandan editor runtime is not available. Reconnect when the runtime update finishes or pass --code-server-bin <path> for a custom development runtime.");
+    throw new Error("The Linzumi editor runtime is not available. Reconnect when the runtime update finishes or pass --code-server-bin <path> for a custom development runtime.");
   }
 }
 function dependencyStatusPayload(status) {
@@ -6877,7 +7935,9 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     forwardPortAttributions.set(port, {
       kandanThreadId: attribution.kandanThreadId ?? null,
       codexThreadId: attribution.codexThreadId ?? null,
-      channelSlug: attribution.channelSlug ?? null
+      channelSlug: attribution.channelSlug ?? null,
+      processName: attribution.processName ?? null,
+      processIconKey: attribution.processIconKey ?? null
     });
   };
   const clearForwardPortAttribution = (port) => {
@@ -6889,7 +7949,9 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       port,
       kandanThreadId: attribution?.kandanThreadId ?? null,
       codexThreadId: attribution?.codexThreadId ?? null,
-      channelSlug: attribution?.channelSlug ?? null
+      channelSlug: attribution?.channelSlug ?? null,
+      processName: attribution?.processName ?? null,
+      processIconKey: attribution?.processIconKey ?? null
     };
   });
   const allowedCwds = { value: [...options.allowedCwds] };
@@ -6908,6 +7970,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     codexRemoteTui: true,
     startInstance: allowedCwds.value.length > 0,
     allowedCwds: allowedCwds.value,
+    missingConfiguredAllowedCwds: options.missingConfiguredAllowedCwds ?? [],
     allowedCwdSuggestions: allowedCwdSuggestions(options.cwd, allowedCwds.value),
     portForwarding: liveForwardPorts.size > 0,
     allowedPorts: Array.from(liveForwardPorts).sort((left, right) => left - right),
@@ -6922,7 +7985,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   const joinPayload = () => ({
     clientName: "kandan-local-codex-runner",
     version: "0.0.1",
-    workspace: options.channelSession?.workspaceSlug ?? null,
+    workspace: options.channelSession?.workspaceSlug ?? options.workspaceSlug ?? null,
     channel: options.channelSession?.channelSlug ?? null,
     capabilities: capabilitiesPayload()
   });
@@ -6940,7 +8003,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   const started = options.codexUrl === undefined ? await startOwnedCodexAppServer(options) : undefined;
   if (started !== undefined) {
     cleanup.actions.push(() => {
-      started.process.kill("SIGINT");
+      started.stop();
     });
   }
   const codexUrl = options.codexUrl ?? started?.url;
@@ -6990,6 +8053,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   cleanup.actions.push(() => codex.close());
   const seq = { value: 0 };
   const codexThreads = options.channelSession === undefined ? await discoverCodexThreads(codex, options.cwd) : [];
+  const discoveredCodexThreads = { value: codexThreads };
   const runnerHost = hostname2();
   const instancePayload = {
     instanceId,
@@ -7038,21 +8102,27 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     kandan.onReconnect(() => channelSession.handleKandanReconnect());
   }
   const dynamicChannelSessions = new Map;
+  kandan.onReconnect(() => rebindDynamicChannelSessionsOnReconnect(dynamicChannelSessions.values()));
   cleanup.actions.push(async () => {
     await Promise.all(Array.from(dynamicChannelSessions.values(), (session) => session.close()));
     dynamicChannelSessions.clear();
   });
-  const attachStartedThreadSession = async (control, cwd, codexThreadId) => {
+  const attachThreadSession = async (control, cwd, codexThreadId) => {
     const workspaceSlug = normalizedWorkDescription(control.workspace);
     const channelSlug = normalizedWorkDescription(control.channel);
     const kandanThreadId = normalizedWorkDescription(control.threadId);
-    if (workspaceSlug === undefined || channelSlug === undefined || kandanThreadId === undefined || dynamicChannelSessions.has(kandanThreadId)) {
+    if (workspaceSlug === undefined || channelSlug === undefined || kandanThreadId === undefined) {
       return;
     }
+    const existingSession = dynamicChannelSessions.get(kandanThreadId);
+    if (existingSession !== undefined) {
+      return existingSession;
+    }
     const listenUser = options.channelSession?.listenUser ?? identityFromAccessToken(options.token).actorUsername;
     if (listenUser === undefined) {
       throw new Error("missing listen user for Commander-started Codex session");
     }
+    const runtimeSettings = startInstanceRuntimeSettings(options, control);
     const session = await attachChannelSession({
       kandan,
       codex,
@@ -7085,10 +8155,10 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
           rootSeq: integerValue(control.rootSeq),
           codexThreadId,
           listenUser,
-          model: control.model,
-          reasoningEffort: control.reasoningEffort,
-          sandbox: control.sandbox,
-          approvalPolicy: control.approvalPolicy
+          model: runtimeSettings.model,
+          reasoningEffort: runtimeSettings.reasoningEffort,
+          sandbox: runtimeSettings.sandbox,
+          approvalPolicy: runtimeSettings.approvalPolicy
         }
       },
       log
@@ -7101,10 +8171,11 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     codexUrl,
     cwd: options.cwd,
     hostname: runnerHost,
-    workspace: options.channelSession?.workspaceSlug ?? null,
+    workspace: options.channelSession?.workspaceSlug ?? options.workspaceSlug ?? null,
     channel: options.channelSession?.channelSlug ?? null,
     threadId: channelSession?.currentKandanThreadId() ?? null,
     codexThreadId: channelSession?.currentCodexThreadId() ?? null,
+    codexThreads: discoveredCodexThreads.value,
     model: options.channelSession?.model ?? null,
     reasoningEffort: options.channelSession?.reasoningEffort ?? null,
     fast: options.fast ?? false,
@@ -7115,11 +8186,19 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       message: error instanceof Error ? error.message : String(error)
     });
   });
+  const refreshDiscoveredCodexThreads = () => discoverCodexThreads(codex, options.cwd).then((threads) => {
+    discoveredCodexThreads.value = threads;
+    return kandan.push(topic, "heartbeat", heartbeatPayload());
+  }).catch((error) => {
+    log("kandan.codex_threads_refresh_failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+  });
   const heartbeatInterval = setInterval(() => {
-    pushHeartbeat();
+    channelSession === undefined ? refreshDiscoveredCodexThreads() : pushHeartbeat();
   }, 15000);
   cleanup.actions.push(() => clearInterval(heartbeatInterval));
-  kandan.onReconnect(() => pushHeartbeat().then(() => {
+  kandan.onReconnect(() => (channelSession === undefined ? refreshDiscoveredCodexThreads() : pushHeartbeat()).then(() => {
     return;
   }));
   pushHeartbeat();
@@ -7153,6 +8232,9 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
         });
       });
     }
+    if (channelSession === undefined && notification.method === "thread/started") {
+      refreshDiscoveredCodexThreads();
+    }
     log("codex.notification", {
       method: notification.method,
       metadata
@@ -7264,11 +8346,35 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       pushHeartbeat();
       return;
     }
+    if (isSetPortForwardEnabledControl(control)) {
+      switch (control.enabled) {
+        case true:
+          liveForwardPorts.add(control.port);
+          break;
+        case false:
+          liveForwardPorts.delete(control.port);
+          managedForwardPorts.delete(control.port);
+          clearForwardPortAttribution(control.port);
+          kandan.push(topic, "forward_port_revoked", {
+            instanceId,
+            port: control.port,
+            reason: "user_disabled",
+            capabilities: revocationCapabilities(capabilitiesPayload(), control.port)
+          }).catch((error) => {
+            log("kandan.forward_port_revoked_push_failed", {
+              message: error instanceof Error ? error.message : String(error)
+            });
+          });
+          break;
+      }
+      pushHeartbeat();
+      return;
+    }
     resolveSessionControl(channelSession, dynamicChannelSessions, control).then((handled) => {
       if (handled !== undefined) {
         return handled;
       }
-      return applyControl(codex, kandan, topic, instanceId, options, allowedCwds.value, control, attachStartedThreadSession);
+      return applyControl(codex, kandan, topic, instanceId, options, allowedCwds.value, control, attachThreadSession);
     }).then((response) => {
       return kandan.push(topic, "codex_response", response);
     }).catch((error) => {
@@ -7333,6 +8439,8 @@ async function discoverCodexThreads(codex, cwd) {
   const data = arrayValue(result?.data);
   return data === undefined ? [] : data.filter(isJsonObject).map((thread) => ({
     id: stringValue(thread.id) ?? "",
+    title: stringValue(thread.title) ?? stringValue(thread.name) ?? stringValue(thread.preview) ?? "",
+    description: stringValue(thread.description) ?? stringValue(thread.summary) ?? stringValue(thread.preview) ?? "",
     preview: stringValue(thread.preview) ?? "",
     cwd: stringValue(thread.cwd) ?? "",
     source: stringValue(thread.source) ?? "",
@@ -7408,6 +8516,9 @@ function launchCodexTui(codexBin, codexUrl, cwd, codexThreadId, session, fast) {
   });
   return child;
 }
+async function rebindDynamicChannelSessionsOnReconnect(sessions) {
+  await Promise.all(Array.from(sessions, (session) => session.handleKandanReconnect()));
+}
 function forwardedHeaderValue(headers, name) {
   if (!Array.isArray(headers)) {
     return;
@@ -7465,6 +8576,7 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
         ensureCodexProjectTrusted(cwd.cwd);
       }
       const developerPrompt = normalizedWorkDescription(control.developerPrompt);
+      const runtimeSettings = startInstanceRuntimeSettings(options, control);
       const response = await codex.request("thread/start", {
         cwd: cwd.cwd,
         serviceName: "kandan-local-runner",
@@ -7473,11 +8585,11 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
           cwd: cwd.cwd,
           developerPrompt
         }),
-        ...control.model === undefined ? {} : { model: control.model },
-        ...control.reasoningEffort === undefined ? {} : { reasoningEffort: control.reasoningEffort },
-        ...control.approvalPolicy === undefined ? {} : { approvalPolicy: control.approvalPolicy },
-        ...control.sandbox === undefined ? {} : { sandbox: control.sandbox },
-        ...control.fast === true ? { serviceTier: "fast" } : {}
+        ...runtimeSettings.model === undefined ? {} : { model: runtimeSettings.model },
+        ...runtimeSettings.reasoningEffort === undefined ? {} : { reasoningEffort: runtimeSettings.reasoningEffort },
+        ...runtimeSettings.approvalPolicy === undefined ? {} : { approvalPolicy: runtimeSettings.approvalPolicy },
+        ...runtimeSettings.sandbox === undefined ? {} : { sandbox: runtimeSettings.sandbox },
+        ...runtimeSettings.fast === true ? { serviceTier: "fast" } : {}
       });
       const codexThreadId = extractStartedThreadId(response);
       const workDescription = normalizedWorkDescription(control.workDescription);
@@ -7487,10 +8599,11 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
       const startedThreadSession = codexThreadId !== undefined && onStartedThread !== undefined ? await onStartedThread(control, cwd.cwd, codexThreadId) : undefined;
       if (codexThreadId !== undefined && workDescription !== undefined) {
         const rootSeq = integerValue(control.rootSeq);
-        if (startedThreadSession !== undefined && rootSeq !== undefined) {
+        const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
+        if (startedThreadSession !== undefined && sourceSeq !== undefined) {
           const identity = identityFromAccessToken(options.token);
           await startedThreadSession.startThreadMessageTurn({
-            seq: rootSeq,
+            seq: sourceSeq,
             body: workDescription,
             actorSlug: identity.actorUsername,
             actorUserId: identity.actorUserId
@@ -7510,6 +8623,52 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
         response
       };
     }
+    case "reconnect_thread": {
+      const cwd = resolveAllowedCwd(control.cwd, allowedCwds);
+      if (!cwd.ok) {
+        return {
+          instanceId,
+          controlType: control.type,
+          ok: false,
+          error: cwd.reason
+        };
+      }
+      if (options.codexUrl === undefined) {
+        ensureCodexProjectTrusted(cwd.cwd);
+      }
+      const codexThreadId = normalizedWorkDescription(control.codexThreadId);
+      if (codexThreadId === undefined) {
+        return {
+          instanceId,
+          controlType: control.type,
+          ok: false,
+          error: "missing_codex_thread_id"
+        };
+      }
+      const workDescription = normalizedWorkDescription(control.workDescription);
+      const startedThreadSession = onStartedThread === undefined ? undefined : await onStartedThread(control, cwd.cwd, codexThreadId);
+      if (workDescription !== undefined) {
+        const rootSeq = integerValue(control.rootSeq);
+        const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
+        if (startedThreadSession === undefined || sourceSeq === undefined) {
+          throw new Error("cannot reconnect a Kandan thread without a session");
+        }
+        const identity = identityFromAccessToken(options.token);
+        await startedThreadSession.startThreadMessageTurn({
+          seq: sourceSeq,
+          body: workDescription,
+          actorSlug: identity.actorUsername,
+          actorUserId: identity.actorUserId
+        });
+      }
+      return {
+        instanceId,
+        controlType: control.type,
+        cwd: cwd.cwd,
+        matchedRoot: cwd.matchedRoot,
+        codexThreadId
+      };
+    }
     case "start_turn": {
       const response = await codex.request("turn/start", {
         threadId: control.threadId,
@@ -7560,6 +8719,8 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
     case "interrupt_queued_messages":
     case "resolve_codex_approval_request":
     case "resolve_port_forward_request":
+    case "update_session_settings":
+    case "set_port_forward_enabled":
     case "forward_http_request":
     case "forward_websocket_open":
     case "forward_websocket_send":
@@ -7649,6 +8810,16 @@ ${developerPrompt}`,
     client_message_id: `codex-start-instructions-${threadId}`
   });
 }
+function startInstanceRuntimeSettings(options, control) {
+  const session = options.channelSession;
+  return {
+    model: control.model ?? session?.model,
+    reasoningEffort: control.reasoningEffort ?? session?.reasoningEffort,
+    approvalPolicy: control.approvalPolicy ?? session?.approvalPolicy,
+    sandbox: control.sandbox ?? session?.sandbox,
+    fast: control.fast ?? options.fast
+  };
+}
 async function startOwnedCodexAppServer(options) {
   ensureCodexProjectTrusted(options.cwd);
   return await startCodexAppServer(options.codexBin, options.cwd, {
@@ -7660,6 +8831,9 @@ async function startOwnedCodexAppServer(options) {
 function isUpdateRunnerConfigControl(control) {
   return control.type === "update_runner_config";
 }
+function isSetPortForwardEnabledControl(control) {
+  return control.type === "set_port_forward_enabled" && Number.isInteger(control.port) && control.port > 0 && control.port <= 65535;
+}
 function normalizeAllowedCwds(values) {
   return Array.from(new Set(values.flatMap((value) => {
     const normalized = value.trim();
@@ -7810,7 +8984,13 @@ async function acquireAndCacheToken(args) {
 }
 
 // src/localConfig.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, realpathSync as realpathSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import {
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync4,
+  realpathSync as realpathSync4,
+  writeFileSync as writeFileSync5
+} from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { dirname as dirname5, resolve as resolve5 } from "node:path";
 function localConfigPath(env = process.env) {
@@ -7830,14 +9010,22 @@ function readLocalConfig(path = localConfigPath()) {
     allowedCwds: uniqueStrings(parsed.allowedCwds)
   };
 }
-function readConfiguredAllowedCwds(path = localConfigPath()) {
-  return readLocalConfig(path).allowedCwds.map((cwd) => {
+function readConfiguredAllowedCwdState(path = localConfigPath()) {
+  const allowedCwds = [];
+  const missingCwds = [];
+  for (const cwd of readLocalConfig(path).allowedCwds) {
     try {
-      return realpathSync4(resolve5(expandUserPath(cwd)));
+      const absolutePath = resolve5(expandUserPath(cwd));
+      const realPath = realpathSync4(absolutePath);
+      allowedCwds.push(...realPath === absolutePath ? [realPath] : [realPath, absolutePath]);
     } catch (_error) {
-      throw new Error(`invalid Linzumi config allowed path: ${cwd} does not exist`);
+      missingCwds.push(cwd);
     }
-  });
+  }
+  return {
+    allowedCwds: uniqueStrings(allowedCwds),
+    missingCwds: uniqueStrings(missingCwds)
+  };
 }
 function addAllowedCwd(pathValue, path = localConfigPath()) {
   const normalizedPath = realpathSync4(resolve5(expandUserPath(pathValue)));
@@ -7866,7 +9054,9 @@ function isConfigPayload(value) {
   return typeof value === "object" && value !== null && value.version === 1 && Array.isArray(value.allowedCwds) && value.allowedCwds.every((cwd) => typeof cwd === "string" && cwd.trim() !== "");
 }
 function uniqueStrings(values) {
-  return [...new Set(values.map((value) => value.trim()).filter((value) => value !== ""))];
+  return [
+    ...new Set(values.map((value) => value.trim()).filter((value) => value !== ""))
+  ];
 }
 function realpathOrResolved(pathValue) {
   try {
@@ -9382,7 +10572,9 @@ function readProcessIdentity(pid) {
     if (match === null) {
       return { command: output };
     }
-    return { startedAt: match[1], command: match[2] };
+    const startedAt = match[1];
+    const processCommand = match[2];
+    return startedAt === undefined || processCommand === undefined ? { command: output } : { startedAt, command: processCommand };
   } catch (_error) {
     return;
   }
@@ -9495,7 +10687,7 @@ async function main(args) {
       process.stdout.write(connectGuideText());
       return;
     case "version":
-      process.stdout.write(`linzumi 0.0.37-beta
+      process.stdout.write(`linzumi 0.0.39-beta
 `);
       return;
     case "auth":
@@ -9589,12 +10781,17 @@ function runHelloCommand(args) {
     process.stdout.write(helloHelpText());
     return;
   }
+  const rootPath = stringValue3(values, "dir");
+  const parentDir = stringValue3(values, "parent-dir");
+  const name = stringValue3(values, "name");
+  const port = tcpPortValue(values, "port");
+  const host = stringValue3(values, "host");
   const project = createHelloLinzumiProject({
-    rootPath: stringValue3(values, "dir"),
-    parentDir: stringValue3(values, "parent-dir") === undefined ? undefined : resolveUserPath(required(values, "parent-dir")),
-    name: stringValue3(values, "name"),
-    port: tcpPortValue(values, "port"),
-    host: stringValue3(values, "host"),
+    ...rootPath === undefined ? {} : { rootPath },
+    ...parentDir === undefined ? {} : { parentDir: resolveUserPath(parentDir) },
+    ...name === undefined ? {} : { name },
+    ...port === undefined ? {} : { port },
+    ...host === undefined ? {} : { host },
     reset: values.get("reset") === true
   });
   if (values.get("json") === true) {
@@ -9875,12 +11072,13 @@ async function parseAgentRunnerArgs(args, deps = {
   }
   const tokenFilePath = stringValue3(values, "agent-token-file") ?? defaultAgentTokenFilePath();
   const tokenFile = readStoredAgentTokenFile(tokenFilePath, deps.readTextFile);
-  const channelSlug = requiredStoredAgentChannel(tokenFile.channelId);
-  const listenUser = stringValue3(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername);
+  const channelSlug = tokenFile.channelId;
+  const listenUser = channelSlug === undefined ? undefined : stringValue3(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername);
   const kandanUrl = stringValue3(values, "linzumi-url") ?? agentApiUrlToKandanUrl(tokenFile.apiUrl);
   const requestedCwdValue = cwdArg ?? stringValue3(values, "cwd");
   const requestedCwd = resolveUserPath(requestedCwdValue ?? process.cwd());
-  const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : requestedCwdValue === undefined ? readConfiguredAllowedCwds() : assertConfiguredAllowedCwds([requestedCwd]);
+  const configuredAllowedCwdState = values.has("allowed-cwd") || requestedCwdValue !== undefined ? { allowedCwds: [], missingCwds: [] } : readConfiguredAllowedCwdState();
+  const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : requestedCwdValue === undefined ? configuredAllowedCwdState.allowedCwds : assertConfiguredAllowedCwds([requestedCwd]);
   const cwd = allowedCwds[0] ?? requestedCwd;
   const codexBin = stringValue3(values, "codex-bin") ?? "codex";
   const customCodeServerBin = stringValue3(values, "code-server-bin");
@@ -9914,12 +11112,14 @@ async function parseAgentRunnerArgs(args, deps = {
     fast: values.get("fast") === true,
     logFile: stringValue3(values, "log-file"),
     allowedCwds,
+    missingConfiguredAllowedCwds: configuredAllowedCwdState.missingCwds,
     allowedForwardPorts: parseAllowedPortList(stringValue3(values, "forward-port")),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
     socketFactory: trustedWebSocketFactory(kandanTlsTrustFromEnv()),
     dependencyStatus,
-    channelSession: {
+    workspaceSlug: tokenFile.workspaceId,
+    channelSession: channelSlug === undefined || listenUser === undefined ? undefined : {
       workspaceSlug: tokenFile.workspaceId,
       channelSlug,
       kandanThreadId: stringValue3(values, "linzumi-thread-id"),
@@ -9947,12 +11147,6 @@ function rejectAgentRunnerTargetingFlags(values) {
     throw new Error(`linzumi commander uses the claimed human Commander token scope; remove ${unsupportedFlags.map((flag) => `--${flag}`).join(", ")}.`);
   }
 }
-function requiredStoredAgentChannel(channelId) {
-  if (channelId !== undefined) {
-    return channelId;
-  }
-  throw new Error("agent token file is missing channelId; rerun linzumi claim before starting a Commander");
-}
 function requiredStoredOwnerUsername(ownerUsername) {
   if (ownerUsername !== undefined) {
     return ownerUsername;
@@ -10009,7 +11203,7 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   if (values.get("version") === true) {
-    process.stdout.write(`linzumi 0.0.37-beta
+    process.stdout.write(`linzumi 0.0.39-beta
 `);
     process.exit(0);
   }
@@ -10017,7 +11211,10 @@ async function parseRunnerArgs(args, deps = {
   const kandanUrl = required(values, "linzumi-url");
   const cwd = stringValue3(values, "cwd") ?? process.cwd();
   const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
-  const configuredAllowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : readConfiguredAllowedCwds();
+  const configuredAllowedCwdState = values.has("allowed-cwd") ? {
+    allowedCwds: assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))),
+    missingCwds: []
+  } : readConfiguredAllowedCwdState();
   const codexBin = stringValue3(values, "codex-bin") ?? "codex";
   const customCodeServerBin = stringValue3(values, "code-server-bin");
   const explicitToken = stringValue3(values, "token");
@@ -10057,12 +11254,14 @@ async function parseRunnerArgs(args, deps = {
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
     logFile: stringValue3(values, "log-file"),
-    allowedCwds: Array.from(new Set([...cwdAllowedCwds, ...configuredAllowedCwds])),
+    allowedCwds: Array.from(new Set([...cwdAllowedCwds, ...configuredAllowedCwdState.allowedCwds])),
+    missingConfiguredAllowedCwds: configuredAllowedCwdState.missingCwds,
     allowedForwardPorts: parseAllowedPortList(stringValue3(values, "forward-port")),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
     socketFactory: trustedWebSocketFactory(kandanTlsTrustFromEnv()),
     dependencyStatus,
+    workspaceSlug: channelSession?.workspaceSlug ?? singleWorkspaceScopeFromAccessToken(token),
     channelSession
   };
 }