@linzumi/cli 0.0.40-beta → 0.0.42-beta

package/dist/index.js

@@ -1,16 +1,16 @@
 // src/index.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync9, realpathSync as realpathSync6 } from "node:fs";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { existsSync as existsSync11, readFileSync as readFileSync10, realpathSync as realpathSync6 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/runner.ts
 import { spawn as spawn6 } from "node:child_process";
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { realpathSync as realpathSync4 } from "node:fs";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { realpathSync as realpathSync5 } from "node:fs";
 import { hostname as hostname2 } from "node:os";
-import { join as join6, resolve as resolve5 } from "node:path";
+import { join as join8, resolve as resolve6 } from "node:path";
 
 // src/channelSessionSupport.ts
 import { spawnSync } from "node:child_process";
@@ -248,7 +248,7 @@ function codexThreadRuntimeOverrides(options) {
     ...session.model === undefined ? {} : { model: session.model },
     ...session.reasoningEffort === undefined ? {} : { reasoningEffort: session.reasoningEffort },
     ...options.fast === true ? { serviceTier: "fast" } : {},
-    ...session.approvalPolicy === undefined ? {} : { approvalPolicy: session.approvalPolicy },
+    approvalPolicy: codexApprovalPolicyForRequest(session.approvalPolicy, session.sandbox),
     ...session.sandbox === undefined ? {} : { sandbox: session.sandbox }
   };
 }
@@ -259,10 +259,30 @@ function codexTurnRuntimeOverrides(options) {
     ...session.model === undefined ? {} : { model: session.model },
     ...session.reasoningEffort === undefined ? {} : { effort: session.reasoningEffort },
     ...options.fast === true ? { serviceTier: "fast" } : {},
-    ...session.approvalPolicy === undefined ? {} : { approvalPolicy: session.approvalPolicy },
+    approvalPolicy: codexApprovalPolicyForRequest(session.approvalPolicy, session.sandbox),
     ...session.sandbox === undefined ? {} : { sandboxPolicy: codexSandboxPolicy(session.sandbox, options.cwd) }
   };
 }
+function codexApprovalPolicySetting(approvalPolicy, sandbox) {
+  if (approvalPolicy === undefined || approvalPolicy === "default") {
+    return;
+  }
+  return codexApprovalPolicyForRequest(approvalPolicy, sandbox);
+}
+function codexApprovalPolicyForRequest(approvalPolicy, sandbox) {
+  switch (approvalPolicy) {
+    case undefined:
+    case "default":
+      return "on-request";
+    case "never":
+      return sandbox === "danger-full-access" ? "never" : "on-request";
+    case "on-request":
+    case "on-failure":
+      return approvalPolicy;
+    default:
+      throw new Error(`unsupported Codex approval policy: ${approvalPolicy}`);
+  }
+}
 function codexSandboxPolicy(sandbox, cwd) {
   switch (sandbox) {
     case "danger-full-access":
@@ -290,6 +310,9 @@ function codexSandboxPolicy(sandbox, cwd) {
 // src/codexOutput.ts
 import { Buffer as Buffer2 } from "node:buffer";
 var maxVisibleWebSearchQueries = 6;
+var maxPersistedCommandOutputChars = 14000;
+var maxPersistedCommandLabelChars = 512;
+var commandOutputTruncationReason = "phoenix_insert_body_limit";
 function codexOutputMessagesForTurn(response, turnId) {
   if ("error" in response) {
     return [];
@@ -355,21 +378,20 @@ function codexOutputMessagesForItem(item, index) {
     case "commandExecution": {
       const command = stringValue(item.command) ?? "command";
       const output = nonBlankStringValue(item.aggregatedOutput) ?? "";
-      const body = [`$ ${command}`, output].filter((part) => part.trim() !== "").join(`
-
-`);
+      const projection = codexCommandOutputProjection(command, output);
       return [
         {
           itemKey,
-          body,
+          body: projection.body,
           structured: baseStructured("codex_command_execution", {
-            command,
+            command: projection.command,
             cwd: stringValue(item.cwd) ?? "",
             status: stringValue(item.status) ?? "",
             process_id: stringValue(item.processId) ?? "",
             duration_ms: integerValue(item.durationMs) ?? null,
             exit_code: integerValue(item.exitCode) ?? null,
-            output
+            output: projection.output,
+            ...commandOutputTruncationMetadata(projection)
           })
         }
       ];
@@ -501,21 +523,29 @@ function codexCommandOutputDeltaFromNotification(params) {
   };
 }
 function codexCommandExecutionStructuredMessage(itemKey, fields, streamState) {
+  const projection = codexCommandOutputProjection(fields.command, fields.output);
+  return codexCommandExecutionStructuredMessageFromProjection(itemKey, fields, streamState, projection);
+}
+function codexCommandExecutionStructuredMessageFromProjection(itemKey, fields, streamState, projection) {
   return {
     kind: "codex_command_execution",
     item_id: itemKey,
     transcript_unit_id: `codex_command_execution:${itemKey}`,
     stream_state: streamState,
-    command: fields.command,
+    command: projection.command,
     cwd: fields.cwd ?? "",
     status: fields.status ?? streamState,
     process_id: fields.processId ?? "",
     duration_ms: fields.durationMs ?? null,
     exit_code: fields.exitCode ?? null,
     stream: fields.stream ?? "",
-    output: fields.output
+    output: projection.output,
+    ...commandOutputTruncationMetadata(projection)
   };
 }
+function codexCommandOutputBody(command, output) {
+  return codexCommandOutputProjection(command, output).body;
+}
 function codexFileChangeDeltaFromNotification(params) {
   const patchText = textDeltaFromParams(params);
   if (patchText === undefined || patchText === "") {
@@ -618,6 +648,65 @@ function assistantVisibleText(item) {
 function assistantDeltaText(params) {
   return textDeltaFromParams(params);
 }
+function codexCommandOutputProjection(command, output) {
+  const normalizedCommand = truncatePersistedText(sanitizePersistedText(command), maxPersistedCommandLabelChars, "command label");
+  const normalizedOutput = truncateCommandOutput(sanitizePersistedText(output));
+  const body = commandOutputBodyForProjection(normalizedCommand.text, normalizedOutput.text);
+  return {
+    command: normalizedCommand.text,
+    output: normalizedOutput.text,
+    body,
+    truncated: normalizedCommand.truncated || normalizedOutput.truncated,
+    originalLength: output.length,
+    maxOutputChars: maxPersistedCommandOutputChars,
+    truncationReason: commandOutputTruncationReason
+  };
+}
+function commandOutputTruncationMetadata(projection) {
+  return projection.truncated ? {
+    output_truncated: true,
+    output_original_length: projection.originalLength,
+    output_max_chars: projection.maxOutputChars,
+    output_truncation_reason: projection.truncationReason
+  } : {};
+}
+function commandOutputBodyForProjection(command, output) {
+  return [`$ ${command}`, output].filter((part) => part.trim() !== "").join(`
+
+`);
+}
+function truncateCommandOutput(output) {
+  if (output.length <= maxPersistedCommandOutputChars) {
+    return { text: output, truncated: false };
+  }
+  const marker = `
+
+[Linzumi truncated command output: output was too large to persist fully. Owners should search runner logs for codex.command_output_truncated failure_class=phoenix_insert_body_limit.]
+
+`;
+  const availableChars = Math.max(0, maxPersistedCommandOutputChars - marker.length);
+  const headChars = Math.min(2000, Math.floor(availableChars / 3));
+  const tailChars = availableChars - headChars;
+  const text = `${output.slice(0, headChars)}${marker}${output.slice(-tailChars)}`;
+  return {
+    text: text.slice(0, maxPersistedCommandOutputChars),
+    truncated: true
+  };
+}
+function truncatePersistedText(text, maxChars, label) {
+  if (text.length <= maxChars) {
+    return { text, truncated: false };
+  }
+  const marker = `[Linzumi truncated ${label}]`;
+  const availableChars = Math.max(0, maxChars - marker.length - 1);
+  return {
+    text: `${text.slice(0, availableChars)} ${marker}`.slice(0, maxChars),
+    truncated: true
+  };
+}
+function sanitizePersistedText(text) {
+  return text.replaceAll("\x00", "�");
+}
 function textDeltaFromParams(params) {
   const delta = params.delta;
   if (typeof delta === "string") {
@@ -641,57 +730,67 @@ function commandMessageForFunctionCall(item, output, index) {
   const command = name === "exec_command" ? nonBlankStringValue(args?.cmd) ?? name : `${name}${toolArgumentsSummary(item.arguments)}`;
   const cwd = nonBlankStringValue(args?.cwd) ?? "";
   const outputText = toolOutputText(output);
-  const body = [`$ ${command}`, outputText].filter((part) => part.trim() !== "").join(`
-
-`);
-  return [{
-    itemKey,
-    body,
-    structured: codexCommandExecutionStructuredMessage(itemKey, {
-      command,
-      cwd,
-      output: outputText,
-      status: output === undefined ? "started" : "completed"
-    }, "completed")
-  }];
+  const projection = codexCommandOutputProjection(command, outputText);
+  return [
+    {
+      itemKey,
+      body: projection.body,
+      structured: codexCommandExecutionStructuredMessage(itemKey, {
+        command,
+        cwd,
+        output: outputText,
+        status: output === undefined ? "started" : "completed"
+      }, "completed")
+    }
+  ];
 }
 function messageForCustomToolCall(item, output, index) {
   const name = stringValue(item.name) ?? "custom_tool_call";
   const itemKey = stringValue(item.call_id) ?? stringValue(item.id) ?? `item-${index}`;
   const input = nonBlankStringValue(item.input) ?? nonBlankStringValue(item.arguments) ?? "";
   if (name === "apply_patch") {
-    return [{
-      itemKey,
-      body: input,
-      structured: {
-        kind: "codex_file_change",
-        item_id: itemKey,
-        transcript_unit_id: `codex_file_change:${itemKey}`,
-        stream_state: "completed",
-        status: output === undefined ? "started" : "completed",
-        patch_text: input,
-        changes: fileChangesFromPatch(input)
+    return [
+      {
+        itemKey,
+        body: input,
+        structured: {
+          kind: "codex_file_change",
+          item_id: itemKey,
+          transcript_unit_id: `codex_file_change:${itemKey}`,
+          stream_state: "completed",
+          status: output === undefined ? "started" : "completed",
+          patch_text: input,
+          changes: fileChangesFromPatch(input)
+        }
       }
-    }];
+    ];
   }
   const outputText = toolOutputText(output);
   const command = `${name}${toolArgumentsSummary(item.input)}`;
-  return [{
-    itemKey,
-    body: [`$ ${command}`, outputText].filter((part) => part.trim() !== "").join(`
-
-`),
-    structured: codexCommandExecutionStructuredMessage(itemKey, { command, output: outputText, status: output === undefined ? "started" : "completed" }, "completed")
-  }];
+  const projection = codexCommandOutputProjection(command, outputText);
+  return [
+    {
+      itemKey,
+      body: projection.body,
+      structured: codexCommandExecutionStructuredMessage(itemKey, {
+        command,
+        output: outputText,
+        status: output === undefined ? "started" : "completed"
+      }, "completed")
+    }
+  ];
 }
 function commandMessageForUnpairedToolOutput(item, index) {
   const itemKey = stringValue(item.call_id) ?? stringValue(item.id) ?? `item-${index}`;
   const output = toolOutputText(item);
-  return [{
-    itemKey,
-    body: output,
-    structured: codexCommandExecutionStructuredMessage(itemKey, { command: "tool output", output, status: "completed" }, "completed")
-  }];
+  const projection = codexCommandOutputProjection("tool output", output);
+  return [
+    {
+      itemKey,
+      body: projection.output,
+      structured: codexCommandExecutionStructuredMessageFromProjection(itemKey, { status: "completed" }, "completed", projection)
+    }
+  ];
 }
 function toolArgumentsSummary(value) {
   const text = nonBlankStringValue(value);
@@ -710,13 +809,34 @@ function fileChangesFromPatch(patchText) {
     const addPrefix = "*** Add File: ";
     const deletePrefix = "*** Delete File: ";
     if (line.startsWith(updatePrefix)) {
-      return [{ path: line.slice(updatePrefix.length).trim(), diff: "", kind: "update", move_path: "" }];
+      return [
+        {
+          path: line.slice(updatePrefix.length).trim(),
+          diff: "",
+          kind: "update",
+          move_path: ""
+        }
+      ];
     }
     if (line.startsWith(addPrefix)) {
-      return [{ path: line.slice(addPrefix.length).trim(), diff: "", kind: "add", move_path: "" }];
+      return [
+        {
+          path: line.slice(addPrefix.length).trim(),
+          diff: "",
+          kind: "add",
+          move_path: ""
+        }
+      ];
     }
     if (line.startsWith(deletePrefix)) {
-      return [{ path: line.slice(deletePrefix.length).trim(), diff: "", kind: "delete", move_path: "" }];
+      return [
+        {
+          path: line.slice(deletePrefix.length).trim(),
+          diff: "",
+          kind: "delete",
+          move_path: ""
+        }
+      ];
     }
     return [];
   });
@@ -2345,8 +2465,8 @@ async function attachChannelSession(args) {
   const session = args.options.channelSession;
   const chatTopic = `chat:${session.workspaceSlug}:${session.channelSlug}`;
   const state = initialChannelSessionState(0, session.rootSeq, session.kandanThreadId, session.codexThreadId, args.options);
-  const joined = await args.kandan.join(chatTopic, { last_seq: 0 }, {
-    rejoinPayload: () => ({ last_seq: state.minSeq })
+  const joined = await args.kandan.join(chatTopic, chatJoinPayload(args.options.runnerId, state, 0), {
+    rejoinPayload: () => chatJoinPayload(args.options.runnerId, state, state.minSeq)
   });
   const cursor = integerValue(joined.cursor) ?? 0;
   const runnerIdentity = identityFromAccessToken(args.options.token);
@@ -2492,6 +2612,19 @@ async function attachChannelSession(args) {
     }
   };
 }
+function chatJoinPayload(runnerId, state, lastSeq) {
+  const base = { last_seq: lastSeq };
+  switch (state.kandanThreadId) {
+    case undefined:
+      return base;
+    default:
+      return {
+        ...base,
+        runner_id: runnerId,
+        thread_id: state.kandanThreadId
+      };
+  }
+}
 async function bindCurrentCodexThread(args, state) {
   if (state.codexThreadId === undefined) {
     return;
@@ -3498,7 +3631,7 @@ async function handleCodexServerRequest(args, state, payloadContext, request) {
   throw new Error(message);
 }
 function codexApprovalRequestCanAutoAccept(settings, method) {
-  return settings.approvalPolicy === "never" && (method === "item/commandExecution/requestApproval" || method === "item/fileChange/requestApproval");
+  return settings.approvalPolicy === "never" && settings.sandbox === "danger-full-access" && (method === "item/commandExecution/requestApproval" || method === "item/fileChange/requestApproval");
 }
 function codexApprovalRequestCanSurface(method) {
   return method === "item/commandExecution/requestApproval" || method === "item/fileChange/requestApproval";
@@ -3972,13 +4105,25 @@ async function forwardCommandOutputDeltaPayload(args, state, delta, payloadConte
   }
   const existing = findStreamingCommandOutput(state, delta.itemKey);
   const output = `${existing?.output ?? ""}${delta.delta}`;
-  const body = commandOutputBody("command output", output);
   const structured = codexCommandExecutionStructuredMessage(delta.itemKey, {
     command: "command output",
     output,
     processId: delta.processId,
     stream: delta.stream
   }, "streaming");
+  const persistedOutput = typeof structured.output === "string" ? structured.output : output;
+  const body = codexCommandOutputBody("command output", output);
+  if (structured.output_truncated === true) {
+    args.log("codex.command_output_truncated", {
+      item_key: delta.itemKey,
+      turn_id: turnId,
+      process_id: delta.processId ?? null,
+      stream: delta.stream,
+      failure_class: stringValue(structured.output_truncation_reason) ?? null,
+      original_length: integerValue(structured.output_original_length) ?? null,
+      persisted_length: persistedOutput.length
+    });
+  }
   if (existing === undefined) {
     const session = args.options.channelSession;
     const reply = await pushOk(args.kandan, args.topic, "session:post_thread_message", {
@@ -4002,7 +4147,7 @@ async function forwardCommandOutputDeltaPayload(args, state, delta, payloadConte
         itemKey: delta.itemKey,
         turnId,
         seq,
-        output,
+        output: persistedOutput,
         processId: delta.processId,
         stream: delta.stream
       });
@@ -4011,7 +4156,7 @@ async function forwardCommandOutputDeltaPayload(args, state, delta, payloadConte
     await editCodexStructuredOutput(args, state, existing.seq, body, structured);
     rememberStreamingCommandOutput(state, {
       ...existing,
-      output,
+      output: persistedOutput,
       processId: delta.processId ?? existing.processId,
       stream: delta.stream
     });
@@ -4021,7 +4166,7 @@ async function forwardCommandOutputDeltaPayload(args, state, delta, payloadConte
     turn_id: turnId,
     process_id: delta.processId ?? null,
     stream: delta.stream,
-    output_length: output.length
+    output_length: persistedOutput.length
   });
 }
 async function forwardFileChangeDeltaPayload(args, state, delta, payloadContext) {
@@ -4216,11 +4361,6 @@ function webSearchProgressClientMessageId(instanceId, turnId) {
 function webSearchProgressItemKey(turnId) {
   return `web-search:${turnId}`;
 }
-function commandOutputBody(command, output) {
-  return [`$ ${command}`, output].filter((part) => part.trim() !== "").join(`
-
-`);
-}
 async function streamCompletedCodexOutput(args, state, payloadContext, params) {
   if (state.kandanThreadId === undefined || state.codexThreadId === undefined) {
     return;
@@ -5012,20 +5152,27 @@ function runtimeSettingsFromOptions(options) {
   return {
     model: options.channelSession.model,
     reasoningEffort: options.channelSession.reasoningEffort,
-    approvalPolicy: options.channelSession.approvalPolicy,
+    approvalPolicy: codexApprovalPolicySetting(options.channelSession.approvalPolicy, options.channelSession.sandbox),
     sandbox: options.channelSession.sandbox,
     fast: options.fast
   };
 }
 function mergeRuntimeSettings(current, update) {
+  const sandbox = mergeOptionalStringRuntimeSetting(current.sandbox, update, "sandbox");
   return {
     model: mergeOptionalStringRuntimeSetting(current.model, update, "model"),
     reasoningEffort: mergeOptionalStringRuntimeSetting(current.reasoningEffort, update, "reasoningEffort"),
-    approvalPolicy: mergeOptionalStringRuntimeSetting(current.approvalPolicy, update, "approvalPolicy"),
-    sandbox: mergeOptionalStringRuntimeSetting(current.sandbox, update, "sandbox"),
+    approvalPolicy: mergeOptionalApprovalPolicyRuntimeSetting(current.approvalPolicy, update, sandbox),
+    sandbox,
     fast: update.fast ?? current.fast
   };
 }
+function mergeOptionalApprovalPolicyRuntimeSetting(current, update, sandbox) {
+  if (Object.prototype.hasOwnProperty.call(update, "approvalPolicy")) {
+    return codexApprovalPolicySetting(update.approvalPolicy ?? undefined, sandbox);
+  }
+  return codexApprovalPolicySetting(current, sandbox);
+}
 function mergeOptionalStringRuntimeSetting(current, update, key) {
   if (Object.prototype.hasOwnProperty.call(update, key)) {
     return update[key] ?? undefined;
@@ -6249,30 +6396,14 @@ function prepareCodeServerLaunch(options) {
   if (platform !== "darwin") {
     return filesystemSandboxUnavailable();
   }
-  const sandboxExecBin = options.sandboxExecBin ?? "/usr/bin/sandbox-exec";
-  if (!existsSync2(sandboxExecBin)) {
-    return filesystemSandboxUnavailable();
-  }
   const codeServerExecutable = resolveCodeServerExecutable(options.codeServerBin, options.envPath ?? process.env.PATH ?? "");
   if (!codeServerExecutable.ok) {
     return filesystemSandboxUnavailable();
   }
   return {
     ok: true,
-    command: sandboxExecBin,
-    args: [
-      "-p",
-      codeServerSandboxProfile(options, codeServerExecutable.directory),
-      "--",
-      "/bin/sh",
-      "-c",
-      'export HOME="$1"; export PWD="$1"; export TMPDIR="$2"; export TMP="$2"; export TEMP="$2"; shift 2; exec "$@"',
-      "kandan-code-server-env",
-      options.cwd,
-      join4(options.userDataDir, "tmp"),
-      codeServerExecutable.command,
-      ...codeServerArgs(options.port, options.cwd, options.userDataDir, options.extensionsDir)
-    ]
+    command: codeServerExecutable.command,
+    args: codeServerArgs(options.port, options.cwd, options.userDataDir, options.extensionsDir)
   };
 }
 function prepareLinuxCodeServerLaunch(options) {
@@ -6343,43 +6474,6 @@ function filesystemSandboxUnavailable() {
     reason: "local_editor_filesystem_sandbox_unavailable"
   };
 }
-function codeServerSandboxProfile(options, codeServerBinDir) {
-  const readOnlyRoots = uniquePaths([
-    "/System",
-    "/Library",
-    "/usr",
-    "/bin",
-    "/sbin",
-    "/etc",
-    "/private/etc",
-    "/opt/homebrew",
-    ...options.codeServerRuntimeRoot === undefined ? [] : sandboxPathAliases(options.codeServerRuntimeRoot),
-    codeServerBinDir
-  ]);
-  const readWriteRoots = uniquePaths([
-    ...sandboxPathAliases(options.cwd),
-    ...sandboxPathAliases(options.userDataDir),
-    ...options.extensionsDir === undefined ? [] : sandboxPathAliases(options.extensionsDir)
-  ]);
-  return [
-    "(version 1)",
-    "(deny default)",
-    "(allow process*)",
-    "(allow signal (target self))",
-    "(allow signal (target same-sandbox))",
-    "(allow sysctl*)",
-    "(allow mach*)",
-    "(allow ipc*)",
-    "(allow network*)",
-    "(allow file-read-metadata)",
-    "(allow file-map-executable)",
-    '(allow file-read* (literal "/") (literal "/private") (literal "/private/var"))',
-    `(allow file-read* ${readOnlyRoots.map(sandboxSubpath).join(" ")})`,
-    '(allow file-read* file-write* (subpath "/dev"))',
-    `(allow file-read* file-write* ${readWriteRoots.map(sandboxSubpath).join(" ")})`
-  ].join(`
-`);
-}
 function resolveCodeServerExecutable(command, envPath) {
   if (hasPathSeparator(command)) {
     const directory = safeRealpathDir(command);
@@ -6420,9 +6514,6 @@ function sandboxPathAliases(path) {
 function uniquePaths(paths) {
   return Array.from(new Set(paths.filter((path) => path.length > 0)));
 }
-function sandboxSubpath(path) {
-  return `(subpath "${path.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}")`;
-}
 function prepareLocalEditorCollaboration(collaboration, runnerId, serverPort, browserBaseUrl) {
   if (collaboration === undefined || serverPort === undefined) {
     return;
@@ -6548,19 +6639,11 @@ function installDirectory(sourceDir, destinationDir) {
   mkdirSync3(dirname2(destinationDir), { recursive: true });
   cpSync(sourceDir, destinationDir, { recursive: true });
 }
-function codeServerEnv(env, cwd, userDataDir, collaboration) {
+function codeServerEnv(env, cwd, _userDataDir, collaboration) {
   const { PORT: _port, ...hostEnv } = env;
-  const tempDir = join4(userDataDir, "tmp");
   const base = {
     ...hostEnv,
-    HOME: cwd,
-    PWD: cwd,
-    TMPDIR: tempDir,
-    TMP: tempDir,
-    TEMP: tempDir,
-    XDG_CACHE_HOME: join4(userDataDir, "xdg-cache"),
-    XDG_CONFIG_HOME: join4(userDataDir, "xdg-config"),
-    XDG_DATA_HOME: join4(userDataDir, "xdg-data")
+    PWD: cwd
   };
   if (collaboration === undefined) {
     return base;
@@ -7891,6 +7974,356 @@ function waitForOpen2(websocket) {
   });
 }
 
+// src/runnerLock.ts
+import {
+  closeSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync6,
+  openSync as openSync2,
+  readFileSync as readFileSync4,
+  unlinkSync as unlinkSync2,
+  writeSync
+} from "node:fs";
+import { dirname as dirname5, join as join7 } from "node:path";
+
+// src/localConfig.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  existsSync as existsSync4,
+  linkSync,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync4,
+  unlinkSync,
+  writeFileSync as writeFileSync4
+} from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { basename as basename4, dirname as dirname4, join as join6, resolve as resolve5 } from "node:path";
+function localConfigPath(env = process.env) {
+  const override = env.LINZUMI_CONFIG_FILE;
+  return override !== undefined && override.trim() !== "" ? resolve5(expandUserPath(override)) : resolve5(homedir5(), ".linzumi", "config.json");
+}
+function readLocalConfig(path = localConfigPath()) {
+  if (!existsSync4(path)) {
+    return { version: 1, allowedCwds: [] };
+  }
+  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  if (!isConfigPayload(parsed)) {
+    throw new Error(`invalid Linzumi config: ${path}`);
+  }
+  const allowedCwds = uniqueStrings(parsed.allowedCwds);
+  return parsed.machineId === undefined ? { version: 1, allowedCwds } : { version: 1, machineId: parsed.machineId, allowedCwds };
+}
+function ensureLocalMachineId(path = localConfigPath(), createMachineId = randomUUID2) {
+  const config = readLocalConfig(path);
+  if (config.machineId !== undefined) {
+    return config.machineId;
+  }
+  const machineId = ensureLocalMachineIdSeed(path, createMachineId);
+  const latestConfig = readLocalConfig(path);
+  const latestMachineId = latestConfig.machineId;
+  if (latestMachineId !== undefined) {
+    return latestMachineId;
+  }
+  writeLocalConfig({ ...latestConfig, machineId }, path);
+  return machineId;
+}
+function localMachineIdSeedPath(configPath = localConfigPath()) {
+  return join6(dirname4(configPath), `${basename4(configPath)}.machine-id`);
+}
+function readConfiguredAllowedCwdDetails(path = localConfigPath()) {
+  const allowedCwds = [];
+  const missingAllowedCwds = [];
+  for (const cwd of readLocalConfig(path).allowedCwds) {
+    const absolutePath = resolve5(expandUserPath(cwd));
+    try {
+      const realPath = realpathSync4(absolutePath);
+      allowedCwds.push(...realPath === absolutePath ? [realPath] : [realPath, absolutePath]);
+    } catch (error) {
+      if (isMissingPathError(error)) {
+        missingAllowedCwds.push(absolutePath);
+        continue;
+      }
+      throw error;
+    }
+  }
+  return {
+    allowedCwds: uniqueStrings(allowedCwds),
+    missingAllowedCwds: uniqueStrings(missingAllowedCwds)
+  };
+}
+function addAllowedCwd(pathValue, path = localConfigPath()) {
+  const normalizedPath = realpathSync4(resolve5(expandUserPath(pathValue)));
+  const config = readLocalConfig(path);
+  const allowedCwds = uniqueStrings([...config.allowedCwds, normalizedPath]);
+  writeLocalConfig({ ...config, version: 1, allowedCwds }, path);
+  return allowedCwds;
+}
+function removeAllowedCwd(pathValue, path = localConfigPath()) {
+  const requestedPath = resolve5(expandUserPath(pathValue));
+  const normalizedRequest = realpathOrResolved(requestedPath);
+  const config = readLocalConfig(path);
+  const allowedCwds = config.allowedCwds.filter((cwd) => {
+    const normalizedExisting = realpathOrResolved(cwd);
+    return cwd !== pathValue && normalizedExisting !== normalizedRequest;
+  });
+  writeLocalConfig({ ...config, version: 1, allowedCwds }, path);
+  return allowedCwds;
+}
+function writeLocalConfig(config, path = localConfigPath()) {
+  mkdirSync5(dirname4(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+function isConfigPayload(value) {
+  return typeof value === "object" && value !== null && value.version === 1 && Array.isArray(value.allowedCwds) && machineIdValid(value.machineId) && value.allowedCwds.every((cwd) => typeof cwd === "string" && cwd.trim() !== "");
+}
+function machineIdValid(value) {
+  return value === undefined || typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function ensureLocalMachineIdSeed(configPath, createMachineId) {
+  const seedPath = localMachineIdSeedPath(configPath);
+  if (existsSync4(seedPath)) {
+    return readMachineIdSeed(seedPath);
+  }
+  const machineId = createMachineId();
+  if (!machineIdValid(machineId)) {
+    throw new Error(`invalid generated Linzumi machine id: ${machineId}`);
+  }
+  mkdirSync5(dirname4(seedPath), { recursive: true });
+  const tempPath = join6(dirname4(seedPath), `.${basename4(seedPath)}.${process.pid}.${randomUUID2()}.tmp`);
+  writeFileSync4(tempPath, `${machineId}
+`, { encoding: "utf8", flag: "wx" });
+  try {
+    linkSync(tempPath, seedPath);
+    return machineId;
+  } catch (error) {
+    if (isNodeErrorCode(error, "EEXIST")) {
+      return readMachineIdSeed(seedPath);
+    }
+    throw error;
+  } finally {
+    unlinkSync(tempPath);
+  }
+}
+function readMachineIdSeed(seedPath) {
+  const machineId = readFileSync3(seedPath, "utf8").trim();
+  if (!machineIdValid(machineId)) {
+    throw new Error(`invalid Linzumi machine id seed: ${seedPath}`);
+  }
+  return machineId;
+}
+function uniqueStrings(values) {
+  return [
+    ...new Set(values.map((value) => value.trim()).filter((value) => value !== ""))
+  ];
+}
+function isMissingPathError(error) {
+  return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR" || error.code === "EACCES" || error.code === "ELOOP" || error.code === "EIO");
+}
+function isNodeErrorCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function realpathOrResolved(pathValue) {
+  try {
+    return realpathSync4(resolve5(expandUserPath(pathValue)));
+  } catch (_error) {
+    return resolve5(expandUserPath(pathValue));
+  }
+}
+
+// src/version.ts
+var linzumiCliVersion = "0.0.42-beta";
+var linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
+
+// src/runnerLock.ts
+function runnerLockPath(machineId, configPath = localConfigPath()) {
+  return join7(dirname5(configPath), "runners", `${encodeURIComponent(machineId)}.lock`);
+}
+function acquireRunnerLock(options) {
+  const path = runnerLockPath(options.machineId, options.configPath);
+  const isPidAlive = options.isPidAlive ?? processIsAlive;
+  const record = {
+    version: 1,
+    machineId: options.machineId,
+    runnerId: options.runnerId,
+    pid: options.pid ?? process.pid,
+    cwd: options.cwd,
+    workspace: options.workspace,
+    startedAt: (options.now ?? (() => new Date))().toISOString(),
+    cliVersion: options.cliVersion ?? linzumiCliVersion
+  };
+  writeLockOrHandleExisting(path, record, isPidAlive, options.beforeReadExistingLock, options.beforeReplaceStaleLock);
+  return {
+    path,
+    record,
+    release: () => releaseRunnerLock(path, record)
+  };
+}
+function writeLockOrHandleExisting(path, record, isPidAlive, beforeReadExistingLock, beforeReplaceStaleLock) {
+  if (tryCreateLock(path, record)) {
+    return;
+  }
+  beforeReadExistingLock?.();
+  const existing = readRunnerLockIfPresent(path);
+  if (existing === undefined) {
+    if (tryCreateLock(path, record)) {
+      return;
+    }
+    throw new Error(`another Linzumi runner lock appeared while starting: ${path}`);
+  }
+  if (isPidAlive(existing.pid)) {
+    throw new Error(activeRunnerLockMessage(path, existing));
+  }
+  beforeReplaceStaleLock?.();
+  withStaleReplacementLock(path, isPidAlive, () => {
+    const latest = existsSync5(path) ? readRunnerLock(path) : undefined;
+    if (latest !== undefined && isPidAlive(latest.pid)) {
+      throw new Error(activeRunnerLockMessage(path, latest));
+    }
+    if (latest !== undefined) {
+      unlinkSync2(path);
+    }
+    if (!tryCreateLock(path, record)) {
+      throw new Error(`another Linzumi runner lock appeared while starting: ${path}`);
+    }
+  });
+}
+function tryCreateLock(path, record) {
+  mkdirSync6(dirname5(path), { recursive: true });
+  try {
+    const fd = openSync2(path, "wx");
+    try {
+      writeSync(fd, `${JSON.stringify(record, null, 2)}
+`);
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch (error) {
+    if (isNodeErrorCode2(error, "EEXIST")) {
+      return false;
+    }
+    throw error;
+  }
+}
+function withStaleReplacementLock(path, isPidAlive, callback) {
+  const replacementPath = `${path}.replace`;
+  while (true) {
+    try {
+      const fd = openSync2(replacementPath, "wx");
+      try {
+        writeSync(fd, `${process.pid}
+`);
+        callback();
+      } finally {
+        closeSync(fd);
+        unlinkSync2(replacementPath);
+      }
+      return;
+    } catch (error) {
+      if (isNodeErrorCode2(error, "EEXIST")) {
+        const replacementPid = readReplacementLockPidIfPresent(replacementPath);
+        if (replacementPid === undefined) {
+          continue;
+        }
+        if (isPidAlive(replacementPid)) {
+          throw new Error([
+            "another Linzumi runner is already replacing a stale runner lock",
+            `lock: ${path}`,
+            "Wait for that startup to finish, then retry."
+          ].join(`
+`));
+        }
+        unlinkSync2(replacementPath);
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+function readReplacementLockPidIfPresent(path) {
+  let value;
+  try {
+    value = readFileSync4(path, "utf8").trim();
+  } catch (error) {
+    if (isNodeErrorCode2(error, "ENOENT")) {
+      return;
+    }
+    throw error;
+  }
+  const pid = Number.parseInt(value, 10);
+  if (pid.toString() !== value || pid <= 0) {
+    throw new Error(`invalid Linzumi runner replacement lock: ${path}`);
+  }
+  return pid;
+}
+function releaseRunnerLock(path, record) {
+  const current = readRunnerLockForRelease(path);
+  if (current !== undefined && current.machineId === record.machineId && current.runnerId === record.runnerId && current.pid === record.pid) {
+    unlinkSync2(path);
+  }
+}
+function readRunnerLockForRelease(path) {
+  try {
+    return readRunnerLockIfPresent(path);
+  } catch (_error) {
+    return;
+  }
+}
+function readRunnerLockIfPresent(path) {
+  if (!existsSync5(path)) {
+    return;
+  }
+  try {
+    return readRunnerLock(path);
+  } catch (error) {
+    if (isNodeErrorCode2(error, "ENOENT")) {
+      return;
+    }
+    throw error;
+  }
+}
+function readRunnerLock(path) {
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  if (!isRunnerLockRecord(parsed)) {
+    throw new Error(`invalid Linzumi runner lock: ${path}`);
+  }
+  return parsed;
+}
+function isRunnerLockRecord(value) {
+  return typeof value === "object" && value !== null && value.version === 1 && typeof value.machineId === "string" && value.machineId.trim() !== "" && typeof value.runnerId === "string" && value.runnerId.trim() !== "" && Number.isInteger(value.pid) && value.pid > 0 && typeof value.cwd === "string" && value.cwd.trim() !== "" && workspaceValid(value.workspace) && typeof value.startedAt === "string" && value.startedAt.trim() !== "" && typeof value.cliVersion === "string" && value.cliVersion.trim() !== "";
+}
+function workspaceValid(value) {
+  return value === null || typeof value === "string" && value.trim() !== "";
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return isNodeErrorCode2(error, "ESRCH") ? false : true;
+  }
+}
+function activeRunnerLockMessage(path, record) {
+  const workspace = record.workspace === null ? "workspace: unknown" : `workspace: ${record.workspace}`;
+  return [
+    "another Linzumi runner is already running for this machine",
+    `runner id: ${record.runnerId}`,
+    `pid: ${record.pid}`,
+    `cwd: ${record.cwd}`,
+    workspace,
+    `CLI version: ${record.cliVersion}`,
+    `started at: ${record.startedAt}`,
+    `lock: ${path}`,
+    "Stop that process first, then retry. If the process has already exited, remove the stale lock file and retry."
+  ].join(`
+`);
+}
+function isNodeErrorCode2(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
 // src/runnerConsoleReporter.ts
 function reportRunnerConsoleEvent(event, payload) {
   const line = formatRunnerConsoleEvent(event, payload);
@@ -7902,7 +8335,15 @@ function reportRunnerConsoleEvent(event, payload) {
 function formatRunnerConsoleEvent(event, payload) {
   switch (event) {
     case "runner.instance_started":
-      return `Runner connected: instance=${text(payload.instanceId)} codex=${text(payload.codexUrl)}`;
+      return connectedRunnerMessage(payload);
+    case "runner.replaced":
+      return [
+        "Runner replaced: another Linzumi CLI connected from this machine.",
+        `New runner: ${text(payload.replacementRunnerId)}`,
+        `Version: ${text(payload.replacementVersion)}`,
+        "This process is exiting."
+      ].join(`
+`);
     case "kandan.message_ignored":
       return `Incoming message from ${sender(payload)}: ignored for reason ${text(payload.reason)}`;
     case "kandan.message_queued":
@@ -7937,6 +8378,40 @@ function formatRunnerConsoleEvent(event, payload) {
       return;
   }
 }
+function connectedRunnerMessage(payload) {
+  return [
+    "Connected to Linzumi",
+    optionalLine("Computer", payload.hostname),
+    optionalLine("Workspace", payload.workspace),
+    `Runner: ${text(payload.runnerId)}`,
+    `CLI: ${text(payload.version)}`,
+    optionalLine("Codex", payload.codexUrl),
+    ...replacementLines(payload.replacedRunners)
+  ].filter((line) => line !== undefined).join(`
+`);
+}
+function optionalLine(label, value) {
+  const normalized = stringValue2(value) ?? numberValue(value)?.toString();
+  return normalized === undefined ? undefined : `${label}: ${normalized}`;
+}
+function replacementLines(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.flatMap((entry) => {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+      return [];
+    }
+    const record = entry;
+    const runnerId = stringValue2(record.runnerId);
+    if (runnerId === undefined) {
+      return [];
+    }
+    const version = stringValue2(record.version);
+    const suffix = version === undefined ? "" : ` (CLI ${version})`;
+    return [`Replaced older runner from this machine: ${runnerId}${suffix}`];
+  });
+}
 function sender(payload) {
   const slug = stringValue2(payload.actor_slug);
   const userId = numberValue(payload.actor_user_id);
@@ -8000,6 +8475,21 @@ async function runLocalCodexRunner(options) {
     kandanUrl: options.kandanUrl
   });
   try {
+    if (options.machineId !== undefined) {
+      const runnerLock = acquireRunnerLock({
+        machineId: options.machineId,
+        runnerId: options.runnerId,
+        cwd: options.cwd,
+        workspace: runnerWorkspaceSlug(options) ?? null,
+        configPath: options.runnerLockConfigPath
+      });
+      cleanup.actions.push(() => runnerLock.release());
+      log("runner.lock_acquired", {
+        path: runnerLock.path,
+        machineId: options.machineId,
+        runnerId: options.runnerId
+      });
+    }
     return await openLocalCodexRunner(options, log, cleanup, close);
   } catch (error) {
     await close().catch(() => {
@@ -8067,9 +8557,11 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   const kandan = await connectPhoenixClient(options.kandanUrl, options.token, options.socketFactory);
   cleanup.actions.push(() => kandan.close());
   const topic = `local_runner:${options.runnerId}`;
+  const clientId = options.machineId ?? options.runnerId;
   const joinPayload = () => ({
     clientName: "kandan-local-codex-runner",
-    version: "0.0.1",
+    clientId,
+    version: linzumiCliVersion,
     workspace: runnerWorkspaceSlug(options) ?? null,
     channel: options.channelSession?.channelSlug ?? null,
     capabilities: capabilitiesPayload()
@@ -8084,7 +8576,10 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     }
     dispatcher(control);
   });
-  await kandan.join(topic, joinPayload(), { rejoinPayload: joinPayload });
+  const joinResponse = await kandan.join(topic, joinPayload(), {
+    rejoinPayload: joinPayload
+  });
+  const replacedRunners = replacementRunnerSummaries(objectValue(joinResponse)?.replaced_runners);
   const started = options.codexUrl === undefined ? await startOwnedCodexAppServer(options) : undefined;
   if (started !== undefined) {
     cleanup.actions.push(() => {
@@ -8095,7 +8590,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   if (codexUrl === undefined) {
     throw new Error("missing codex app-server websocket URL");
   }
-  const instanceId = `codex-${randomUUID2()}`;
+  const instanceId = `codex-${randomUUID3()}`;
   const publishLocalEditorStatus = (payload) => {
     kandan.push(topic, "local_editor_status", payload).catch((error) => {
       log("kandan.local_editor_status_push_failed", {
@@ -8143,6 +8638,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   const runtimeDefaults = runnerRuntimeDefaults(options);
   const instancePayload = {
     instanceId,
+    clientId,
     codexUrl,
     tuiLaunched: options.launchTui,
     cwd: options.cwd,
@@ -8155,7 +8651,15 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     fast: options.fast ?? false
   };
   await kandan.push(topic, "instance_started", instancePayload);
-  log("runner.instance_started", { instanceId, codexUrl });
+  log("runner.instance_started", {
+    runnerId: options.runnerId,
+    hostname: runnerHost,
+    workspace: runnerWorkspaceSlug(options) ?? null,
+    version: linzumiCliVersion,
+    instanceId,
+    codexUrl,
+    replacedRunners
+  });
   const channelSession = options.channelSession === undefined ? undefined : await attachChannelSession({
     kandan,
     codex,
@@ -8256,6 +8760,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   };
   const heartbeatPayload = () => ({
     instanceId,
+    clientId,
     codexUrl,
     cwd: options.cwd,
     hostname: runnerHost,
@@ -8334,6 +8839,20 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   });
   const handleControl = (control) => {
     log("kandan.control", { control });
+    if (control.type === "replace_runner") {
+      log("runner.replaced", {
+        runnerId: options.runnerId,
+        reason: control.reason,
+        replacementRunnerId: control.replacementRunnerId,
+        replacementVersion: control.replacementVersion
+      });
+      close().catch((error) => {
+        log("runner.replace_close_failed", {
+          message: error instanceof Error ? error.message : String(error)
+        });
+      });
+      return;
+    }
     if (!controlTargetsInstance(control, instanceId)) {
       log("kandan.control_ignored", {
         reason: "instance_id_mismatch",
@@ -8548,8 +9067,24 @@ function normalizedWorkDescription(value) {
   const normalized = value?.trim();
   return normalized === undefined || normalized === "" ? undefined : normalized;
 }
+function replacementRunnerSummaries(value) {
+  const entries = arrayValue(value) ?? [];
+  return entries.flatMap((entry) => {
+    const record = objectValue(entry);
+    const runnerId = stringValue(record?.runnerId);
+    if (runnerId === undefined) {
+      return [];
+    }
+    return [
+      {
+        runnerId,
+        version: stringValue(record?.version) ?? null
+      }
+    ];
+  });
+}
 function makeRunnerLogger(options) {
-  return createRunnerLogger(options.logFile ?? join6(options.cwd, ".linzumi-runner.log"), options.launchTui ? undefined : reportRunnerConsoleEvent);
+  return createRunnerLogger(options.logFile ?? join8(options.cwd, ".linzumi-runner.log"), options.launchTui ? undefined : reportRunnerConsoleEvent);
 }
 function installCleanupHandlers(close) {
   const closeAndExit = () => {
@@ -8654,6 +9189,8 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
   switch (control.type) {
     case "start_instance": {
       const cwd = resolveAllowedCwd(control.cwd, allowedCwds);
+      let startupStage = "starting_codex_session";
+      let startedCodexThreadId;
       if (!cwd.ok) {
         return {
           instanceId,
@@ -8672,8 +9209,10 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
       }
       try {
         if (options.codexUrl === undefined) {
+          startupStage = "checking_project_trust";
           ensureCodexProjectTrusted(cwd.cwd);
         }
+        startupStage = "starting_codex_session";
         const developerPrompt = normalizedWorkDescription(control.developerPrompt);
         const runtimeSettings = startInstanceRuntimeSettings(options, control);
         const response = await codex.request("thread/start", {
@@ -8691,12 +9230,18 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
           ...runtimeSettings.fast === true ? { serviceTier: "fast" } : {}
         });
         const codexThreadId = extractStartedThreadId(response);
+        startedCodexThreadId = codexThreadId;
         const workDescription = normalizedWorkDescription(control.workDescription);
         if (codexThreadId !== undefined && developerPrompt !== undefined) {
           await postVisibleDeveloperPrompt(kandan, topic, control, developerPrompt, codexThreadId);
         }
-        const startedThreadSession = codexThreadId !== undefined && onStartedThread !== undefined ? await onStartedThread(control, cwd.cwd, codexThreadId) : undefined;
+        let startedThreadSession;
+        if (codexThreadId !== undefined && onStartedThread !== undefined) {
+          startupStage = "binding_kandan_thread";
+          startedThreadSession = await onStartedThread(control, cwd.cwd, codexThreadId);
+        }
         if (codexThreadId !== undefined && workDescription !== undefined) {
+          startupStage = "starting_first_turn";
           const rootSeq = integerValue(control.rootSeq);
           const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
           if (startedThreadSession !== undefined && sourceSeq !== undefined) {
@@ -8722,8 +9267,16 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
           response
         };
       } catch (error) {
+        const failureReason = startInstanceFailureReason(startupStage, error);
+        log("kandan.start_instance_failed", {
+          stage: startupStage,
+          message: error instanceof Error ? error.message : String(error),
+          thread_id: optionalThreadControlField(control, "threadId") ?? null,
+          source_seq: integerValue(control.sourceSeq) ?? integerValue(control.rootSeq) ?? null,
+          codex_thread_id: startedCodexThreadId ?? null
+        });
         try {
-          await publishStartInstanceMessageState(kandan, topic, control, "failed", "failed to start Codex session");
+          await publishStartInstanceMessageState(kandan, topic, control, "failed", failureReason, { codexThreadId: startedCodexThreadId });
         } catch (_publishError) {}
         throw error;
       }
@@ -8835,6 +9388,26 @@ async function applyControl(codex, kandan, topic, instanceId, options, allowedCw
       return { instanceId, controlType: control.type, skipped: true };
   }
 }
+function startInstanceFailureReason(stage, error) {
+  const detail = truncateFailureDetail(error instanceof Error ? error.message : String(error));
+  switch (stage) {
+    case "checking_project_trust":
+      return `Codex could not start because this folder is not trusted locally. Trust the folder with linzumi paths add, or restart the runner from a trusted folder. Detail: ${detail}`;
+    case "starting_codex_session":
+      return `Codex did not create a session. Restart the local runner and try again. Detail: ${detail}`;
+    case "binding_kandan_thread":
+      return `Codex started, but Linzumi could not attach it to this thread. Try starting the agent again; if it repeats, share this failed message with the runner owner. Detail: ${detail}`;
+    case "starting_first_turn":
+      return `Codex started, but the first prompt could not be delivered. Try sending the message again; if it repeats, reconnect the local runner. Detail: ${detail}`;
+  }
+}
+function truncateFailureDetail(message) {
+  const trimmed = message.trim();
+  if (trimmed.length <= 240) {
+    return trimmed;
+  }
+  return `${trimmed.slice(0, 237)}...`;
+}
 function commanderDeveloperInstructions(args) {
   const customPrompt = args.developerPrompt === undefined ? "" : `
 <invoker_developer_prompt>
@@ -8915,14 +9488,14 @@ ${developerPrompt}`,
     client_message_id: `codex-start-instructions-${threadId}`
   });
 }
-async function publishStartInstanceMessageState(kandan, topic, control, status, reason) {
-  const payload = startInstanceMessageStatePayload(control, status, reason);
+async function publishStartInstanceMessageState(kandan, topic, control, status, reason, diagnostics = {}) {
+  const payload = startInstanceMessageStatePayload(control, status, reason, diagnostics);
   if (payload === undefined) {
     return;
   }
   await kandan.push(topic, "message_state", payload);
 }
-function startInstanceMessageStatePayload(control, status, reason) {
+function startInstanceMessageStatePayload(control, status, reason, diagnostics = {}) {
   const rootSeq = integerValue(control.rootSeq);
   const sourceSeq = integerValue(control.sourceSeq) ?? rootSeq;
   if (sourceSeq === undefined) {
@@ -8937,7 +9510,8 @@ function startInstanceMessageStatePayload(control, status, reason) {
     thread_id: threadId,
     seq: sourceSeq,
     status,
-    reason
+    reason,
+    ...diagnostics.codexThreadId === undefined ? {} : { codex_thread_id: diagnostics.codexThreadId }
   };
 }
 function requiredStartInstanceControlField(control, field) {
@@ -8959,11 +9533,12 @@ function optionalThreadControlField(control, field) {
 }
 function startInstanceRuntimeSettings(options, control) {
   const defaults = runnerRuntimeDefaults(options);
+  const sandbox = control.sandbox ?? defaults.sandbox;
   return {
     model: control.model ?? defaults.model,
     reasoningEffort: control.reasoningEffort ?? defaults.reasoningEffort,
-    approvalPolicy: control.approvalPolicy ?? defaults.approvalPolicy,
-    sandbox: control.sandbox ?? defaults.sandbox,
+    approvalPolicy: codexApprovalPolicyForRequest(control.approvalPolicy ?? defaults.approvalPolicy, sandbox),
+    sandbox,
     fast: control.fast ?? options.fast
   };
 }
@@ -8982,11 +9557,12 @@ function runnerWorkspaceSlug(options) {
 function runnerRuntimeDefaults(options) {
   const session = options.channelSession;
   const defaults = options.runtimeDefaults;
+  const sandbox = defaults?.sandbox ?? session?.sandbox;
   return {
     model: defaults?.model ?? session?.model,
     reasoningEffort: defaults?.reasoningEffort ?? session?.reasoningEffort,
-    approvalPolicy: defaults?.approvalPolicy ?? session?.approvalPolicy,
-    sandbox: defaults?.sandbox ?? session?.sandbox
+    approvalPolicy: codexApprovalPolicySetting(defaults?.approvalPolicy ?? session?.approvalPolicy, sandbox),
+    sandbox
   };
 }
 function isUpdateRunnerConfigControl(control) {
@@ -9005,9 +9581,9 @@ function configuredAllowedCwds(values) {
   const allowedCwds = [];
   const missingAllowedCwds = [];
   for (const value of normalizeAllowedCwds(values)) {
-    const absolutePath = resolve5(expandUserPath(value));
+    const absolutePath = resolve6(expandUserPath(value));
     try {
-      const realPath = realpathSync4(absolutePath);
+      const realPath = realpathSync5(absolutePath);
       allowedCwds.push(...realPath === absolutePath ? [realPath] : [realPath, absolutePath]);
     } catch (error) {
       if (isMissingAllowedCwdError(error)) {
@@ -9030,18 +9606,18 @@ function allowedCwdSuggestions(cwd, allowedCwds) {
 }
 
 // src/authCache.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { dirname as dirname6, join as join9 } from "node:path";
 function defaultAuthFilePath() {
-  const base = process.env.KANDAN_HOME ?? join7(homedir5(), ".kandan");
-  return join7(base, "auth.json");
+  const base = process.env.KANDAN_HOME ?? join9(homedir6(), ".kandan");
+  return join9(base, "auth.json");
 }
 function readCachedLocalRunnerToken(kandanUrl, authFilePath = defaultAuthFilePath()) {
-  if (!existsSync4(authFilePath)) {
+  if (!existsSync6(authFilePath)) {
     return;
   }
-  const authFile = parseAuthFile(readFileSync3(authFilePath, "utf8"));
+  const authFile = parseAuthFile(readFileSync5(authFilePath, "utf8"));
   const kandanBaseUrl = kandanHttpBaseUrl(kandanUrl);
   const entry = authFile.local_codex_runner?.[kandanBaseUrl];
   if (entry === undefined || entry.access_token.trim() === "") {
@@ -9059,7 +9635,7 @@ function readCachedLocalRunnerToken(kandanUrl, authFilePath = defaultAuthFilePat
 }
 function writeCachedLocalRunnerToken(args) {
   const authFilePath = args.authFilePath ?? defaultAuthFilePath();
-  const existing = existsSync4(authFilePath) ? parseAuthFile(readFileSync3(authFilePath, "utf8")) : { version: 1 };
+  const existing = existsSync6(authFilePath) ? parseAuthFile(readFileSync5(authFilePath, "utf8")) : { version: 1 };
   const kandanBaseUrl = kandanHttpBaseUrl(args.kandanUrl);
   const issuedAt = new Date;
   const expiresAt = args.expiresInSeconds === undefined ? undefined : new Date(issuedAt.getTime() + args.expiresInSeconds * 1000).toISOString();
@@ -9075,8 +9651,8 @@ function writeCachedLocalRunnerToken(args) {
       }
     }
   };
-  mkdirSync5(dirname4(authFilePath), { recursive: true });
-  writeFileSync4(authFilePath, `${JSON.stringify(next, null, 2)}
+  mkdirSync7(dirname6(authFilePath), { recursive: true });
+  writeFileSync5(authFilePath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return {
     accessToken: args.accessToken,
@@ -9168,102 +9744,12 @@ async function acquireAndCacheToken(args) {
   return token.accessToken;
 }
 
-// src/localConfig.ts
-import {
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync4,
-  realpathSync as realpathSync5,
-  writeFileSync as writeFileSync5
-} from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { dirname as dirname5, resolve as resolve6 } from "node:path";
-function localConfigPath(env = process.env) {
-  const override = env.LINZUMI_CONFIG_FILE;
-  return override !== undefined && override.trim() !== "" ? resolve6(expandUserPath(override)) : resolve6(homedir6(), ".linzumi", "config.json");
-}
-function readLocalConfig(path = localConfigPath()) {
-  if (!existsSync5(path)) {
-    return { version: 1, allowedCwds: [] };
-  }
-  const parsed = JSON.parse(readFileSync4(path, "utf8"));
-  if (!isConfigPayload(parsed)) {
-    throw new Error(`invalid Linzumi config: ${path}`);
-  }
-  return {
-    version: 1,
-    allowedCwds: uniqueStrings(parsed.allowedCwds)
-  };
-}
-function readConfiguredAllowedCwdDetails(path = localConfigPath()) {
-  const allowedCwds = [];
-  const missingAllowedCwds = [];
-  for (const cwd of readLocalConfig(path).allowedCwds) {
-    const absolutePath = resolve6(expandUserPath(cwd));
-    try {
-      const realPath = realpathSync5(absolutePath);
-      allowedCwds.push(...realPath === absolutePath ? [realPath] : [realPath, absolutePath]);
-    } catch (error) {
-      if (isMissingPathError(error)) {
-        missingAllowedCwds.push(absolutePath);
-        continue;
-      }
-      throw error;
-    }
-  }
-  return {
-    allowedCwds: uniqueStrings(allowedCwds),
-    missingAllowedCwds: uniqueStrings(missingAllowedCwds)
-  };
-}
-function addAllowedCwd(pathValue, path = localConfigPath()) {
-  const normalizedPath = realpathSync5(resolve6(expandUserPath(pathValue)));
-  const config = readLocalConfig(path);
-  const allowedCwds = uniqueStrings([...config.allowedCwds, normalizedPath]);
-  writeLocalConfig({ version: 1, allowedCwds }, path);
-  return allowedCwds;
-}
-function removeAllowedCwd(pathValue, path = localConfigPath()) {
-  const requestedPath = resolve6(expandUserPath(pathValue));
-  const normalizedRequest = realpathOrResolved(requestedPath);
-  const config = readLocalConfig(path);
-  const allowedCwds = config.allowedCwds.filter((cwd) => {
-    const normalizedExisting = realpathOrResolved(cwd);
-    return cwd !== pathValue && normalizedExisting !== normalizedRequest;
-  });
-  writeLocalConfig({ version: 1, allowedCwds }, path);
-  return allowedCwds;
-}
-function writeLocalConfig(config, path = localConfigPath()) {
-  mkdirSync6(dirname5(path), { recursive: true });
-  writeFileSync5(path, `${JSON.stringify(config, null, 2)}
-`, "utf8");
-}
-function isConfigPayload(value) {
-  return typeof value === "object" && value !== null && value.version === 1 && Array.isArray(value.allowedCwds) && value.allowedCwds.every((cwd) => typeof cwd === "string" && cwd.trim() !== "");
-}
-function uniqueStrings(values) {
-  return [
-    ...new Set(values.map((value) => value.trim()).filter((value) => value !== ""))
-  ];
-}
-function isMissingPathError(error) {
-  return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR" || error.code === "EACCES" || error.code === "ELOOP" || error.code === "EIO");
-}
-function realpathOrResolved(pathValue) {
-  try {
-    return realpathSync5(resolve6(expandUserPath(pathValue)));
-  } catch (_error) {
-    return resolve6(expandUserPath(pathValue));
-  }
-}
-
 // src/defaultUrls.ts
 var defaultLinzumiHttpUrl = "https://serve.linzumi.com";
 var defaultLinzumiWebSocketUrl = "wss://serve.linzumi.com";
 
 // src/kandanTls.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
 import { Agent } from "undici";
 import { WebSocket as WsWebSocket } from "ws";
 function kandanTlsTrustFromEnv() {
@@ -9274,10 +9760,10 @@ function kandanTlsTrustFromCaFile(caFile) {
     return;
   }
   const trimmed = caFile.trim();
-  if (!existsSync6(trimmed)) {
+  if (!existsSync7(trimmed)) {
     throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${trimmed}`);
   }
-  const ca = readFileSync5(trimmed, "utf8");
+  const ca = readFileSync6(trimmed, "utf8");
   return {
     caFile: trimmed,
     ca,
@@ -9306,8 +9792,8 @@ function trustedWebSocketFactory(trust, WebSocketImpl = WsWebSocket) {
 }
 
 // src/agentBootstrap.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname6, join as join8 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join10 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 async function runAgentCliCommand(args, deps = {
   fetchImpl: fetch,
@@ -9907,7 +10393,7 @@ function agentTokenFile(flags) {
   return flags.get("agent-token-file") ?? defaultAgentTokenFilePath();
 }
 function defaultAgentTokenFilePath() {
-  return join8(homedir7(), ".linzumi", "agent-token.json");
+  return join10(homedir7(), ".linzumi", "agent-token.json");
 }
 function normalizedApiUrl(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
@@ -9916,10 +10402,10 @@ function authorizationHeaders(token) {
   return { authorization: `Bearer ${token}` };
 }
 function readOptionalTextFile(path) {
-  return existsSync7(path) ? readFileSync6(path, "utf8") : undefined;
+  return existsSync8(path) ? readFileSync7(path, "utf8") : undefined;
 }
 function writeTextFile(path, content) {
-  mkdirSync7(dirname6(path), { recursive: true });
+  mkdirSync8(dirname7(path), { recursive: true });
   writeFileSync6(path, content);
 }
 function readStoredAgentTokenFile(path, readTextFile = readOptionalTextFile) {
@@ -9996,8 +10482,8 @@ Launch target:
 }
 
 // src/helloLinzumiProject.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname7, join as join9, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname8, join as join11, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
 var defaultHelloLinzumiProjectDir = "/tmp/hello_linzumi";
 var defaultHelloLinzumiProjectName = "hello_linzumi";
@@ -10005,8 +10491,8 @@ var defaultHelloLinzumiParentDir = "/tmp";
 var defaultHelloLinzumiPort = 8787;
 var defaultHelloLinzumiHost = "0.0.0.0";
 var markerFile = ".linzumi-demo-project";
-var moduleDir = dirname7(fileURLToPath(import.meta.url));
-var linzumiLogoSvg = readFileSync7(join9(moduleDir, "assets", "linzumi-logo.svg"), "utf8");
+var moduleDir = dirname8(fileURLToPath(import.meta.url));
+var linzumiLogoSvg = readFileSync8(join11(moduleDir, "assets", "linzumi-logo.svg"), "utf8");
 function createHelloLinzumiProject(input = {}) {
   const options = typeof input === "string" ? { rootPath: input } : input;
   const root = resolveHelloProjectRoot(options);
@@ -10014,9 +10500,9 @@ function createHelloLinzumiProject(input = {}) {
   const host = normalizeHost(options.host);
   assertTcpPort(port);
   assertWritableDemoRoot(root, options.reset === true);
-  mkdirSync8(join9(root, "src"), { recursive: true });
+  mkdirSync9(join11(root, "src"), { recursive: true });
   for (const file of demoFiles({ root, port, host })) {
-    writeFileSync7(join9(root, file.path), file.content, "utf8");
+    writeFileSync7(join11(root, file.path), file.content, "utf8");
   }
   return {
     root,
@@ -10057,11 +10543,11 @@ function assertTcpPort(port) {
   throw new Error("--port must be a TCP port from 1 to 65535");
 }
 function assertWritableDemoRoot(root, reset) {
-  if (!existsSync8(root)) {
+  if (!existsSync9(root)) {
     return;
   }
-  const markerPath = join9(root, markerFile);
-  const isDemoRoot = existsSync8(markerPath) && readFileSync7(markerPath, "utf8").trim() === "hello-linzumi";
+  const markerPath = join11(root, markerFile);
+  const isDemoRoot = existsSync9(markerPath) && readFileSync8(markerPath, "utf8").trim() === "hello-linzumi";
   if (isDemoRoot && reset) {
     rmSync2(root, { recursive: true, force: true });
     return;
@@ -10560,27 +11046,30 @@ To kick the agent off:
 
 // src/commanderDaemon.ts
 import {
-  existsSync as existsSync9,
-  closeSync,
-  mkdirSync as mkdirSync9,
-  openSync as openSync2,
-  readFileSync as readFileSync8,
+  existsSync as existsSync10,
+  closeSync as closeSync2,
+  mkdirSync as mkdirSync10,
+  openSync as openSync3,
+  readFileSync as readFileSync9,
   watch,
   writeFileSync as writeFileSync8
 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname8, join as join10, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, join as join12, resolve as resolve8 } from "node:path";
 import { execFileSync, spawn as spawn7 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var connectedMarker = "Runner connected:";
+var connectedMarkers = ["Connected to Linzumi", "Runner connected:"];
 function commanderStatusDir() {
-  return join10(homedir8(), ".linzumi", "commanders");
+  return join12(homedir8(), ".linzumi", "commanders");
 }
 function commanderStatusFile(runnerId, statusDir = commanderStatusDir()) {
-  return join10(statusDir, `${safeRunnerId(runnerId)}.json`);
+  return join12(statusDir, `${safeRunnerId(runnerId)}.json`);
 }
 function defaultCommanderLogFile(runnerId, statusDir = commanderStatusDir()) {
-  return join10(statusDir, `${safeRunnerId(runnerId)}.log`);
+  return join12(statusDir, `${safeRunnerId(runnerId)}.log`);
+}
+function commanderLogIsConnected(log) {
+  return connectedMarkers.some((marker) => log.includes(marker));
 }
 function startCommanderDaemon(options) {
   const statusDir = options.statusDir ?? commanderStatusDir();
@@ -10598,10 +11087,10 @@ function startCommanderDaemon(options) {
     "--log-file",
     logFile
   ];
-  mkdirSync9(statusDir, { recursive: true });
-  mkdirSync9(dirname8(logFile), { recursive: true });
-  const out = openSync2(logFile, "a");
-  const err = openSync2(logFile, "a");
+  mkdirSync10(statusDir, { recursive: true });
+  mkdirSync10(dirname9(logFile), { recursive: true });
+  const out = openSync3(logFile, "a");
+  const err = openSync3(logFile, "a");
   writeCliAuditEvent("process.spawn", {
     command: nodeBin,
     args: command,
@@ -10620,8 +11109,8 @@ function startCommanderDaemon(options) {
     pid: child.pid,
     purpose: "commander_daemon.start"
   }, { sessionId: options.runnerId });
-  closeSync(out);
-  closeSync(err);
+  closeSync2(out);
+  closeSync2(err);
   child.unref();
   if (child.pid === undefined) {
     throw new Error("commander daemon did not report a pid");
@@ -10643,15 +11132,15 @@ function startCommanderDaemon(options) {
 }
 function commanderDaemonStatus(runnerId, statusDir = commanderStatusDir(), processIdentityReader = readProcessIdentity) {
   const statusFile = commanderStatusFile(runnerId, statusDir);
-  if (!existsSync9(statusFile)) {
+  if (!existsSync10(statusFile)) {
     return { status: "missing", runnerId, statusFile };
   }
-  const record = parseRecord(readFileSync8(statusFile, "utf8"));
+  const record = parseRecord(readFileSync9(statusFile, "utf8"));
   return processIsRunning(record.pid) && processMatchesRecord(record, processIdentityReader) ? { status: "running", record } : { status: "stopped", record };
 }
 async function waitForCommanderDaemon(options) {
   const now = options.now ?? (() => Date.now());
-  const readTextFile = options.readTextFile ?? ((path) => existsSync9(path) ? readFileSync8(path, "utf8") : undefined);
+  const readTextFile = options.readTextFile ?? ((path) => existsSync10(path) ? readFileSync9(path, "utf8") : undefined);
   const statusImpl = options.statusImpl ?? commanderDaemonStatus;
   const deadline = now() + options.timeoutMs;
   while (now() <= deadline) {
@@ -10666,12 +11155,12 @@ async function waitForCommanderDaemon(options) {
         if (log === undefined) {
           return { ok: false, reason: "timeout" };
         }
-        if (log.includes(connectedMarker)) {
+        if (commanderLogIsConnected(log)) {
           return { ok: true, record: status.record };
         }
         await waitForFileChangeOrTimeout(status.record.logFile, deadline, now, () => {
           const updatedLog = readTextFile(status.record.logFile);
-          return updatedLog !== undefined && updatedLog.includes(connectedMarker);
+          return updatedLog !== undefined && commanderLogIsConnected(updatedLog);
         });
       }
     }
@@ -10881,7 +11370,7 @@ async function main(args) {
       process.stdout.write(connectGuideText());
       return;
     case "version":
-      process.stdout.write(`linzumi 0.0.40-beta
+      process.stdout.write(`${linzumiCliVersionText}
 `);
       return;
     case "auth":
@@ -10901,18 +11390,18 @@ async function main(args) {
       return;
     case "agentRunner": {
       const options = await parseAgentRunnerArgs(parsed.args);
-      await runLocalCodexRunner(options);
+      await runLocalCodexRunner(withLocalMachineId(options));
       return;
     }
     case "start": {
       const options = await parseStartRunnerArgs(parsed.args);
       addAllowedCwd(options.cwd);
-      await runLocalCodexRunner(options);
+      await runLocalCodexRunner(withLocalMachineId(options));
       return;
     }
     case "run": {
       const options = await parseRunnerArgs(parsed.args);
-      await runLocalCodexRunner(options);
+      await runLocalCodexRunner(withLocalMachineId(options));
       return;
     }
   }
@@ -11223,7 +11712,7 @@ async function parseStartRunnerArgs(args, deps = {
   return {
     kandanUrl,
     token: targetToken,
-    runnerId: stringValue3(values, "runner-id") ?? `runner-${randomUUID3()}`,
+    runnerId: stringValue3(values, "runner-id") ?? `runner-${randomUUID4()}`,
     workspaceSlug: target.workspaceSlug,
     cwd,
     codexBin,
@@ -11311,7 +11800,7 @@ async function parseAgentRunnerArgs(args, deps = {
   return {
     kandanUrl,
     token: tokenFile.commanderToken,
-    runnerId: stringValue3(values, "runner-id") ?? `agent-runner-${randomUUID3()}`,
+    runnerId: stringValue3(values, "runner-id") ?? `agent-runner-${randomUUID4()}`,
     workspaceSlug: tokenFile.workspaceId,
     cwd,
     codexBin,
@@ -11331,7 +11820,7 @@ async function parseAgentRunnerArgs(args, deps = {
   };
 }
 function readAgentTokenTextFile(path) {
-  return existsSync10(path) ? readFileSync9(path, "utf8") : undefined;
+  return existsSync11(path) ? readFileSync10(path, "utf8") : undefined;
 }
 function rejectAgentRunnerTargetingFlags(values) {
   const unsupportedFlags = [
@@ -11407,12 +11896,12 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   if (values.get("version") === true) {
-    process.stdout.write(`linzumi 0.0.40-beta
+    process.stdout.write(`${linzumiCliVersionText}
 `);
     process.exit(0);
   }
-  const channelTarget = parseChannelSessionTarget(values);
-  const kandanUrl = required(values, "linzumi-url");
+  const connectTarget = parseConnectTarget(values);
+  const kandanUrl = stringValue3(values, "linzumi-url") ?? defaultLinzumiWebSocketUrl;
   const cwd = stringValue3(values, "cwd") ?? process.cwd();
   const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
   const localConfiguredAllowedCwds = values.has("allowed-cwd") ? { allowedCwds: [], missingAllowedCwds: [] } : readConfiguredAllowedCwdDetails();
@@ -11423,8 +11912,8 @@ async function parseRunnerArgs(args, deps = {
   const token = await deps.resolveToken({
     kandanUrl,
     explicitToken,
-    workspaceSlug: channelTarget?.workspaceSlug,
-    channelSlug: channelTarget?.channelSlug,
+    workspaceSlug: connectTarget?.workspaceSlug,
+    channelSlug: connectTarget?.channelSlug,
     authFilePath: stringValue3(values, "auth-file"),
     callbackHost: stringValue3(values, "oauth-callback-host"),
     reportRejectedCachedToken: () => {
@@ -11432,7 +11921,7 @@ async function parseRunnerArgs(args, deps = {
 `);
     }
   });
-  const channelSession = parseChannelSession(values, token, channelTarget);
+  const channelSession = parseChannelSession(values, token, connectTarget);
   const editorRuntime = await deps.resolveEditorRuntime({
     kandanUrl,
     token,
@@ -11449,7 +11938,7 @@ async function parseRunnerArgs(args, deps = {
   return {
     kandanUrl,
     token,
-    runnerId: stringValue3(values, "runner-id") ?? `runner-${randomUUID3()}`,
+    runnerId: stringValue3(values, "runner-id") ?? `runner-${randomUUID4()}`,
     cwd,
     codexBin,
     codexUrl: stringValue3(values, "codex-url"),
@@ -11463,7 +11952,7 @@ async function parseRunnerArgs(args, deps = {
     editorRuntime: editorRuntime.runtime,
     socketFactory: trustedWebSocketFactory(kandanTlsTrustFromEnv()),
     dependencyStatus,
-    workspaceSlug: channelSession?.workspaceSlug ?? singleWorkspaceScopeFromAccessToken(token),
+    workspaceSlug: connectTarget?.workspaceSlug ?? singleWorkspaceScopeFromAccessToken(token),
     runtimeDefaults: runnerRuntimeDefaultsFromValues(values),
     channelSession
   };
@@ -11575,7 +12064,7 @@ function resolveUserPath(pathValue) {
   return resolve9(pathValue);
 }
 function parseChannelSession(values, token, target) {
-  if (target === undefined) {
+  if (target === undefined || target.channelSlug === undefined) {
     return;
   }
   const listenUser = stringValue3(values, "listen-user") ?? defaultListenUserFromToken(token);
@@ -11591,7 +12080,7 @@ function parseChannelSession(values, token, target) {
     streamFlushMs: positiveIntegerValue(values, "stream-flush-ms")
   };
 }
-function parseChannelSessionTarget(values) {
+function parseConnectTarget(values) {
   return parseOptionalChannelTarget(values);
 }
 function defaultListenUserFromToken(token) {
@@ -11604,12 +12093,15 @@ function defaultListenUserFromToken(token) {
 function parseOptionalChannelTarget(values) {
   const channel = stringValue3(values, "channel");
   const workspace = stringValue3(values, "workspace");
-  if (channel === undefined && workspace === undefined) {
-    return;
+  if (channel === undefined) {
+    if (workspace === undefined) {
+      return;
+    }
+    return { workspaceSlug: workspace };
   }
-  return channel !== undefined && channel.includes("/") ? parseChannelPath(channel) : {
+  return channel.includes("/") ? parseChannelPath(channel) : {
     workspaceSlug: workspace ?? required(values, "workspace"),
-    channelSlug: channel ?? required(values, "channel")
+    channelSlug: channel
   };
 }
 function parseChannelPath(channel) {
@@ -11622,6 +12114,12 @@ function parseChannelPath(channel) {
     channelSlug: channelSlug.trim()
   };
 }
+function withLocalMachineId(options) {
+  return {
+    ...options,
+    machineId: ensureLocalMachineId()
+  };
+}
 function required(values, key) {
   const value = stringValue3(values, key);
   if (value === undefined) {
@@ -11678,19 +12176,19 @@ Usage:
   linzumi commander <folder> [options]
   linzumi start <folder> [options]
   linzumi paths list|add|remove [path]
-  linzumi connect --linzumi-url <ws-url> --workspace <slug> --channel <slug> [options]
+  linzumi connect --workspace <slug> [--channel <slug>] [options]
   linzumi auth --linzumi-url <ws-url> [--workspace <slug> --channel <slug>]
 
-Required:
+Connection:
   --linzumi-url <ws-url>      Linzumi backend URL, default ${defaultLinzumiWebSocketUrl}
                                 (deprecated alias: --kandan-url)
   --token <jwt>               Optional override token. Otherwise ~/.linzumi/auth.json is validated or OAuth opens.
   --auth-file <path>          Auth cache path, default ~/.linzumi/auth.json
   --oauth-callback-host <ip>  Callback host reachable by your browser
 
-Channel binding:
+Workspace and optional channel binding:
   --workspace <slug>          Workspace slug
-  --channel <slug|w/c>        Channel slug, or workspace/channel
+  --channel <slug|w/c>        Optional channel slug, or workspace/channel
   --linzumi-thread-id <uuid>  Resume an existing Linzumi thread instead of announcing a new root
                                 (deprecated alias: --kandan-thread-id)
   --listen-user <user|all>    User whose replies are accepted, default authenticated user
@@ -11723,8 +12221,9 @@ Examples:
     linzumi commander daemon --runner-id launch-commander
     linzumi start ~/
     linzumi start ~/code/my-app
-    linzumi connect --workspace <your-workspace> --channel <your-channel> --launch-tui
-    linzumi connect --workspace <your-workspace> --channel <your-channel> --model gpt-5 --reasoning-effort low --fast --launch-tui
+    linzumi connect --workspace <your-workspace> --launch-tui
+    linzumi connect --workspace <your-workspace> --model gpt-5 --reasoning-effort low --fast --launch-tui
+    linzumi connect --workspace <your-workspace> --channel <your-channel>
     linzumi auth --workspace <your-workspace> --channel <your-channel>
     linzumi paths add ~/code/my-app
     linzumi paths list
@@ -11734,9 +12233,9 @@ Examples:
       Missing --listen-user and authenticated user is unavailable.
     linzumi connect --token "$TOKEN" --listen-users sean
       Invalid flag: use --listen-user.
-    linzumi connect --workspace <your-workspace> --channel <your-channel> --allowed-cwd /does/not/exist
+    linzumi connect --workspace <your-workspace> --allowed-cwd /does/not/exist
       Invalid --allowed-cwd: allowed cwd roots must exist locally.
-    linzumi connect --workspace <your-workspace> --channel <your-channel> --forward-port vite
+    linzumi connect --workspace <your-workspace> --forward-port vite
       Invalid --forward-port: value must be a TCP port from 1 to 65535.
 `;
 }
@@ -11894,7 +12393,7 @@ space, persists this folder to your trusted-paths list, and starts this
 computer as a local Codex runner.
 
 Advanced (when you already know your workspace and channel):
-  linzumi connect --workspace <your-workspace> --channel <your-channel>
+  linzumi connect --workspace <your-workspace>
 
 For help:
   linzumi connect --help