@linzumi/cli 0.0.38-beta → 0.0.40-beta

package/dist/index.js

@@ -1,15 +1,16 @@
 // src/index.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync9, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, realpathSync as realpathSync6 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/runner.ts
 import { spawn as spawn6 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
+import { realpathSync as realpathSync4 } from "node:fs";
 import { hostname as hostname2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join6, resolve as resolve5 } from "node:path";
 
 // src/channelSessionSupport.ts
 import { spawnSync } from "node:child_process";
@@ -149,19 +150,34 @@ function senderAllowed(listenUser, event, runnerIdentity) {
   return runnerIdentity.actorUsername?.toLocaleLowerCase() === normalized && runnerIdentity.actorUserId !== undefined && event.actorUserId === runnerIdentity.actorUserId;
 }
 function identityFromAccessToken(token) {
+  const decoded = decodeAccessTokenPayload(token);
+  if (decoded === undefined) {
+    return { actorUserId: undefined, actorUsername: undefined };
+  }
+  const actorUserId = integerValue(decoded.actor_id) ?? integerValue(decoded.sub);
+  return {
+    actorUserId,
+    actorUsername: stringValue(decoded.actor_username)
+  };
+}
+function singleWorkspaceScopeFromAccessToken(token) {
+  const decoded = decodeAccessTokenPayload(token);
+  const workspaceScope = (arrayValue(decoded?.workspace_scope) ?? []).flatMap((value) => {
+    const workspace = stringValue(value)?.trim();
+    return workspace === undefined || workspace === "" ? [] : [workspace];
+  });
+  return workspaceScope.length === 1 ? workspaceScope[0] : undefined;
+}
+function decodeAccessTokenPayload(token) {
   const [, payload] = token.split(".");
   if (payload === undefined) {
-    return { actorUserId: undefined, actorUsername: undefined };
+    return;
   }
   try {
     const decoded = JSON.parse(Buffer.from(base64UrlToBase64(payload), "base64").toString("utf8"));
-    const actorUserId = integerValue(decoded.actor_id) ?? integerValue(decoded.sub);
-    return {
-      actorUserId,
-      actorUsername: stringValue(decoded.actor_username)
-    };
+    return isJsonObject(decoded) ? decoded : undefined;
   } catch (_error) {
-    return { actorUserId: undefined, actorUsername: undefined };
+    return;
   }
 }
 function detectCodexVersion(codexBin, cwd) {
@@ -801,6 +817,203 @@ function fuseQueuedMessages(selected) {
   };
 }
 
+// src/reconnectContext.ts
+var recentVerbatimMessageCount = 5;
+var reconnectContextModel = "openai/gpt-oss-120b";
+var noiseLocalRunnerEventTypes = new Set([
+  "availability",
+  "port_forward_requested",
+  "port_forward_ready",
+  "port_forward_resolved",
+  "settings",
+  "status",
+  "local_runner_config_seeded",
+  "local_runner_config_updated"
+]);
+function parseReconnectContextMessages(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.flatMap(messageFromWirePayload);
+}
+function filterReconnectContextMessages(messages) {
+  return messages.filter((message) => {
+    const trimmed = message.body.trim();
+    if (trimmed === "") {
+      return false;
+    }
+    if (message.actorKind === "system") {
+      return false;
+    }
+    const eventType = localRunnerEventType2(message.payload);
+    if (eventType !== undefined && eventType !== "codex_output") {
+      return false;
+    }
+    if (looksLikeLegacyRunnerNoise(message)) {
+      return false;
+    }
+    return true;
+  });
+}
+async function buildReconnectContextInjection(messages, summarizer = createConfiguredReconnectContextSummarizer()) {
+  const filtered = filterReconnectContextMessages(messages);
+  if (filtered.length === 0) {
+    throw new Error("durable Linzumi thread history did not include user-visible context");
+  }
+  const older = filtered.slice(0, Math.max(0, filtered.length - recentVerbatimMessageCount));
+  const recent = filtered.slice(-recentVerbatimMessageCount);
+  const summary = older.length === 0 ? undefined : await summarizeOlderReconnectContext(older, summarizer);
+  const sections = [
+    "Reconnected Linzumi thread context",
+    "",
+    "The local Codex app-server thread was restarted, so this durable Linzumi thread history is being injected before retrying the latest user message.",
+    "",
+    ...summary === undefined ? [] : ["Summary of earlier messages:", summary, ""],
+    "Last five user-visible messages verbatim:",
+    recent.map(formatReconnectContextMessage).join(`
+
+---
+
+`)
+  ];
+  return { type: "text", text: sections.join(`
+`) };
+}
+function createConfiguredReconnectContextSummarizer(fetchImpl = globalThis.fetch) {
+  return {
+    summarize: (messages) => summarizeWithOpenAiCompatibleProvider(fetchImpl, messages)
+  };
+}
+async function summarizeOlderReconnectContext(messages, summarizer) {
+  const summary = (await summarizer.summarize(messages)).trim();
+  if (summary === "") {
+    throw new Error("reconnect context summarizer returned an empty summary");
+  }
+  return summary;
+}
+async function summarizeWithOpenAiCompatibleProvider(fetchImpl, messages) {
+  const provider = configuredReconnectContextProvider();
+  if (provider === undefined) {
+    throw new Error("Reconnect context summarization requires LINZUMI_RECONNECT_CONTEXT_API_KEY, GROQ_API_KEY, or OPENROUTER_API_KEY");
+  }
+  const model = envString("LINZUMI_RECONNECT_CONTEXT_MODEL") ?? envString("KANDAN_AGENT_PROGRESS_SUMMARY_MODEL") ?? reconnectContextModel;
+  const response = await fetchImpl(`${provider.baseUrl.replace(/\/$/, "")}/chat/completions`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${provider.apiKey}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      model,
+      temperature: 0,
+      messages: [
+        {
+          role: "system",
+          content: "Summarize durable Linzumi thread history for a restarted local Codex coding agent. Preserve concrete user requests, constraints, file/module names, and decisions. Do not mention local runner availability, reconnect status, or port-forward noise."
+        },
+        {
+          role: "user",
+          content: messages.map(formatReconnectContextMessage).join(`
+
+---
+
+`)
+        }
+      ]
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`reconnect context summarization failed: ${response.status} ${response.statusText}`);
+  }
+  const parsed = await response.json();
+  if (!isJsonObject(parsed)) {
+    throw new Error("reconnect context summarizer returned non-object JSON");
+  }
+  const choices = parsed.choices;
+  if (!Array.isArray(choices)) {
+    throw new Error("reconnect context summarizer response did not include choices");
+  }
+  const first = choices.find(isJsonObject);
+  const message = objectValue(first?.message);
+  const content = stringValue(message?.content)?.trim();
+  if (content === undefined || content === "") {
+    throw new Error("reconnect context summarizer response did not include message content");
+  }
+  return content;
+}
+function configuredReconnectContextProvider() {
+  const linzumiApiKey = envString("LINZUMI_RECONNECT_CONTEXT_API_KEY");
+  if (linzumiApiKey !== undefined) {
+    return {
+      apiKey: linzumiApiKey,
+      baseUrl: envString("LINZUMI_RECONNECT_CONTEXT_BASE_URL") ?? "https://api.groq.com/openai/v1"
+    };
+  }
+  const groqApiKey = envString("GROQ_API_KEY");
+  if (groqApiKey !== undefined) {
+    return {
+      apiKey: groqApiKey,
+      baseUrl: envString("GROQ_BASE_URL") ?? "https://api.groq.com/openai/v1"
+    };
+  }
+  const openRouterApiKey = envString("OPENROUTER_API_KEY");
+  if (openRouterApiKey !== undefined) {
+    return {
+      apiKey: openRouterApiKey,
+      baseUrl: envString("OPENROUTER_BASE_URL") ?? "https://openrouter.ai/api/v1"
+    };
+  }
+  return;
+}
+function messageFromWirePayload(value) {
+  if (!isJsonObject(value)) {
+    return [];
+  }
+  const seq = integerValue(value.seq);
+  const payload = objectValue(value.payload) ?? {};
+  const body = stringValue(value.body) ?? stringValue(payload.body) ?? stringValue(payload.text);
+  const type = stringValue(value.type) ?? "thread.message";
+  if (seq === undefined || body === undefined) {
+    return [];
+  }
+  const actor = objectValue(value.actor) ?? {};
+  return [
+    {
+      seq,
+      type,
+      actorKind: stringValue(actor.kind) ?? "unknown",
+      actorSlug: stringValue(actor.slug),
+      actorUserId: integerValue(value.actor_user_id),
+      body,
+      payload
+    }
+  ];
+}
+function formatReconnectContextMessage(message) {
+  const sender = message.actorSlug?.trim() === "" || message.actorSlug === undefined ? message.actorKind : message.actorSlug;
+  const userId = message.actorUserId === undefined ? "unknown" : message.actorUserId.toString();
+  return [
+    `Linzumi durable message seq=${message.seq} from ${sender} (kind=${message.actorKind}, user_id=${userId}):`,
+    "",
+    message.body
+  ].join(`
+`);
+}
+function localRunnerEventType2(payload) {
+  const metadata = objectValue(payload.metadata);
+  const localRunner = objectValue(metadata?.local_codex_runner);
+  const eventType = stringValue(localRunner?.event_type);
+  return eventType === undefined || eventType.trim() === "" ? undefined : eventType.trim();
+}
+function looksLikeLegacyRunnerNoise(message) {
+  const body = message.body.trim();
+  return body.startsWith("Codex reconnected.") || body.startsWith("[codex reconnected") || body.startsWith("Codex is ready.") || /^Runner port \d+ is open in (Kandan|Linzumi):/.test(body) || /^.+ on port \d+ is ready in Linzumi\. \[Open\]\(/.test(body);
+}
+function envString(name) {
+  const value = process.env[name];
+  return value === undefined || value.trim() === "" ? undefined : value.trim();
+}
+
 // src/localCodexMessageState.ts
 function codexApprovalMessageState(request) {
   const params = objectValue(request.params) ?? {};
@@ -843,7 +1056,11 @@ function processingReasonForCodexNotification(method, params) {
 function processingMessageStateFromActive(state) {
   switch (state.reason) {
     case "awaiting approval":
-      return { status: "processing", reason: state.reason, approval: state.approval };
+      return {
+        status: "processing",
+        reason: state.reason,
+        approval: state.approval
+      };
     case "starting turn":
     case "streaming response":
     case "running terminal command":
@@ -1151,14 +1368,17 @@ var defaultIntervalMs = 2000;
 var defaultDebounceMs = 750;
 function startPortForwardWatcher(options) {
   const rootPid = options.rootPid ?? process.pid;
+  const rootCwd = normalizeCwd(options.rootCwd);
   const intervalMs = options.intervalMs ?? defaultIntervalMs;
   const debounceMs = options.debounceMs ?? defaultDebounceMs;
+  const lostDebounceMs = options.lostDebounceMs ?? intervalMs * 2 + debounceMs;
   const scanProcesses = options.scanProcesses ?? readProcessRows;
   const scanListenSockets = options.scanListenSockets ?? readListenSocketRows;
   const scanProcessCwds = options.scanProcessCwds ?? readProcessCwdRows;
   const nowMs = options.nowMs ?? Date.now;
   const candidateStabilityByPort = new Map;
   const emittedByPort = new Map;
+  const missingByPort = new Map;
   const inFlight = { value: false };
   const scan = () => {
     if (inFlight.value) {
@@ -1168,18 +1388,26 @@ function startPortForwardWatcher(options) {
     Promise.resolve().then(async () => {
       const descendants = descendantPidSet(scanProcesses(), rootPid);
       const sockets = scanListenSockets();
-      const candidatePids = sockets.filter((socket) => descendants.has(socket.pid)).map((socket) => socket.pid);
-      const candidates = detectedForwardCandidates(sockets, descendants, scanProcessCwds(candidatePids));
-      const stable = stableForwardCandidates(candidateStabilityByPort, candidates, nowMs(), debounceMs);
-      const changes = changedForwardCandidates(emittedByPort, stable.stableCandidates);
+      const candidatePids = rootCwd === undefined ? sockets.filter((socket) => descendants.has(socket.pid)).map((socket) => socket.pid) : sockets.map((socket) => socket.pid);
+      const candidates = detectedForwardCandidates(sockets, descendants, scanProcessCwds(candidatePids), { rootCwd });
+      const scanTimeMs = nowMs();
+      const stable = stableForwardCandidates(candidateStabilityByPort, candidates, scanTimeMs, debounceMs);
+      const changes = debouncedForwardCandidateChanges(emittedByPort, missingByPort, stable.stableCandidates, scanTimeMs, lostDebounceMs);
       candidateStabilityByPort.clear();
       emittedByPort.clear();
+      missingByPort.clear();
       for (const [port, observed] of stable.nextObservedByPort) {
         candidateStabilityByPort.set(port, observed);
       }
       for (const [port, candidate] of changes.nextObservedByPort) {
         emittedByPort.set(port, candidate);
       }
+      for (const [port, missing] of changes.nextMissingByPort) {
+        missingByPort.set(port, missing);
+      }
+      for (const candidate of changes.lostCandidates) {
+        await options.onCandidateLost?.(candidate);
+      }
       for (const candidate of changes.changedCandidates) {
         await options.onCandidate(candidate);
       }
@@ -1195,9 +1423,11 @@ function startPortForwardWatcher(options) {
     close: () => clearInterval(interval)
   };
 }
-function changedForwardCandidates(previousObservedByPort, candidates) {
+function debouncedForwardCandidateChanges(previousObservedByPort, previousMissingByPort, candidates, nowMs, lostDebounceMs) {
   const nextObservedByPort = new Map;
+  const nextMissingByPort = new Map;
   const changedCandidates = [];
+  const lostCandidates = [];
   for (const candidate of candidates) {
     nextObservedByPort.set(candidate.port, candidate);
     const previous = previousObservedByPort.get(candidate.port);
@@ -1205,7 +1435,28 @@ function changedForwardCandidates(previousObservedByPort, candidates) {
       changedCandidates.push(candidate);
     }
   }
-  return { nextObservedByPort, changedCandidates };
+  for (const previous of previousObservedByPort.values()) {
+    if (nextObservedByPort.has(previous.port)) {
+      continue;
+    }
+    const previousMissing = previousMissingByPort.get(previous.port);
+    const firstMissingAtMs = previousMissing !== undefined && sameForwardCandidate(previousMissing.candidate, previous) ? previousMissing.firstMissingAtMs : nowMs;
+    if (lostDebounceMs <= 0 || nowMs - firstMissingAtMs >= lostDebounceMs) {
+      lostCandidates.push(previous);
+      continue;
+    }
+    nextObservedByPort.set(previous.port, previous);
+    nextMissingByPort.set(previous.port, {
+      candidate: previous,
+      firstMissingAtMs
+    });
+  }
+  return {
+    nextObservedByPort,
+    nextMissingByPort,
+    changedCandidates,
+    lostCandidates
+  };
 }
 function stableForwardCandidates(previousObservedByPort, candidates, nowMs, debounceMs) {
   const nextObservedByPort = new Map;
@@ -1242,8 +1493,17 @@ function descendantPidSet(rows, rootPid) {
   }
   return descendants;
 }
-function detectedForwardCandidates(sockets, descendantPids, processCwds = new Map) {
-  return sockets.filter((socket) => descendantPids.has(socket.pid)).filter((socket) => socket.port > 0 && socket.port < 65536).sort((left, right) => left.port - right.port).map((socket) => {
+function detectedForwardCandidates(sockets, descendantPids, processCwds = new Map, options = {}) {
+  const rootCwd = normalizeCwd(options.rootCwd);
+  return sockets.filter((socket) => {
+    if (descendantPids.has(socket.pid)) {
+      return true;
+    }
+    if (rootCwd === undefined) {
+      return false;
+    }
+    return cwdMatchesRoot(processCwds.get(socket.pid), rootCwd);
+  }).filter((socket) => socket.port > 0 && socket.port < 65536).sort((left, right) => left.port - right.port).map((socket) => {
     const cwd = processCwds.get(socket.pid);
     return {
       port: socket.port,
@@ -1253,6 +1513,20 @@ function detectedForwardCandidates(sockets, descendantPids, processCwds = new Ma
     };
   });
 }
+function normalizeCwd(cwd) {
+  if (cwd === undefined) {
+    return;
+  }
+  const normalized = cwd.trim().replace(/\/+$/, "");
+  return normalized === "" ? undefined : normalized;
+}
+function cwdMatchesRoot(candidateCwd, rootCwd) {
+  const normalizedCandidate = normalizeCwd(candidateCwd);
+  if (normalizedCandidate === undefined) {
+    return false;
+  }
+  return normalizedCandidate === rootCwd || normalizedCandidate.startsWith(`${rootCwd}/`);
+}
 function parseProcessRows(output) {
   return output.split(`
 `).map((line) => line.trim()).filter((line) => line !== "").map((line) => {
@@ -1329,7 +1603,9 @@ function readProcessRows() {
   return parseProcessRows(result.stdout);
 }
 function readListenSocketRows() {
-  const result = spawnSync2("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-FpPcn"], { encoding: "utf8" });
+  const result = spawnSync2("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-FpPcn"], {
+    encoding: "utf8"
+  });
   if (result.error !== undefined) {
     throw result.error;
   }
@@ -1430,22 +1706,6 @@ function approvedTargetFromRequest(request) {
 function portForwardPromptLabel(candidate) {
   return commandLabel(candidate.command);
 }
-function portForwardPromptBody(candidate, requestId) {
-  const label = portForwardPromptLabel(candidate);
-  const cwdLine = candidate.cwd === undefined ? undefined : `Working directory: ${candidate.cwd}`;
-  return [
-    `Detected ${label} listening from a descendant process.`,
-    `Port: ${candidate.port}`,
-    `PID: ${candidate.pid}`,
-    `Command: ${candidate.command}`,
-    ...cwdLine === undefined ? [] : [cwdLine],
-    "Kandan can open this as an authenticated HTTP, HTTPS, or WebSocket preview. It does not expose arbitrary TCP or UDP protocols.",
-    "Open this preview in Kandan?",
-    "",
-    `Fallback commands: ${portForwardDecisionCommand("approve", requestId)} or ${portForwardDecisionCommand("deny", requestId)}`
-  ].join(`
-`);
-}
 function portForwardPromptReason(candidate) {
   return [
     `Port ${candidate.port}`,
@@ -1455,15 +1715,16 @@ function portForwardPromptReason(candidate) {
     "preview protocols: HTTP, HTTPS, WebSocket"
   ].join(" / ");
 }
-function portForwardDecisionCommand(decision, requestId) {
-  return `/kandan ${decision}-port-forward ${requestId}`;
-}
 function forwardPreviewPath(runnerId, port) {
   return `/local-codex-runners/${encodeURIComponent(runnerId)}/forwards/${port}/preview`;
 }
 function revocationCapabilities(capabilities, port) {
+  const existingAllowedPorts = Array.isArray(capabilities?.allowedPorts) ? capabilities.allowedPorts.filter((value) => typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535) : [];
+  const allowedPorts = existingAllowedPorts.filter((allowedPort) => allowedPort !== port);
   return {
     ...capabilities ?? {},
+    portForwarding: allowedPorts.length > 0,
+    allowedPorts,
     revokedPorts: [port]
   };
 }
@@ -1474,6 +1735,608 @@ function isInternalCodexProcess(candidate) {
   return commandLabel(candidate.command) === "codex";
 }
 
+// src/processNameCatalog.ts
+var processCatalogEntries = [
+  { appName: "Bun", iconKey: "bun", names: ["bun", "bunx"] },
+  {
+    appName: "Node.js",
+    iconKey: "nodejs",
+    names: ["node", "nodejs", "node.exe"]
+  },
+  { appName: "npm", iconKey: "npm", names: ["npm", "npm-cli.js", "npx"] },
+  { appName: "pnpm", iconKey: "pnpm", names: ["pnpm", "pnpx"] },
+  { appName: "Yarn", iconKey: "yarn", names: ["yarn", "yarnpkg", "yarn.js"] },
+  { appName: "Corepack", iconKey: "corepack", names: ["corepack"] },
+  { appName: "Deno", iconKey: "deno", names: ["deno"] },
+  { appName: "Vite", iconKey: "vite", names: ["vite", "vite-node"] },
+  { appName: "Vitest", iconKey: "vitest", names: ["vitest"] },
+  { appName: "Next.js", iconKey: "nextjs", names: ["next", "next-server"] },
+  { appName: "Nuxt", iconKey: "nuxt", names: ["nuxt", "nuxi"] },
+  { appName: "Astro", iconKey: "astro", names: ["astro"] },
+  {
+    appName: "SvelteKit",
+    iconKey: "svelte",
+    names: ["svelte-kit", "sveltekit"]
+  },
+  { appName: "Remix", iconKey: "remix", names: ["remix"] },
+  { appName: "Expo", iconKey: "expo", names: ["expo", "expo-cli"] },
+  { appName: "React Native", iconKey: "react", names: ["react-native"] },
+  {
+    appName: "Metro",
+    iconKey: "metro",
+    names: ["metro", "metro-inspector-proxy"]
+  },
+  {
+    appName: "Webpack",
+    iconKey: "webpack",
+    names: ["webpack", "webpack-dev-server", "webpack-cli"]
+  },
+  { appName: "Parcel", iconKey: "parcel", names: ["parcel"] },
+  { appName: "Rollup", iconKey: "rollup", names: ["rollup"] },
+  { appName: "esbuild", iconKey: "esbuild", names: ["esbuild"] },
+  { appName: "SWC", iconKey: "swc", names: ["swc"] },
+  {
+    appName: "TypeScript",
+    iconKey: "typescript",
+    names: ["tsc", "tsserver", "tsx", "ts-node", "typescript-language-server"]
+  },
+  { appName: "ESLint", iconKey: "eslint", names: ["eslint", "eslint_d"] },
+  { appName: "Prettier", iconKey: "prettier", names: ["prettier"] },
+  { appName: "Biome", iconKey: "biome", names: ["biome"] },
+  {
+    appName: "Storybook",
+    iconKey: "storybook",
+    names: ["storybook", "start-storybook"]
+  },
+  { appName: "Playwright", iconKey: "playwright", names: ["playwright"] },
+  { appName: "Cypress", iconKey: "cypress", names: ["cypress"] },
+  { appName: "Jest", iconKey: "jest", names: ["jest"] },
+  {
+    appName: "Python",
+    iconKey: "python",
+    names: [
+      "python",
+      "python2",
+      "python3",
+      "python3.9",
+      "python3.10",
+      "python3.11",
+      "python3.12",
+      "python3.13",
+      "pypy",
+      "pypy3"
+    ]
+  },
+  { appName: "pip", iconKey: "python", names: ["pip", "pip2", "pip3"] },
+  { appName: "pipx", iconKey: "python", names: ["pipx"] },
+  { appName: "uv", iconKey: "python", names: ["uv", "uvx"] },
+  { appName: "Poetry", iconKey: "poetry", names: ["poetry"] },
+  { appName: "Pipenv", iconKey: "python", names: ["pipenv"] },
+  {
+    appName: "Conda",
+    iconKey: "conda",
+    names: ["conda", "mamba", "micromamba"]
+  },
+  {
+    appName: "Django",
+    iconKey: "django",
+    names: ["django-admin", "django-admin.py", "manage.py"]
+  },
+  { appName: "Flask", iconKey: "flask", names: ["flask"] },
+  { appName: "Uvicorn", iconKey: "uvicorn", names: ["uvicorn"] },
+  { appName: "Gunicorn", iconKey: "gunicorn", names: ["gunicorn"] },
+  { appName: "Hypercorn", iconKey: "python", names: ["hypercorn"] },
+  { appName: "Celery", iconKey: "celery", names: ["celery"] },
+  {
+    appName: "Jupyter",
+    iconKey: "jupyter",
+    names: ["jupyter", "jupyter-lab", "jupyter-notebook", "ipython"]
+  },
+  { appName: "Ruby", iconKey: "ruby", names: ["ruby", "erb", "irb"] },
+  { appName: "Bundler", iconKey: "ruby", names: ["bundle", "bundler"] },
+  { appName: "Rails", iconKey: "rails", names: ["rails", "bin/rails"] },
+  { appName: "Rack", iconKey: "ruby", names: ["rackup"] },
+  { appName: "Puma", iconKey: "puma", names: ["puma"] },
+  { appName: "Sidekiq", iconKey: "sidekiq", names: ["sidekiq"] },
+  { appName: "RSpec", iconKey: "ruby", names: ["rspec"] },
+  { appName: "Go", iconKey: "go", names: ["go", "gofmt", "gopls", "air"] },
+  { appName: "Delve", iconKey: "go", names: ["dlv"] },
+  {
+    appName: "Rust",
+    iconKey: "rust",
+    names: ["rustc", "rustup", "cargo", "rust-analyzer"]
+  },
+  {
+    appName: "Java",
+    iconKey: "java",
+    names: ["java", "javac", "jar", "jshell", "jwebserver"]
+  },
+  { appName: "Gradle", iconKey: "gradle", names: ["gradle", "gradlew"] },
+  { appName: "Maven", iconKey: "maven", names: ["mvn", "mvnw"] },
+  {
+    appName: "Spring Boot",
+    iconKey: "spring",
+    names: ["spring", "spring-boot"]
+  },
+  {
+    appName: "Kotlin",
+    iconKey: "kotlin",
+    names: ["kotlin", "kotlinc", "kotlin-language-server"]
+  },
+  {
+    appName: "Scala",
+    iconKey: "scala",
+    names: ["scala", "scalac", "sbt", "metals"]
+  },
+  {
+    appName: "Clojure",
+    iconKey: "clojure",
+    names: ["clojure", "clj", "lein", "boot"]
+  },
+  {
+    appName: "PHP",
+    iconKey: "php",
+    names: ["php", "php-fpm", "php-cgi", "composer"]
+  },
+  { appName: "Laravel", iconKey: "laravel", names: ["artisan", "laravel"] },
+  { appName: "Symfony", iconKey: "symfony", names: ["symfony"] },
+  { appName: "Elixir", iconKey: "elixir", names: ["elixir", "iex", "mix"] },
+  {
+    appName: "Erlang",
+    iconKey: "erlang",
+    names: ["erl", "beam.smp", "beam", "epmd", "rebar3"]
+  },
+  { appName: "Phoenix", iconKey: "phoenix", names: ["phx.server", "phoenix"] },
+  {
+    appName: "PostgreSQL",
+    iconKey: "postgresql",
+    names: ["postgres", "postmaster", "pg_ctl", "psql", "pg_isready"]
+  },
+  {
+    appName: "Redis",
+    iconKey: "redis",
+    names: ["redis-server", "redis-cli", "redis-sentinel"]
+  },
+  {
+    appName: "MySQL",
+    iconKey: "mysql",
+    names: ["mysql", "mysqld", "mysqladmin"]
+  },
+  {
+    appName: "MariaDB",
+    iconKey: "mariadb",
+    names: ["mariadb", "mariadbd", "mariadb-admin"]
+  },
+  { appName: "SQLite", iconKey: "sqlite", names: ["sqlite3", "sqlite"] },
+  {
+    appName: "MongoDB",
+    iconKey: "mongodb",
+    names: ["mongod", "mongosh", "mongo"]
+  },
+  {
+    appName: "Elasticsearch",
+    iconKey: "elasticsearch",
+    names: ["elasticsearch"]
+  },
+  { appName: "OpenSearch", iconKey: "opensearch", names: ["opensearch"] },
+  { appName: "Solr", iconKey: "solr", names: ["solr"] },
+  {
+    appName: "Kafka",
+    iconKey: "kafka",
+    names: [
+      "kafka-server-start",
+      "kafka-console-consumer",
+      "kafka-console-producer"
+    ]
+  },
+  {
+    appName: "ZooKeeper",
+    iconKey: "zookeeper",
+    names: ["zookeeper-server-start", "zkserver"]
+  },
+  {
+    appName: "RabbitMQ",
+    iconKey: "rabbitmq",
+    names: ["rabbitmq-server", "rabbitmqctl"]
+  },
+  { appName: "NATS", iconKey: "nats", names: ["nats-server", "nats"] },
+  {
+    appName: "Docker",
+    iconKey: "docker",
+    names: [
+      "docker",
+      "dockerd",
+      "docker-compose",
+      "docker-proxy",
+      "com.docker.backend"
+    ]
+  },
+  { appName: "Podman", iconKey: "podman", names: ["podman", "podman-compose"] },
+  {
+    appName: "Kubernetes",
+    iconKey: "kubernetes",
+    names: ["kubectl", "kube-apiserver", "kubelet", "minikube", "kind"]
+  },
+  { appName: "Helm", iconKey: "helm", names: ["helm"] },
+  { appName: "Tilt", iconKey: "tilt", names: ["tilt"] },
+  { appName: "nginx", iconKey: "nginx", names: ["nginx"] },
+  { appName: "Caddy", iconKey: "caddy", names: ["caddy"] },
+  {
+    appName: "Apache HTTP Server",
+    iconKey: "apache",
+    names: ["httpd", "apache2", "apachectl"]
+  },
+  { appName: "HAProxy", iconKey: "haproxy", names: ["haproxy"] },
+  { appName: "Traefik", iconKey: "traefik", names: ["traefik"] },
+  { appName: "Envoy", iconKey: "envoy", names: ["envoy"] },
+  {
+    appName: "Tailscale",
+    iconKey: "tailscale",
+    names: ["tailscale", "tailscaled"]
+  },
+  {
+    appName: "Cloudflare Tunnel",
+    iconKey: "cloudflare",
+    names: ["cloudflared"]
+  },
+  { appName: "ngrok", iconKey: "ngrok", names: ["ngrok"] },
+  { appName: "localtunnel", iconKey: "terminal", names: ["lt", "localtunnel"] },
+  { appName: "SSH", iconKey: "ssh", names: ["ssh", "sshd", "scp", "sftp"] },
+  {
+    appName: "Git",
+    iconKey: "git",
+    names: ["git", "git-lfs", "git-upload-pack", "git-receive-pack"]
+  },
+  { appName: "GitHub CLI", iconKey: "github", names: ["gh"] },
+  { appName: "GitLab CLI", iconKey: "gitlab", names: ["glab"] },
+  { appName: "Subversion", iconKey: "subversion", names: ["svn"] },
+  { appName: "Mercurial", iconKey: "mercurial", names: ["hg"] },
+  { appName: "AWS CLI", iconKey: "aws", names: ["aws", "aws-vault", "sam"] },
+  { appName: "Azure CLI", iconKey: "azure", names: ["az"] },
+  {
+    appName: "Google Cloud CLI",
+    iconKey: "google-cloud",
+    names: ["gcloud", "gsutil", "bq"]
+  },
+  { appName: "Terraform", iconKey: "terraform", names: ["terraform"] },
+  { appName: "OpenTofu", iconKey: "opentofu", names: ["tofu"] },
+  {
+    appName: "Ansible",
+    iconKey: "ansible",
+    names: ["ansible", "ansible-playbook"]
+  },
+  { appName: "Pulumi", iconKey: "pulumi", names: ["pulumi"] },
+  { appName: "Nomad", iconKey: "nomad", names: ["nomad"] },
+  { appName: "Vault", iconKey: "vault", names: ["vault"] },
+  { appName: "Consul", iconKey: "consul", names: ["consul"] },
+  { appName: "Make", iconKey: "make", names: ["make", "gmake"] },
+  { appName: "CMake", iconKey: "cmake", names: ["cmake", "ctest", "cpack"] },
+  { appName: "Ninja", iconKey: "ninja", names: ["ninja"] },
+  { appName: "Bazel", iconKey: "bazel", names: ["bazel", "bazelisk"] },
+  { appName: "Buck", iconKey: "buck", names: ["buck", "buck2"] },
+  { appName: "Clang", iconKey: "clang", names: ["clang", "clang++", "clangd"] },
+  { appName: "GCC", iconKey: "gcc", names: ["gcc", "g++", "cc", "c++"] },
+  { appName: "LLDB", iconKey: "terminal", names: ["lldb"] },
+  { appName: "GDB", iconKey: "terminal", names: ["gdb"] },
+  {
+    appName: "Swift",
+    iconKey: "swift",
+    names: ["swift", "swiftc", "sourcekit-lsp"]
+  },
+  {
+    appName: "Xcode",
+    iconKey: "xcode",
+    names: ["xcodebuild", "xcrun", "simctl"]
+  },
+  { appName: "Zig", iconKey: "zig", names: ["zig"] },
+  {
+    appName: "Lua",
+    iconKey: "lua",
+    names: ["lua", "luajit", "lua-language-server"]
+  },
+  { appName: "Perl", iconKey: "perl", names: ["perl"] },
+  {
+    appName: "R",
+    iconKey: "r",
+    names: ["r", "rscript", "rserver", "rsession"]
+  },
+  { appName: "Julia", iconKey: "julia", names: ["julia"] },
+  {
+    appName: "Haskell",
+    iconKey: "haskell",
+    names: ["ghc", "ghci", "cabal", "stack", "haskell-language-server-wrapper"]
+  },
+  {
+    appName: "OCaml",
+    iconKey: "ocaml",
+    names: ["ocaml", "ocamlc", "dune", "opam"]
+  },
+  { appName: "F#", iconKey: "fsharp", names: ["fsharpi", "fsautocomplete"] },
+  {
+    appName: ".NET",
+    iconKey: "dotnet",
+    names: ["dotnet", "csharp-ls", "omnisharp"]
+  },
+  {
+    appName: "PowerShell",
+    iconKey: "powershell",
+    names: ["pwsh", "powershell"]
+  },
+  { appName: "Bash", iconKey: "terminal", names: ["bash"] },
+  { appName: "Zsh", iconKey: "terminal", names: ["zsh"] },
+  { appName: "fish", iconKey: "terminal", names: ["fish"] },
+  { appName: "tmux", iconKey: "terminal", names: ["tmux"] },
+  { appName: "GNU Screen", iconKey: "terminal", names: ["screen"] },
+  { appName: "direnv", iconKey: "terminal", names: ["direnv"] },
+  {
+    appName: "Nix",
+    iconKey: "nix",
+    names: ["nix", "nix-shell", "nix-daemon", "nix-build", "nix develop"]
+  },
+  { appName: "Homebrew", iconKey: "homebrew", names: ["brew"] },
+  { appName: "mise", iconKey: "terminal", names: ["mise"] },
+  { appName: "asdf", iconKey: "terminal", names: ["asdf"] },
+  { appName: "Volta", iconKey: "volta", names: ["volta"] },
+  { appName: "fnm", iconKey: "nodejs", names: ["fnm"] },
+  { appName: "nvm", iconKey: "nodejs", names: ["nvm"] },
+  { appName: "curl", iconKey: "terminal", names: ["curl"] },
+  { appName: "HTTPie", iconKey: "httpie", names: ["http", "https", "httpie"] },
+  { appName: "wget", iconKey: "terminal", names: ["wget"] },
+  { appName: "jq", iconKey: "terminal", names: ["jq"] },
+  { appName: "ripgrep", iconKey: "terminal", names: ["rg", "ripgrep"] },
+  { appName: "fd", iconKey: "terminal", names: ["fd"] },
+  { appName: "fzf", iconKey: "terminal", names: ["fzf"] },
+  { appName: "bat", iconKey: "terminal", names: ["bat"] },
+  { appName: "eza", iconKey: "terminal", names: ["eza", "exa"] },
+  { appName: "htop", iconKey: "terminal", names: ["htop", "top", "btop"] },
+  { appName: "Vim", iconKey: "vim", names: ["vim", "view", "vimdiff"] },
+  { appName: "Neovim", iconKey: "neovim", names: ["nvim", "nvim-qt"] },
+  { appName: "Emacs", iconKey: "emacs", names: ["emacs", "emacsclient"] },
+  {
+    appName: "Visual Studio Code",
+    iconKey: "vscode",
+    names: [
+      "code",
+      "code-insiders",
+      "vscode",
+      "visual studio code",
+      "visual studio code - insiders"
+    ]
+  },
+  { appName: "code-server", iconKey: "vscode", names: ["code-server"] },
+  { appName: "Cursor", iconKey: "cursor", names: ["cursor"] },
+  { appName: "Zed", iconKey: "zed", names: ["zed"] },
+  {
+    appName: "Sublime Text",
+    iconKey: "sublime-text",
+    names: ["subl", "sublime_text", "sublime text"]
+  },
+  { appName: "Atom", iconKey: "atom", names: ["atom"] },
+  {
+    appName: "IntelliJ IDEA",
+    iconKey: "intellij-idea",
+    names: ["idea", "idea.sh", "intellij idea", "idea64.exe"]
+  },
+  {
+    appName: "WebStorm",
+    iconKey: "webstorm",
+    names: ["webstorm", "webstorm.sh"]
+  },
+  { appName: "PyCharm", iconKey: "pycharm", names: ["pycharm", "pycharm.sh"] },
+  {
+    appName: "RubyMine",
+    iconKey: "rubymine",
+    names: ["rubymine", "rubymine.sh"]
+  },
+  { appName: "GoLand", iconKey: "goland", names: ["goland", "goland.sh"] },
+  { appName: "CLion", iconKey: "clion", names: ["clion", "clion.sh"] },
+  {
+    appName: "DataGrip",
+    iconKey: "datagrip",
+    names: ["datagrip", "datagrip.sh"]
+  },
+  { appName: "Rider", iconKey: "rider", names: ["rider", "rider.sh"] },
+  {
+    appName: "Android Studio",
+    iconKey: "android-studio",
+    names: ["studio", "studio.sh", "android studio"]
+  },
+  { appName: "Xcode", iconKey: "xcode", names: ["xcode", "xcode.app"] },
+  { appName: "Postman", iconKey: "postman", names: ["postman"] },
+  { appName: "Insomnia", iconKey: "insomnia", names: ["insomnia"] },
+  { appName: "Hoppscotch", iconKey: "hoppscotch", names: ["hoppscotch"] },
+  { appName: "TablePlus", iconKey: "tableplus", names: ["tableplus"] },
+  { appName: "DBeaver", iconKey: "dbeaver", names: ["dbeaver"] },
+  { appName: "RedisInsight", iconKey: "redis", names: ["redisinsight"] },
+  { appName: "Prisma", iconKey: "prisma", names: ["prisma"] },
+  { appName: "Drizzle Kit", iconKey: "drizzle", names: ["drizzle-kit"] },
+  { appName: "Supabase", iconKey: "supabase", names: ["supabase"] },
+  { appName: "Firebase", iconKey: "firebase", names: ["firebase"] },
+  { appName: "Vercel", iconKey: "vercel", names: ["vercel"] },
+  { appName: "Netlify", iconKey: "netlify", names: ["netlify", "ntl"] },
+  { appName: "Fly.io", iconKey: "fly", names: ["fly", "flyctl"] },
+  { appName: "Heroku", iconKey: "heroku", names: ["heroku"] },
+  { appName: "Stripe CLI", iconKey: "stripe", names: ["stripe"] },
+  { appName: "Twilio CLI", iconKey: "twilio", names: ["twilio"] },
+  { appName: "Mailpit", iconKey: "mail", names: ["mailpit"] },
+  { appName: "MailHog", iconKey: "mail", names: ["mailhog"] },
+  { appName: "OpenSSL", iconKey: "openssl", names: ["openssl"] },
+  { appName: "mkcert", iconKey: "certificate", names: ["mkcert"] },
+  { appName: "mkdocs", iconKey: "markdown", names: ["mkdocs"] },
+  { appName: "Hugo", iconKey: "hugo", names: ["hugo"] },
+  { appName: "Jekyll", iconKey: "jekyll", names: ["jekyll"] },
+  { appName: "Eleventy", iconKey: "eleventy", names: ["eleventy", "11ty"] },
+  { appName: "Docusaurus", iconKey: "docusaurus", names: ["docusaurus"] },
+  { appName: "Trunk", iconKey: "rust", names: ["trunk"] },
+  { appName: "wasm-pack", iconKey: "webassembly", names: ["wasm-pack"] },
+  { appName: "wasmtime", iconKey: "webassembly", names: ["wasmtime"] },
+  {
+    appName: "Language Server",
+    iconKey: "language-server",
+    names: [
+      "lua-language-server",
+      "yaml-language-server",
+      "vscode-json-language-server",
+      "docker-langserver",
+      "bash-language-server",
+      "marksman",
+      "taplo"
+    ]
+  }
+];
+var executableNameLookup = new Map;
+for (const entry of processCatalogEntries) {
+  for (const name of entry.names) {
+    executableNameLookup.set(normalizeProcessName(name), {
+      appName: entry.appName,
+      iconKey: entry.iconKey
+    });
+  }
+}
+var processNameCatalogSize = executableNameLookup.size;
+function canonicalizeProcessName(processName) {
+  const executableName = executableNameFromPathOrName(processName);
+  if (executableName === undefined) {
+    return;
+  }
+  const directMatch = lookupCanonicalProcess(executableName);
+  if (directMatch !== undefined) {
+    return directMatch;
+  }
+  const pathMatch = lookupCanonicalPathHint(processName);
+  if (pathMatch !== undefined) {
+    return pathMatch;
+  }
+  return;
+}
+function guessCanonicalProcessFromCommand(command) {
+  const tokens = shellCommandTokens(command);
+  const executable = executableTokenFromCommandTokens(tokens);
+  if (executable === undefined) {
+    return;
+  }
+  return canonicalizeProcessName(executable);
+}
+function lookupCanonicalProcess(processName) {
+  const normalized = normalizeProcessName(processName);
+  const identity = executableNameLookup.get(normalized);
+  if (identity === undefined) {
+    return;
+  }
+  return {
+    ...identity,
+    executableName: processName,
+    matchedName: normalized
+  };
+}
+function lookupCanonicalPathHint(processPath) {
+  const normalizedPath = normalizeProcessName(processPath);
+  const pathParts = normalizedPath.split("/").map((part) => trimExecutableExtension(part)).filter((part) => part.length > 0);
+  for (const pathPart of pathParts.reverse()) {
+    const pathHint = executableNameLookup.get(pathPart);
+    if (pathHint !== undefined) {
+      return {
+        ...pathHint,
+        executableName: executableNameFromPathOrName(processPath) ?? processPath,
+        matchedName: pathPart
+      };
+    }
+  }
+  return;
+}
+function executableTokenFromCommandTokens(tokens) {
+  const [firstToken, ...remainingTokens] = tokens;
+  switch (firstToken) {
+    case undefined:
+      return;
+    case "env":
+    case "/usr/bin/env":
+      return executableTokenFromCommandTokens(remainingTokens.filter((token) => !isEnvironmentAssignment(token)));
+    case "sudo":
+    case "command":
+    case "exec":
+    case "nohup":
+      return executableTokenFromCommandTokens(remainingTokens.filter((token) => !token.startsWith("-")));
+    default:
+      switch (isEnvironmentAssignment(firstToken)) {
+        case true:
+          return executableTokenFromCommandTokens(remainingTokens);
+        case false:
+          return firstToken;
+      }
+  }
+}
+function executableNameFromPathOrName(processName) {
+  const trimmed = processName.trim();
+  if (trimmed.length === 0) {
+    return;
+  }
+  const normalizedSeparators = trimmed.replaceAll("\\", "/");
+  const [lastPathPart] = normalizedSeparators.split("/").filter((part) => part.length > 0).slice(-1);
+  switch (lastPathPart) {
+    case undefined:
+      return;
+    default:
+      return trimExecutableExtension(lastPathPart);
+  }
+}
+function trimExecutableExtension(executableName) {
+  const normalized = executableName.toLowerCase();
+  switch (true) {
+    case normalized.endsWith(".app"):
+      return executableName.slice(0, -4);
+    case normalized.endsWith(".exe"):
+      return executableName.slice(0, -4);
+    case normalized.endsWith(".cmd"):
+    case normalized.endsWith(".bat"):
+      return executableName.slice(0, -4);
+    default:
+      return executableName;
+  }
+}
+function normalizeProcessName(processName) {
+  return trimExecutableExtension(processName.trim().replaceAll("\\", "/").toLowerCase());
+}
+function isEnvironmentAssignment(token) {
+  return /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
+}
+function shellCommandTokens(command) {
+  const tokens = [];
+  let currentToken = "";
+  let quote = undefined;
+  let escaping = false;
+  for (const character of command.trim()) {
+    switch (true) {
+      case escaping:
+        currentToken = `${currentToken}${character}`;
+        escaping = false;
+        break;
+      case character === "\\":
+        escaping = true;
+        break;
+      case (quote === undefined && (character === '"' || character === "'")):
+        quote = character;
+        break;
+      case quote === character:
+        quote = undefined;
+        break;
+      case (quote === undefined && /\s/.test(character)):
+        if (currentToken.length > 0) {
+          tokens.push(currentToken);
+          currentToken = "";
+        }
+        break;
+      default:
+        currentToken = `${currentToken}${character}`;
+        break;
+    }
+  }
+  if (currentToken.length > 0) {
+    tokens.push(currentToken);
+  }
+  return tokens;
+}
+
 // src/channelSession.ts
 var codexTypingHeartbeatMs = 5000;
 var defaultStreamFlushIntervalMs = 150;
@@ -1534,7 +2397,7 @@ async function attachChannelSession(args) {
         }
         switch (method) {
           case "turn/started":
-            if (turnId !== undefined) {
+            if (threadId !== undefined && turnId !== undefined) {
               rememberLocalTuiTurnIfNeeded(args, state, threadId, turnId);
             }
             break;
@@ -1669,19 +2532,42 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     forwardedTerminalInputKeys: new Set,
     webSearchProgressOutputs: createBoundedCache(maxForwardedTurnIds),
     pendingApprovalRequests: new Map,
+    approvalPromptChain: Promise.resolve(),
     pendingPortForwardRequests: new Map,
+    queuedPortForwardCandidates: new Map,
     approvedForwardPorts: new Set,
     approvedForwardTargets: new Map,
     dismissedForwardTargets: new Map,
     portForwardWatcher: undefined,
     activeProcessingState: undefined,
+    pendingReconnectContextInjection: undefined,
     terminalInputForwardChain: Promise.resolve(),
     webSearchProgressForwardChain: Promise.resolve(),
     typingHeartbeat: undefined,
     typingHeartbeatInFlight: false,
-    runtimeSettings: runtimeSettingsFromOptions(options)
+    runtimeSettings: runtimeSettingsFromOptions(options),
+    pendingRuntimeSettingsResume: false,
+    runtimeSettingsGeneration: 0,
+    runtimeSettingsResumeChain: Promise.resolve()
   };
 }
+async function handleLostPortForwardCandidate(args, state, payloadContext, candidate) {
+  dropLostQueuedPortForwardCandidate(args, state, candidate);
+  await expireLostPendingPortForwardRequest(args, state, payloadContext, candidate);
+  await revokeLostApprovedForwardPort(args, state, candidate);
+}
+function dropLostQueuedPortForwardCandidate(args, state, candidate) {
+  const queued = state.queuedPortForwardCandidates.get(candidate.port);
+  if (queued === undefined || !sameForwardCandidate(queued, candidate)) {
+    return;
+  }
+  state.queuedPortForwardCandidates.delete(candidate.port);
+  args.log("port_forward.queued_request_dropped", {
+    port: candidate.port,
+    pid: candidate.pid,
+    reason: "listener_exited"
+  });
+}
 function startPortForwardWatchIfEnabled(args, state, payloadContext) {
   if (args.options.enablePortForwardWatch !== true || state.portForwardWatcher !== undefined || state.kandanThreadId === undefined || state.codexThreadId === undefined) {
     return;
@@ -1692,8 +2578,10 @@ function startPortForwardWatchIfEnabled(args, state, payloadContext) {
     state.approvedForwardPorts.add(port);
   }
   state.portForwardWatcher = start({
+    rootCwd: watchOptions.rootCwd ?? args.options.cwd,
     ...watchOptions,
     onCandidate: (candidate) => publishPortForwardPrompt(args, state, payloadContext, candidate),
+    onCandidateLost: (candidate) => handleLostPortForwardCandidate(args, state, payloadContext, candidate),
     onError: (error) => args.log("port_forward.watch_failed", { message: error.message })
   });
 }
@@ -1746,7 +2634,11 @@ async function handleChannelSessionControl(args, state, payloadContext, control)
     return;
   }
   if (state.codexThreadId === undefined || state.kandanThreadId === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "thread_not_bound" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "thread_not_bound"
+    };
   }
   const interrupted = interruptPendingKandanMessages(state.queue, control.throughSeq);
   const activeQueuedSeq = interruptibleQueuedSeq(state.turn);
@@ -1794,14 +2686,20 @@ async function handleChannelSessionControl(args, state, payloadContext, control)
     interruptedQueuedMessages: interrupted.ok ? interrupted.selectedCount : 0
   };
 }
-function updateSessionSettings(args, state, control) {
+async function updateSessionSettings(args, state, control) {
   if (state.codexThreadId !== control.threadId) {
     return;
   }
   if (state.codexThreadId === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "thread_not_bound" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "thread_not_bound"
+    };
   }
   state.runtimeSettings = mergeRuntimeSettings(state.runtimeSettings, control);
+  state.pendingRuntimeSettingsResume = true;
+  state.runtimeSettingsGeneration += 1;
   publishRuntimeSettings(args, state).catch((error) => {
     args.log("kandan.session_settings_publish_failed", {
       message: error instanceof Error ? error.message : String(error)
@@ -1814,6 +2712,7 @@ function updateSessionSettings(args, state, control) {
     sandbox: state.runtimeSettings.sandbox ?? null,
     fast: state.runtimeSettings.fast ?? null
   });
+  await tryResumeCodexThreadForPendingRuntimeSettings(args, state);
   return {
     instanceId: args.instanceId,
     ok: true,
@@ -1824,21 +2723,97 @@ function updateSessionSettings(args, state, control) {
     fast: state.runtimeSettings.fast ?? null
   };
 }
+async function resumeCodexThreadForPendingRuntimeSettings(args, state) {
+  const requestedGeneration = state.runtimeSettingsGeneration;
+  const previousResume = state.runtimeSettingsResumeChain.catch(() => {
+    return;
+  });
+  const resume = previousResume.then(() => performCodexThreadResumeForPendingRuntimeSettings(args, state, requestedGeneration));
+  state.runtimeSettingsResumeChain = resume.then(() => {
+    return;
+  }, () => {
+    return;
+  });
+  return await resume;
+}
+async function performCodexThreadResumeForPendingRuntimeSettings(args, state, requestedGeneration) {
+  if (state.pendingRuntimeSettingsResume !== true || state.closed || state.turn.status !== "idle" || localTuiTurnIsActive(state)) {
+    return true;
+  }
+  const codexThreadId = state.codexThreadId;
+  if (codexThreadId === undefined) {
+    return true;
+  }
+  if (state.runtimeSettingsGeneration !== requestedGeneration) {
+    return false;
+  }
+  const resumeGeneration = requestedGeneration;
+  const resumeSettings = state.runtimeSettings;
+  const runtimeOptions = runtimeOptionsForSettings(args.options, resumeSettings);
+  const resumeParams = {
+    threadId: codexThreadId,
+    ...codexThreadRuntimeOverrides(runtimeOptions)
+  };
+  args.log("codex.session_settings_resume_requested", {
+    codex_thread_id: codexThreadId,
+    model: resumeSettings.model ?? null,
+    reasoning_effort: resumeSettings.reasoningEffort ?? null,
+    approval_policy: resumeSettings.approvalPolicy ?? null,
+    sandbox: resumeSettings.sandbox ?? null,
+    fast: resumeSettings.fast ?? null,
+    generation: resumeGeneration
+  });
+  const resumed = await args.codex.request("thread/resume", resumeParams);
+  if ("error" in resumed) {
+    throw new Error(`failed to resume Codex thread with updated settings: ${resumed.error.message}`);
+  }
+  if (state.pendingRuntimeSettingsResume === true && state.runtimeSettingsGeneration === resumeGeneration) {
+    state.pendingRuntimeSettingsResume = false;
+  }
+  args.log("codex.session_settings_resume_completed", {
+    codex_thread_id: codexThreadId,
+    generation: resumeGeneration,
+    current_generation: state.runtimeSettingsGeneration,
+    pending: state.pendingRuntimeSettingsResume
+  });
+  return state.pendingRuntimeSettingsResume !== true;
+}
+async function tryResumeCodexThreadForPendingRuntimeSettings(args, state) {
+  try {
+    return await resumeCodexThreadForPendingRuntimeSettings(args, state);
+  } catch (error) {
+    args.log("codex.session_settings_resume_failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return false;
+  }
+}
 async function resolvePendingCodexApprovalRequest(args, state, control) {
   if (state.codexThreadId !== control.threadId) {
     return;
   }
   if (state.codexThreadId === undefined || state.kandanThreadId === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "thread_not_bound" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "thread_not_bound"
+    };
   }
   const approval = state.pendingApprovalRequests.get(approvalRequestKey(control.requestId, control.sourceSeq));
   if (approval === undefined) {
-    return { instanceId: args.instanceId, ok: false, error: "approval_request_not_found" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "approval_request_not_found"
+    };
   }
   state.pendingApprovalRequests.delete(approvalRequestKey(control.requestId, control.sourceSeq));
   const codexDecision = control.decision === "approve" ? "accept" : "decline";
   approval.resolve({ decision: codexDecision });
-  state.activeProcessingState = { seq: approval.sourceSeq, reason: "streaming response" };
+  state.activeProcessingState = {
+    seq: approval.sourceSeq,
+    reason: "streaming response"
+  };
   await publishMessageState(args, state.kandanThreadId, approval.sourceSeq, {
     status: "processing",
     reason: "streaming response"
@@ -1851,6 +2826,17 @@ async function resolvePendingCodexApprovalRequest(args, state, control) {
   });
   return { instanceId: args.instanceId, ok: true };
 }
+async function drainQueuedPortForwardPrompt(args, state, payloadContext) {
+  if (state.pendingPortForwardRequests.size > 0 || state.queuedPortForwardCandidates.size === 0) {
+    return;
+  }
+  const next = Array.from(state.queuedPortForwardCandidates.values()).sort((left, right) => left.port - right.port)[0];
+  if (next === undefined) {
+    return;
+  }
+  state.queuedPortForwardCandidates.delete(next.port);
+  await publishPortForwardPrompt(args, state, payloadContext, next);
+}
 async function resolvePendingPortForwardRequest(args, state, payloadContext, control) {
   const request = state.pendingPortForwardRequests.get(control.requestId);
   if (request === undefined) {
@@ -1863,7 +2849,11 @@ async function resolvePendingPortForwardRequest(args, state, payloadContext, con
       actor_user_id: control.actorUserId ?? null,
       reason: "sender_not_allowed"
     });
-    return { instanceId: args.instanceId, ok: false, error: "sender_not_allowed" };
+    return {
+      instanceId: args.instanceId,
+      ok: false,
+      error: "sender_not_allowed"
+    };
   }
   state.pendingPortForwardRequests.delete(control.requestId);
   if (control.decision === "deny") {
@@ -1874,14 +2864,18 @@ async function resolvePendingPortForwardRequest(args, state, payloadContext, con
       port: request.port,
       pid: request.pid
     });
+    await drainQueuedPortForwardPrompt(args, state, payloadContext);
     return { instanceId: args.instanceId, ok: true };
   }
   state.approvedForwardPorts.add(request.port);
   state.approvedForwardTargets.set(request.port, approvedTargetFromRequest(request));
+  const processIdentity = guessCanonicalProcessFromCommand(request.command);
   const capabilities = args.options.onForwardPortApproved?.(request.port, {
     kandanThreadId: state.kandanThreadId ?? null,
     codexThreadId: state.codexThreadId ?? null,
-    channelSlug: args.options.channelSession.channelSlug ?? null
+    channelSlug: args.options.channelSession.channelSlug ?? null,
+    processName: processIdentity?.appName ?? null,
+    processIconKey: processIdentity?.iconKey ?? null
   });
   await publishForwardPortResolvedEvent(args, request, capabilities);
   await publishMessageStateForPortForwardResult(args, state, request, "processed");
@@ -1891,6 +2885,7 @@ async function resolvePendingPortForwardRequest(args, state, payloadContext, con
     port: request.port,
     pid: request.pid
   });
+  await drainQueuedPortForwardPrompt(args, state, payloadContext);
   return { instanceId: args.instanceId, ok: true, port: request.port };
 }
 function portForwardControlSenderAllowed(args, payloadContext, control) {
@@ -1927,37 +2922,39 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
       state.approvedForwardTargets.set(review.target.port, review.target);
       return;
     case "revoke_and_prompt":
+      if (state.pendingPortForwardRequests.size > 0) {
+        state.queuedPortForwardCandidates.set(candidate.port, candidate);
+        args.log("port_forward.request_queued", {
+          port: candidate.port,
+          pid: candidate.pid,
+          pending_count: state.pendingPortForwardRequests.size
+        });
+        return;
+      }
       await revokeApprovedForwardPort(args, state, review.revoked, review.reason);
       break;
     case "prompt":
+      if (state.pendingPortForwardRequests.size > 0) {
+        state.queuedPortForwardCandidates.set(candidate.port, candidate);
+        args.log("port_forward.request_queued", {
+          port: candidate.port,
+          pid: candidate.pid,
+          pending_count: state.pendingPortForwardRequests.size
+        });
+        return;
+      }
       break;
   }
   const requestId = `port-forward-${randomUUID()}`;
   const label = portForwardPromptLabel(candidate);
-  const body = portForwardPromptBody(candidate, requestId);
-  const payload = {
-    ...localRunnerPayload(args.options, args.instanceId, "port_forward_request", state.codexThreadId, payloadContext),
-    reply_to_seq: state.rootSeq ?? null,
-    structured: {
-      kind: "local_runner_port_forward_request",
-      request_id: requestId,
+  const sourceSeq = portForwardApprovalSourceSeq(state);
+  if (sourceSeq === undefined) {
+    args.log("port_forward.prompt_skipped", {
       port: candidate.port,
       pid: candidate.pid,
-      command: candidate.command,
-      ...candidate.cwd === undefined ? {} : { cwd: candidate.cwd },
-      command_label: label
-    }
-  };
-  const reply = await pushOk(args.kandan, args.topic, "session:post_thread_message", {
-    workspace: args.options.channelSession.workspaceSlug,
-    channel: args.options.channelSession.channelSlug,
-    thread_id: state.kandanThreadId,
-    body,
-    payload
-  });
-  const sourceSeq = integerValue(reply.seq);
-  if (sourceSeq === undefined) {
-    throw new Error("port forward prompt did not return a Kandan message seq");
+      reason: "source_seq_missing"
+    });
+    return;
   }
   const request = pendingRequestFromCandidate({
     requestId,
@@ -1965,6 +2962,9 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
     candidate
   });
   state.pendingPortForwardRequests.set(requestId, request);
+  const processIdentity = guessCanonicalProcessFromCommand(candidate.command);
+  const processIconPath = processIdentity?.iconKey === undefined ? undefined : `/web/process-icons/${processIdentity.iconKey}.png`;
+  const processName = processIdentity?.appName ?? label;
   await publishForwardPortRequestedEvent(args, request);
   await publishMessageState(args, state.kandanThreadId, sourceSeq, {
     status: "processing",
@@ -1972,13 +2972,20 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
     approval: {
       requestId,
       kind: "local_runner_port_forward",
-      summary: `Open runner port ${candidate.port} from ${label}`,
+      summary: `Make ${processName} on port ${candidate.port} accessible on Linzumi?`,
       reason: portForwardPromptReason(candidate),
+      port: candidate.port,
+      pid: candidate.pid,
+      command: candidate.command,
+      ...candidate.cwd === undefined ? {} : { cwd: candidate.cwd },
+      ...processIdentity?.appName === undefined ? {} : { processName },
+      ...processIdentity?.iconKey === undefined ? {} : { processIconKey: processIdentity.iconKey },
+      ...processIconPath === undefined ? {} : { processIconPath },
       choices: [
         {
           decision: "approve",
-          label: "Open preview",
-          description: `Allow Kandan to proxy HTTP, HTTPS, and WebSocket traffic for runner port ${candidate.port}.`
+          label: "Enable",
+          description: `Allow Linzumi to proxy HTTP, HTTPS, and WebSocket traffic for runner port ${candidate.port}.`
         },
         {
           decision: "deny",
@@ -1996,6 +3003,9 @@ async function publishPortForwardPrompt(args, state, payloadContext, candidate)
     pid: candidate.pid
   });
 }
+function portForwardApprovalSourceSeq(state) {
+  return state.activeProcessingState?.seq ?? state.rootSeq;
+}
 async function revokeApprovedForwardPort(args, state, target, reason) {
   state.approvedForwardPorts.delete(target.port);
   state.approvedForwardTargets.delete(target.port);
@@ -2015,30 +3025,58 @@ async function revokeApprovedForwardPort(args, state, target, reason) {
     reason
   });
 }
+async function revokeLostApprovedForwardPort(args, state, candidate) {
+  if (!state.approvedForwardPorts.has(candidate.port)) {
+    return;
+  }
+  await revokeApprovedForwardPort(args, state, state.approvedForwardTargets.get(candidate.port) ?? candidate, "listener_exited");
+}
+async function expireLostPendingPortForwardRequest(args, state, payloadContext, candidate) {
+  const request = Array.from(state.pendingPortForwardRequests.values()).find((request2) => sameForwardCandidate(approvedTargetFromRequest(request2), candidate));
+  if (request === undefined) {
+    return;
+  }
+  state.pendingPortForwardRequests.delete(request.requestId);
+  await publishMessageStateForPortForwardResult(args, state, request, "failed", "port_forward_listener_exited");
+  args.log("port_forward.pending_request_expired", {
+    request_id: request.requestId,
+    port: request.port,
+    pid: request.pid,
+    reason: "listener_exited"
+  });
+  await drainQueuedPortForwardPrompt(args, state, payloadContext);
+}
 async function publishPortForwardReadyMessage(args, state, payloadContext, request) {
   if (state.kandanThreadId === undefined || state.codexThreadId === undefined) {
     return;
   }
   const path = forwardPreviewPath(args.options.runnerId, request.port);
+  const processIdentity = guessCanonicalProcessFromCommand(request.command);
+  const processIconPath = processIdentity?.iconKey === undefined ? undefined : `/web/process-icons/${processIdentity.iconKey}.png`;
+  const processName = processIdentity?.appName ?? `Port ${request.port}`;
+  const readySummary = `${processName} on port ${request.port} is ready in Linzumi.`;
   await pushOptional(args.kandan, args.topic, "session:post_thread_message", {
     workspace: args.options.channelSession.workspaceSlug,
     channel: args.options.channelSession.channelSlug,
     thread_id: state.kandanThreadId,
-    body: `Runner port ${request.port} is open in Kandan: [Open preview](${path})`,
+    body: `${readySummary} [Open](${path})`,
     payload: {
       ...localRunnerPayload(args.options, args.instanceId, "port_forward_ready", state.codexThreadId, payloadContext),
       ...state.rootSeq === undefined ? {} : { reply_to_seq: state.rootSeq },
       structured: {
         kind: "local_runner_port_forward_ready",
         status: "ready",
-        summary: `Runner port ${request.port} is open in Kandan.`,
+        summary: readySummary,
         next_action: "Open HTTP/HTTPS/WebSocket preview",
         source_path: path,
-        link_label: "Open preview",
+        link_label: "Open",
         request_id: request.requestId,
         port: request.port,
         pid: request.pid,
         command: request.command,
+        ...processIdentity?.appName === undefined ? {} : { process_name: processIdentity.appName },
+        ...processIdentity?.iconKey === undefined ? {} : { process_icon_key: processIdentity.iconKey },
+        ...processIconPath === undefined ? {} : { process_icon_path: processIconPath },
         ...request.cwd === undefined ? {} : { cwd: request.cwd },
         url: path
       }
@@ -2067,10 +3105,15 @@ async function publishForwardPortResolvedEvent(args, request, capabilities) {
     ...capabilities === undefined ? {} : { capabilities }
   }, args.log);
 }
-async function publishMessageStateForPortForwardResult(args, state, request, status) {
+async function publishMessageStateForPortForwardResult(args, state, request, status, failedReason = "port_forward_denied") {
   if (state.kandanThreadId === undefined) {
     return;
   }
+  const activeProcessingState = state.activeProcessingState;
+  if (activeProcessingState !== undefined && activeProcessingState.seq === request.sourceSeq) {
+    await publishMessageState(args, state.kandanThreadId, request.sourceSeq, processingMessageStateFromActive(activeProcessingState), undefined, undefined, state.codexThreadId);
+    return;
+  }
   switch (status) {
     case "processed":
       await publishMessageState(args, state.kandanThreadId, request.sourceSeq, {
@@ -2080,7 +3123,7 @@ async function publishMessageStateForPortForwardResult(args, state, request, sta
     case "failed":
       await publishMessageState(args, state.kandanThreadId, request.sourceSeq, {
         status: "failed",
-        reason: "port_forward_denied"
+        reason: failedReason
       });
       break;
   }
@@ -2151,7 +3194,12 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
       actorUserId: event.actorUserId,
       actorSlug: event.actorSlug
     });
-    if (result.ok === true) {
+    if (result === undefined) {
+      await publishKandanMessageState(args, event, {
+        status: "failed",
+        reason: "port_forward_decision_missing"
+      });
+    } else if (result.ok === true) {
       await publishKandanMessageState(args, event, { status: "processed" });
     } else {
       await publishKandanMessageState(args, event, {
@@ -2301,11 +3349,19 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
   if (state.closed || state.turn.status !== "idle" || localTuiTurnIsActive(state)) {
     return;
   }
+  const resumed = await tryResumeCodexThreadForPendingRuntimeSettings(args, state);
+  if (!resumed) {
+    return;
+  }
   const next = dequeuePendingKandanMessage(state.queue);
   if (next === undefined) {
     return;
   }
-  state.turn = { status: "starting", queuedSeq: next.seq, interruptAfterStart: false };
+  state.turn = {
+    status: "starting",
+    queuedSeq: next.seq,
+    interruptAfterStart: false
+  };
   state.activeProcessingState = { seq: next.seq, reason: "starting turn" };
   args.log("codex.turn_starting", {
     queued_seq: next.seq,
@@ -2328,10 +3384,11 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
     }
     const started = await args.codex.request("turn/start", {
       threadId: codexThreadId,
-      input: await codexInputItemsForQueuedKandanMessage(args, next),
+      input: await codexInputItemsForQueuedKandanMessage(args, next, state.pendingReconnectContextInjection),
       ...codexTurnRuntimeOverrides(runtimeOptionsForSettings(args.options, state.runtimeSettings))
     });
     const turnId = extractTurnIdFromResponse(started);
+    state.pendingReconnectContextInjection = undefined;
     const interruptAfterStart = state.turn.status === "starting" && state.turn.interruptAfterStart;
     state.turn = { status: "active", turnId, queuedSeq: next.seq };
     rememberTurnReplyTarget(state, turnId, next.seq);
@@ -2357,12 +3414,14 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
         await stopCodexTyping(args, state);
         const newCodexThreadId = await startCodexThread(args.codex, args.options);
         state.codexThreadId = newCodexThreadId;
+        await bindCurrentCodexThread(args, state);
         args.log("codex.thread_rebound", {
           kandan_thread_id: state.kandanThreadId,
           old_codex_thread_id: oldCodexThreadId ?? null,
           new_codex_thread_id: newCodexThreadId
         });
         await postCodexThreadReboundMessage(args, state, payloadContext, oldCodexThreadId, newCodexThreadId);
+        state.pendingReconnectContextInjection = await fetchReconnectContextInjection(args, state);
         requeuePendingKandanMessageFront(state.queue, next);
         state.turn = { status: "idle" };
         await drainKandanMessageQueue(args, state, payloadContext);
@@ -2388,6 +3447,26 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
     });
   }
 }
+async function fetchReconnectContextInjection(args, state) {
+  if (state.kandanThreadId === undefined) {
+    throw new Error("cannot fetch reconnect context without a Linzumi thread id");
+  }
+  const session = args.options.channelSession;
+  const reply = await pushOk(args.kandan, args.topic, "session:thread_context", {
+    workspace: session.workspaceSlug,
+    channel: session.channelSlug,
+    thread_id: state.kandanThreadId
+  });
+  const messages = parseReconnectContextMessages(reply.messages);
+  const summarizer = args.options.reconnectContextSummarizer ?? createConfiguredReconnectContextSummarizer();
+  const injection = await buildReconnectContextInjection(messages, summarizer);
+  args.log("codex.thread_reconnect_context_prepared", {
+    codex_thread_id: state.codexThreadId ?? null,
+    kandan_thread_id: state.kandanThreadId,
+    context_message_count: messages.length
+  });
+  return injection;
+}
 async function handleCodexServerRequest(args, state, payloadContext, request) {
   const params = objectValue(request.params) ?? {};
   const turnId = codexNotificationTurnId(params);
@@ -2425,35 +3504,48 @@ function codexApprovalRequestCanSurface(method) {
   return method === "item/commandExecution/requestApproval" || method === "item/fileChange/requestApproval";
 }
 async function requestKandanApproval(args, state, request, turnId, payloadContext) {
-  const sourceSeq = activeQueuedSeqForTurn(state.turn, turnId);
-  if (sourceSeq === undefined || state.kandanThreadId === undefined) {
-    const message = `Codex approval request has no active Kandan source message: ${request.method}`;
-    await failActiveCodexTurn(args, state, turnId, message, payloadContext);
-    throw new Error(message);
-  }
-  const approval = codexApprovalMessageState(request);
-  state.activeProcessingState = { seq: sourceSeq, reason: "awaiting approval", approval };
-  await publishMessageState(args, state.kandanThreadId, sourceSeq, {
-    status: "processing",
-    reason: "awaiting approval",
-    approval
-  }, undefined, undefined, state.codexThreadId);
-  args.log("codex.approval_request_pending", {
-    request_id: approval.requestId,
-    source_seq: sourceSeq,
-    turn_id: turnId,
-    method: request.method
-  });
-  return new Promise((resolve2, reject) => {
-    const request2 = {
-      requestId: approval.requestId,
-      sourceSeq,
-      turnId,
-      resolve: resolve2,
-      reject
+  const approvalResult = state.approvalPromptChain.then(async () => {
+    const sourceSeq = activeQueuedSeqForTurn(state.turn, turnId);
+    if (sourceSeq === undefined || state.kandanThreadId === undefined) {
+      const message = `Codex approval request has no active Kandan source message: ${request.method}`;
+      await failActiveCodexTurn(args, state, turnId, message, payloadContext);
+      throw new Error(message);
+    }
+    const approval = codexApprovalMessageState(request);
+    state.activeProcessingState = {
+      seq: sourceSeq,
+      reason: "awaiting approval",
+      approval
     };
-    state.pendingApprovalRequests.set(approvalRequestKey(request2.requestId, request2.sourceSeq), request2);
+    const approvalPromise = new Promise((resolve2, reject) => {
+      const pendingRequest = {
+        requestId: approval.requestId,
+        sourceSeq,
+        turnId,
+        resolve: resolve2,
+        reject
+      };
+      state.pendingApprovalRequests.set(approvalRequestKey(pendingRequest.requestId, pendingRequest.sourceSeq), pendingRequest);
+    });
+    await publishMessageState(args, state.kandanThreadId, sourceSeq, {
+      status: "processing",
+      reason: "awaiting approval",
+      approval
+    }, undefined, undefined, state.codexThreadId);
+    args.log("codex.approval_request_pending", {
+      request_id: approval.requestId,
+      source_seq: sourceSeq,
+      turn_id: turnId,
+      method: request.method
+    });
+    return approvalPromise;
+  });
+  state.approvalPromptChain = approvalResult.then(() => {
+    return;
+  }, () => {
+    return;
   });
+  return approvalResult;
 }
 function rejectPendingApprovalRequests(state, error) {
   const pendingApprovals = [...state.pendingApprovalRequests.values()];
@@ -2479,7 +3571,11 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
   const completingActiveTurn = completingQueuedSeq !== undefined;
   const completingLocalTuiTurn = isLocalTuiTurn(state, turnId);
   if (completingQueuedSeq !== undefined) {
-    state.turn = { status: "completing", turnId, queuedSeq: completingQueuedSeq };
+    state.turn = {
+      status: "completing",
+      turnId,
+      queuedSeq: completingQueuedSeq
+    };
   }
   await waitForPendingTuiInputMirror(state, turnId);
   await waitForStreamingForwardChains(args, state, payloadContext);
@@ -2582,11 +3678,17 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
     if (completingActiveTurn && state.turn.status === "completing" && state.turn.turnId === turnId) {
       state.turn = { status: "idle" };
       await stopCodexTyping(args, state);
-      await drainKandanMessageQueue(args, state, payloadContext);
+      const resumed = await tryResumeCodexThreadForPendingRuntimeSettings(args, state);
+      if (resumed) {
+        await drainKandanMessageQueue(args, state, payloadContext);
+      }
     }
     if (completingLocalTuiTurn && !completingActiveTurn) {
       await stopCodexTyping(args, state);
-      await drainKandanMessageQueue(args, state, payloadContext);
+      const resumed = await tryResumeCodexThreadForPendingRuntimeSettings(args, state);
+      if (resumed) {
+        await drainKandanMessageQueue(args, state, payloadContext);
+      }
     }
   }
 }
@@ -2841,7 +3943,10 @@ async function forwardReasoningDeltaPayload(args, state, delta, payloadContext)
     }
   } else {
     await editCodexStructuredOutput(args, state, existing.seq, nextContent, codexReasoningStructuredMessage(delta.itemKey, nextContent, "streaming"));
-    rememberStreamingReasoningOutput(state, { ...existing, content: nextContent });
+    rememberStreamingReasoningOutput(state, {
+      ...existing,
+      content: nextContent
+    });
   }
   args.log("kandan.codex_reasoning_delta_forwarded", {
     item_key: delta.itemKey,
@@ -3398,7 +4503,10 @@ function rememberLocalTuiTurnIfNeeded(args, state, threadId, turnId) {
   if (state.kandanThreadId !== undefined) {
     startCodexTypingHeartbeat(args, state, state.kandanThreadId);
   }
-  args.log("codex.tui_turn_started", { turn_id: turnId, codex_thread_id: threadId });
+  args.log("codex.tui_turn_started", {
+    turn_id: turnId,
+    codex_thread_id: threadId
+  });
 }
 function isLocalTuiTurn(state, turnId) {
   return state.localTuiTurnIds.has(turnId);
@@ -3465,7 +4573,10 @@ function clearPendingStreamFlushTimers(state) {
   clearStreamDeltaFlushTimer(state.fileChangeQueue);
 }
 function rememberTurnReplyTarget(state, turnId, replyToSeq) {
-  rememberBoundedCacheValue(state.turnReplyTargets, turnId, { turnId, replyToSeq });
+  rememberBoundedCacheValue(state.turnReplyTargets, turnId, {
+    turnId,
+    replyToSeq
+  });
 }
 function sourceMessageSeqForTurn(state, turnId) {
   return getBoundedCacheValue(state.turnReplyTargets, turnId)?.replyToSeq;
@@ -3474,20 +4585,12 @@ function fileChangePaths(structured) {
   const changes = arrayValue(structured.changes) ?? [];
   return changes.filter(isJsonObject).map((change) => stringValue(change.path) ?? "").filter((path) => path.trim() !== "");
 }
-async function postCodexThreadReboundMessage(args, state, payloadContext, oldCodexThreadId, newCodexThreadId) {
+async function postCodexThreadReboundMessage(args, state, payloadContext, _oldCodexThreadId, newCodexThreadId) {
   if (state.kandanThreadId === undefined) {
     return;
   }
   const session = args.options.channelSession;
-  const body = [
-    "Codex reconnected.",
-    "",
-    "The previous local Codex app-server thread was not available in this process, so this runner started a new local Codex thread for this Kandan thread.",
-    "",
-    `Previous Codex thread: ${oldCodexThreadId ?? "unknown"}`,
-    `New Codex thread: ${newCodexThreadId}`
-  ].join(`
-`);
+  const body = "[codex reconnected to new thread]";
   await pushOk(args.kandan, args.topic, "session:post_thread_message", {
     workspace: session.workspaceSlug,
     channel: session.channelSlug,
@@ -3622,10 +4725,19 @@ async function publishMessageState(args, threadId, seq, state, actorSlug, actorU
       approval_request_id: state.approval.requestId,
       approval_kind: state.approval.kind,
       approval_summary: state.approval.summary,
+      ...state.approval.port === undefined ? {} : { approval_port: state.approval.port },
+      ...state.approval.pid === undefined ? {} : { approval_pid: state.approval.pid },
+      ...state.approval.command === undefined ? {} : { approval_command: state.approval.command },
+      ...state.approval.cwd === undefined ? {} : { approval_cwd: state.approval.cwd },
+      ...state.approval.processName === undefined ? {} : { approval_process_name: state.approval.processName },
+      ...state.approval.processIconKey === undefined ? {} : { approval_process_icon_key: state.approval.processIconKey },
+      ...state.approval.processIconPath === undefined ? {} : { approval_process_icon_path: state.approval.processIconPath },
       ...state.approval.reason === undefined ? {} : { approval_reason: state.approval.reason },
       ...state.approval.choices === undefined ? {} : { approval_choices: state.approval.choices },
       ...state.approval.allowedActorSlug === undefined ? {} : { approval_allowed_actor_slug: state.approval.allowedActorSlug },
-      ...state.approval.allowedActorUserId === undefined ? {} : { approval_allowed_actor_user_id: state.approval.allowedActorUserId }
+      ...state.approval.allowedActorUserId === undefined ? {} : {
+        approval_allowed_actor_user_id: state.approval.allowedActorUserId
+      }
     } : {},
     ...actorSlug === undefined ? {} : { actor_slug: actorSlug },
     ...actorUserId === undefined ? {} : { actor_user_id: actorUserId }
@@ -3679,11 +4791,15 @@ function clearActiveProcessingState(state, seq) {
     state.activeProcessingState = undefined;
   }
 }
-async function codexInputItemsForQueuedKandanMessage(args, message) {
+async function codexInputItemsForQueuedKandanMessage(args, message, reconnectContextInjection = undefined) {
   const attachments = await downloadQueuedKandanAttachments(args, message);
   const text = appendDownloadedAttachmentContext(codexInputForQueuedKandanMessage(message), attachments);
   const imageItems = attachments.flatMap((attachment) => attachment.isImage ? [{ type: "localImage", path: attachment.path }] : []);
-  return [{ type: "text", text }, ...imageItems];
+  return [
+    ...reconnectContextInjection === undefined ? [] : [reconnectContextInjection],
+    { type: "text", text },
+    ...imageItems
+  ];
 }
 async function downloadQueuedKandanAttachments(args, message) {
   if (message.attachments.length === 0) {
@@ -3816,10 +4932,11 @@ async function uploadedFileIdsForCodexOutput(args, body, structured) {
       throw new Error("Kandan attachment prepare response missing upload_url");
     }
     const bytes = await readFile(file.path);
+    const uploadBody = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
     const response = await fetch(resolveKandanAttachmentUrl(args.options.kandanUrl, uploadUrl), {
       method: uploadMethod,
       headers: { "content-type": file.contentType },
-      body: bytes
+      body: uploadBody
     });
     if (!response.ok) {
       throw new Error(`Kandan attachment upload failed for ${file.fileName}: ${response.status} ${response.statusText}`);
@@ -4059,7 +5176,7 @@ function defaultCliAuditLogFile() {
   return override === undefined || override === "" ? join2(homedir(), ".linzumi", "logs", "command-events.jsonl") : override;
 }
 function redactForCliLog(value) {
-  return redactValue(value, undefined);
+  return redactObject(value);
 }
 function redactValue(value, key) {
   if (sensitiveKey(key)) {
@@ -4204,8 +5321,10 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
   const child = spawn(codexBin, args, {
     cwd,
     env: process.env,
-    stdio: ["ignore", "inherit", "inherit"]
+    stdio: ["ignore", "inherit", "inherit"],
+    detached: true
   });
+  const stop = () => stopCodexAppServerProcess(child);
   writeCliAuditEvent("process.spawned", {
     command: codexBin,
     args,
@@ -4231,33 +5350,57 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
   try {
     await waitForReadyz(url, child);
   } catch (error) {
-    child.kill("SIGINT");
+    stop();
     throw error;
   }
-  return { url, process: child };
+  return { url, process: child, stop };
+}
+function stopCodexAppServerProcess(child, killProcess = process.kill) {
+  if (child.pid !== undefined) {
+    try {
+      killProcess(-child.pid, "SIGINT");
+      return;
+    } catch (error) {
+      logProcessGroupSignalFailure(child.pid, error);
+    }
+  }
+  child.kill("SIGINT");
+}
+function logProcessGroupSignalFailure(pid, error) {
+  const code = processSignalErrorCode(error);
+  const message = error instanceof Error ? error.message : String(error);
+  const event = code === "EPERM" ? "process.group_signal_denied" : code === "ESRCH" ? "process.group_signal_missing" : "process.group_signal_failed";
+  writeCliAuditEvent(event, {
+    pid,
+    signal: "SIGINT",
+    code,
+    message,
+    fallback: "child_signal",
+    purpose: "codex.app_server"
+  });
+  if (code === "EPERM") {
+    process.stderr.write(`codex app-server process-group SIGINT denied for pid ${pid}; falling back to direct child SIGINT
+`);
+  }
+}
+function processSignalErrorCode(error) {
+  if (error !== null && typeof error === "object" && "code" in error) {
+    const code = error.code;
+    return typeof code === "string" ? code : undefined;
+  }
+  return;
 }
 function codexAppServerArgs(listenUrl, options = {}) {
-  return [
-    "app-server",
-    ...codexConfigArgs(options),
-    "--listen",
-    listenUrl
-  ];
+  return ["app-server", ...codexConfigArgs(options), "--listen", listenUrl];
 }
 function codexConfigArgs(options) {
   return [
-    ...options.model === undefined ? [] : [
-      "-c",
-      `model=${JSON.stringify(options.model)}`
-    ],
+    ...options.model === undefined ? [] : ["-c", `model=${JSON.stringify(options.model)}`],
     ...options.reasoningEffort === undefined ? [] : [
       "-c",
       `model_reasoning_effort=${JSON.stringify(options.reasoningEffort)}`
     ],
-    ...options.fast === true ? [
-      "-c",
-      `service_tier=${JSON.stringify("fast")}`
-    ] : []
+    ...options.fast === true ? ["-c", `service_tier=${JSON.stringify("fast")}`] : []
   ];
 }
 async function connectCodexAppServer(websocketUrl, socketFactory = (url) => new WebSocket(url)) {
@@ -4611,7 +5754,9 @@ async function handleForwardHttpRequest(control, allowedPorts) {
       method: control.method,
       headers: requestHeaders(control.headers),
       redirect: "manual",
-      ...bodyDecision.body === undefined ? {} : { body: bodyDecision.body }
+      ...bodyDecision.body === undefined ? {} : {
+        body: bodyDecision.body.buffer.slice(bodyDecision.body.byteOffset, bodyDecision.body.byteOffset + bodyDecision.body.byteLength)
+      }
     };
     const response = await fetchWithHttpsFallback(control.port, control.path, control.queryString, request);
     const upstreamBuffer = Buffer.from(await response.arrayBuffer());
@@ -5081,10 +6226,12 @@ function prepareCodeServerProfile(collaboration, editorRuntime) {
     const userDataDir = mkdtempSync(join4(tmpdir(), "kandan-local-editor-"));
     const extensionsDir = join4(userDataDir, "extensions");
     const collaborationServerDir = join4(userDataDir, "collaboration-server");
+    const tempDir = join4(userDataDir, "tmp");
     const userSettingsDir = join4(userDataDir, "User");
     mkdirSync3(userSettingsDir, { recursive: true });
     mkdirSync3(extensionsDir, { recursive: true });
     mkdirSync3(collaborationServerDir, { recursive: true });
+    mkdirSync3(tempDir, { recursive: true });
     if (editorRuntime !== undefined) {
       installDirectory(editorRuntime.assets.documentStateExtensionDir, join4(extensionsDir, "kandan.document-state-telemetry"));
     }
@@ -5117,6 +6264,12 @@ function prepareCodeServerLaunch(options) {
       "-p",
       codeServerSandboxProfile(options, codeServerExecutable.directory),
       "--",
+      "/bin/sh",
+      "-c",
+      'export HOME="$1"; export PWD="$1"; export TMPDIR="$2"; export TMP="$2"; export TEMP="$2"; shift 2; exec "$@"',
+      "kandan-code-server-env",
+      options.cwd,
+      join4(options.userDataDir, "tmp"),
       codeServerExecutable.command,
       ...codeServerArgs(options.port, options.cwd, options.userDataDir, options.extensionsDir)
     ]
@@ -5200,7 +6353,6 @@ function codeServerSandboxProfile(options, codeServerBinDir) {
     "/etc",
     "/private/etc",
     "/opt/homebrew",
-    "/dev",
     ...options.codeServerRuntimeRoot === undefined ? [] : sandboxPathAliases(options.codeServerRuntimeRoot),
     codeServerBinDir
   ]);
@@ -5223,6 +6375,7 @@ function codeServerSandboxProfile(options, codeServerBinDir) {
     "(allow file-map-executable)",
     '(allow file-read* (literal "/") (literal "/private") (literal "/private/var"))',
     `(allow file-read* ${readOnlyRoots.map(sandboxSubpath).join(" ")})`,
+    '(allow file-read* file-write* (subpath "/dev"))',
     `(allow file-read* file-write* ${readWriteRoots.map(sandboxSubpath).join(" ")})`
   ].join(`
 `);
@@ -5397,10 +6550,14 @@ function installDirectory(sourceDir, destinationDir) {
 }
 function codeServerEnv(env, cwd, userDataDir, collaboration) {
   const { PORT: _port, ...hostEnv } = env;
+  const tempDir = join4(userDataDir, "tmp");
   const base = {
     ...hostEnv,
     HOME: cwd,
     PWD: cwd,
+    TMPDIR: tempDir,
+    TMP: tempDir,
+    TEMP: tempDir,
     XDG_CACHE_HOME: join4(userDataDir, "xdg-cache"),
     XDG_CONFIG_HOME: join4(userDataDir, "xdg-config"),
     XDG_DATA_HOME: join4(userDataDir, "xdg-data")
@@ -5789,7 +6946,7 @@ async function exchangeCodeForToken(args) {
   };
 }
 function stringBodyField(body, key) {
-  const value = key in body ? body[key] : undefined;
+  const value = body[key];
   return typeof value === "string" && value.trim() !== "" ? value : undefined;
 }
 function startCallbackServer(args) {
@@ -5859,7 +7016,9 @@ function isTcpAddress(address) {
   return typeof address === "object" && address !== null && typeof address.port === "number";
 }
 function writeOauthResult(response, args) {
-  response.writeHead(args.status, { "content-type": "text/html; charset=utf-8" });
+  response.writeHead(args.status, {
+    "content-type": "text/html; charset=utf-8"
+  });
   response.end(oauthResultHtml(args));
 }
 function oauthResultHtml(args) {
@@ -6474,7 +7633,7 @@ function assertStartDependencies(status) {
     throw new Error(`Codex is not available at ${status.codex.command}. Install Codex or pass --codex-bin <path>.`);
   }
   if (status.editorRuntime?.status === "unavailable" || status.codeServer?.available === false && status.codeServer.reason !== "not_configured") {
-    throw new Error("The Kandan editor runtime is not available. Reconnect when the runtime update finishes or pass --code-server-bin <path> for a custom development runtime.");
+    throw new Error("The Linzumi editor runtime is not available. Reconnect when the runtime update finishes or pass --code-server-bin <path> for a custom development runtime.");
   }
 }
 function dependencyStatusPayload(status) {
@@ -6858,7 +8017,9 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     forwardPortAttributions.set(port, {
       kandanThreadId: attribution.kandanThreadId ?? null,
       codexThreadId: attribution.codexThreadId ?? null,
-      channelSlug: attribution.channelSlug ?? null
+      channelSlug: attribution.channelSlug ?? null,
+      processName: attribution.processName ?? null,
+      processIconKey: attribution.processIconKey ?? null
     });
   };
   const clearForwardPortAttribution = (port) => {
@@ -6870,10 +8031,15 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       port,
       kandanThreadId: attribution?.kandanThreadId ?? null,
       codexThreadId: attribution?.codexThreadId ?? null,
-      channelSlug: attribution?.channelSlug ?? null
+      channelSlug: attribution?.channelSlug ?? null,
+      processName: attribution?.processName ?? null,
+      processIconKey: attribution?.processIconKey ?? null
     };
   });
   const allowedCwds = { value: [...options.allowedCwds] };
+  const missingAllowedCwds = {
+    value: normalizeAllowedCwds(options.missingAllowedCwds ?? [])
+  };
   const localEditorState = {
     value: { status: "disabled" }
   };
@@ -6889,6 +8055,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     codexRemoteTui: true,
     startInstance: allowedCwds.value.length > 0,
     allowedCwds: allowedCwds.value,
+    missingAllowedCwds: missingAllowedCwds.value,
     allowedCwdSuggestions: allowedCwdSuggestions(options.cwd, allowedCwds.value),
     portForwarding: liveForwardPorts.size > 0,
     allowedPorts: Array.from(liveForwardPorts).sort((left, right) => left - right),
@@ -6903,7 +8070,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   const joinPayload = () => ({
     clientName: "kandan-local-codex-runner",
     version: "0.0.1",
-    workspace: options.channelSession?.workspaceSlug ?? null,
+    workspace: runnerWorkspaceSlug(options) ?? null,
     channel: options.channelSession?.channelSlug ?? null,
     capabilities: capabilitiesPayload()
   });
@@ -6921,7 +8088,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   const started = options.codexUrl === undefined ? await startOwnedCodexAppServer(options) : undefined;
   if (started !== undefined) {
     cleanup.actions.push(() => {
-      started.process.kill("SIGINT");
+      started.stop();
     });
   }
   const codexUrl = options.codexUrl ?? started?.url;
@@ -6971,7 +8138,9 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   cleanup.actions.push(() => codex.close());
   const seq = { value: 0 };
   const codexThreads = options.channelSession === undefined ? await discoverCodexThreads(codex, options.cwd) : [];
+  const discoveredCodexThreads = { value: codexThreads };
   const runnerHost = hostname2();
+  const runtimeDefaults = runnerRuntimeDefaults(options);
   const instancePayload = {
     instanceId,
     codexUrl,
@@ -6979,8 +8148,10 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     cwd: options.cwd,
     hostname: runnerHost,
     codexThreads,
-    model: options.channelSession?.model ?? null,
-    reasoningEffort: options.channelSession?.reasoningEffort ?? null,
+    workspace: runnerWorkspaceSlug(options) ?? null,
+    channel: options.channelSession?.channelSlug ?? null,
+    model: runtimeDefaults.model ?? null,
+    reasoningEffort: runtimeDefaults.reasoningEffort ?? null,
     fast: options.fast ?? false
   };
   await kandan.push(topic, "instance_started", instancePayload);
@@ -7019,17 +8190,22 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     kandan.onReconnect(() => channelSession.handleKandanReconnect());
   }
   const dynamicChannelSessions = new Map;
+  kandan.onReconnect(() => rebindDynamicChannelSessionsOnReconnect(dynamicChannelSessions.values()));
   cleanup.actions.push(async () => {
     await Promise.all(Array.from(dynamicChannelSessions.values(), (session) => session.close()));
     dynamicChannelSessions.clear();
   });
-  const attachStartedThreadSession = async (control, cwd, codexThreadId) => {
-    const workspaceSlug = normalizedWorkDescription(control.workspace);
-    const channelSlug = normalizedWorkDescription(control.channel);
-    const kandanThreadId = normalizedWorkDescription(control.threadId);
-    if (workspaceSlug === undefined || channelSlug === undefined || kandanThreadId === undefined || dynamicChannelSessions.has(kandanThreadId)) {
+  const attachThreadSession = async (control, cwd, codexThreadId) => {
+    const workspaceSlug = optionalThreadControlField(control, "workspace");
+    const channelSlug = optionalThreadControlField(control, "channel");
+    const kandanThreadId = optionalThreadControlField(control, "threadId");
+    if (workspaceSlug === undefined || channelSlug === undefined || kandanThreadId === undefined) {
       return;
     }
+    const existingSession = dynamicChannelSessions.get(kandanThreadId);
+    if (existingSession !== undefined) {
+      return existingSession;
+    }
     const listenUser = options.channelSession?.listenUser ?? identityFromAccessToken(options.token).actorUsername;
     if (listenUser === undefined) {
       throw new Error("missing listen user for Commander-started Codex session");
@@ -7083,12 +8259,13 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     codexUrl,
     cwd: options.cwd,
     hostname: runnerHost,
-    workspace: options.channelSession?.workspaceSlug ?? null,
+    workspace: runnerWorkspaceSlug(options) ?? null,
     channel: options.channelSession?.channelSlug ?? null,
     threadId: channelSession?.currentKandanThreadId() ?? null,
     codexThreadId: channelSession?.currentCodexThreadId() ?? null,
-    model: options.channelSession?.model ?? null,
-    reasoningEffort: options.channelSession?.reasoningEffort ?? null,
+    codexThreads: discoveredCodexThreads.value,
+    model: runtimeDefaults.model ?? null,
+    reasoningEffort: runtimeDefaults.reasoningEffort ?? null,
     fast: options.fast ?? false,
     capabilities: capabilitiesPayload()
   });
@@ -7097,11 +8274,19 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       message: error instanceof Error ? error.message : String(error)
     });
   });
+  const refreshDiscoveredCodexThreads = () => discoverCodexThreads(codex, options.cwd).then((threads) => {
+    discoveredCodexThreads.value = threads;
+    return kandan.push(topic, "heartbeat", heartbeatPayload());
+  }).catch((error) => {
+    log("kandan.codex_threads_refresh_failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+  });
   const heartbeatInterval = setInterval(() => {
-    pushHeartbeat();
+    channelSession === undefined ? refreshDiscoveredCodexThreads() : pushHeartbeat();
   }, 15000);
   cleanup.actions.push(() => clearInterval(heartbeatInterval));
-  kandan.onReconnect(() => pushHeartbeat().then(() => {
+  kandan.onReconnect(() => (channelSession === undefined ? refreshDiscoveredCodexThreads() : pushHeartbeat()).then(() => {
     return;
   }));
   pushHeartbeat();
@@ -7135,6 +8320,9 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
         });
       });
     }
+    if (channelSession === undefined && notification.method === "thread/started") {
+      refreshDiscoveredCodexThreads();
+    }
     log("codex.notification", {
       method: notification.method,
       metadata
@@ -7242,7 +8430,33 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       return;
     }
     if (isUpdateRunnerConfigControl(control)) {
-      allowedCwds.value = normalizeAllowedCwds(control.allowedCwds);
+      const updatedAllowedCwds = configuredAllowedCwds(control.allowedCwds);
+      allowedCwds.value = updatedAllowedCwds.allowedCwds;
+      missingAllowedCwds.value = updatedAllowedCwds.missingAllowedCwds;
+      pushHeartbeat();
+      return;
+    }
+    if (isSetPortForwardEnabledControl(control)) {
+      switch (control.enabled) {
+        case true:
+          liveForwardPorts.add(control.port);
+          break;
+        case false:
+          liveForwardPorts.delete(control.port);
+          managedForwardPorts.delete(control.port);
+          clearForwardPortAttribution(control.port);
+          kandan.push(topic, "forward_port_revoked", {
+            instanceId,
+            port: control.port,
+            reason: "user_disabled",
+            capabilities: revocationCapabilities(capabilitiesPayload(), control.port)
+          }).catch((error) => {
+            log("kandan.forward_port_revoked_push_failed", {
+              message: error instanceof Error ? error.message : String(error)
+            });
+          });
+          break;
+      }
       pushHeartbeat();
       return;
     }
@@ -7250,7 +8464,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       if (handled !== undefined) {
         return handled;
       }
-      return applyControl(codex, kandan, topic, instanceId, options, allowedCwds.value, control, attachStartedThreadSession);
+      return applyControl(codex, kandan, topic, instanceId, options, allowedCwds.value, control, log, attachThreadSession);
     }).then((response) => {
       return kandan.push(topic, "codex_response", response);
     }).catch((error) => {
@@ -7315,6 +8529,8 @@ async function discoverCodexThreads(codex, cwd) {
   const data = arrayValue(result?.data);
   return data === undefined ? [] : data.filter(isJsonObject).map((thread) => ({
     id: stringValue(thread.id) ?? "",
+    title: stringValue(thread.title) ?? stringValue(thread.name) ?? stringValue(thread.preview) ?? "",
+    description: stringValue(thread.description) ?? stringValue(thread.summary) ?? stringValue(thread.preview) ?? "",
     preview: stringValue(thread.preview) ?? "",
     cwd: stringValue(thread.cwd) ?? "",
     source: stringValue(thread.source) ?? "",
@@ -7324,7 +8540,7 @@ async function discoverCodexThreads(codex, cwd) {
 }
 function extractStartedThreadId(response) {
   if ("error" in response) {
-    return;
+    throw new Error(`thread/start failed: ${response.error.message}`);
   }
   return stringValue(objectValue(objectValue(response.result)?.thread)?.id);
 }
@@ -7390,6 +8606,9 @@ function launchCodexTui(codexBin, codexUrl, cwd, codexThreadId, session, fast) {
   });
   return child;
 }
+async function rebindDynamicChannelSessionsOnReconnect(sessions) {
+  await Promise.all(Array.from(sessions, (session) => session.handleKandanReconnect()));
+}
 function forwardedHeaderValue(headers, name) {
   if (!Array.isArray(headers)) {
     return;
@@ -7431,9 +8650,85 @@ async function prepareCodexThreadForTuiResume(codex, codexThreadId) {
     throw new Error(`failed to verify Codex TUI resume: ${verified.error.message}`);
   }
 }
-async function applyControl(codex, kandan, topic, instanceId, options, allowedCwds, control, onStartedThread) {
+async function applyControl(codex, kandan, topic, instanceId, options, allowedCwds, control, log, onStartedThread) {
   switch (control.type) {
     case "start_instance": {
+      const cwd = resolveAllowedCwd(control.cwd, allowedCwds);
+      if (!cwd.ok) {
+        return {
+          instanceId,
+          controlType: control.type,
+          ok: false,
+          error: cwd.reason
+        };
+      }
+      const processingStatePayload = startInstanceMessageStatePayload(control, "processing", "starting Codex session");
+      if (processingStatePayload !== undefined) {
+        kandan.push(topic, "message_state", processingStatePayload).catch((error) => {
+          log("kandan.start_instance_processing_state_push_failed", {
+            message: error instanceof Error ? error.message : String(error)
+          });
+        });
+      }
+      try {
+        if (options.codexUrl === undefined) {
+          ensureCodexProjectTrusted(cwd.cwd);
+        }
+        const developerPrompt = normalizedWorkDescription(control.developerPrompt);
+        const runtimeSettings = startInstanceRuntimeSettings(options, control);
+        const response = await codex.request("thread/start", {
+          cwd: cwd.cwd,
+          serviceName: "kandan-local-runner",
+          personality: "pragmatic",
+          developerInstructions: commanderDeveloperInstructions({
+            cwd: cwd.cwd,
+            developerPrompt
+          }),
+          ...runtimeSettings.model === undefined ? {} : { model: runtimeSettings.model },
+          ...runtimeSettings.reasoningEffort === undefined ? {} : { reasoningEffort: runtimeSettings.reasoningEffort },
+          ...runtimeSettings.approvalPolicy === undefined ? {} : { approvalPolicy: runtimeSettings.approvalPolicy },
+          ...runtimeSettings.sandbox === undefined ? {} : { sandbox: runtimeSettings.sandbox },
+          ...runtimeSettings.fast === true ? { serviceTier: "fast" } : {}
+        });
+        const codexThreadId = extractStartedThreadId(response);
+        const workDescription = normalizedWorkDescription(control.workDescription);
+        if (codexThreadId !== undefined && developerPrompt !== undefined) {
+          await postVisibleDeveloperPrompt(kandan, topic, control, developerPrompt, codexThreadId);
+        }
+        const startedThreadSession = codexThreadId !== undefined && onStartedThread !== undefined ? await onStartedThread(control, cwd.cwd, codexThreadId) : undefined;
+        if (codexThreadId !== undefined && workDescription !== undefined) {
+          const rootSeq = integerValue(control.rootSeq);
+          const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
+          if (startedThreadSession !== undefined && sourceSeq !== undefined) {
+            const identity = identityFromAccessToken(options.token);
+            await startedThreadSession.startThreadMessageTurn({
+              seq: sourceSeq,
+              body: workDescription,
+              actorSlug: identity.actorUsername,
+              actorUserId: identity.actorUserId
+            });
+          } else {
+            await codex.request("turn/start", {
+              threadId: codexThreadId,
+              input: [{ type: "text", text: workDescription }]
+            });
+          }
+        }
+        return {
+          instanceId,
+          controlType: control.type,
+          cwd: cwd.cwd,
+          matchedRoot: cwd.matchedRoot,
+          response
+        };
+      } catch (error) {
+        try {
+          await publishStartInstanceMessageState(kandan, topic, control, "failed", "failed to start Codex session");
+        } catch (_publishError) {}
+        throw error;
+      }
+    }
+    case "reconnect_thread": {
       const cwd = resolveAllowedCwd(control.cwd, allowedCwds);
       if (!cwd.ok) {
         return {
@@ -7446,51 +8741,37 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
       if (options.codexUrl === undefined) {
         ensureCodexProjectTrusted(cwd.cwd);
       }
-      const developerPrompt = normalizedWorkDescription(control.developerPrompt);
-      const runtimeSettings = startInstanceRuntimeSettings(options, control);
-      const response = await codex.request("thread/start", {
-        cwd: cwd.cwd,
-        serviceName: "kandan-local-runner",
-        personality: "pragmatic",
-        developerInstructions: commanderDeveloperInstructions({
-          cwd: cwd.cwd,
-          developerPrompt
-        }),
-        ...runtimeSettings.model === undefined ? {} : { model: runtimeSettings.model },
-        ...runtimeSettings.reasoningEffort === undefined ? {} : { reasoningEffort: runtimeSettings.reasoningEffort },
-        ...runtimeSettings.approvalPolicy === undefined ? {} : { approvalPolicy: runtimeSettings.approvalPolicy },
-        ...runtimeSettings.sandbox === undefined ? {} : { sandbox: runtimeSettings.sandbox },
-        ...runtimeSettings.fast === true ? { serviceTier: "fast" } : {}
-      });
-      const codexThreadId = extractStartedThreadId(response);
-      const workDescription = normalizedWorkDescription(control.workDescription);
-      if (codexThreadId !== undefined && developerPrompt !== undefined) {
-        await postVisibleDeveloperPrompt(kandan, topic, control, developerPrompt, codexThreadId);
+      const codexThreadId = normalizedWorkDescription(control.codexThreadId);
+      if (codexThreadId === undefined) {
+        return {
+          instanceId,
+          controlType: control.type,
+          ok: false,
+          error: "missing_codex_thread_id"
+        };
       }
-      const startedThreadSession = codexThreadId !== undefined && onStartedThread !== undefined ? await onStartedThread(control, cwd.cwd, codexThreadId) : undefined;
-      if (codexThreadId !== undefined && workDescription !== undefined) {
+      const workDescription = normalizedWorkDescription(control.workDescription);
+      const startedThreadSession = onStartedThread === undefined ? undefined : await onStartedThread(control, cwd.cwd, codexThreadId);
+      if (workDescription !== undefined) {
         const rootSeq = integerValue(control.rootSeq);
-        if (startedThreadSession !== undefined && rootSeq !== undefined) {
-          const identity = identityFromAccessToken(options.token);
-          await startedThreadSession.startThreadMessageTurn({
-            seq: rootSeq,
-            body: workDescription,
-            actorSlug: identity.actorUsername,
-            actorUserId: identity.actorUserId
-          });
-        } else {
-          await codex.request("turn/start", {
-            threadId: codexThreadId,
-            input: [{ type: "text", text: workDescription }]
-          });
+        const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
+        if (startedThreadSession === undefined || sourceSeq === undefined) {
+          throw new Error("cannot reconnect a Kandan thread without a session");
         }
+        const identity = identityFromAccessToken(options.token);
+        await startedThreadSession.startThreadMessageTurn({
+          seq: sourceSeq,
+          body: workDescription,
+          actorSlug: identity.actorUsername,
+          actorUserId: identity.actorUserId
+        });
       }
       return {
         instanceId,
         controlType: control.type,
         cwd: cwd.cwd,
         matchedRoot: cwd.matchedRoot,
-        response
+        codexThreadId
       };
     }
     case "start_turn": {
@@ -7543,6 +8824,8 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
     case "interrupt_queued_messages":
     case "resolve_codex_approval_request":
     case "resolve_port_forward_request":
+    case "update_session_settings":
+    case "set_port_forward_enabled":
     case "forward_http_request":
     case "forward_websocket_open":
     case "forward_websocket_send":
@@ -7608,9 +8891,9 @@ secure tunnel, and keep the Linzumi thread truthful.
 </task_reminder>`;
 }
 async function postVisibleDeveloperPrompt(kandan, topic, control, developerPrompt, codexThreadId) {
-  const workspace = normalizedWorkDescription(control.workspace);
-  const channel = normalizedWorkDescription(control.channel);
-  const threadId = normalizedWorkDescription(control.threadId);
+  const workspace = optionalThreadControlField(control, "workspace");
+  const channel = optionalThreadControlField(control, "channel");
+  const threadId = optionalThreadControlField(control, "threadId");
   if (workspace === undefined || channel === undefined || threadId === undefined) {
     return;
   }
@@ -7632,33 +8915,116 @@ ${developerPrompt}`,
     client_message_id: `codex-start-instructions-${threadId}`
   });
 }
+async function publishStartInstanceMessageState(kandan, topic, control, status, reason) {
+  const payload = startInstanceMessageStatePayload(control, status, reason);
+  if (payload === undefined) {
+    return;
+  }
+  await kandan.push(topic, "message_state", payload);
+}
+function startInstanceMessageStatePayload(control, status, reason) {
+  const rootSeq = integerValue(control.rootSeq);
+  const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
+  if (sourceSeq === undefined) {
+    return;
+  }
+  const workspace = requiredStartInstanceControlField(control, "workspace");
+  const channel = requiredStartInstanceControlField(control, "channel");
+  const threadId = requiredStartInstanceControlField(control, "threadId");
+  return {
+    workspace,
+    channel,
+    thread_id: threadId,
+    seq: sourceSeq,
+    status,
+    reason
+  };
+}
+function requiredStartInstanceControlField(control, field) {
+  return requiredThreadControlField(control, field);
+}
+function requiredThreadControlField(control, field) {
+  const value = optionalThreadControlField(control, field);
+  if (value === undefined) {
+    throw new Error(`${control.type} control missing ${field}`);
+  }
+  return value;
+}
+function optionalThreadControlField(control, field) {
+  const value = stringValue(control[field])?.trim();
+  if (value === undefined || value === "") {
+    return;
+  }
+  return value;
+}
 function startInstanceRuntimeSettings(options, control) {
-  const session = options.channelSession;
+  const defaults = runnerRuntimeDefaults(options);
   return {
-    model: control.model ?? session?.model,
-    reasoningEffort: control.reasoningEffort ?? session?.reasoningEffort,
-    approvalPolicy: control.approvalPolicy ?? session?.approvalPolicy,
-    sandbox: control.sandbox ?? session?.sandbox,
+    model: control.model ?? defaults.model,
+    reasoningEffort: control.reasoningEffort ?? defaults.reasoningEffort,
+    approvalPolicy: control.approvalPolicy ?? defaults.approvalPolicy,
+    sandbox: control.sandbox ?? defaults.sandbox,
     fast: control.fast ?? options.fast
   };
 }
 async function startOwnedCodexAppServer(options) {
   ensureCodexProjectTrusted(options.cwd);
+  const defaults = runnerRuntimeDefaults(options);
   return await startCodexAppServer(options.codexBin, options.cwd, {
-    model: options.channelSession?.model,
-    reasoningEffort: options.channelSession?.reasoningEffort,
+    model: defaults.model,
+    reasoningEffort: defaults.reasoningEffort,
     fast: options.fast
   });
 }
+function runnerWorkspaceSlug(options) {
+  return options.channelSession?.workspaceSlug ?? options.workspaceSlug;
+}
+function runnerRuntimeDefaults(options) {
+  const session = options.channelSession;
+  const defaults = options.runtimeDefaults;
+  return {
+    model: defaults?.model ?? session?.model,
+    reasoningEffort: defaults?.reasoningEffort ?? session?.reasoningEffort,
+    approvalPolicy: defaults?.approvalPolicy ?? session?.approvalPolicy,
+    sandbox: defaults?.sandbox ?? session?.sandbox
+  };
+}
 function isUpdateRunnerConfigControl(control) {
   return control.type === "update_runner_config";
 }
+function isSetPortForwardEnabledControl(control) {
+  return control.type === "set_port_forward_enabled" && Number.isInteger(control.port) && control.port > 0 && control.port <= 65535;
+}
 function normalizeAllowedCwds(values) {
   return Array.from(new Set(values.flatMap((value) => {
     const normalized = value.trim();
     return normalized === "" ? [] : [normalized];
   })));
 }
+function configuredAllowedCwds(values) {
+  const allowedCwds = [];
+  const missingAllowedCwds = [];
+  for (const value of normalizeAllowedCwds(values)) {
+    const absolutePath = resolve5(expandUserPath(value));
+    try {
+      const realPath = realpathSync4(absolutePath);
+      allowedCwds.push(...realPath === absolutePath ? [realPath] : [realPath, absolutePath]);
+    } catch (error) {
+      if (isMissingAllowedCwdError(error)) {
+        missingAllowedCwds.push(absolutePath);
+        continue;
+      }
+      throw error;
+    }
+  }
+  return {
+    allowedCwds: normalizeAllowedCwds(allowedCwds),
+    missingAllowedCwds: normalizeAllowedCwds(missingAllowedCwds)
+  };
+}
+function isMissingAllowedCwdError(error) {
+  return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR" || error.code === "EACCES" || error.code === "ELOOP" || error.code === "EIO");
+}
 function allowedCwdSuggestions(cwd, allowedCwds) {
   return normalizeAllowedCwds([cwd, ...allowedCwds]);
 }
@@ -7803,12 +9169,18 @@ async function acquireAndCacheToken(args) {
 }
 
 // src/localConfig.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync4, realpathSync as realpathSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import {
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync4,
+  realpathSync as realpathSync5,
+  writeFileSync as writeFileSync5
+} from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
+import { dirname as dirname5, resolve as resolve6 } from "node:path";
 function localConfigPath(env = process.env) {
   const override = env.LINZUMI_CONFIG_FILE;
-  return override !== undefined && override.trim() !== "" ? resolve5(expandUserPath(override)) : resolve5(homedir6(), ".linzumi", "config.json");
+  return override !== undefined && override.trim() !== "" ? resolve6(expandUserPath(override)) : resolve6(homedir6(), ".linzumi", "config.json");
 }
 function readLocalConfig(path = localConfigPath()) {
   if (!existsSync5(path)) {
@@ -7823,24 +9195,36 @@ function readLocalConfig(path = localConfigPath()) {
     allowedCwds: uniqueStrings(parsed.allowedCwds)
   };
 }
-function readConfiguredAllowedCwds(path = localConfigPath()) {
-  return readLocalConfig(path).allowedCwds.map((cwd) => {
+function readConfiguredAllowedCwdDetails(path = localConfigPath()) {
+  const allowedCwds = [];
+  const missingAllowedCwds = [];
+  for (const cwd of readLocalConfig(path).allowedCwds) {
+    const absolutePath = resolve6(expandUserPath(cwd));
     try {
-      return realpathSync4(resolve5(expandUserPath(cwd)));
-    } catch (_error) {
-      throw new Error(`invalid Linzumi config allowed path: ${cwd} does not exist`);
+      const realPath = realpathSync5(absolutePath);
+      allowedCwds.push(...realPath === absolutePath ? [realPath] : [realPath, absolutePath]);
+    } catch (error) {
+      if (isMissingPathError(error)) {
+        missingAllowedCwds.push(absolutePath);
+        continue;
+      }
+      throw error;
     }
-  });
+  }
+  return {
+    allowedCwds: uniqueStrings(allowedCwds),
+    missingAllowedCwds: uniqueStrings(missingAllowedCwds)
+  };
 }
 function addAllowedCwd(pathValue, path = localConfigPath()) {
-  const normalizedPath = realpathSync4(resolve5(expandUserPath(pathValue)));
+  const normalizedPath = realpathSync5(resolve6(expandUserPath(pathValue)));
   const config = readLocalConfig(path);
   const allowedCwds = uniqueStrings([...config.allowedCwds, normalizedPath]);
   writeLocalConfig({ version: 1, allowedCwds }, path);
   return allowedCwds;
 }
 function removeAllowedCwd(pathValue, path = localConfigPath()) {
-  const requestedPath = resolve5(expandUserPath(pathValue));
+  const requestedPath = resolve6(expandUserPath(pathValue));
   const normalizedRequest = realpathOrResolved(requestedPath);
   const config = readLocalConfig(path);
   const allowedCwds = config.allowedCwds.filter((cwd) => {
@@ -7859,13 +9243,18 @@ function isConfigPayload(value) {
   return typeof value === "object" && value !== null && value.version === 1 && Array.isArray(value.allowedCwds) && value.allowedCwds.every((cwd) => typeof cwd === "string" && cwd.trim() !== "");
 }
 function uniqueStrings(values) {
-  return [...new Set(values.map((value) => value.trim()).filter((value) => value !== ""))];
+  return [
+    ...new Set(values.map((value) => value.trim()).filter((value) => value !== ""))
+  ];
+}
+function isMissingPathError(error) {
+  return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR" || error.code === "EACCES" || error.code === "ELOOP" || error.code === "EIO");
 }
 function realpathOrResolved(pathValue) {
   try {
-    return realpathSync4(resolve5(expandUserPath(pathValue)));
+    return realpathSync5(resolve6(expandUserPath(pathValue)));
   } catch (_error) {
-    return resolve5(expandUserPath(pathValue));
+    return resolve6(expandUserPath(pathValue));
   }
 }
 
@@ -8263,7 +9652,7 @@ async function runClaim(command, deps) {
     workspaceName: stringValue(response.workspace_name),
     channelId: stringValue(response.channel_id),
     ownerUsername: stringValue(response.owner_username),
-    channelUrl: requiredString(response, "channel_url"),
+    channelUrl: stringValue(response.channel_url),
     loginUrl: requiredString(response, "login_url"),
     supportChannelId: requiredString(response, "support_channel_id"),
     supportChannelUrl: requiredString(response, "support_channel_url"),
@@ -8282,8 +9671,10 @@ async function runClaim(command, deps) {
   deps.stdout.write(`login_url: ${tokenFile.loginUrl}
 `);
   writeHumanLoginUrlWarning(deps);
-  deps.stdout.write(`channel_url: ${tokenFile.channelUrl}
+  if (tokenFile.channelUrl !== undefined) {
+    deps.stdout.write(`channel_url: ${tokenFile.channelUrl}
 `);
+  }
   deps.stdout.write(`support_channel_id: ${tokenFile.supportChannelId}
 `);
   deps.stdout.write(`support_channel_url: ${tokenFile.supportChannelUrl}
@@ -8552,7 +9943,7 @@ function readStoredAgentTokenFile(path, readTextFile = readOptionalTextFile) {
     workspaceName: stringValue(parsed.workspaceName),
     channelId: stringValue(parsed.channelId),
     ownerUsername: stringValue(parsed.ownerUsername),
-    channelUrl: requiredString(parsed, "channelUrl"),
+    channelUrl: stringValue(parsed.channelUrl),
     loginUrl: requiredString(parsed, "loginUrl"),
     supportChannelId: requiredString(parsed, "supportChannelId"),
     supportChannelUrl: stringValue(parsed.supportChannelUrl),
@@ -8606,7 +9997,7 @@ Launch target:
 
 // src/helloLinzumiProject.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname7, join as join9, resolve as resolve6 } from "node:path";
+import { dirname as dirname7, join as join9, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
 var defaultHelloLinzumiProjectDir = "/tmp/hello_linzumi";
 var defaultHelloLinzumiProjectName = "hello_linzumi";
@@ -8640,10 +10031,10 @@ function resolveHelloProjectRoot(options) {
     throw new Error("linzumi init-hello-linzumi-demo-app accepts either --dir or --parent-dir/--name, not both");
   }
   if (options.rootPath !== undefined) {
-    return resolve6(options.rootPath);
+    return resolve7(options.rootPath);
   }
   const name = normalizeProjectName(options.name ?? defaultHelloLinzumiProjectName);
-  return resolve6(options.parentDir ?? defaultHelloLinzumiParentDir, name);
+  return resolve7(options.parentDir ?? defaultHelloLinzumiParentDir, name);
 }
 function normalizeProjectName(value) {
   const name = value.trim();
@@ -9178,7 +10569,7 @@ import {
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname8, join as join10, resolve as resolve7 } from "node:path";
+import { dirname as dirname8, join as join10, resolve as resolve8 } from "node:path";
 import { execFileSync, spawn as spawn7 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var connectedMarker = "Runner connected:";
@@ -9194,7 +10585,7 @@ function defaultCommanderLogFile(runnerId, statusDir = commanderStatusDir()) {
 function startCommanderDaemon(options) {
   const statusDir = options.statusDir ?? commanderStatusDir();
   const statusFile = commanderStatusFile(options.runnerId, statusDir);
-  const logFile = resolve7(options.logFile ?? defaultCommanderLogFile(options.runnerId, statusDir));
+  const logFile = resolve8(options.logFile ?? defaultCommanderLogFile(options.runnerId, statusDir));
   const entrypoint = options.entrypoint ?? currentEntrypoint();
   const nodeBin = options.nodeBin ?? process.execPath;
   const command = [
@@ -9375,7 +10766,9 @@ function readProcessIdentity(pid) {
     if (match === null) {
       return { command: output };
     }
-    return { startedAt: match[1], command: match[2] };
+    const startedAt = match[1];
+    const processCommand = match[2];
+    return startedAt === undefined || processCommand === undefined ? { command: output } : { startedAt, command: processCommand };
   } catch (_error) {
     return;
   }
@@ -9389,7 +10782,7 @@ function safeRunnerId(runnerId) {
 }
 async function waitForFileChangeOrTimeout(path, deadline, now, ready2 = () => false) {
   const remaining = Math.max(0, deadline - now());
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     let resolved = false;
     let watcher;
     const finish = () => {
@@ -9399,7 +10792,7 @@ async function waitForFileChangeOrTimeout(path, deadline, now, ready2 = () => fa
       resolved = true;
       watcher?.close();
       clearTimeout(timer);
-      resolve8();
+      resolve9();
     };
     const timer = setTimeout(finish, remaining);
     try {
@@ -9479,7 +10872,7 @@ function isMainModule() {
   if (scriptPath === undefined) {
     return false;
   }
-  return fileURLToPath3(import.meta.url) === resolve8(scriptPath);
+  return fileURLToPath3(import.meta.url) === resolve9(scriptPath);
 }
 async function main(args) {
   const parsed = parseCommand(args);
@@ -9488,7 +10881,7 @@ async function main(args) {
       process.stdout.write(connectGuideText());
       return;
     case "version":
-      process.stdout.write(`linzumi 0.0.38-beta
+      process.stdout.write(`linzumi 0.0.40-beta
 `);
       return;
     case "auth":
@@ -9582,12 +10975,17 @@ function runHelloCommand(args) {
     process.stdout.write(helloHelpText());
     return;
   }
+  const rootPath = stringValue3(values, "dir");
+  const parentDir = stringValue3(values, "parent-dir");
+  const name = stringValue3(values, "name");
+  const port = tcpPortValue(values, "port");
+  const host = stringValue3(values, "host");
   const project = createHelloLinzumiProject({
-    rootPath: stringValue3(values, "dir"),
-    parentDir: stringValue3(values, "parent-dir") === undefined ? undefined : resolveUserPath(required(values, "parent-dir")),
-    name: stringValue3(values, "name"),
-    port: tcpPortValue(values, "port"),
-    host: stringValue3(values, "host"),
+    ...rootPath === undefined ? {} : { rootPath },
+    ...parentDir === undefined ? {} : { parentDir: resolveUserPath(parentDir) },
+    ...name === undefined ? {} : { name },
+    ...port === undefined ? {} : { port },
+    ...host === undefined ? {} : { host },
     reset: values.get("reset") === true
   });
   if (values.get("json") === true) {
@@ -9636,7 +11034,7 @@ function runPathsCommand(args) {
       if (pathValue === undefined || pathValue.trim() === "") {
         throw new Error("missing path for linzumi paths add");
       }
-      const trustedPath = realpathSync5(resolve8(expandUserPath(pathValue)));
+      const trustedPath = realpathSync6(resolve9(expandUserPath(pathValue)));
       addAllowedCwd(pathValue);
       process.stdout.write(`Trusted ${trustedPath}
 `);
@@ -9826,6 +11224,7 @@ async function parseStartRunnerArgs(args, deps = {
     kandanUrl,
     token: targetToken,
     runnerId: stringValue3(values, "runner-id") ?? `runner-${randomUUID3()}`,
+    workspaceSlug: target.workspaceSlug,
     cwd,
     codexBin,
     codexUrl: stringValue3(values, "codex-url"),
@@ -9838,6 +11237,7 @@ async function parseStartRunnerArgs(args, deps = {
     editorRuntime: editorRuntime.runtime,
     socketFactory: trustedWebSocketFactory(kandanTlsTrustFromEnv()),
     dependencyStatus,
+    runtimeDefaults: runnerRuntimeDefaultsFromValues(values),
     channelSession: {
       workspaceSlug: target.workspaceSlug,
       channelSlug: target.channelSlug,
@@ -9868,12 +11268,24 @@ async function parseAgentRunnerArgs(args, deps = {
   }
   const tokenFilePath = stringValue3(values, "agent-token-file") ?? defaultAgentTokenFilePath();
   const tokenFile = readStoredAgentTokenFile(tokenFilePath, deps.readTextFile);
-  const channelSlug = requiredStoredAgentChannel(tokenFile.channelId);
-  const listenUser = stringValue3(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername);
+  const channelSlug = tokenFile.channelId;
+  rejectWorkspaceCommanderThreadFlags(values, channelSlug);
+  const channelSession = channelSlug === undefined ? undefined : {
+    workspaceSlug: tokenFile.workspaceId,
+    channelSlug,
+    kandanThreadId: stringValue3(values, "linzumi-thread-id"),
+    listenUser: stringValue3(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
+    model: stringValue3(values, "model"),
+    reasoningEffort: stringValue3(values, "reasoning-effort"),
+    sandbox: stringValue3(values, "sandbox"),
+    approvalPolicy: stringValue3(values, "approval-policy"),
+    streamFlushMs: positiveIntegerValue(values, "stream-flush-ms")
+  };
   const kandanUrl = stringValue3(values, "linzumi-url") ?? agentApiUrlToKandanUrl(tokenFile.apiUrl);
   const requestedCwdValue = cwdArg ?? stringValue3(values, "cwd");
   const requestedCwd = resolveUserPath(requestedCwdValue ?? process.cwd());
-  const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : requestedCwdValue === undefined ? readConfiguredAllowedCwds() : assertConfiguredAllowedCwds([requestedCwd]);
+  const configuredAllowedCwds2 = requestedCwdValue === undefined && !values.has("allowed-cwd") ? readConfiguredAllowedCwdDetails() : { allowedCwds: [], missingAllowedCwds: [] };
+  const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : requestedCwdValue === undefined ? configuredAllowedCwds2.allowedCwds.length > 0 ? [...configuredAllowedCwds2.allowedCwds] : assertConfiguredAllowedCwds([requestedCwd]) : assertConfiguredAllowedCwds([requestedCwd]);
   const cwd = allowedCwds[0] ?? requestedCwd;
   const codexBin = stringValue3(values, "codex-bin") ?? "codex";
   const customCodeServerBin = stringValue3(values, "code-server-bin");
@@ -9900,6 +11312,7 @@ async function parseAgentRunnerArgs(args, deps = {
     kandanUrl,
     token: tokenFile.commanderToken,
     runnerId: stringValue3(values, "runner-id") ?? `agent-runner-${randomUUID3()}`,
+    workspaceSlug: tokenFile.workspaceId,
     cwd,
     codexBin,
     codexUrl: stringValue3(values, "codex-url"),
@@ -9907,22 +11320,14 @@ async function parseAgentRunnerArgs(args, deps = {
     fast: values.get("fast") === true,
     logFile: stringValue3(values, "log-file"),
     allowedCwds,
+    missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(stringValue3(values, "forward-port")),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
     socketFactory: trustedWebSocketFactory(kandanTlsTrustFromEnv()),
     dependencyStatus,
-    channelSession: {
-      workspaceSlug: tokenFile.workspaceId,
-      channelSlug,
-      kandanThreadId: stringValue3(values, "linzumi-thread-id"),
-      listenUser,
-      model: stringValue3(values, "model"),
-      reasoningEffort: stringValue3(values, "reasoning-effort"),
-      sandbox: stringValue3(values, "sandbox"),
-      approvalPolicy: stringValue3(values, "approval-policy"),
-      streamFlushMs: positiveIntegerValue(values, "stream-flush-ms")
-    }
+    runtimeDefaults: runnerRuntimeDefaultsFromValues(values),
+    channelSession
   };
 }
 function readAgentTokenTextFile(path) {
@@ -9940,11 +11345,11 @@ function rejectAgentRunnerTargetingFlags(values) {
     throw new Error(`linzumi commander uses the claimed human Commander token scope; remove ${unsupportedFlags.map((flag) => `--${flag}`).join(", ")}.`);
   }
 }
-function requiredStoredAgentChannel(channelId) {
-  if (channelId !== undefined) {
-    return channelId;
+function rejectWorkspaceCommanderThreadFlags(values, channelSlug) {
+  if (channelSlug !== undefined || !values.has("linzumi-thread-id")) {
+    return;
   }
-  throw new Error("agent token file is missing channelId; rerun linzumi claim before starting a Commander");
+  throw new Error("linzumi commander cannot bind --linzumi-thread-id because the agent token file has no channelId");
 }
 function requiredStoredOwnerUsername(ownerUsername) {
   if (ownerUsername !== undefined) {
@@ -10002,7 +11407,7 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   if (values.get("version") === true) {
-    process.stdout.write(`linzumi 0.0.38-beta
+    process.stdout.write(`linzumi 0.0.40-beta
 `);
     process.exit(0);
   }
@@ -10010,7 +11415,8 @@ async function parseRunnerArgs(args, deps = {
   const kandanUrl = required(values, "linzumi-url");
   const cwd = stringValue3(values, "cwd") ?? process.cwd();
   const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
-  const configuredAllowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : readConfiguredAllowedCwds();
+  const localConfiguredAllowedCwds = values.has("allowed-cwd") ? { allowedCwds: [], missingAllowedCwds: [] } : readConfiguredAllowedCwdDetails();
+  const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : [...localConfiguredAllowedCwds.allowedCwds];
   const codexBin = stringValue3(values, "codex-bin") ?? "codex";
   const customCodeServerBin = stringValue3(values, "code-server-bin");
   const explicitToken = stringValue3(values, "token");
@@ -10050,15 +11456,26 @@ async function parseRunnerArgs(args, deps = {
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
     logFile: stringValue3(values, "log-file"),
-    allowedCwds: Array.from(new Set([...cwdAllowedCwds, ...configuredAllowedCwds])),
+    allowedCwds: Array.from(new Set([...cwdAllowedCwds, ...configuredAllowedCwds2])),
+    missingAllowedCwds: localConfiguredAllowedCwds.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(stringValue3(values, "forward-port")),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
     socketFactory: trustedWebSocketFactory(kandanTlsTrustFromEnv()),
     dependencyStatus,
+    workspaceSlug: channelSession?.workspaceSlug ?? singleWorkspaceScopeFromAccessToken(token),
+    runtimeDefaults: runnerRuntimeDefaultsFromValues(values),
     channelSession
   };
 }
+function runnerRuntimeDefaultsFromValues(values) {
+  return {
+    model: stringValue3(values, "model"),
+    reasoningEffort: stringValue3(values, "reasoning-effort"),
+    approvalPolicy: stringValue3(values, "approval-policy"),
+    sandbox: stringValue3(values, "sandbox")
+  };
+}
 function strictFlagValues(args, definitions = flagDefinitions) {
   const values = new Map;
   for (let index = 0;index < args.length; index += 1) {
@@ -10153,9 +11570,9 @@ function resolveUserPath(pathValue) {
     return homedir9();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve8(homedir9(), pathValue.slice(2));
+    return resolve9(homedir9(), pathValue.slice(2));
   }
-  return resolve8(pathValue);
+  return resolve9(pathValue);
 }
 function parseChannelSession(values, token, target) {
   if (target === undefined) {
@@ -10439,10 +11856,10 @@ Usage:
 
 What it does:
   Starts this computer as the claimed human's scoped Linzumi Commander. The command
-  reads ~/.linzumi/agent-token.json, uses its workspace/channel scope, reads
-  trusted folders from ~/.linzumi/config.json when no folder is passed, and
-  listens only to the owning human recorded during claim unless --listen-user is
-  passed.
+  reads ~/.linzumi/agent-token.json, connects to its workspace even when no
+  channel is assigned, reads trusted folders from ~/.linzumi/config.json when no
+  folder is passed, and uses the token's channel scope for channel-bound startup
+  when one is present.
 
 Options:
   --agent-token-file <path>   Agent token cache, default ~/.linzumi/agent-token.json