@linzumi/cli 0.0.72-beta → 0.0.74-beta

package/dist/index.js

@@ -140,6 +140,7 @@ function parseKandanChatEvent(value) {
     actorSlug: stringValue(actor?.slug),
     actorUserId: integerValue(value.actor_user_id),
     threadId: stringValue(payload.thread_id),
+    threadTitle: kandanThreadTitle(value, payload),
     replyToSeq: integerValue(payload.reply_to_seq),
     localRunnerEventType: localRunnerEventType(payload),
     body: stringValue(value.body) ?? stringValue(value.text) ?? stringValue(payload.body) ?? stringValue(payload.text) ?? "",
@@ -148,6 +149,11 @@ function parseKandanChatEvent(value) {
     )
   };
 }
+function kandanThreadTitle(value, payload) {
+  const payloadThread = objectValue(payload.thread);
+  const eventThread = objectValue(value.thread);
+  return stringValue(payload.thread_title) ?? stringValue(payload.threadTitle) ?? stringValue(payload.title) ?? stringValue(payloadThread?.thread_title) ?? stringValue(payloadThread?.threadTitle) ?? stringValue(payloadThread?.title) ?? stringValue(value.thread_title) ?? stringValue(value.threadTitle) ?? stringValue(value.title) ?? stringValue(eventThread?.thread_title) ?? stringValue(eventThread?.threadTitle) ?? stringValue(eventThread?.title);
+}
 function parseKandanChatAttachments(attachments) {
   return attachments.flatMap((attachment) => {
     const value = objectValue(attachment);
@@ -797,6 +803,130 @@ var init_commanderAttachments = __esm({
   }
 });
 
+// src/codexNotificationDiagnostics.ts
+function codexNotificationDiagnosticDetails(method, params) {
+  switch (method) {
+    case "warning":
+    case "error":
+      return {
+        diagnostic_summary: codexNotificationDiagnosticSummary(method, params) ?? `${method}: seen (no details)`,
+        diagnostic_payload: redactedJsonValue(params, 0),
+        diagnostic_payload_keys: Object.keys(params).sort()
+      };
+    default:
+      return {};
+  }
+}
+function codexNotificationDiagnosticSummary(method, params) {
+  const error = objectValue2(params.error);
+  const item = objectValue2(params.item);
+  const code = stringValue2(params.code) ?? numberStringValue(params.code) ?? stringValue2(error?.code) ?? numberStringValue(error?.code) ?? stringValue2(params.status) ?? numberStringValue(params.status);
+  const message = stringValue2(params.message) ?? stringValue2(params.detail) ?? stringValue2(params.reason) ?? stringValue2(error?.message) ?? stringValue2(error?.detail) ?? stringValue2(error?.reason);
+  const itemType = stringValue2(item?.type);
+  const redactedCode = code === void 0 ? void 0 : redactedDiagnosticText(code);
+  const prefix = redactedCode === void 0 ? method : `${method} ${redactedCode}`;
+  const detail = message === void 0 ? itemType === void 0 ? void 0 : `item.type=${itemType}` : redactedDiagnosticText(message);
+  return detail === void 0 ? void 0 : `${prefix}: ${detail}`;
+}
+function redactedJsonValue(value, depth) {
+  if (value === void 0) {
+    return null;
+  }
+  if (typeof value === "string") {
+    const redacted = redactedDiagnosticText(value);
+    return redacted.length <= maxDiagnosticStringLength ? redacted : `${redacted.slice(0, maxDiagnosticStringLength)}...`;
+  }
+  if (value === null || typeof value === "boolean" || typeof value === "number") {
+    return value;
+  }
+  if (depth >= maxDiagnosticDepth) {
+    return "[max-depth]";
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactedJsonValue(entry, depth + 1));
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      sensitiveKey(key) ? redactedValue : redactedJsonValue(entry, depth + 1)
+    ])
+  );
+}
+function sensitiveKey(key) {
+  const normalizedKey = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[\s-]+/g, "_").toLowerCase();
+  switch (normalizedKey) {
+    case "authorization":
+    case "cookie":
+    case "cookies":
+    case "credential":
+    case "credentials":
+    case "password":
+    case "secret":
+    case "token":
+    case "access_key":
+    case "api_key":
+    case "auth_token":
+    case "bearer_token":
+    case "client_secret":
+    case "id_token":
+    case "private_key":
+    case "proxy_authorization":
+    case "refresh_token":
+    case "secret_key":
+    case "session_token":
+    case "set_cookie":
+    case "sig":
+    case "signature":
+    case "signing_key":
+    case "x_amz_signature":
+    case "x_api_key":
+      return true;
+    default:
+      return normalizedKey.endsWith("_api_key") || normalizedKey.endsWith("_access_key") || normalizedKey.endsWith("_private_key") || normalizedKey.endsWith("_secret_key") || normalizedKey.endsWith("_authorization") || normalizedKey.endsWith("_cookie") || normalizedKey.endsWith("_cookies") || normalizedKey.endsWith("_token") || normalizedKey.endsWith("_secret") || normalizedKey.endsWith("_password") || normalizedKey.endsWith("_signature") || normalizedKey.endsWith("_sig") || normalizedKey.endsWith("_credential") || normalizedKey.endsWith("_credentials");
+  }
+}
+function redactedDiagnosticText(value) {
+  return value.replace(
+    /https?:\/\/\S*(?:token|secret|signature|sig|x-amz-signature|api[_-]?key|access[_-]?key|private[_-]?key|refresh)\S*/gi,
+    redactedUrl
+  ).replace(
+    /(^|[^A-Za-z0-9_-])(["']?)(set-cookie|cookie)\2\s*(:|=)\s*(["']?)[^\r\n"']*\5/gi,
+    (_match, prefix, keyQuote, key, separator, valueQuote) => {
+      const spacing = separator === ":" && valueQuote === "" ? " " : "";
+      return `${prefix}${keyQuote}${key}${keyQuote}${separator}${spacing}${valueQuote}${redactedValue}${valueQuote}`;
+    }
+  ).replace(
+    new RegExp(
+      `(^|[^A-Za-z0-9_-])(["']?)(${credentialTextKeyPattern})\\2\\s*(:|=)\\s*(["']?)(?:(?:Bearer|Basic|Digest|Token|ApiKey|OAuth|Negotiate)\\s+)?[^"'\\s,;}&]+\\5`,
+      "gi"
+    ),
+    (_match, prefix, keyQuote, key, separator, valueQuote) => {
+      const spacing = separator === ":" && valueQuote === "" ? " " : "";
+      return `${prefix}${keyQuote}${key}${keyQuote}${separator}${spacing}${valueQuote}${redactedValue}${valueQuote}`;
+    }
+  ).replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]");
+}
+function objectValue2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function stringValue2(value) {
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function numberStringValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value.toString() : void 0;
+}
+var redactedValue, redactedUrl, maxDiagnosticDepth, maxDiagnosticStringLength, credentialTextKeyPattern;
+var init_codexNotificationDiagnostics = __esm({
+  "src/codexNotificationDiagnostics.ts"() {
+    "use strict";
+    redactedValue = "[redacted]";
+    redactedUrl = "[redacted-url]";
+    maxDiagnosticDepth = 12;
+    maxDiagnosticStringLength = 8e3;
+    credentialTextKeyPattern = "(?:(?:[A-Za-z0-9]+[_-]+)*(?:proxy-authorization|authorization|set-cookie|cookie|x-api-key|api[_-]?key|access[_-]?key|access[_-]?token|private[_-]?key|refresh(?:[_-]?token)?|auth[_-]?token|id[_-]?token|client[_-]?secret|bearer[_-]?token|session[_-]?token|secret[_-]?key|signing[_-]?key|credential|credentials|token|secret|password|signature|sig))";
+  }
+});
+
 // src/codexRuntimeOptions.ts
 function codexThreadRuntimeOverrides(options) {
   const session = options.channelSession;
@@ -1831,6 +1961,10 @@ function interruptQueuedMessages(queue, throughSeq) {
 }
 function fuseQueuedMessages(selected) {
   const last = selected[selected.length - 1];
+  const receivedAtMs = selected.reduce(
+    (earliest, message) => message.receivedAtMs === void 0 ? earliest : earliest === void 0 ? message.receivedAtMs : Math.min(earliest, message.receivedAtMs),
+    void 0
+  );
   if (last === void 0) {
     return void 0;
   }
@@ -1839,7 +1973,8 @@ function fuseQueuedMessages(selected) {
     actorSlug: "kandan",
     actorUserId: void 0,
     body: selected.map(codexInputForQueuedKandanMessage).join("\n\n---\n\n"),
-    attachments: selected.flatMap((message) => message.attachments)
+    attachments: selected.flatMap((message) => message.attachments),
+    receivedAtMs
   };
 }
 var init_kandanQueue = __esm({
@@ -2346,6 +2481,7 @@ function coalesceAssistantDeltas(deltas) {
   return coalesceTextDeltas(deltas, (delta) => ({
     itemKey: delta.itemKey,
     turnId: delta.turnId,
+    sourceMessageSeq: delta.sourceMessageSeq,
     delta: delta.delta
   }));
 }
@@ -3648,8 +3784,15 @@ async function attachChannelSession(args) {
     handleCodexNotification: (method, params) => {
       const turnId = codexNotificationTurnId(params);
       const threadId = codexNotificationThreadId(params);
-      const routedTurnId = turnId ?? codexNotificationActiveTurnFallback(method, state, params);
+      const routedTurnId = turnId ?? codexNotificationActiveTurnFallback(method, state, params, threadId);
       if (codexNotificationBelongsToSession(state, threadId, routedTurnId)) {
+        rememberRecentCodexDiagnostic(
+          state,
+          method,
+          params,
+          threadId,
+          routedTurnId
+        );
         const processingReason = processingReasonForCodexNotification(
           method,
           params
@@ -3713,7 +3856,15 @@ async function attachChannelSession(args) {
             break;
           }
           case "item/agentMessage/delta":
-            enqueueAssistantDelta(args, state, params, payloadContext);
+            const assistantDeltaSourceSeq = routedTurnId === void 0 ? startingSourceMessageSeq(state) : void 0;
+            enqueueAssistantDelta(
+              args,
+              state,
+              params,
+              payloadContext,
+              routedTurnId,
+              assistantDeltaSourceSeq
+            );
             break;
           case "item/reasoning/textDelta":
             enqueueReasoningDelta(args, state, params, payloadContext);
@@ -3734,16 +3885,26 @@ async function attachChannelSession(args) {
           case "item/completed":
             enqueueWebSearchProgress(args, state, params, payloadContext);
             enqueueCompletedFileChange(args, state, params, payloadContext);
+            const pendingCompletedAssistantSourceSeq = routedTurnId === void 0 ? startingSourceMessageSeq(state) : void 0;
             const completedAssistantItemForward = forwardCompletedAssistantItem(
               args,
               state,
               params,
-              payloadContext
+              payloadContext,
+              routedTurnId,
+              pendingCompletedAssistantSourceSeq
             );
-            if (turnId !== void 0) {
+            if (routedTurnId !== void 0) {
               rememberPendingCompletedAssistantItemForward(
                 state,
-                turnId,
+                routedTurnId,
+                completedAssistantItemForward
+              );
+            }
+            if (pendingCompletedAssistantSourceSeq !== void 0) {
+              rememberPendingCompletedAssistantItemSourceForward(
+                state,
+                pendingCompletedAssistantSourceSeq,
                 completedAssistantItemForward
               );
             }
@@ -3752,29 +3913,38 @@ async function attachChannelSession(args) {
                 message: error instanceof Error ? error.message : String(error)
               });
             }).finally(() => {
-              if (turnId !== void 0) {
+              if (routedTurnId !== void 0) {
                 forgetPendingCompletedAssistantItemForward(
                   state,
-                  turnId,
+                  routedTurnId,
+                  completedAssistantItemForward
+                );
+              }
+              if (pendingCompletedAssistantSourceSeq !== void 0) {
+                forgetPendingCompletedAssistantItemSourceForward(
+                  state,
+                  pendingCompletedAssistantSourceSeq,
                   completedAssistantItemForward
                 );
               }
             });
-            if (turnId !== void 0) {
+            if (routedTurnId !== void 0) {
               const promise = mirrorLocalTuiInputFromNotification(
                 args,
                 state,
-                turnId,
+                routedTurnId,
                 params,
                 payloadContext
               );
-              rememberPendingTuiInputMirror(state, turnId, promise);
+              rememberPendingTuiInputMirror(state, routedTurnId, promise);
               void promise.catch((error) => {
                 args.log("codex.tui_input_mirror_failed", {
-                  turn_id: turnId,
+                  turn_id: routedTurnId,
                   message: error instanceof Error ? error.message : String(error)
                 });
-              }).finally(() => forgetPendingTuiInputMirror(state, turnId));
+              }).finally(
+                () => forgetPendingTuiInputMirror(state, routedTurnId)
+              );
             }
             break;
           case "response_item":
@@ -3845,6 +4015,7 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
   return {
     rootSeq,
     kandanThreadId,
+    kandanThreadTitle: void 0,
     codexThreadId,
     turn: { status: "idle" },
     closed: false,
@@ -3855,7 +4026,10 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     recoveredCompletingTurnIds: /* @__PURE__ */ new Set(),
     retryableTurnIds: /* @__PURE__ */ new Set(),
     completedAssistantItemKeys: /* @__PURE__ */ new Set(),
+    completedAssistantItemTurns: createBoundedCache(maxForwardedTurnIds),
+    completedAssistantItemSourceSeqs: createBoundedCache(maxForwardedTurnIds),
     pendingCompletedAssistantItemForwards: /* @__PURE__ */ new Map(),
+    pendingCompletedAssistantItemSourceForwards: /* @__PURE__ */ new Map(),
     claimedKandanMessageKeys: /* @__PURE__ */ new Set(),
     localTuiTurnIds: /* @__PURE__ */ new Set(),
     mirroredTuiInputProjections: createBoundedCache(maxForwardedTurnIds),
@@ -3867,6 +4041,7 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     pendingCommandOutputs: createBoundedCache(maxForwardedTurnIds),
     observedCommandOutputCommands: createBoundedCache(maxForwardedTurnIds * 3),
     streamingFileChangeOutputs: createBoundedCache(maxForwardedTurnIds),
+    recentCodexDiagnostics: createBoundedCache(maxForwardedTurnIds * 3),
     assistantDeltaQueue: createStreamDeltaQueue(),
     reasoningDeltaQueue: createStreamDeltaQueue(),
     commandOutputQueue: createStreamDeltaQueue(),
@@ -3969,6 +4144,7 @@ async function bindChannelSession(args, state, payloadContext) {
       state.minSeq = Math.max(state.minSeq, state.rootSeq);
     }
   } else if (state.codexThreadId !== void 0) {
+    await hydrateKandanThreadTitleFromThreadContext(args, state);
     await bindCurrentCodexThread(args, state);
   } else {
     const resolved = await pushOk2(
@@ -3983,6 +4159,10 @@ async function bindChannelSession(args, state, payloadContext) {
     );
     state.rootSeq = integerValue(resolved.seq);
     state.codexThreadId = stringValue(resolved.codex_thread_id);
+    updateKandanThreadTitle(
+      state,
+      kandanThreadTitleFromResolvedMessage(resolved.message)
+    );
     if (state.codexThreadId === void 0) {
       throw new Error(
         "Kandan thread root metadata did not include a Codex thread id"
@@ -4914,6 +5094,50 @@ function parsePortForwardDecision(body) {
     requestId: match[2] ?? ""
   };
 }
+function runnerConsoleBodyPreview(body) {
+  const normalized = body.replace(/\s+/g, " ").trim();
+  return normalized.length <= 50 ? normalized : `${normalized.slice(0, 47)}...`;
+}
+function updateKandanThreadTitle(state, title) {
+  if (title !== void 0) {
+    state.kandanThreadTitle = title;
+  }
+}
+function kandanThreadTitleFromResolvedMessage(message) {
+  return message === void 0 ? void 0 : parseKandanChatEvent(message)?.threadTitle;
+}
+function kandanThreadTitleFromWireMessages(messages) {
+  if (!Array.isArray(messages)) {
+    return void 0;
+  }
+  for (const message of messages) {
+    const title = parseKandanChatEvent(message)?.threadTitle;
+    if (title !== void 0) {
+      return title;
+    }
+  }
+  return void 0;
+}
+async function hydrateKandanThreadTitleFromThreadContext(args, state) {
+  if (state.kandanThreadId === void 0 || state.kandanThreadTitle !== void 0) {
+    return;
+  }
+  const session = args.options.channelSession;
+  const reply = await pushOk2(
+    args.kandan,
+    args.topic,
+    "session:thread_context",
+    {
+      workspace: session.workspaceSlug,
+      channel: session.channelSlug,
+      thread_id: state.kandanThreadId
+    }
+  );
+  updateKandanThreadTitle(
+    state,
+    kandanThreadTitleFromWireMessages(reply.messages)
+  );
+}
 async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext, event) {
   const session = args.options.channelSession;
   if (event.type !== "thread.message") {
@@ -5023,6 +5247,7 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
     });
     return;
   }
+  updateKandanThreadTitle(state, event.threadTitle);
   if (!claimKandanMessage(args, state, event)) {
     args.log("kandan.message_ignored", {
       seq: event.seq,
@@ -5032,17 +5257,26 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
     });
     return;
   }
+  const receivedAtMs = Date.now();
   enqueuePendingKandanMessage(state.queue, {
     seq: event.seq,
     actorSlug: event.actorSlug,
     actorUserId: event.actorUserId,
     body: event.body,
-    attachments: event.attachments
+    attachments: event.attachments,
+    receivedAtMs
   });
   args.log("kandan.message_queued", {
     seq: event.seq,
     actor_slug: event.actorSlug ?? null,
     actor_user_id: event.actorUserId ?? null,
+    linzumi_thread_id: state.kandanThreadId ?? null,
+    codex_thread_id: state.codexThreadId ?? null,
+    runner_console: {
+      body_preview: runnerConsoleBodyPreview(event.body),
+      message_received_at_ms: receivedAtMs,
+      ...state.kandanThreadTitle === void 0 ? {} : { linzumi_thread_title: state.kandanThreadTitle }
+    },
     queue_depth: pendingKandanMessageQueueLength(state.queue)
   });
   await publishKandanMessageState(args, event, { status: "queued" });
@@ -5111,13 +5345,21 @@ async function startThreadMessageTurn(args, state, payloadContext, message) {
     actorSlug: message.actorSlug,
     actorUserId: message.actorUserId,
     body: message.body,
-    attachments: []
+    attachments: [],
+    receivedAtMs: Date.now()
   };
   enqueuePendingKandanMessage(state.queue, queued);
   args.log("kandan.message_queued", {
     seq: queued.seq,
     actor_slug: queued.actorSlug ?? null,
     actor_user_id: queued.actorUserId ?? null,
+    linzumi_thread_id: state.kandanThreadId ?? null,
+    codex_thread_id: state.codexThreadId ?? null,
+    runner_console: {
+      body_preview: runnerConsoleBodyPreview(queued.body),
+      message_received_at_ms: queued.receivedAtMs ?? Date.now(),
+      ...state.kandanThreadTitle === void 0 ? {} : { linzumi_thread_title: state.kandanThreadTitle }
+    },
     queue_depth: pendingKandanMessageQueueLength(state.queue)
   });
   await publishQueuedMessageState(args, state, queued, { status: "queued" });
@@ -5141,11 +5383,15 @@ async function bindUnboundHistoricalThread(args, state, event) {
     );
     const rootSeq = integerValue(resolved.seq);
     const codexThreadId = stringValue(resolved.codex_thread_id);
+    const resolvedThreadTitle = kandanThreadTitleFromResolvedMessage(
+      resolved.message
+    );
     if (rootSeq !== event.replyToSeq || codexThreadId === void 0) {
       return false;
     }
     state.rootSeq = rootSeq;
     state.kandanThreadId = event.threadId;
+    updateKandanThreadTitle(state, event.threadTitle ?? resolvedThreadTitle);
     state.codexThreadId = codexThreadId;
     await bindCurrentCodexThread(args, state);
     args.log("kandan.thread_bound_from_historical_reply", {
@@ -5240,7 +5486,13 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
     queued_seq: next.seq,
     actor_slug: next.actorSlug ?? null,
     actor_user_id: next.actorUserId ?? null,
+    linzumi_thread_id: state.kandanThreadId ?? null,
     codex_thread_id: state.codexThreadId ?? null,
+    runner_console: {
+      body_preview: runnerConsoleBodyPreview(next.body),
+      message_received_at_ms: next.receivedAtMs ?? Date.now(),
+      ...state.kandanThreadTitle === void 0 ? {} : { linzumi_thread_title: state.kandanThreadTitle }
+    },
     queue_depth: pendingKandanMessageQueueLength(state.queue)
   });
   await publishQueuedMessageState(args, state, next, {
@@ -5306,7 +5558,7 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
         state.codexThreadId = newCodexThreadId;
         await bindCurrentCodexThread(args, state);
         args.log("codex.thread_rebound", {
-          kandan_thread_id: state.kandanThreadId,
+          linzumi_thread_id: state.kandanThreadId,
           old_codex_thread_id: oldCodexThreadId ?? null,
           new_codex_thread_id: newCodexThreadId
         });
@@ -5552,6 +5804,15 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
   if (completingTurnWasRecovered(state, turnId)) {
     return;
   }
+  if (completingQueuedSeq !== void 0) {
+    await waitForPendingCompletedAssistantItemSourceForwards(
+      state,
+      completingQueuedSeq
+    );
+  }
+  if (completingTurnWasRecovered(state, turnId)) {
+    return;
+  }
   await waitForStreamingForwardChains(args, state, payloadContext);
   if (completingTurnWasRecovered(state, turnId)) {
     return;
@@ -5614,6 +5875,13 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
     );
     const sourceMessageSeq = sourceMessageSeqForTurn(state, turnId);
     const rootSeq = state.rootSeq;
+    const completedAssistantOutputCount = completedOutputs.filter(
+      completedOutputProjectionIsAssistant
+    ).length;
+    const completedForwardedAssistantSnapshotCount = forwardedAssistantSnapshotOutputCount(state, messages);
+    const completedSourceSeqAssistantItemCount = sourceMessageSeq === void 0 ? 0 : completedAssistantItemForwardedForSourceSeq(state, sourceMessageSeq);
+    const completedStreamingAssistantOutputCount = completedAssistantOutputCount === 0 ? await completeStreamingAssistantOutputsForTurn(args, state, turnId) : 0;
+    const completedAssistantResponseSeen = completedAssistantOutputCount > 0 || completedForwardedAssistantSnapshotCount > 0 || completedSourceSeqAssistantItemCount > 0 || completedStreamingAssistantOutputCount > 0 || completedAssistantItemForwardedForTurn(state, turnId);
     for (const output of completedOutputs) {
       if (completingTurnWasRecovered(state, turnId)) {
         return;
@@ -5631,6 +5899,35 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
     if (completingTurnWasRecovered(state, turnId)) {
       return;
     }
+    if (!completedAssistantResponseSeen) {
+      const recentError = recentCodexDiagnosticSummaryForTurn(
+        state,
+        "error",
+        state.codexThreadId,
+        turnId
+      );
+      const recentWarning = recentCodexDiagnosticSummaryForTurn(
+        state,
+        "warning",
+        state.codexThreadId,
+        turnId
+      );
+      args.log("codex.turn_completed_without_assistant_output", {
+        turn_id: turnId,
+        codex_thread_id: state.codexThreadId,
+        kandan_thread_id: state.kandanThreadId,
+        source_seq: sourceMessageSeq ?? null,
+        output_count: completedOutputs.length,
+        assistant_output_count: completedAssistantOutputCount,
+        forwarded_assistant_snapshot_output_count: completedForwardedAssistantSnapshotCount,
+        source_seq_assistant_item_count: completedSourceSeqAssistantItemCount,
+        completed_streaming_assistant_output_count: completedStreamingAssistantOutputCount,
+        thread_read_output_count: readMessages.length,
+        session_log_output_count: sessionLogMessages.length,
+        recent_error: recentError ?? null,
+        recent_warning: recentWarning ?? null
+      });
+    }
     rememberForwardedTurnId(state, turnId);
     forgetLocalTuiTurnId(state, turnId);
     if (completingQueuedSeq !== void 0) {
@@ -5638,8 +5935,9 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
         args,
         state.kandanThreadId,
         completingQueuedSeq,
-        {
-          status: "processed"
+        completedAssistantResponseSeen ? { status: "processed" } : {
+          status: "failed",
+          reason: "Codex completed without producing a response."
         }
       );
       clearActiveProcessingState(state, completingQueuedSeq);
@@ -5789,6 +6087,21 @@ function completedOutputProjectionsForTurn(state, turnId, messages) {
     compareCompletedOutputProjection
   );
 }
+function completedOutputProjectionIsAssistant(output) {
+  switch (output.kind) {
+    case "snapshot":
+      return stringValue(output.message.structured.kind) === "codex_assistant_message";
+    case "cached_reasoning":
+    case "cached_command":
+    case "cached_file_change":
+      return false;
+  }
+}
+function forwardedAssistantSnapshotOutputCount(state, messages) {
+  return messages.filter(
+    (message) => stringValue(message.structured.kind) === "codex_assistant_message" && completedAssistantItemForwarded(state, message.itemKey)
+  ).length;
+}
 async function sessionLogOutputMessagesForTurn(args, codexThreadId, turnId) {
   try {
     return await codexSessionLogOutputMessagesForTurn({
@@ -5805,39 +6118,76 @@ async function sessionLogOutputMessagesForTurn(args, codexThreadId, turnId) {
   }
 }
 function completedMessagesWithSessionLog(readMessages, sessionLogMessages) {
-  const readExactKeys = new Set(readMessages.map(completedMessageExactKey));
-  const readSemanticCounts = completedMessageSemanticCounts(readMessages);
-  const missingSessionStructuredMessages = [];
-  for (const message of sessionLogMessages) {
-    if (stringValue(message.structured.kind) === "codex_assistant_message") {
-      continue;
-    }
-    if (readExactKeys.has(completedMessageExactKey(message))) {
-      continue;
+  if (sessionLogMessages.length === 0) {
+    return [...readMessages];
+  }
+  const consumedReadIndexes = /* @__PURE__ */ new Set();
+  const sessionOrderedEntries = sessionLogMessages.map((message) => {
+    const readIndex = findUnconsumedCompletedMessageIndex(
+      readMessages,
+      consumedReadIndexes,
+      completedMessageExactKey(message)
+    );
+    if (readIndex >= 0) {
+      consumedReadIndexes.add(readIndex);
+      return { kind: "read", readIndex };
     }
-    const semanticKey = completedMessageSemanticKey(message);
-    const remainingReadCount = readSemanticCounts.get(semanticKey) ?? 0;
-    if (remainingReadCount > 0) {
-      readSemanticCounts.set(semanticKey, remainingReadCount - 1);
-      continue;
+    const semanticReadIndex = findUnconsumedCompletedMessageSemanticIndex(
+      readMessages,
+      consumedReadIndexes,
+      completedMessageSemanticKey(message)
+    );
+    if (semanticReadIndex >= 0) {
+      consumedReadIndexes.add(semanticReadIndex);
+      return { kind: "read", readIndex: semanticReadIndex };
+    }
+    return { kind: "session", message };
+  });
+  const mergedMessages = [];
+  let nextReadIndex = 0;
+  for (const entry of sessionOrderedEntries) {
+    switch (entry.kind) {
+      case "read":
+        while (nextReadIndex < entry.readIndex) {
+          if (!consumedReadIndexes.has(nextReadIndex)) {
+            const message = readMessages[nextReadIndex];
+            if (message !== void 0) {
+              mergedMessages.push(message);
+            }
+          }
+          nextReadIndex += 1;
+        }
+        mergedMessages.push(readMessages[entry.readIndex]);
+        nextReadIndex = Math.max(nextReadIndex, entry.readIndex + 1);
+        break;
+      case "session":
+        mergedMessages.push(entry.message);
+        break;
     }
-    missingSessionStructuredMessages.push(message);
   }
-  if (missingSessionStructuredMessages.length === 0) {
-    return [...readMessages];
+  while (nextReadIndex < readMessages.length) {
+    if (!consumedReadIndexes.has(nextReadIndex)) {
+      const message = readMessages[nextReadIndex];
+      if (message !== void 0) {
+        mergedMessages.push(message);
+      }
+    }
+    nextReadIndex += 1;
   }
-  return [...missingSessionStructuredMessages, ...readMessages];
+  return mergedMessages;
 }
 function completedMessageExactKey(message) {
   return `${stringValue(message.structured.kind) ?? ""}:${message.itemKey}`;
 }
-function completedMessageSemanticCounts(messages) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const message of messages) {
-    const key = completedMessageSemanticKey(message);
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-  }
-  return counts;
+function findUnconsumedCompletedMessageIndex(messages, consumedIndexes, exactKey) {
+  return messages.findIndex(
+    (message, index) => !consumedIndexes.has(index) && completedMessageExactKey(message) === exactKey
+  );
+}
+function findUnconsumedCompletedMessageSemanticIndex(messages, consumedIndexes, semanticKey) {
+  return messages.findIndex(
+    (message, index) => !consumedIndexes.has(index) && completedMessageSemanticKey(message) === semanticKey
+  );
 }
 function completedMessageSemanticKey(message) {
   const kind = stringValue(message.structured.kind) ?? "";
@@ -5966,7 +6316,12 @@ async function postCompletedOutputProjection(args, state, payloadContext, params
           );
           break;
       }
-      logCompletedCodexOutput(args, params.turnId, params.output.message);
+      logCompletedCodexOutput(
+        args,
+        state,
+        params.turnId,
+        params.output.message
+      );
       break;
     }
     case "cached_reasoning": {
@@ -5988,7 +6343,7 @@ async function postCompletedOutputProjection(args, state, payloadContext, params
         message.structured
       );
       forgetStreamingReasoningOutput(state, output.itemKey);
-      logCompletedCodexOutput(args, params.turnId, message);
+      logCompletedCodexOutput(args, state, params.turnId, message);
       break;
     }
     case "cached_command": {
@@ -6015,7 +6370,7 @@ async function postCompletedOutputProjection(args, state, payloadContext, params
         message.structured
       );
       forgetStreamingCommandOutput(state, output.itemKey);
-      logCompletedCodexOutput(args, params.turnId, message);
+      logCompletedCodexOutput(args, state, params.turnId, message);
       break;
     }
     case "cached_file_change": {
@@ -6038,26 +6393,32 @@ async function postCompletedOutputProjection(args, state, payloadContext, params
         message.structured
       );
       forgetStreamingFileChangeOutput(state, output.itemKey);
-      logCompletedCodexOutput(args, params.turnId, message);
+      logCompletedCodexOutput(args, state, params.turnId, message);
       break;
     }
   }
 }
-function logCompletedCodexOutput(args, turnId, message) {
+function logCompletedCodexOutput(args, state, turnId, message) {
   args.log("kandan.codex_output_forwarded", {
     turn_id: turnId,
     item_key: message.itemKey,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     structured_kind: stringValue(message.structured.kind) ?? null,
+    runner_console: {
+      body_preview: runnerConsoleBodyPreview(message.body)
+    },
     command: stringValue(message.structured.command) ?? null,
     file_paths: fileChangePaths(message.structured)
   });
 }
-async function forwardCompletedAssistantItem(args, state, params, payloadContext) {
+async function forwardCompletedAssistantItem(args, state, params, payloadContext, fallbackTurnId = void 0, fallbackSourceMessageSeq = void 0) {
   if (state.kandanThreadId === void 0 || state.codexThreadId === void 0) {
     return;
   }
-  const turnId = stringValue(params.turnId) ?? stringValue(params.turn_id) ?? stringValue(objectValue(params.turn)?.id);
   const item = objectValue(params.item) ?? params;
+  const itemTurn = objectValue(item.turn);
+  const turnId = stringValue(params.turnId) ?? stringValue(params.turn_id) ?? stringValue(objectValue(params.turn)?.id) ?? stringValue(item.turnId) ?? stringValue(item.turn_id) ?? stringValue(itemTurn?.id) ?? fallbackTurnId;
   const completedItemKey = stringValue(params.itemId) ?? stringValue(params.item_id) ?? stringValue(objectValue(params.item)?.id);
   if (turnId !== void 0) {
     await waitForPendingTuiInputMirror(state, turnId);
@@ -6089,7 +6450,7 @@ async function forwardCompletedAssistantItem(args, state, params, payloadContext
   if (message === void 0 || completedAssistantItemForwarded(state, message.itemKey)) {
     return;
   }
-  const sourceMessageSeq = messageTurnId === void 0 ? void 0 : sourceMessageSeqForTurn(state, messageTurnId);
+  const sourceMessageSeq = messageTurnId === void 0 ? fallbackSourceMessageSeq ?? startingSourceMessageSeq(state) : sourceMessageSeqForTurn(state, messageTurnId);
   if (messageTurnId !== void 0 && sourceMessageSeq === void 0) {
     args.log("codex.completed_assistant_item_without_source_message", {
       turn_id: messageTurnId,
@@ -6137,11 +6498,21 @@ async function forwardCompletedAssistantItem(args, state, params, payloadContext
         `Cannot reconcile completed assistant item ${message.itemKey} from item notification; ${streamed.candidateCount} active streamed assistant outputs exist`
       );
   }
-  rememberCompletedAssistantItemKey(state, message.itemKey);
-  logCompletedCodexOutput(args, messageTurnId ?? `item:${message.itemKey}`, {
-    ...message,
-    structured
-  });
+  rememberCompletedAssistantItemKey(
+    state,
+    message.itemKey,
+    messageTurnId,
+    sourceMessageSeq
+  );
+  logCompletedCodexOutput(
+    args,
+    state,
+    messageTurnId ?? `item:${message.itemKey}`,
+    {
+      ...message,
+      structured
+    }
+  );
 }
 function compareCompletedOutputProjection(left, right) {
   if (left.kind === "snapshot" && right.kind === "snapshot" && left.match.kind !== right.match.kind && (left.match.kind === "none" || right.match.kind === "none")) {
@@ -6213,7 +6584,7 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
   }
   const existing = findStreamingAssistantOutput(state, delta.itemKey);
   const nextContent = `${existing?.content ?? ""}${delta.delta}`;
-  const sourceMessageSeq = delta.turnId === void 0 ? void 0 : sourceMessageSeqForTurn(state, delta.turnId);
+  const sourceMessageSeq = delta.turnId === void 0 ? delta.sourceMessageSeq : sourceMessageSeqForTurn(state, delta.turnId);
   const rootSeq = state.rootSeq;
   if (delta.turnId !== void 0 && sourceMessageSeq === void 0) {
     args.log("codex.delta_without_source_message", {
@@ -6260,6 +6631,7 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
       rememberStreamingAssistantOutput(state, {
         itemKey: delta.itemKey,
         turnId: delta.turnId,
+        sourceMessageSeq,
         seq,
         content: nextContent
       });
@@ -6275,20 +6647,24 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
     );
     rememberStreamingAssistantOutput(state, {
       ...existing,
+      sourceMessageSeq: existing.sourceMessageSeq ?? sourceMessageSeq,
       content: nextContent
     });
   }
   args.log("kandan.codex_delta_forwarded", {
     item_key: delta.itemKey,
     turn_id: delta.turnId ?? null,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     content_length: nextContent.length
   });
 }
-function enqueueAssistantDelta(args, state, params, payloadContext) {
-  const delta = codexAssistantDeltaFromNotification(params);
-  if (delta === void 0) {
+function enqueueAssistantDelta(args, state, params, payloadContext, fallbackTurnId = void 0, fallbackSourceMessageSeq = void 0) {
+  const parsedDelta = codexAssistantDeltaFromNotification(params);
+  if (parsedDelta === void 0) {
     return;
   }
+  const delta = parsedDelta.turnId === void 0 && fallbackTurnId !== void 0 ? { ...parsedDelta, turnId: fallbackTurnId } : { ...parsedDelta, sourceMessageSeq: fallbackSourceMessageSeq };
   enqueueStreamDelta(
     state.assistantDeltaQueue,
     delta,
@@ -6527,6 +6903,8 @@ async function forwardReasoningDeltaPayload(args, state, delta, payloadContext)
   args.log("kandan.codex_reasoning_delta_forwarded", {
     item_key: delta.itemKey,
     turn_id: turnId,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     content_length: nextContent.length
   });
 }
@@ -6715,6 +7093,8 @@ async function forwardCommandOutputDeltaPayload(args, state, delta, payloadConte
   args.log("kandan.codex_command_output_forwarded", {
     item_key: delta.itemKey,
     turn_id: turnId,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     process_id: delta.processId ?? null,
     stream: delta.stream,
     output_length: persistedOutput.length
@@ -6798,6 +7178,8 @@ async function forwardFileChangeDeltaPayload(args, state, delta, payloadContext)
   args.log("kandan.codex_file_change_forwarded", {
     item_key: delta.itemKey,
     turn_id: turnId,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     patch_length: patchText.length
   });
 }
@@ -6936,6 +7318,8 @@ async function forwardTerminalInput(args, state, params, payloadContext) {
   args.log("kandan.codex_output_forwarded", {
     turn_id: turnId,
     item_key: terminal.itemKey,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     structured_kind: "codex_terminal_input",
     command: null,
     file_paths: []
@@ -7023,6 +7407,8 @@ async function forwardWebSearchProgress(args, state, params, payloadContext) {
   args.log("kandan.codex_web_search_progress_forwarded", {
     turn_id: progress.turnId,
     item_key: progress.itemKey,
+    linzumi_thread_id: state.kandanThreadId,
+    codex_thread_id: state.codexThreadId,
     query_count: queries.length
   });
 }
@@ -7078,8 +7464,42 @@ async function completeInterruptedAssistantOutputs(args, state, turnId, payloadC
       "completed"
     );
     forgetStreamingAssistantOutput(state, output.itemKey);
-    rememberCompletedAssistantItemKey(state, output.itemKey);
+    rememberCompletedAssistantItemKey(state, output.itemKey, turnId);
+  }
+}
+async function completeStreamingAssistantOutputsForTurn(args, state, turnId) {
+  const sourceMessageSeq = sourceMessageSeqForTurn(state, turnId);
+  const outputs = boundedCacheValues(state.streamingAssistantOutputs).filter(
+    (output) => output.turnId === turnId || sourceMessageSeq !== void 0 && output.sourceMessageSeq === sourceMessageSeq
+  );
+  for (const output of outputs) {
+    const message = {
+      itemKey: output.itemKey,
+      body: output.content,
+      structured: codexAssistantStructuredMessage(
+        output.itemKey,
+        output.content,
+        "completed"
+      )
+    };
+    await editStreamedCodexOutput(
+      args,
+      state,
+      output.seq,
+      output.itemKey,
+      output.content,
+      "completed"
+    );
+    forgetStreamingAssistantOutput(state, output.itemKey);
+    rememberCompletedAssistantItemKey(
+      state,
+      output.itemKey,
+      turnId,
+      output.sourceMessageSeq
+    );
+    logCompletedCodexOutput(args, state, turnId, message);
   }
+  return outputs.length;
 }
 function streamingClientMessageId(instanceId, delta) {
   const digest = createHash("sha256").update(`${instanceId}:${delta.turnId ?? "turn"}:${delta.itemKey}`).digest("hex").slice(0, 32);
@@ -7457,12 +7877,34 @@ function forgetStreamingAssistantOutput(state, itemKey) {
 function completedAssistantItemForwarded(state, itemKey) {
   return state.completedAssistantItemKeys.has(itemKey);
 }
-function rememberCompletedAssistantItemKey(state, itemKey) {
+function completedAssistantItemForwardedForTurn(state, turnId) {
+  return boundedCacheValues(state.completedAssistantItemTurns).some(
+    (item) => item.turnId === turnId
+  );
+}
+function completedAssistantItemForwardedForSourceSeq(state, sourceSeq) {
+  return boundedCacheValues(state.completedAssistantItemSourceSeqs).filter(
+    (item) => item.sourceSeq === sourceSeq
+  ).length;
+}
+function rememberCompletedAssistantItemKey(state, itemKey, turnId = void 0, sourceSeq = void 0) {
   rememberBoundedStringSet(
     state.completedAssistantItemKeys,
     itemKey,
     maxForwardedTurnIds
   );
+  if (turnId !== void 0) {
+    rememberBoundedCacheValue(state.completedAssistantItemTurns, itemKey, {
+      itemKey,
+      turnId
+    });
+  }
+  if (sourceSeq !== void 0) {
+    rememberBoundedCacheValue(state.completedAssistantItemSourceSeqs, itemKey, {
+      itemKey,
+      sourceSeq
+    });
+  }
 }
 function rememberStreamingReasoningOutput(state, output) {
   rememberBoundedCacheValue(
@@ -7537,7 +7979,9 @@ function mergeWebSearchQueries(existing, incoming) {
 }
 function codexNotificationTurnId(params) {
   const turn = objectValue(params.turn);
-  return stringValue(turn?.id) ?? stringValue(params.turnId) ?? stringValue(params.turn_id);
+  const item = objectValue(params.item);
+  const itemTurn = objectValue(item?.turn);
+  return stringValue(turn?.id) ?? stringValue(params.turnId) ?? stringValue(params.turn_id) ?? stringValue(item?.turnId) ?? stringValue(item?.turn_id) ?? stringValue(itemTurn?.id);
 }
 function codexNotificationThreadId(params) {
   const thread = objectValue(params.thread);
@@ -7577,11 +8021,58 @@ function inferThreadOnlyCompletedTurnId(args, state, threadId) {
       return void 0;
   }
 }
-function codexNotificationActiveTurnFallback(method, state, params) {
-  if (method !== "response_item" || codexCompletedFileChangeFromNotification(params) === void 0) {
+function codexNotificationActiveTurnFallback(method, state, params, threadId) {
+  if (threadId === void 0 || state.codexThreadId !== threadId) {
     return void 0;
   }
-  return activeTurnId(state.turn);
+  switch (method) {
+    case "response_item":
+      return codexCompletedFileChangeFromNotification(params) === void 0 ? void 0 : activeTurnId(state.turn);
+    case "item/agentMessage/delta":
+    case "item/completed":
+    case "warning":
+    case "error":
+      return activeTurnId(state.turn);
+    default:
+      return void 0;
+  }
+}
+function rememberRecentCodexDiagnostic(state, method, params, threadId, turnId) {
+  switch (method) {
+    case "warning":
+    case "error": {
+      const summary = codexNotificationDiagnosticSummary(method, params) ?? `${method}: seen (no details)`;
+      const cacheKey = [
+        method,
+        threadId ?? "no-thread",
+        turnId ?? "no-turn"
+      ].join(":");
+      if (getBoundedCacheValue(state.recentCodexDiagnostics, cacheKey)) {
+        break;
+      }
+      rememberBoundedCacheValue(state.recentCodexDiagnostics, cacheKey, {
+        method,
+        threadId,
+        turnId,
+        summary
+      });
+      break;
+    }
+    default:
+      break;
+  }
+}
+function recentCodexDiagnosticSummaryForTurn(state, method, threadId, turnId) {
+  return getBoundedCacheValue(
+    state.recentCodexDiagnostics,
+    [method, threadId, turnId].join(":")
+  )?.summary ?? getBoundedCacheValue(
+    state.recentCodexDiagnostics,
+    [method, "no-thread", turnId].join(":")
+  )?.summary ?? getBoundedCacheValue(
+    state.recentCodexDiagnostics,
+    [method, threadId, "no-turn"].join(":")
+  )?.summary;
 }
 function rememberLocalTuiTurnIfNeeded(args, state, threadId, turnId) {
   if (args.options.launchTui !== true || state.codexThreadId !== threadId || state.turn.status !== "idle") {
@@ -7645,6 +8136,35 @@ function forgetPendingCompletedAssistantItemForward(state, turnId, promise) {
     state.pendingCompletedAssistantItemForwards.delete(turnId);
   }
 }
+function rememberPendingCompletedAssistantItemSourceForward(state, sourceMessageSeq, promise) {
+  const existing = state.pendingCompletedAssistantItemSourceForwards.get(sourceMessageSeq);
+  const pending = existing ?? /* @__PURE__ */ new Set();
+  pending.add(promise);
+  state.pendingCompletedAssistantItemSourceForwards.set(
+    sourceMessageSeq,
+    pending
+  );
+  trimBoundedMap(
+    state.pendingCompletedAssistantItemSourceForwards,
+    maxForwardedTurnIds
+  );
+}
+function forgetPendingCompletedAssistantItemSourceForward(state, sourceMessageSeq, promise) {
+  const pending = state.pendingCompletedAssistantItemSourceForwards.get(sourceMessageSeq);
+  if (pending === void 0) {
+    return;
+  }
+  pending.delete(promise);
+  if (pending.size === 0) {
+    state.pendingCompletedAssistantItemSourceForwards.delete(sourceMessageSeq);
+  }
+}
+async function waitForPendingCompletedAssistantItemSourceForwards(state, sourceMessageSeq) {
+  const pending = state.pendingCompletedAssistantItemSourceForwards.get(sourceMessageSeq);
+  if (pending !== void 0) {
+    await Promise.allSettled([...pending]);
+  }
+}
 async function waitForPendingCompletedAssistantItemForwards(state, turnId) {
   const pending = state.pendingCompletedAssistantItemForwards.get(turnId);
   if (pending !== void 0) {
@@ -7695,6 +8215,16 @@ function rememberTurnReplyTarget(state, turnId, replyToSeq) {
 function sourceMessageSeqForTurn(state, turnId) {
   return getBoundedCacheValue(state.turnReplyTargets, turnId)?.replyToSeq;
 }
+function startingSourceMessageSeq(state) {
+  switch (state.turn.status) {
+    case "starting":
+      return state.turn.queuedSeq;
+    case "active":
+    case "completing":
+    case "idle":
+      return void 0;
+  }
+}
 function fileChangePaths(structured) {
   const changes = arrayValue(structured.changes) ?? [];
   return changes.filter(isJsonObject).map((change) => stringValue(change.path) ?? "").filter((path2) => path2.trim() !== "");
@@ -8177,6 +8707,7 @@ var init_channelSession = __esm({
     "use strict";
     init_channelSessionSupport();
     init_commanderAttachments();
+    init_codexNotificationDiagnostics();
     init_codexRuntimeOptions();
     init_codexOutput();
     init_codexSessionLog();
@@ -8898,7 +9429,7 @@ function createRunnerLogger(logFile, consoleReporter) {
 `,
       "utf8"
     );
-    consoleReporter?.(event, redacted);
+    consoleReporter?.(event, runnerConsolePayload(redacted, payload));
   });
   Object.defineProperty(logger, "close", {
     value: () => closeStream(stream)
@@ -8935,7 +9466,7 @@ function redactForCliLog(value) {
   return redactObject(value);
 }
 function redactValue(value, key) {
-  if (sensitiveKey(key)) {
+  if (sensitiveKey2(key)) {
     return sensitiveMarker;
   }
   if (typeof value === "string") {
@@ -8953,12 +9484,19 @@ function redactObject(value) {
   const headerName = typeof value.name === "string" ? value.name.toLowerCase() : void 0;
   const shouldRedactHeaderValue = headerName === "authorization" || headerName === "cookie" || headerName === "set-cookie";
   return Object.fromEntries(
-    Object.entries(value).map(([key, entry]) => [
+    Object.entries(value).filter(([key]) => key !== "runner_console").map(([key, entry]) => [
       key,
       shouldRedactHeaderValue && key === "value" ? sensitiveMarker : redactValue(entry, key)
     ])
   );
 }
+function runnerConsolePayload(redacted, original) {
+  const consoleFields = objectValue3(original.runner_console);
+  return consoleFields === void 0 ? redacted : { ...redacted, ...redactForCliLog(consoleFields) };
+}
+function objectValue3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
 function redactArgs(args) {
   let redactNext = false;
   return args.map((arg) => {
@@ -8985,7 +9523,7 @@ function splitArgAssignment(value) {
   const index = value.indexOf("=");
   return index === -1 ? [value, void 0] : [value.slice(0, index), value.slice(index + 1)];
 }
-function sensitiveKey(key) {
+function sensitiveKey2(key) {
   if (key === void 0) {
     return false;
   }
@@ -9201,7 +9739,9 @@ var init_mcpConfig = __esm({
 });
 
 // src/codexAppServer.ts
-import { spawn } from "node:child_process";
+import {
+  spawn
+} from "node:child_process";
 import { createServer } from "node:net";
 async function chooseLoopbackPort() {
   return new Promise((resolve11, reject) => {
@@ -9226,9 +9766,15 @@ async function chooseLoopbackPort() {
   });
 }
 async function startCodexAppServer(codexBin, cwd, options = {}) {
+  return startCodexAppServerAttempt(codexBin, cwd, options, 1);
+}
+async function startCodexAppServerAttempt(codexBin, cwd, options, attempt) {
   const port = await chooseLoopbackPort();
   const url = `ws://127.0.0.1:${port}`;
   const args = codexAppServerArgs(url, options);
+  let stderrText = "";
+  const configuredStdio = codexAppServerStdio(process.stdout.isTTY === true);
+  const stdio = [configuredStdio[0], configuredStdio[1], "pipe"];
   writeCliAuditEvent("process.spawn", {
     command: codexBin,
     args,
@@ -9238,9 +9784,20 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
   const child = spawn(codexBin, args, {
     cwd,
     env: codexAppServerEnv(options.env),
-    stdio: ["ignore", "inherit", "inherit"],
+    stdio,
     detached: true
   });
+  if (stdio[1] === "pipe") {
+    drainCodexAppServerOutput(child, "stdout");
+  }
+  if (stdio[2] === "pipe") {
+    drainCodexAppServerOutput(child, "stderr", (chunk) => {
+      stderrText = boundedText(`${stderrText}${chunk}`);
+      if (configuredStdio[2] === "inherit") {
+        process.stderr.write(chunk);
+      }
+    });
+  }
   const stop = () => stopCodexAppServerProcess(child);
   writeCliAuditEvent("process.spawned", {
     command: codexBin,
@@ -9270,10 +9827,49 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
     await waitForReadyz(url, child);
   } catch (error) {
     stop();
+    if (shouldRetryCodexAppServerBindFailure(error, stderrText, attempt)) {
+      writeCliAuditEvent("process.spawn.retry", {
+        command: codexBin,
+        cwd,
+        attempt,
+        reason: "loopback_bind_in_use",
+        purpose: "codex.app_server"
+      });
+      return startCodexAppServerAttempt(codexBin, cwd, options, attempt + 1);
+    }
     throw error;
   }
   return { url, process: child, stop };
 }
+function boundedText(value) {
+  const maxBytes = 12e3;
+  return value.length > maxBytes ? value.slice(value.length - maxBytes) : value;
+}
+function shouldRetryCodexAppServerBindFailure(error, stderrText, attempt) {
+  const maxAttempts = 3;
+  const message = error instanceof Error ? error.message : String(error);
+  return attempt < maxAttempts && message.includes("codex app-server exited before readyz") && stderrText.includes("EADDRINUSE") && stderrText.includes("listen");
+}
+function codexAppServerStdio(stdoutIsTty) {
+  return stdoutIsTty ? ["ignore", "pipe", "pipe"] : ["ignore", "inherit", "inherit"];
+}
+function drainCodexAppServerOutput(child, streamName, onText = void 0) {
+  const stream = child[streamName];
+  if (stream === null) {
+    return;
+  }
+  stream.on("data", (chunk) => {
+    const text2 = chunk.toString();
+    onText?.(text2);
+    writeCliAuditEvent("process.output", {
+      pid: child.pid,
+      purpose: "codex.app_server",
+      stream: streamName,
+      chars: text2.length,
+      output: text2
+    });
+  });
+}
 function codexAppServerEnv(overrides) {
   const env = { ...process.env };
   for (const key of blockedCodexAppServerEnvKeys) {
@@ -9614,9 +10210,9 @@ function codexConfigWithTrustedProject(config, projectPath) {
 trust_level = "trusted"
 `;
   }
-  const table = config.slice(range.start, range.end);
+  const table2 = config.slice(range.start, range.end);
   const trustLine = /^(\s*trust_level\s*=\s*).*(\r?)$/m;
-  const nextTable = trustLine.test(table) ? table.replace(trustLine, '$1"trusted"$2') : `${trimTrailingNewlines(table)}
+  const nextTable = trustLine.test(table2) ? table2.replace(trustLine, '$1"trusted"$2') : `${trimTrailingNewlines(table2)}
 trust_level = "trusted"
 `;
   return `${config.slice(0, range.start)}${nextTable}${config.slice(range.end)}`;
@@ -9648,6 +10244,129 @@ var init_codexProjectTrust = __esm({
   }
 });
 
+// src/codexNotificationConsoleStats.ts
+function codexNotificationConsoleLogPayload(method, params) {
+  return {
+    method,
+    metadata: extractCodexIds(params),
+    ...codexNotificationConsoleStats(method, params)
+  };
+}
+function codexNotificationConsoleStats(method, params) {
+  switch (method) {
+    case "thread/tokenUsage/updated":
+      return {
+        token_usage_summary: tokenUsageSummary(params) ?? "seen (no details)"
+      };
+    case "account/rateLimits/updated":
+      return {
+        rate_limit_summary: rateLimitSummary(params) ?? "seen (no details)"
+      };
+    case "warning":
+    case "error":
+      return codexNotificationDiagnosticDetails(method, params);
+    default:
+      return {};
+  }
+}
+function tokenUsageSummary(params) {
+  const usage = objectValue4(params.tokenUsage) ?? objectValue4(params.token_usage) ?? objectValue4(params.usage) ?? params;
+  const total = tokenUsageBreakdownSummary(objectValue4(usage.total)) ?? tokenUsageBreakdownSummary(objectValue4(usage.totalUsage)) ?? tokenUsageBreakdownSummary(objectValue4(usage.total_usage)) ?? tokenUsageBreakdownSummary(objectValue4(params.totalTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue4(params.total_token_usage)) ?? tokenUsageBreakdownSummary(usage);
+  const last = tokenUsageBreakdownSummary(objectValue4(usage.last)) ?? tokenUsageBreakdownSummary(objectValue4(usage.lastUsage)) ?? tokenUsageBreakdownSummary(objectValue4(usage.last_usage)) ?? tokenUsageBreakdownSummary(objectValue4(params.lastTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue4(params.last_token_usage));
+  const summary = [
+    total === void 0 ? void 0 : `total ${total}`,
+    last === void 0 ? void 0 : `last ${last}`
+  ].filter((value) => value !== void 0);
+  return summary.length === 0 ? void 0 : summary.join(" | ");
+}
+function tokenUsageBreakdownSummary(breakdown) {
+  if (breakdown === void 0) {
+    return void 0;
+  }
+  const inputDetails = objectValue4(breakdown.inputTokensDetails) ?? objectValue4(breakdown.input_tokens_details);
+  const outputDetails = objectValue4(breakdown.outputTokensDetails) ?? objectValue4(breakdown.output_tokens_details);
+  const input = integerValue2(breakdown.inputTokens) ?? integerValue2(breakdown.input_tokens) ?? integerValue2(breakdown.promptTokens) ?? integerValue2(breakdown.prompt_tokens);
+  const output = integerValue2(breakdown.outputTokens) ?? integerValue2(breakdown.output_tokens) ?? integerValue2(breakdown.completionTokens) ?? integerValue2(breakdown.completion_tokens);
+  const total = integerValue2(breakdown.totalTokens) ?? integerValue2(breakdown.total_tokens);
+  const cached = integerValue2(breakdown.cachedInputTokens) ?? integerValue2(breakdown.cached_input_tokens) ?? integerValue2(breakdown.cacheReadInputTokens) ?? integerValue2(breakdown.cache_read_input_tokens) ?? integerValue2(inputDetails?.cachedTokens) ?? integerValue2(inputDetails?.cached_tokens);
+  const reasoning = integerValue2(breakdown.reasoningOutputTokens) ?? integerValue2(breakdown.reasoning_output_tokens) ?? integerValue2(breakdown.reasoningTokens) ?? integerValue2(breakdown.reasoning_tokens) ?? integerValue2(outputDetails?.reasoningTokens) ?? integerValue2(outputDetails?.reasoning_tokens);
+  const values = [
+    input === void 0 ? void 0 : `${input} in`,
+    output === void 0 ? void 0 : `${output} out`,
+    total === void 0 ? void 0 : `${total} total`,
+    cached === void 0 ? void 0 : `${cached} cached`,
+    reasoning === void 0 ? void 0 : `${reasoning} reasoning`
+  ].filter((value) => value !== void 0);
+  return values.length === 0 ? void 0 : values.join(" / ");
+}
+function rateLimitSummary(params) {
+  const rateLimits = objectValue4(params.rateLimits) ?? objectValue4(params.rate_limits) ?? objectValue4(params.limits) ?? params;
+  const direct = rateLimitBucketSummary(rateLimits, void 0);
+  const children = Object.entries(rateLimits).flatMap(([name, value]) => {
+    const bucket = objectValue4(value);
+    return bucket === void 0 ? [] : [rateLimitBucketSummary(bucket, name)];
+  });
+  const summaries = [direct, ...children].filter(
+    (value) => value !== void 0
+  );
+  return summaries.length === 0 ? void 0 : summaries.join(" | ");
+}
+function rateLimitBucketSummary(bucket, fallbackName) {
+  const name = stringValue3(bucket.limitName) ?? stringValue3(bucket.limit_name) ?? stringValue3(bucket.name) ?? stringValue3(bucket.type) ?? fallbackName;
+  const plan = stringValue3(bucket.planType) ?? stringValue3(bucket.plan_type) ?? stringValue3(bucket.plan);
+  const remaining = integerValue2(bucket.remaining) ?? integerValue2(bucket.remainingRequests) ?? integerValue2(bucket.remaining_requests) ?? integerValue2(bucket.remainingTokens) ?? integerValue2(bucket.remaining_tokens);
+  const limit = integerValue2(bucket.limit) ?? integerValue2(bucket.requestLimit) ?? integerValue2(bucket.request_limit) ?? integerValue2(bucket.limitRequests) ?? integerValue2(bucket.limit_requests) ?? integerValue2(bucket.tokenLimit) ?? integerValue2(bucket.token_limit) ?? integerValue2(bucket.limitTokens) ?? integerValue2(bucket.limit_tokens);
+  const reset = stringValue3(bucket.resetAt) ?? stringValue3(bucket.reset_at) ?? stringValue3(bucket.resetsAt) ?? stringValue3(bucket.resets_at) ?? unixTimestampValue(bucket.resetsAt) ?? unixTimestampValue(bucket.resets_at) ?? secondsValue(bucket.resetAfterSeconds) ?? secondsValue(bucket.reset_after_seconds) ?? secondsValue(bucket.retryAfterSeconds) ?? secondsValue(bucket.retry_after_seconds);
+  const usedPercent = integerValue2(bucket.usedPercent) ?? integerValue2(bucket.used_percent);
+  const windowDurationMins = integerValue2(bucket.windowDurationMins) ?? integerValue2(bucket.window_duration_mins);
+  const label = [name, plan].filter((value) => value !== void 0).join(" ");
+  const prefix = label === "" ? void 0 : label;
+  const remainingSummary = remaining === void 0 ? void 0 : limit === void 0 ? `${remaining} remaining` : `${remaining}/${limit} remaining`;
+  const fields = [
+    remainingSummary,
+    usedPercent === void 0 ? void 0 : `${usedPercent}% used`,
+    windowDurationMins === void 0 ? void 0 : `${windowDurationMins}m window`,
+    reset === void 0 ? void 0 : `reset ${reset}`
+  ].filter((value) => value !== void 0);
+  switch (fields.length) {
+    case 0:
+      return prefix === void 0 ? void 0 : `${prefix} seen (no details)`;
+    default:
+      return prefix === void 0 ? fields.join(" ") : `${prefix} ${fields.join(" ")}`;
+  }
+}
+function secondsValue(value) {
+  const seconds = integerValue2(value);
+  return seconds === void 0 ? void 0 : `${seconds}s`;
+}
+function unixTimestampValue(value) {
+  const seconds = integerValue2(value);
+  return seconds === void 0 ? void 0 : new Date(seconds * 1e3).toISOString();
+}
+function objectValue4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function stringValue3(value) {
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function integerValue2(value) {
+  if (typeof value === "number" && Number.isSafeInteger(value)) {
+    return value;
+  }
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const parsed = Number.parseInt(value, 10);
+  return Number.isSafeInteger(parsed) && parsed.toString() === value.trim() ? parsed : void 0;
+}
+var init_codexNotificationConsoleStats = __esm({
+  "src/codexNotificationConsoleStats.ts"() {
+    "use strict";
+    init_codexNotificationDiagnostics();
+    init_protocol();
+  }
+});
+
 // src/localCapabilities.ts
 import { realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
@@ -9690,13 +10409,17 @@ function assertConfiguredAllowedCwds(paths) {
 }
 function expandUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir6();
+    return currentHomeDirectory();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve3(homedir6(), pathValue.slice(2));
+    return resolve3(currentHomeDirectory(), pathValue.slice(2));
   }
   return pathValue;
 }
+function currentHomeDirectory() {
+  const configuredHome = process.env.HOME;
+  return configuredHome === void 0 || configuredHome.trim() === "" ? homedir6() : configuredHome;
+}
 function resolveAllowedCwd(requestedCwd, allowedRoots) {
   if (requestedCwd === void 0 || requestedCwd.trim() === "") {
     return { ok: false, reason: "missing_cwd" };
@@ -13116,7 +13839,8 @@ var init_dependencyStatus = __esm({
 });
 
 // src/phoenix.ts
-function phoenixWebsocketUrl(baseUrl, token) {
+import { Buffer as Buffer3 } from "node:buffer";
+function phoenixWebsocketUrl(baseUrl) {
   const parsed = new URL(baseUrl);
   switch (parsed.protocol) {
     case "http:":
@@ -13127,11 +13851,18 @@ function phoenixWebsocketUrl(baseUrl, token) {
       break;
   }
   parsed.pathname = parsed.pathname.replace(/\/$/, "") + "/socket/websocket";
-  parsed.searchParams.set("token", token);
   parsed.searchParams.set("vsn", "2.0.0");
   return parsed.toString();
 }
-async function connectPhoenixClient(baseUrl, token, socketFactory = (url) => new WebSocket(url), options = {}) {
+function phoenixWebsocketProtocols(token) {
+  return [
+    `${phoenixAuthTokenProtocolPrefix}${Buffer3.from(token, "utf8").toString(
+      "base64url"
+    )}`,
+    "phoenix"
+  ];
+}
+async function connectPhoenixClient(baseUrl, token, socketFactory = (url, protocols) => new WebSocket(url, protocols), options = {}) {
   const pending = /* @__PURE__ */ new Map();
   const joins = /* @__PURE__ */ new Map();
   const controlCallbacks = /* @__PURE__ */ new Set();
@@ -13270,7 +14001,10 @@ async function connectPhoenixClient(baseUrl, token, socketFactory = (url) => new
     if (state.closed) {
       return;
     }
-    const websocket = socketFactory(phoenixWebsocketUrl(baseUrl, token));
+    const websocket = socketFactory(
+      phoenixWebsocketUrl(baseUrl),
+      phoenixWebsocketProtocols(token)
+    );
     state.websocket = websocket;
     websocket.addEventListener("message", handleMessage);
     websocket.addEventListener(
@@ -13408,12 +14142,13 @@ function waitForOpen2(websocket) {
     );
   });
 }
-var defaultPushTimeoutMs;
+var defaultPushTimeoutMs, phoenixAuthTokenProtocolPrefix;
 var init_phoenix = __esm({
   "src/phoenix.ts"() {
     "use strict";
     init_protocol();
     defaultPushTimeoutMs = 3e4;
+    phoenixAuthTokenProtocolPrefix = "base64url.bearer.phx.";
   }
 });
 
@@ -13422,7 +14157,7 @@ var linzumiCliVersion, linzumiCliVersionText;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    linzumiCliVersion = "0.0.72-beta";
+    linzumiCliVersion = "0.0.74-beta";
     linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
   }
 });
@@ -13694,13 +14429,192 @@ var init_runnerLock = __esm({
 });
 
 // src/runnerConsoleReporter.ts
+import blessed from "blessed";
 function reportRunnerConsoleEvent(event, payload) {
+  if (shouldRenderDashboard()) {
+    const tui = initializeDashboardTui(dashboardState);
+    updateRunnerConsoleDashboard(dashboardState, event, payload, Date.now());
+    if (tui !== void 0) {
+      tui.render(Date.now());
+      return;
+    }
+    initializeDashboardKeyboard(dashboardState);
+    initializeDashboardTicker(dashboardState);
+    const screen = renderRunnerConsoleDashboard(dashboardState, Date.now());
+    if (screen !== void 0) {
+      redrawScreen(screen);
+      return;
+    }
+  }
   const line = formatRunnerConsoleEvent(event, payload);
   if (line !== void 0) {
     process.stdout.write(`${line}
 `);
   }
 }
+function shouldRenderDashboard() {
+  switch (process.env.LINZUMI_RUNNER_CONSOLE) {
+    case "dashboard":
+      return true;
+    case "lines":
+      return false;
+    default:
+      return process.stdout.isTTY === true;
+  }
+}
+function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
+  state.lastUpdateAtMs = nowMs;
+  const previousJobKey = latestDashboardJob(state)?.key;
+  switch (event) {
+    case "kandan.message_queued":
+    case "codex.turn_starting": {
+      const job = dashboardJobForPayload(state, payload, nowMs);
+      job.linzumiThreadId = stringValue4(payload.linzumi_thread_id) ?? job.linzumiThreadId;
+      job.linzumiThreadTitle = dashboardLinzumiThreadTitle(payload) ?? job.linzumiThreadTitle;
+      job.codexThreadId = stringValue4(payload.codex_thread_id) ?? job.codexThreadId;
+      job.lastIncomingPreview = stringValue4(payload.body_preview) ?? job.lastIncomingPreview;
+      job.lastIncomingAtMs = numberValue(payload.message_received_at_ms) ?? job.lastIncomingAtMs;
+      job.queueDepth = numberValue(payload.queue_depth) ?? job.queueDepth;
+      job.eventType = dashboardEventLabel(event);
+      job.updatedAtMs = nowMs;
+      break;
+    }
+    case "codex.notification": {
+      const tokenUsage = stringValue4(payload.token_usage_summary);
+      const rateLimit = stringValue4(payload.rate_limit_summary);
+      if (tokenUsage !== void 0) {
+        state.tokenUsage = tokenUsage;
+      }
+      if (rateLimit !== void 0) {
+        state.rateLimit = mergeRateLimitSummary(state.rateLimit, rateLimit);
+      }
+      const method = stringValue4(payload.method);
+      const metadata = objectValue5(payload.metadata);
+      const metadataHasJobSignal = stringValue4(metadata?.threadId) !== void 0 || stringValue4(metadata?.turnId) !== void 0 || stringValue4(metadata?.itemId) !== void 0;
+      if (!metadataHasJobSignal) {
+        break;
+      }
+      const codexThreadId = stringValue4(metadata?.threadId);
+      const job = codexThreadId === void 0 ? latestDashboardJob(state) : dashboardJobForKey(state, `codex:${codexThreadId}`, nowMs);
+      if (job !== void 0) {
+        job.codexThreadId = codexThreadId ?? job.codexThreadId;
+        job.tokenUsage = tokenUsage ?? job.tokenUsage;
+        job.latestCodexEventId = codexEventId(payload);
+        job.eventType = method ?? event;
+        job.turnId = stringValue4(metadata?.turnId) ?? job.turnId;
+        job.updatedAtMs = nowMs;
+      }
+      break;
+    }
+    case "kandan.codex_output_forwarded":
+    case "kandan.codex_delta_forwarded":
+    case "kandan.codex_reasoning_delta_forwarded":
+    case "kandan.codex_command_output_forwarded":
+    case "kandan.codex_file_change_forwarded":
+    case "kandan.codex_web_search_progress_forwarded": {
+      const job = dashboardJobForPayload(state, payload, nowMs);
+      job.latestCodexEventId = stringValue4(payload.item_key) ?? job.latestCodexEventId;
+      job.eventType = codexOutputDashboardLabel(event, payload);
+      job.turnId = stringValue4(payload.turn_id) ?? job.turnId;
+      if (stringValue4(payload.structured_kind) === "codex_assistant_message") {
+        job.lastAssistantPreview = stringValue4(payload.body_preview) ?? job.lastAssistantPreview;
+        job.lastAssistantAtMs = nowMs;
+      }
+      job.updatedAtMs = nowMs;
+      break;
+    }
+    default:
+      break;
+  }
+  rememberRawLine(state, event, payload, previousJobKey);
+}
+function renderRunnerConsoleDashboard(state, nowMs) {
+  if (state.jobs.size === 0 && state.tokenUsage === void 0 && state.rateLimit === void 0) {
+    return void 0;
+  }
+  const jobs = dashboardJobs(state);
+  switch (state.mode.type) {
+    case "table":
+      return renderDashboardTable(state, jobs, nowMs);
+    case "raw_all":
+      return renderRawDashboard(
+        state,
+        "Raw Stream",
+        void 0,
+        "esc: table",
+        state.rawLines,
+        nowMs
+      );
+    case "raw_job": {
+      const jobKey = state.mode.jobKey;
+      const job = state.jobs.get(jobKey);
+      const title = `Raw Stream: ${shortId(job?.linzumiThreadId)} / ${agentId(job?.codexThreadId)}`;
+      return renderRawDashboard(
+        state,
+        title,
+        job?.tokenUsage,
+        "esc: table",
+        state.rawLines.filter((line) => line.jobKey === jobKey),
+        nowMs
+      );
+    }
+  }
+}
+function renderDashboardTable(state, jobs, nowMs) {
+  const model = dashboardTableModel(state, jobs, nowMs);
+  return [
+    "Linzumi Commander",
+    "",
+    `Jobs: ${jobs.length}  Last update: ${timeAgo(state.lastUpdateAtMs, nowMs)}`,
+    `Overall Token Usage: ${state.tokenUsage ?? "?"}`,
+    `Account rate limits: ${state.rateLimit ?? "?"}`,
+    "Controls: up/down select | enter raw job | r raw stream | esc table",
+    "",
+    table(model.rows),
+    ""
+  ].join("\n");
+}
+function dashboardTableModel(state, jobs, nowMs) {
+  const selectedJobKey = selectedDashboardJobKey(state, jobs);
+  const rows = jobs.length === 0 ? [dashboardTableHeader(), emptyJobRow()] : [
+    dashboardTableHeader(),
+    ...jobs.map((job) => jobRow(job, selectedJobKey, nowMs))
+  ];
+  return {
+    jobs,
+    selectedJobKey,
+    rows
+  };
+}
+function dashboardTableHeader() {
+  return [
+    "",
+    "Linzumi thread",
+    "Agent",
+    "Last user message",
+    "Ago",
+    "Last assistant reply",
+    "Ago",
+    "Latest event",
+    "Event type"
+  ];
+}
+function mergeRateLimitSummary(previous, next) {
+  if (previous === void 0) {
+    return next;
+  }
+  const buckets = /* @__PURE__ */ new Map();
+  for (const summary of previous.split(" | ")) {
+    buckets.set(rateLimitSummaryKey(summary), summary);
+  }
+  for (const summary of next.split(" | ")) {
+    buckets.set(rateLimitSummaryKey(summary), summary);
+  }
+  return Array.from(buckets.values()).join(" | ");
+}
+function rateLimitSummaryKey(summary) {
+  return summary.split(" ", 1)[0] ?? summary;
+}
 function formatRunnerConsoleEvent(event, payload) {
   switch (event) {
     case "runner.instance_started":
@@ -13719,13 +14633,20 @@ function formatRunnerConsoleEvent(event, payload) {
     case "kandan.chat_event_failed":
       return `Incoming message handling failed: seq=${text(payload.seq)} reason=${text(payload.message)}`;
     case "kandan.reconnected":
-      return `Kandan reconnected: codex_session=${text(payload.codex_thread_id)} cursor=${text(payload.min_seq)}`;
+      return `Linzumi reconnected: codex_session=${text(payload.codex_thread_id)} cursor=${text(payload.min_seq)}`;
     case "codex.turn_starting":
       return `Incoming message from ${sender(payload)}: forwarding to Codex session ${text(payload.codex_thread_id)} seq=${text(payload.queued_seq)}`;
     case "codex.turn_started":
       return `Codex turn started: id=${text(payload.turn_id)}`;
-    case "codex.notification":
-      return `Codex event [id=${codexEventId(payload)}]: ${text(payload.method)}`;
+    case "codex.notification": {
+      const summary = [
+        stringValue4(payload.token_usage_summary),
+        stringValue4(payload.rate_limit_summary),
+        stringValue4(payload.diagnostic_summary)
+      ].filter((value) => value !== void 0).join(" | ");
+      const suffix = summary === "" ? "" : ` ${summary}`;
+      return `Codex event [id=${codexEventId(payload)}]: ${text(payload.method)}${suffix}`;
+    }
     case "codex.turn_completed":
       return `Codex turn completed: id=${text(payload.turn_id)} outputs=${text(payload.output_count)}`;
     case "kandan.codex_output_forwarded":
@@ -13758,11 +14679,11 @@ function connectedRunnerMessage(payload) {
   ].filter((line) => line !== void 0).join("\n");
 }
 function optionalLine(label, value) {
-  const normalized = stringValue2(value) ?? numberValue(value)?.toString();
+  const normalized = stringValue4(value) ?? numberValue(value)?.toString();
   return normalized === void 0 ? void 0 : `${label}: ${normalized}`;
 }
 function optionalField(label, value) {
-  const normalized = stringValue2(value) ?? numberValue(value)?.toString();
+  const normalized = stringValue4(value) ?? numberValue(value)?.toString();
   return normalized === void 0 ? void 0 : `${label}=${normalized}`;
 }
 function ignoredMessage(payload) {
@@ -13786,17 +14707,17 @@ function replacementLines(value) {
       return [];
     }
     const record = entry;
-    const runnerId = stringValue2(record.runnerId);
+    const runnerId = stringValue4(record.runnerId);
     if (runnerId === void 0) {
       return [];
     }
-    const version = stringValue2(record.version);
+    const version = stringValue4(record.version);
     const suffix = version === void 0 ? "" : ` (CLI ${version})`;
     return [`Replaced older runner from this machine: ${runnerId}${suffix}`];
   });
 }
 function sender(payload) {
-  const slug = stringValue2(payload.actor_slug);
+  const slug = stringValue4(payload.actor_slug);
   const userId = numberValue(payload.actor_user_id);
   if (slug !== void 0 && userId !== void 0) {
     return `${slug}#${userId}`;
@@ -13804,7 +14725,7 @@ function sender(payload) {
   return slug ?? (userId === void 0 ? "unknown" : `user#${userId}`);
 }
 function codexOutputLabel(payload) {
-  const kind = stringValue2(payload.structured_kind) ?? "output";
+  const kind = stringValue4(payload.structured_kind) ?? "output";
   switch (kind) {
     case "codex_assistant_message":
       return "assistant_message";
@@ -13830,22 +14751,693 @@ function codexEventId(payload) {
   const metadata = payload.metadata;
   if (typeof metadata === "object" && metadata !== null && !Array.isArray(metadata)) {
     const record = metadata;
-    return stringValue2(record.turnId) ?? stringValue2(record.itemId) ?? stringValue2(record.threadId) ?? "?";
+    return stringValue4(record.turnId) ?? stringValue4(record.itemId) ?? stringValue4(record.threadId) ?? "?";
   }
   return "?";
 }
+function rememberRawLine(state, event, payload, previousJobKey) {
+  const line = formatRunnerConsoleEvent(event, payload);
+  if (line === void 0) {
+    return;
+  }
+  const jobKey = dashboardRawLineJobKey(state, payload, previousJobKey);
+  state.rawLines.push({ jobKey, line });
+  if (state.rawLines.length > maxRawLines) {
+    state.rawLines.splice(0, state.rawLines.length - maxRawLines);
+  }
+}
+function dashboardRawLineJobKey(state, payload, previousJobKey) {
+  const linzumiThreadId = stringValue4(payload.linzumi_thread_id);
+  const codexThreadId = stringValue4(payload.codex_thread_id);
+  if (linzumiThreadId !== void 0) {
+    return `linzumi:${linzumiThreadId}`;
+  }
+  if (codexThreadId !== void 0) {
+    return Array.from(state.jobs.values()).find(
+      (job) => job.codexThreadId === codexThreadId
+    )?.key;
+  }
+  const metadata = objectValue5(payload.metadata);
+  const metadataCodexThreadId = stringValue4(metadata?.threadId);
+  if (metadataCodexThreadId !== void 0) {
+    return Array.from(state.jobs.values()).find(
+      (job) => job.codexThreadId === metadataCodexThreadId
+    )?.key;
+  }
+  return previousJobKey;
+}
+function selectedDashboardJobKey(state, jobs) {
+  if (jobs.length === 0) {
+    state.selectedJobKey = void 0;
+    return void 0;
+  }
+  if (state.selectedJobKey === void 0 || jobs.every((job) => job.key !== state.selectedJobKey)) {
+    state.selectedJobKey = jobs[0]?.key;
+  }
+  return state.selectedJobKey;
+}
+function renderRawDashboard(state, title, tokenUsage, controls, lines, nowMs) {
+  const visibleLines = lines.slice(-40).map((entry) => entry.line);
+  return [
+    "Linzumi Commander",
+    "",
+    `${title}  Last update: ${timeAgo(state.lastUpdateAtMs, nowMs)}`,
+    ...tokenUsage === void 0 ? [] : [`Token usage: ${tokenUsage}`],
+    `Controls: ${controls}`,
+    "",
+    ...visibleLines.length === 0 ? ["No raw events yet."] : visibleLines,
+    ""
+  ].join("\n");
+}
+function rawDashboardModel(state, mode) {
+  switch (mode.type) {
+    case "raw_all":
+      return {
+        title: "Raw Stream",
+        tokenUsage: void 0,
+        lines: state.rawLines.map((entry) => entry.line)
+      };
+    case "raw_job": {
+      const jobKey = mode.jobKey;
+      const job = state.jobs.get(jobKey);
+      return {
+        title: `Raw Stream: ${shortId(job?.linzumiThreadId)} / ${agentId(job?.codexThreadId)}`,
+        tokenUsage: job?.tokenUsage,
+        lines: state.rawLines.filter((line) => line.jobKey === jobKey).map((entry) => entry.line)
+      };
+    }
+  }
+}
+function dashboardJobs(state) {
+  return Array.from(state.jobs.values()).sort(compareDashboardJobsByCreated);
+}
+function dashboardJobsByUpdatedAt(state) {
+  return Array.from(state.jobs.values()).sort((left, right) => {
+    const updated = right.updatedAtMs - left.updatedAtMs;
+    if (updated !== 0) {
+      return updated;
+    }
+    return compareDashboardJobsByCreated(left, right);
+  });
+}
+function compareDashboardJobsByCreated(left, right) {
+  const created = right.createdAtMs - left.createdAtMs;
+  if (created !== 0) {
+    return created;
+  }
+  const ordinal = right.createdOrdinal - left.createdOrdinal;
+  if (ordinal !== 0) {
+    return ordinal;
+  }
+  return left.key.localeCompare(right.key);
+}
+function nextDashboardJobOrdinal(state) {
+  const ordinal = state.nextJobOrdinal;
+  state.nextJobOrdinal = state.nextJobOrdinal + 1;
+  return ordinal;
+}
+function selectDashboardJobAtVisibleIndex(state, index) {
+  const jobs = dashboardJobs(state);
+  const job = jobs[index];
+  if (job !== void 0) {
+    state.selectedJobKey = job.key;
+  }
+}
+function moveSelection(state, direction) {
+  const jobs = dashboardJobs(state);
+  if (jobs.length === 0) {
+    state.selectedJobKey = void 0;
+    return;
+  }
+  const selectedKey = selectedDashboardJobKey(state, jobs);
+  const currentIndex = Math.max(
+    0,
+    jobs.findIndex((job) => job.key === selectedKey)
+  );
+  const nextIndex = Math.min(
+    jobs.length - 1,
+    Math.max(0, currentIndex + direction)
+  );
+  state.selectedJobKey = jobs[nextIndex]?.key;
+}
+function initializeDashboardKeyboard(state) {
+  if (keyboardState.initialized || process.stdin.isTTY !== true || typeof process.stdin.setRawMode !== "function") {
+    return;
+  }
+  keyboardState.initialized = true;
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  process.stdin.on("data", (chunk) => {
+    handleDashboardKey(state, chunk.toString("utf8"));
+  });
+}
+function initializeDashboardTicker(state) {
+  if (tickerState.stop !== void 0) {
+    return;
+  }
+  tickerState.stop = startRunnerConsoleDashboardTicker(state);
+}
+function initializeDashboardTui(state) {
+  if (tuiState.dashboard !== void 0) {
+    return tuiState.dashboard;
+  }
+  if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+    return void 0;
+  }
+  const dashboard = createRunnerConsoleDashboardTui(state);
+  tuiState.dashboard = dashboard;
+  tuiState.stop = startRunnerConsoleDashboardRenderTicker(() => {
+    dashboard.render(Date.now());
+  });
+  return dashboard;
+}
+function startRunnerConsoleDashboardTicker(state, redraw = redrawScreen, intervalMs = 1e3) {
+  const interval = setInterval(() => {
+    const screen = renderRunnerConsoleDashboard(state, Date.now());
+    if (screen !== void 0) {
+      redraw(screen);
+    }
+  }, intervalMs);
+  interval.unref?.();
+  return () => {
+    clearInterval(interval);
+  };
+}
+function startRunnerConsoleDashboardRenderTicker(render, intervalMs = 1e3) {
+  const interval = setInterval(render, intervalMs);
+  interval.unref?.();
+  return () => {
+    clearInterval(interval);
+  };
+}
+function handleDashboardKey(state, key, exitProcess = () => process.kill(process.pid, "SIGINT")) {
+  if (key === ctrlCKey) {
+    exitProcess();
+    return;
+  }
+  updateRunnerConsoleDashboardMode(state, key);
+  const screen = renderRunnerConsoleDashboard(state, Date.now());
+  if (screen !== void 0) {
+    redrawScreen(screen);
+  }
+}
+function createRunnerConsoleDashboardTui(state, exitProcess = () => process.kill(process.pid, "SIGINT")) {
+  let rendering = false;
+  let rawScrollAnchor;
+  const screen = blessed.screen({
+    title: "Linzumi Commander",
+    smartCSR: true,
+    fullUnicode: true,
+    mouse: true
+  });
+  const header = blessed.box({
+    top: 0,
+    left: 0,
+    width: "100%",
+    height: 6,
+    tags: false
+  });
+  const tableElement = blessed.listtable({
+    top: 6,
+    left: 0,
+    width: "100%",
+    bottom: 1,
+    keys: true,
+    vi: true,
+    mouse: true,
+    scrollable: true,
+    alwaysScroll: true,
+    border: "line",
+    pad: 1,
+    data: [dashboardTableHeader(), emptyJobRow()],
+    scrollbar: {
+      ch: " ",
+      style: { inverse: true }
+    },
+    style: {
+      header: { bold: true },
+      cell: {
+        selected: {
+          inverse: true
+        }
+      },
+      border: {
+        fg: "grey"
+      }
+    }
+  });
+  const rawTitle = blessed.box({
+    top: 0,
+    left: 12,
+    right: 0,
+    height: 2,
+    tags: false,
+    hidden: true
+  });
+  const backButton = blessed.button({
+    top: 0,
+    left: 0,
+    width: 10,
+    height: 1,
+    content: "< Back",
+    mouse: true,
+    keys: true,
+    shrink: true,
+    hidden: true,
+    style: {
+      focus: { inverse: true },
+      hover: { inverse: true }
+    }
+  });
+  const rawBox = blessed.box({
+    top: 3,
+    left: 0,
+    width: "100%",
+    bottom: 0,
+    keys: true,
+    vi: true,
+    mouse: true,
+    scrollable: true,
+    alwaysScroll: true,
+    border: "line",
+    tags: false,
+    hidden: true,
+    scrollbar: {
+      ch: " ",
+      style: { inverse: true }
+    },
+    style: {
+      border: {
+        fg: "grey"
+      }
+    }
+  });
+  screen.append(header);
+  screen.append(tableElement);
+  screen.append(rawTitle);
+  screen.append(backButton);
+  screen.append(rawBox);
+  const showTable = () => {
+    state.mode = { type: "table" };
+    render(Date.now());
+  };
+  const showAllRaw = () => {
+    state.mode = { type: "raw_all" };
+    render(Date.now());
+  };
+  const showSelectedRaw = () => {
+    const selectedKey = selectedDashboardJobKey(state, dashboardJobs(state));
+    if (selectedKey !== void 0) {
+      state.mode = { type: "raw_job", jobKey: selectedKey };
+      render(Date.now());
+    }
+  };
+  screen.key(["C-c"], () => {
+    destroy();
+    exitProcess();
+  });
+  screen.key(["escape"], showTable);
+  screen.key(["r"], showAllRaw);
+  tableElement.key(["enter"], showSelectedRaw);
+  tableElement.on("select item", (_item, index) => {
+    if (rendering || state.mode.type !== "table") {
+      return;
+    }
+    selectDashboardJobAtVisibleIndex(state, index - 1);
+  });
+  tableElement.on("select", (_item, index) => {
+    if (rendering || state.mode.type !== "table") {
+      return;
+    }
+    selectDashboardJobAtVisibleIndex(state, index - 1);
+    showSelectedRaw();
+  });
+  backButton.on("press", showTable);
+  backButton.on("click", showTable);
+  function render(nowMs) {
+    rendering = true;
+    try {
+      switch (state.mode.type) {
+        case "table": {
+          const model = dashboardTableModel(state, dashboardJobs(state), nowMs);
+          header.setContent(tuiHeaderContent(state, model.jobs.length, nowMs));
+          header.show();
+          tableElement.setData(model.rows);
+          tableElement.show();
+          rawTitle.hide();
+          backButton.hide();
+          rawBox.hide();
+          rawScrollAnchor = void 0;
+          syncTuiTableSelection(tableElement, model);
+          tableElement.focus();
+          break;
+        }
+        case "raw_all":
+        case "raw_job": {
+          const model = rawDashboardModel(state, state.mode);
+          const nextRawScrollAnchor = `${state.mode.type}:${state.mode.type === "raw_job" ? state.mode.jobKey : "*"}:${model.lines.length}`;
+          header.hide();
+          tableElement.hide();
+          rawTitle.setContent(
+            [
+              `${model.title}  Last update: ${timeAgo(state.lastUpdateAtMs, nowMs)}  esc/back: table`,
+              model.tokenUsage === void 0 ? void 0 : `Token usage: ${model.tokenUsage}`
+            ].filter((value) => value !== void 0).join("\n")
+          );
+          rawBox.setContent(
+            model.lines.length === 0 ? "No raw events yet." : model.lines.join("\n")
+          );
+          rawTitle.show();
+          backButton.show();
+          rawBox.show();
+          if (rawScrollAnchor !== nextRawScrollAnchor) {
+            rawBox.setScrollPerc(100);
+            rawScrollAnchor = nextRawScrollAnchor;
+          }
+          rawBox.focus();
+          break;
+        }
+      }
+      screen.render();
+    } finally {
+      rendering = false;
+    }
+  }
+  function destroy() {
+    tuiState.stop?.();
+    tuiState.stop = void 0;
+    tuiState.dashboard = void 0;
+    screen.destroy();
+  }
+  return { render, destroy };
+}
+function syncTuiTableSelection(tableElement, model) {
+  const selectedIndex = model.jobs.findIndex(
+    (job) => job.key === model.selectedJobKey
+  );
+  const tableIndex = selectedIndex < 0 ? 1 : selectedIndex + 1;
+  tableElement.select(tableIndex);
+}
+function tuiHeaderContent(state, jobCount, nowMs) {
+  return [
+    "Linzumi Commander",
+    `Jobs: ${jobCount}  Last update: ${timeAgo(state.lastUpdateAtMs, nowMs)}`,
+    `Overall Token Usage: ${state.tokenUsage ?? "?"}`,
+    `Account rate limits: ${state.rateLimit ?? "?"}`,
+    "Controls: click row/enter raw job | r raw stream | esc/back table | mouse wheel scroll"
+  ].join("\n");
+}
+function updateRunnerConsoleDashboardMode(state, key) {
+  switch (key) {
+    case "r":
+      state.mode = { type: "raw_all" };
+      break;
+    case escapeKey:
+      state.mode = { type: "table" };
+      break;
+    case enterKey: {
+      const selectedKey = selectedDashboardJobKey(state, dashboardJobs(state));
+      if (selectedKey !== void 0) {
+        state.mode = { type: "raw_job", jobKey: selectedKey };
+      }
+      break;
+    }
+    case upKey:
+      moveSelection(state, -1);
+      break;
+    case downKey:
+      moveSelection(state, 1);
+      break;
+    default:
+      break;
+  }
+}
+function dashboardJobForPayload(state, payload, nowMs) {
+  const linzumiThreadId = stringValue4(payload.linzumi_thread_id);
+  const codexThreadId = stringValue4(payload.codex_thread_id);
+  const existingByCodex = codexThreadId !== void 0 ? Array.from(state.jobs.values()).find(
+    (job) => job.codexThreadId === codexThreadId
+  ) : void 0;
+  if (existingByCodex !== void 0) {
+    return promoteDashboardJobKey(state, existingByCodex, linzumiThreadId);
+  }
+  const key = linzumiThreadId === void 0 ? codexThreadId === void 0 ? "job:unknown" : `codex:${codexThreadId}` : `linzumi:${linzumiThreadId}`;
+  const existing = state.jobs.get(key);
+  if (existing !== void 0) {
+    return existing;
+  }
+  const created = {
+    key,
+    createdAtMs: numberValue(payload.message_received_at_ms) ?? nowMs,
+    createdOrdinal: nextDashboardJobOrdinal(state),
+    linzumiThreadId,
+    linzumiThreadTitle: dashboardLinzumiThreadTitle(payload),
+    codexThreadId,
+    tokenUsage: void 0,
+    lastIncomingPreview: void 0,
+    lastIncomingAtMs: void 0,
+    lastAssistantPreview: void 0,
+    lastAssistantAtMs: void 0,
+    latestCodexEventId: void 0,
+    eventType: void 0,
+    queueDepth: void 0,
+    turnId: void 0,
+    updatedAtMs: nowMs
+  };
+  state.jobs.set(key, created);
+  return created;
+}
+function promoteDashboardJobKey(state, job, linzumiThreadId) {
+  if (linzumiThreadId === void 0) {
+    return job;
+  }
+  const key = `linzumi:${linzumiThreadId}`;
+  if (job.key === key) {
+    job.linzumiThreadId = linzumiThreadId;
+    return job;
+  }
+  const promoted = { ...job, key, linzumiThreadId };
+  state.jobs.delete(job.key);
+  state.jobs.set(key, promoted);
+  if (state.selectedJobKey === job.key) {
+    state.selectedJobKey = key;
+  }
+  if (state.mode.type === "raw_job" && state.mode.jobKey === job.key) {
+    state.mode = { type: "raw_job", jobKey: key };
+  }
+  state.rawLines.splice(
+    0,
+    state.rawLines.length,
+    ...state.rawLines.map(
+      (line) => line.jobKey === job.key ? { ...line, jobKey: key } : line
+    )
+  );
+  return promoted;
+}
+function dashboardJobForKey(state, key, nowMs) {
+  if (key.startsWith("codex:")) {
+    const codexThreadId = key.slice("codex:".length);
+    const existingByCodex = Array.from(state.jobs.values()).find(
+      (job) => job.codexThreadId === codexThreadId
+    );
+    if (existingByCodex !== void 0) {
+      return existingByCodex;
+    }
+  }
+  const existing = state.jobs.get(key);
+  if (existing !== void 0) {
+    return existing;
+  }
+  const created = {
+    key,
+    createdAtMs: nowMs,
+    createdOrdinal: nextDashboardJobOrdinal(state),
+    linzumiThreadId: void 0,
+    linzumiThreadTitle: void 0,
+    codexThreadId: key.startsWith("codex:") ? key.slice("codex:".length) : void 0,
+    tokenUsage: void 0,
+    lastIncomingPreview: void 0,
+    lastIncomingAtMs: void 0,
+    lastAssistantPreview: void 0,
+    lastAssistantAtMs: void 0,
+    latestCodexEventId: void 0,
+    eventType: void 0,
+    queueDepth: void 0,
+    turnId: void 0,
+    updatedAtMs: nowMs
+  };
+  state.jobs.set(key, created);
+  return created;
+}
+function latestDashboardJob(state) {
+  return dashboardJobsByUpdatedAt(state)[0];
+}
+function jobRow(job, selectedJobKey, nowMs) {
+  return [
+    job.key === selectedJobKey ? ">" : " ",
+    linzumiThreadLabel(job),
+    agentId(job.codexThreadId),
+    truncate(job.lastIncomingPreview ?? "?", 50),
+    timeAgo(job.lastIncomingAtMs, nowMs),
+    truncate(job.lastAssistantPreview ?? "?", 50),
+    timeAgo(job.lastAssistantAtMs, nowMs),
+    lastFour(job.latestCodexEventId),
+    truncate(job.eventType ?? "?", 34)
+  ];
+}
+function emptyJobRow() {
+  return [" ", "?", "?", "?", "?", "?", "?", "?", "?"];
+}
+function codexOutputDashboardLabel(event, payload) {
+  switch (event) {
+    case "kandan.codex_output_forwarded":
+      return codexOutputLabel(payload);
+    case "kandan.codex_delta_forwarded":
+      return "assistant_delta";
+    case "kandan.codex_reasoning_delta_forwarded":
+      return "reasoning_delta";
+    case "kandan.codex_command_output_forwarded":
+      return `command_output ${text(payload.stream)}`;
+    case "kandan.codex_file_change_forwarded":
+      return "file_change";
+    case "kandan.codex_web_search_progress_forwarded":
+      return "search_progress";
+    default:
+      return event;
+  }
+}
+function dashboardEventLabel(event) {
+  switch (event) {
+    case "kandan.message_queued":
+      return "message_queued";
+    case "codex.turn_starting":
+      return "turn_starting";
+    default:
+      return event;
+  }
+}
+function table(rows) {
+  if (rows.length === 0) {
+    return "";
+  }
+  const widths = dashboardTableColumns.map((column) => column.width);
+  const divider = widths.map((width) => "-".repeat(width)).join("-+-");
+  return rows.map((row, index) => {
+    const line = row.map(
+      (cell, cellIndex) => fixedWidthCell(cell, widths[cellIndex] ?? displayWidth(cell))
+    ).join(" | ");
+    return index === 0 ? `${line}
+${divider}` : line;
+  }).join("\n");
+}
+function displayWidth(value) {
+  return value.length;
+}
+function shortId(value) {
+  return value === void 0 ? "?" : truncate(value, 18);
+}
+function linzumiThreadLabel(job) {
+  if (job.linzumiThreadTitle === void 0) {
+    return shortId(job.linzumiThreadId);
+  }
+  return firstN(job.linzumiThreadTitle, 30);
+}
+function dashboardLinzumiThreadTitle(payload) {
+  return stringValue4(payload.linzumi_thread_title) ?? stringValue4(payload.thread_title) ?? stringValue4(payload.threadTitle) ?? stringValue4(payload.title);
+}
+function agentId(codexThreadId) {
+  if (codexThreadId === void 0) {
+    return "?";
+  }
+  return `codex/...${lastN(codexThreadId, 5)}`;
+}
+function fixedWidthCell(value, width) {
+  return truncate(value, width).padEnd(width, " ");
+}
+function truncate(value, maxLength) {
+  if (value.length <= maxLength) {
+    return value;
+  }
+  return `${value.slice(0, Math.max(0, maxLength - 3))}...`;
+}
+function firstN(value, maxLength) {
+  return value.length <= maxLength ? value : value.slice(0, maxLength);
+}
+function lastFour(value) {
+  if (value === void 0) {
+    return "?";
+  }
+  return lastN(value, 4);
+}
+function lastN(value, count) {
+  return value.length <= count ? value : value.slice(-count);
+}
+function timeAgo(valueMs, nowMs) {
+  if (valueMs === void 0) {
+    return "?";
+  }
+  const seconds = Math.max(0, Math.floor((nowMs - valueMs) / 1e3));
+  if (seconds < 60) {
+    return `${seconds}s`;
+  }
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) {
+    return `${minutes}m`;
+  }
+  return `${Math.floor(minutes / 60)}h`;
+}
+function objectValue5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
 function text(value) {
-  return stringValue2(value) ?? numberValue(value)?.toString() ?? "?";
+  return stringValue4(value) ?? numberValue(value)?.toString() ?? "?";
 }
-function stringValue2(value) {
+function stringValue4(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function numberValue(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
+var dashboardState, maxRawLines, escapeKey, ctrlCKey, enterKey, upKey, downKey, dashboardTableColumns, redrawScreen, keyboardState, tickerState, tuiState;
 var init_runnerConsoleReporter = __esm({
   "src/runnerConsoleReporter.ts"() {
     "use strict";
+    dashboardState = {
+      jobs: /* @__PURE__ */ new Map(),
+      rawLines: [],
+      nextJobOrdinal: 0,
+      mode: { type: "table" },
+      selectedJobKey: void 0,
+      tokenUsage: void 0,
+      rateLimit: void 0,
+      lastUpdateAtMs: void 0
+    };
+    maxRawLines = 500;
+    escapeKey = "\x1B";
+    ctrlCKey = "";
+    enterKey = "\r";
+    upKey = "\x1B[A";
+    downKey = "\x1B[B";
+    dashboardTableColumns = [
+      { width: 1 },
+      { width: 30 },
+      { width: 16 },
+      { width: 38 },
+      { width: 6 },
+      { width: 42 },
+      { width: 6 },
+      { width: 12 },
+      { width: 24 }
+    ];
+    redrawScreen = (screen) => {
+      process.stdout.write(`\x1B[2J\x1B[H${screen}`);
+    };
+    keyboardState = { initialized: false };
+    tickerState = { stop: void 0 };
+    tuiState = {
+      dashboard: void 0,
+      stop: void 0
+    };
   }
 });
 
@@ -14557,8 +16149,8 @@ import {
   statSync
 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { homedir as homedir10, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname9, join as join14, resolve as resolve7 } from "node:path";
+import { hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join14, resolve as resolve7 } from "node:path";
 async function runLocalCodexRunner(options) {
   const log = makeRunnerLogger(options);
   const cleanup = {
@@ -15675,11 +17267,10 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       sessionCodex.onNotification((notification) => {
         seq.value += 1;
         const params = notification.params ?? {};
-        const metadata = extractCodexIds(params);
-        log("codex.notification", {
-          method: notification.method,
-          metadata
-        });
+        log(
+          "codex.notification",
+          codexNotificationConsoleLogPayload(notification.method, params)
+        );
         session.handleCodexNotification(notification.method, params);
       });
     }
@@ -15722,6 +17313,11 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     }
     const spawnThreadRunner = options.spawnThreadRunner ?? spawnLocalThreadRunnerProcess;
     const readyTimeoutMs = threadRunnerReadyTimeoutMs(options);
+    log("runner.thread_process_starting", {
+      kandanThreadId,
+      cwd,
+      readyTimeoutMs
+    });
     const startingEntry = {
       kind: "starting",
       promise: withThreadRunnerReadyTimeout(
@@ -15749,6 +17345,11 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       if (threadRunnerProcesses.get(kandanThreadId) === startingEntry) {
         threadRunnerProcesses.delete(kandanThreadId);
       }
+      log("runner.thread_process_start_failed", {
+        kandanThreadId,
+        cwd,
+        message: error instanceof Error ? error.message : String(error)
+      });
       throw error;
     }
     for (const port of handle.commanderManagedPorts ?? []) {
@@ -15894,14 +17495,17 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
   codex.onNotification((notification) => {
     seq.value += 1;
     const params = notification.params ?? {};
-    const metadata = extractCodexIds(params);
+    const logPayload = codexNotificationConsoleLogPayload(
+      notification.method,
+      params
+    );
     if (channelSession === void 0) {
       void kandan.push(topic, "codex_notification", {
         instanceId,
         seq: seq.value,
         method: notification.method,
         params,
-        metadata,
+        metadata: logPayload.metadata,
         receivedAt: (/* @__PURE__ */ new Date()).toISOString()
       }).catch((error) => {
         log("kandan.codex_notification_push_failed", {
@@ -15909,10 +17513,7 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
         });
       });
     }
-    log("codex.notification", {
-      method: notification.method,
-      metadata
-    });
+    log("codex.notification", logPayload);
     channelSession?.handleCodexNotification(notification.method, params);
     for (const session of dynamicChannelSessions.values()) {
       session.handleCodexNotification(notification.method, params);
@@ -16517,6 +18118,11 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
       }
       const agentProvider = agentProviderResult.provider;
       if (!cwd.ok) {
+        log("kandan.start_instance_cwd_rejected", {
+          thread_id: controlThreadId(control) ?? null,
+          reason: cwd.reason,
+          allowedCwdCount: allowedCwds.value.length
+        });
         try {
           await publishStartInstanceCwdFailureMessageState(
             kandan,
@@ -18736,13 +20342,8 @@ async function closeThreadRunnerEntry(entry) {
   }
 }
 async function spawnLocalThreadRunnerProcess(options) {
-  const scriptPath = process.argv[1];
+  const scriptPath = threadRunnerScriptPath(process.argv[1], process.cwd());
   const kandanThreadId = options.threadProcess?.kandanThreadId ?? "";
-  if (scriptPath === void 0 || scriptPath.trim() === "") {
-    throw new Error(
-      "cannot fork thread runner without current CLI script path"
-    );
-  }
   const args = ["run", ...threadRunnerCliArgs(options)];
   const nodeArgs = threadRunnerNodeArgs(scriptPath, args);
   const redactedNodeArgs = threadRunnerNodeArgs(
@@ -18870,6 +20471,14 @@ async function spawnLocalThreadRunnerProcess(options) {
 function threadRunnerNodeArgs(scriptPath, args) {
   return [...threadRunnerLoaderExecArgv(process.execArgv), scriptPath, ...args];
 }
+function threadRunnerScriptPath(scriptPath, cwd) {
+  if (scriptPath === void 0 || scriptPath.trim() === "") {
+    throw new Error(
+      "cannot fork thread runner without current CLI script path"
+    );
+  }
+  return isAbsolute3(scriptPath) ? scriptPath : resolve7(cwd, scriptPath);
+}
 function threadRunnerLoaderExecArgv(execArgv, index = 0) {
   const current = execArgv[index];
   if (current === void 0) {
@@ -19248,7 +20857,7 @@ function isGitProjectDirectory(cwd) {
 }
 function browseRunnerDirectory(control, options) {
   const requestId = stringValue(control.requestId) ?? null;
-  const requestedPath = stringValue(control.path) ?? homedir10();
+  const requestedPath = stringValue(control.path) ?? currentHomeDirectory();
   try {
     const currentPath = realpathSync5(resolve7(expandUserPath(requestedPath)));
     const stats = statSync(currentPath);
@@ -19279,7 +20888,7 @@ function browseRunnerDirectory(control, options) {
       ok: true,
       currentPath,
       parentPath: parent === currentPath ? null : parent,
-      homePath: homedir10(),
+      homePath: currentHomeDirectory(),
       runnerCwd: resolve7(options.cwd),
       entries,
       isGit: isGitProjectDirectory(currentPath)
@@ -19332,7 +20941,7 @@ function createRunnerProject(control, options, allowedCwds) {
       error: "invalid_project_template"
     };
   }
-  const projectsRoot = join14(homedir10(), "linzumi");
+  const projectsRoot = join14(currentHomeDirectory(), "linzumi");
   const resolvedProjectDirName = template === "hello_linzumi_demo" ? availableProjectDirectoryName(projectsRoot, projectDirName) : projectDirName;
   const projectPath = join14(projectsRoot, resolvedProjectDirName);
   let createdProjectPath = false;
@@ -19359,16 +20968,18 @@ function createRunnerProject(control, options, allowedCwds) {
     }
     const git = spawnSync4("git", ["init"], {
       cwd: projectPath,
-      encoding: "utf8"
+      encoding: "utf8",
+      env: process.env
     });
     if (git.status !== 0) {
       const cleanupError = removeCreatedProjectDirectory(projectPath);
+      const gitFailure = git.error instanceof Error ? git.error.message : git.stderr || git.stdout || git.status;
       return {
         instanceId: options.runnerId,
         controlType: control.type,
         requestId,
         ok: false,
-        error: cleanupError === void 0 ? `git_init_failed:${git.stderr || git.stdout || git.status}` : `git_init_cleanup_failed:${cleanupError}`
+        error: cleanupError === void 0 ? `git_init_failed:${gitFailure}` : `git_init_cleanup_failed:${cleanupError}`
       };
     }
     const projectRealPath = realpathSync5(projectPath);
@@ -19474,6 +21085,7 @@ var init_runner = __esm({
     init_codexAppServer();
     init_codexProjectTrust();
     init_codexRuntimeOptions();
+    init_codexNotificationConsoleStats();
     init_json();
     init_linzumiContext();
     init_localCapabilities();
@@ -19547,9 +21159,12 @@ function trustedWebSocketFactory(trust, WebSocketImpl = WsWebSocket) {
   if (trust === void 0) {
     return void 0;
   }
-  return (url) => new WebSocketImpl(url, {
-    ca: trust.ca
-  });
+  return (url, protocols) => {
+    const options = {
+      ca: trust.ca
+    };
+    return protocols === void 0 ? new WebSocketImpl(url, options) : new WebSocketImpl(url, protocols, options);
+  };
 }
 var init_kandanTls = __esm({
   "src/kandanTls.ts"() {
@@ -29823,23 +31438,23 @@ var require_sbcs = __commonJS({
         this.ngramList = theNgramList;
         this.byteMap = theByteMap;
       }
-      search(table, value) {
+      search(table2, value) {
         let index = 0;
-        if (table[index + 32] <= value)
+        if (table2[index + 32] <= value)
           index += 32;
-        if (table[index + 16] <= value)
+        if (table2[index + 16] <= value)
           index += 16;
-        if (table[index + 8] <= value)
+        if (table2[index + 8] <= value)
           index += 8;
-        if (table[index + 4] <= value)
+        if (table2[index + 4] <= value)
           index += 4;
-        if (table[index + 2] <= value)
+        if (table2[index + 2] <= value)
           index += 2;
-        if (table[index + 1] <= value)
+        if (table2[index + 1] <= value)
           index += 1;
-        if (table[index] > value)
+        if (table2[index] > value)
           index -= 1;
-        if (index < 0 || table[index] != value)
+        if (index < 0 || table2[index] != value)
           return -1;
         return index;
       }
@@ -34469,7 +36084,7 @@ var require_safer = __commonJS({
   "../../node_modules/safer-buffer/safer.js"(exports, module) {
     "use strict";
     var buffer = __require("buffer");
-    var Buffer3 = buffer.Buffer;
+    var Buffer4 = buffer.Buffer;
     var safer = {};
     var key;
     for (key in buffer) {
@@ -34478,12 +36093,12 @@ var require_safer = __commonJS({
       safer[key] = buffer[key];
     }
     var Safer = safer.Buffer = {};
-    for (key in Buffer3) {
-      if (!Buffer3.hasOwnProperty(key)) continue;
+    for (key in Buffer4) {
+      if (!Buffer4.hasOwnProperty(key)) continue;
       if (key === "allocUnsafe" || key === "allocUnsafeSlow") continue;
-      Safer[key] = Buffer3[key];
+      Safer[key] = Buffer4[key];
     }
-    safer.Buffer.prototype = Buffer3.prototype;
+    safer.Buffer.prototype = Buffer4.prototype;
     if (!Safer.from || Safer.from === Uint8Array.from) {
       Safer.from = function(value, encodingOrOffset, length) {
         if (typeof value === "number") {
@@ -34492,7 +36107,7 @@ var require_safer = __commonJS({
         if (value && typeof value.length === "undefined") {
           throw new TypeError("The first argument must be one of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type " + typeof value);
         }
-        return Buffer3(value, encodingOrOffset, length);
+        return Buffer4(value, encodingOrOffset, length);
       };
     }
     if (!Safer.alloc) {
@@ -34503,7 +36118,7 @@ var require_safer = __commonJS({
         if (size < 0 || size >= 2 * (1 << 30)) {
           throw new RangeError('The value "' + size + '" is invalid for option "size"');
         }
-        var buf = Buffer3(size);
+        var buf = Buffer4(size);
         if (!fill || fill.length === 0) {
           buf.fill(0);
         } else if (typeof encoding === "string") {
@@ -34598,7 +36213,7 @@ var require_merge_exports = __commonJS({
 var require_internal = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/internal.js"(exports, module) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     module.exports = {
       // Encodings
       utf8: { type: "_internal", bomAware: true },
@@ -34622,7 +36237,7 @@ var require_internal = __commonJS({
       } else if (this.enc === "cesu8") {
         this.enc = "utf8";
         this.encoder = InternalEncoderCesu8;
-        if (Buffer3.from("eda0bdedb2a9", "hex").toString() !== "\u{1F4A9}") {
+        if (Buffer4.from("eda0bdedb2a9", "hex").toString() !== "\u{1F4A9}") {
           this.decoder = InternalDecoderCesu8;
           this.defaultCharUnicode = iconv2.defaultCharUnicode;
         }
@@ -34635,8 +36250,8 @@ var require_internal = __commonJS({
       this.decoder = new StringDecoder(codec.enc);
     }
     InternalDecoder.prototype.write = function(buf) {
-      if (!Buffer3.isBuffer(buf)) {
-        buf = Buffer3.from(buf);
+      if (!Buffer4.isBuffer(buf)) {
+        buf = Buffer4.from(buf);
       }
       return this.decoder.write(buf);
     };
@@ -34647,7 +36262,7 @@ var require_internal = __commonJS({
       this.enc = codec.enc;
     }
     InternalEncoder.prototype.write = function(str) {
-      return Buffer3.from(str, this.enc);
+      return Buffer4.from(str, this.enc);
     };
     InternalEncoder.prototype.end = function() {
     };
@@ -34659,15 +36274,15 @@ var require_internal = __commonJS({
       var completeQuads = str.length - str.length % 4;
       this.prevStr = str.slice(completeQuads);
       str = str.slice(0, completeQuads);
-      return Buffer3.from(str, "base64");
+      return Buffer4.from(str, "base64");
     };
     InternalEncoderBase64.prototype.end = function() {
-      return Buffer3.from(this.prevStr, "base64");
+      return Buffer4.from(this.prevStr, "base64");
     };
     function InternalEncoderCesu8(options, codec) {
     }
     InternalEncoderCesu8.prototype.write = function(str) {
-      var buf = Buffer3.alloc(str.length * 3);
+      var buf = Buffer4.alloc(str.length * 3);
       var bufIdx = 0;
       for (var i = 0; i < str.length; i++) {
         var charCode = str.charCodeAt(i);
@@ -34763,13 +36378,13 @@ var require_internal = __commonJS({
           str = str.slice(0, str.length - 1);
         }
       }
-      return Buffer3.from(str, this.enc);
+      return Buffer4.from(str, this.enc);
     };
     InternalEncoderUtf8.prototype.end = function() {
       if (this.highSurrogate) {
         var str = this.highSurrogate;
         this.highSurrogate = "";
-        return Buffer3.from(str, this.enc);
+        return Buffer4.from(str, this.enc);
       }
     };
   }
@@ -34779,7 +36394,7 @@ var require_internal = __commonJS({
 var require_utf32 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/utf32.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports._utf32 = Utf32Codec;
     function Utf32Codec(codecOptions, iconv2) {
       this.iconv = iconv2;
@@ -34797,8 +36412,8 @@ var require_utf32 = __commonJS({
       this.highSurrogate = 0;
     }
     Utf32Encoder.prototype.write = function(str) {
-      var src = Buffer3.from(str, "ucs2");
-      var dst = Buffer3.alloc(src.length * 2);
+      var src = Buffer4.from(str, "ucs2");
+      var dst = Buffer4.alloc(src.length * 2);
       var write32 = this.isLE ? dst.writeUInt32LE : dst.writeUInt32BE;
       var offset = 0;
       for (var i = 0; i < src.length; i += 2) {
@@ -34834,7 +36449,7 @@ var require_utf32 = __commonJS({
       if (!this.highSurrogate) {
         return;
       }
-      var buf = Buffer3.alloc(4);
+      var buf = Buffer4.alloc(4);
       if (this.isLE) {
         buf.writeUInt32LE(this.highSurrogate, 0);
       } else {
@@ -34854,7 +36469,7 @@ var require_utf32 = __commonJS({
       }
       var i = 0;
       var codepoint = 0;
-      var dst = Buffer3.alloc(src.length + 4);
+      var dst = Buffer4.alloc(src.length + 4);
       var offset = 0;
       var isLE = this.isLE;
       var overflow = this.overflow;
@@ -35010,7 +36625,7 @@ var require_utf32 = __commonJS({
 var require_utf16 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/utf16.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports.utf16be = Utf16BECodec;
     function Utf16BECodec() {
     }
@@ -35020,7 +36635,7 @@ var require_utf16 = __commonJS({
     function Utf16BEEncoder() {
     }
     Utf16BEEncoder.prototype.write = function(str) {
-      var buf = Buffer3.from(str, "ucs2");
+      var buf = Buffer4.from(str, "ucs2");
       for (var i = 0; i < buf.length; i += 2) {
         var tmp = buf[i];
         buf[i] = buf[i + 1];
@@ -35037,7 +36652,7 @@ var require_utf16 = __commonJS({
       if (buf.length == 0) {
         return "";
       }
-      var buf2 = Buffer3.alloc(buf.length + 1);
+      var buf2 = Buffer4.alloc(buf.length + 1);
       var i = 0;
       var j = 0;
       if (this.overflowByte !== -1) {
@@ -35153,7 +36768,7 @@ var require_utf16 = __commonJS({
 var require_utf7 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/utf7.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports.utf7 = Utf7Codec;
     exports.unicode11utf7 = "utf7";
     function Utf7Codec(codecOptions, iconv2) {
@@ -35167,7 +36782,7 @@ var require_utf7 = __commonJS({
       this.iconv = codec.iconv;
     }
     Utf7Encoder.prototype.write = function(str) {
-      return Buffer3.from(str.replace(nonDirectChars, function(chunk) {
+      return Buffer4.from(str.replace(nonDirectChars, function(chunk) {
         return "+" + (chunk === "+" ? "" : this.iconv.encode(chunk, "utf16-be").toString("base64").replace(/=+$/, "")) + "-";
       }.bind(this)));
     };
@@ -35205,7 +36820,7 @@ var require_utf7 = __commonJS({
               res += "+";
             } else {
               var b64str = base64Accum + this.iconv.decode(buf.slice(lastI, i2), "ascii");
-              res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+              res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
             }
             if (buf[i2] != minusChar) {
               i2--;
@@ -35223,7 +36838,7 @@ var require_utf7 = __commonJS({
         var canBeDecoded = b64str.length - b64str.length % 8;
         base64Accum = b64str.slice(canBeDecoded);
         b64str = b64str.slice(0, canBeDecoded);
-        res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+        res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
       }
       this.inBase64 = inBase64;
       this.base64Accum = base64Accum;
@@ -35232,7 +36847,7 @@ var require_utf7 = __commonJS({
     Utf7Decoder.prototype.end = function() {
       var res = "";
       if (this.inBase64 && this.base64Accum.length > 0) {
-        res = this.iconv.decode(Buffer3.from(this.base64Accum, "base64"), "utf16-be");
+        res = this.iconv.decode(Buffer4.from(this.base64Accum, "base64"), "utf16-be");
       }
       this.inBase64 = false;
       this.base64Accum = "";
@@ -35248,14 +36863,14 @@ var require_utf7 = __commonJS({
     function Utf7IMAPEncoder(options, codec) {
       this.iconv = codec.iconv;
       this.inBase64 = false;
-      this.base64Accum = Buffer3.alloc(6);
+      this.base64Accum = Buffer4.alloc(6);
       this.base64AccumIdx = 0;
     }
     Utf7IMAPEncoder.prototype.write = function(str) {
       var inBase64 = this.inBase64;
       var base64Accum = this.base64Accum;
       var base64AccumIdx = this.base64AccumIdx;
-      var buf = Buffer3.alloc(str.length * 5 + 10);
+      var buf = Buffer4.alloc(str.length * 5 + 10);
       var bufIdx = 0;
       for (var i2 = 0; i2 < str.length; i2++) {
         var uChar = str.charCodeAt(i2);
@@ -35294,7 +36909,7 @@ var require_utf7 = __commonJS({
       return buf.slice(0, bufIdx);
     };
     Utf7IMAPEncoder.prototype.end = function() {
-      var buf = Buffer3.alloc(10);
+      var buf = Buffer4.alloc(10);
       var bufIdx = 0;
       if (this.inBase64) {
         if (this.base64AccumIdx > 0) {
@@ -35331,7 +36946,7 @@ var require_utf7 = __commonJS({
               res += "&";
             } else {
               var b64str = base64Accum + this.iconv.decode(buf.slice(lastI, i2), "ascii").replace(/,/g, "/");
-              res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+              res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
             }
             if (buf[i2] != minusChar) {
               i2--;
@@ -35349,7 +36964,7 @@ var require_utf7 = __commonJS({
         var canBeDecoded = b64str.length - b64str.length % 8;
         base64Accum = b64str.slice(canBeDecoded);
         b64str = b64str.slice(0, canBeDecoded);
-        res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+        res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
       }
       this.inBase64 = inBase64;
       this.base64Accum = base64Accum;
@@ -35358,7 +36973,7 @@ var require_utf7 = __commonJS({
     Utf7IMAPDecoder.prototype.end = function() {
       var res = "";
       if (this.inBase64 && this.base64Accum.length > 0) {
-        res = this.iconv.decode(Buffer3.from(this.base64Accum, "base64"), "utf16-be");
+        res = this.iconv.decode(Buffer4.from(this.base64Accum, "base64"), "utf16-be");
       }
       this.inBase64 = false;
       this.base64Accum = "";
@@ -35371,7 +36986,7 @@ var require_utf7 = __commonJS({
 var require_sbcs_codec = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/sbcs-codec.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports._sbcs = SBCSCodec;
     function SBCSCodec(codecOptions, iconv2) {
       if (!codecOptions) {
@@ -35387,8 +37002,8 @@ var require_sbcs_codec = __commonJS({
         }
         codecOptions.chars = asciiString + codecOptions.chars;
       }
-      this.decodeBuf = Buffer3.from(codecOptions.chars, "ucs2");
-      var encodeBuf = Buffer3.alloc(65536, iconv2.defaultCharSingleByte.charCodeAt(0));
+      this.decodeBuf = Buffer4.from(codecOptions.chars, "ucs2");
+      var encodeBuf = Buffer4.alloc(65536, iconv2.defaultCharSingleByte.charCodeAt(0));
       for (var i = 0; i < codecOptions.chars.length; i++) {
         encodeBuf[codecOptions.chars.charCodeAt(i)] = i;
       }
@@ -35400,7 +37015,7 @@ var require_sbcs_codec = __commonJS({
       this.encodeBuf = codec.encodeBuf;
     }
     SBCSEncoder.prototype.write = function(str) {
-      var buf = Buffer3.alloc(str.length);
+      var buf = Buffer4.alloc(str.length);
       for (var i = 0; i < str.length; i++) {
         buf[i] = this.encodeBuf[str.charCodeAt(i)];
       }
@@ -35413,7 +37028,7 @@ var require_sbcs_codec = __commonJS({
     }
     SBCSDecoder.prototype.write = function(buf) {
       var decodeBuf = this.decodeBuf;
-      var newBuf = Buffer3.alloc(buf.length * 2);
+      var newBuf = Buffer4.alloc(buf.length * 2);
       var idx1 = 0;
       var idx2 = 0;
       for (var i = 0; i < buf.length; i++) {
@@ -36041,7 +37656,7 @@ var require_sbcs_data_generated = __commonJS({
 var require_dbcs_codec = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/dbcs-codec.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports._dbcs = DBCSCodec;
     var UNASSIGNED = -1;
     var GB18030_CODE = -2;
@@ -36277,7 +37892,7 @@ var require_dbcs_codec = __commonJS({
       this.gb18030 = codec.gb18030;
     }
     DBCSEncoder.prototype.write = function(str) {
-      var newBuf = Buffer3.alloc(str.length * (this.gb18030 ? 4 : 3));
+      var newBuf = Buffer4.alloc(str.length * (this.gb18030 ? 4 : 3));
       var leadSurrogate = this.leadSurrogate;
       var seqObj = this.seqObj;
       var nextChar = -1;
@@ -36381,7 +37996,7 @@ var require_dbcs_codec = __commonJS({
       if (this.leadSurrogate === -1 && this.seqObj === void 0) {
         return;
       }
-      var newBuf = Buffer3.alloc(10);
+      var newBuf = Buffer4.alloc(10);
       var j = 0;
       if (this.seqObj) {
         var dbcsCode = this.seqObj[DEF_CHAR];
@@ -36412,7 +38027,7 @@ var require_dbcs_codec = __commonJS({
       this.gb18030 = codec.gb18030;
     }
     DBCSDecoder.prototype.write = function(buf) {
-      var newBuf = Buffer3.alloc(buf.length * 2);
+      var newBuf = Buffer4.alloc(buf.length * 2);
       var nodeIdx = this.nodeIdx;
       var prevBytes = this.prevBytes;
       var prevOffset = this.prevBytes.length;
@@ -36478,15 +38093,15 @@ var require_dbcs_codec = __commonJS({
       this.nodeIdx = 0;
       return ret;
     };
-    function findIdx(table, val) {
-      if (table[0] > val) {
+    function findIdx(table2, val) {
+      if (table2[0] > val) {
         return -1;
       }
       var l = 0;
-      var r = table.length;
+      var r = table2.length;
       while (l < r - 1) {
         var mid = l + (r - l + 1 >> 1);
-        if (table[mid] <= val) {
+        if (table2[mid] <= val) {
           l = mid;
         } else {
           r = mid;
@@ -38021,7 +39636,7 @@ var require_encodings = __commonJS({
 var require_streams = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/lib/streams.js"(exports, module) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     module.exports = function(streamModule) {
       var Transform = streamModule.Transform;
       function IconvLiteEncoderStream(conv, options) {
@@ -38061,7 +39676,7 @@ var require_streams = __commonJS({
           chunks.push(chunk);
         });
         this.on("end", function() {
-          cb(null, Buffer3.concat(chunks));
+          cb(null, Buffer4.concat(chunks));
         });
         return this;
       };
@@ -38075,7 +39690,7 @@ var require_streams = __commonJS({
         constructor: { value: IconvLiteDecoderStream }
       });
       IconvLiteDecoderStream.prototype._transform = function(chunk, encoding, done) {
-        if (!Buffer3.isBuffer(chunk) && !(chunk instanceof Uint8Array)) {
+        if (!Buffer4.isBuffer(chunk) && !(chunk instanceof Uint8Array)) {
           return done(new Error("Iconv decoding stream needs buffers as its input."));
         }
         try {
@@ -38118,7 +39733,7 @@ var require_streams = __commonJS({
 var require_lib3 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/lib/index.js"(exports, module) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     var bomHandling = require_bom_handling();
     var mergeModules = require_merge_exports();
     var iconv2 = module.exports;
@@ -38130,7 +39745,7 @@ var require_lib3 = __commonJS({
       var encoder = iconv2.getEncoder(encoding, options);
       var res = encoder.write(str);
       var trail = encoder.end();
-      return trail && trail.length > 0 ? Buffer3.concat([res, trail]) : res;
+      return trail && trail.length > 0 ? Buffer4.concat([res, trail]) : res;
     };
     iconv2.decode = function decode(buf, encoding, options) {
       if (typeof buf === "string") {
@@ -38138,7 +39753,7 @@ var require_lib3 = __commonJS({
           console.error("Iconv-lite warning: decode()-ing strings is deprecated. Refer to https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding");
           iconv2.skipDecodeWarning = true;
         }
-        buf = Buffer3.from("" + (buf || ""), "binary");
+        buf = Buffer4.from("" + (buf || ""), "binary");
       }
       var decoder = iconv2.getDecoder(encoding, options);
       var res = decoder.write(buf);
@@ -38537,8 +40152,8 @@ var init_esm6 = __esm({
       if (status === "loading") {
         helpTip = theme.style.help("Received");
       } else if (status === "idle") {
-        const enterKey = theme.style.key("enter");
-        helpTip = theme.style.help(`Press ${enterKey} to launch your preferred editor.`);
+        const enterKey2 = theme.style.key("enter");
+        helpTip = theme.style.help(`Press ${enterKey2} to launch your preferred editor.`);
       }
       let error = "";
       if (errorMsg) {
@@ -39568,15 +41183,15 @@ function signupErrorCodeFromResponseText(text2) {
 function renderEmailCodeStart(value) {
   const body = objectRecord(value, "signup email-code start response");
   return {
-    pendingId: stringValue4(body, "pending_id"),
-    email: stringValue4(body, "email")
+    pendingId: stringValue6(body, "pending_id"),
+    email: stringValue6(body, "email")
   };
 }
 function renderEmailCodeVerify(value) {
   const body = objectRecord(value, "signup email-code verify response");
   return {
-    accessToken: stringValue4(body, "access_token"),
-    refreshToken: stringValue4(body, "refresh_token"),
+    accessToken: stringValue6(body, "access_token"),
+    refreshToken: stringValue6(body, "refresh_token"),
     expiresInSeconds: positiveIntegerValue(body, "expires_in"),
     user: renderUserRef(requiredValue(body, "user")),
     isNewUser: booleanValue(body, "is_new_user"),
@@ -39616,7 +41231,7 @@ function renderMissionControlComplete(value) {
     localRunnerToken: renderLocalRunnerToken(
       requiredValue(body, "local_runner_token")
     ),
-    launchUrl: stringValue4(body, "launch_url"),
+    launchUrl: stringValue6(body, "launch_url"),
     ...missionControlUrl === void 0 ? {} : { missionControlUrl },
     config: {
       allowedCwds: arrayValue2(config, "allowed_cwds").map(
@@ -39636,21 +41251,21 @@ function renderLocalRunnerToken(value) {
   const body = objectRecord(value, "signup local runner token");
   const expiresInSeconds = optionalPositiveIntegerValue(body, "expires_in");
   return {
-    accessToken: stringValue4(body, "access_token"),
+    accessToken: stringValue6(body, "access_token"),
     ...expiresInSeconds === void 0 ? {} : { expiresInSeconds },
-    workspaceSlug: stringValue4(body, "workspace"),
-    channelSlug: stringValue4(body, "channel")
+    workspaceSlug: stringValue6(body, "workspace"),
+    channelSlug: stringValue6(body, "channel")
   };
 }
 function renderTaskStartResult(value) {
   const body = objectRecord(value, "signup task start");
-  const status = stringValue4(body, "status");
+  const status = stringValue6(body, "status");
   if (status !== "queued" && status !== "started" && status !== "failed") {
     throw new Error("signup task start status was incomplete");
   }
   return {
-    threadId: stringValue4(body, "thread_id"),
-    title: stringValue4(body, "title"),
+    threadId: stringValue6(body, "thread_id"),
+    title: stringValue6(body, "title"),
     status,
     ...optionalStringValue(body, "runner_id") === void 0 ? {} : { runnerId: optionalStringValue(body, "runner_id") },
     ...optionalStringValue(body, "error") === void 0 ? {} : { error: optionalStringValue(body, "error") }
@@ -39660,7 +41275,7 @@ function renderUserRef(value) {
   const body = objectRecord(value, "signup user");
   return {
     id: positiveIntegerValue(body, "id"),
-    username: stringValue4(body, "username"),
+    username: stringValue6(body, "username"),
     ...optionalStringValue(body, "display_name") === void 0 ? {} : { displayName: optionalStringValue(body, "display_name") },
     ...optionalStringValue(body, "primary_email") === void 0 ? {} : { primaryEmail: optionalStringValue(body, "primary_email") }
   };
@@ -39669,23 +41284,23 @@ function renderWorkspaceRef(value) {
   const body = objectRecord(value, "signup workspace");
   return {
     id: positiveIntegerValue(body, "id"),
-    slug: stringValue4(body, "slug"),
-    name: stringValue4(body, "name")
+    slug: stringValue6(body, "slug"),
+    name: stringValue6(body, "name")
   };
 }
 function renderChannelRef(value) {
   const body = objectRecord(value, "signup channel");
   return {
     id: positiveIntegerValue(body, "id"),
-    slug: stringValue4(body, "slug"),
-    name: stringValue4(body, "name")
+    slug: stringValue6(body, "slug"),
+    name: stringValue6(body, "name")
   };
 }
 function renderThreadRef(value) {
   const body = objectRecord(value, "signup thread");
   return {
-    threadId: stringValue4(body, "thread_id"),
-    title: stringValue4(body, "title"),
+    threadId: stringValue6(body, "thread_id"),
+    title: stringValue6(body, "title"),
     rootSeq: positiveIntegerValue(body, "root_seq"),
     threadSeq: positiveIntegerValue(body, "thread_seq")
   };
@@ -39703,7 +41318,7 @@ function requiredValue(record, key) {
   }
   return value;
 }
-function stringValue4(record, key) {
+function stringValue6(record, key) {
   return stringFromUnknown(requiredValue(record, key), `signup ${key}`);
 }
 function optionalStringValue(record, key) {
@@ -39778,6 +41393,7 @@ __export(signupFlow_exports, {
   resolveSignupCodexCommandForTest: () => resolveSignupCodexCommandForTest,
   runSignupFlow: () => runSignupFlow,
   signupCodexTaskSuggestionProcessForTest: () => signupCodexTaskSuggestionProcessForTest,
+  signupCommanderAllowedCwdsForTest: () => signupCommanderAllowedCwdsForTest,
   signupDiscoverProjectsForStartForTest: () => signupDiscoverProjectsForStartForTest,
   signupEmailPickerChoiceNamesForTest: () => signupEmailPickerChoiceNamesForTest,
   signupHelpText: () => signupHelpText,
@@ -39806,7 +41422,7 @@ import {
   writeFileSync as writeFileSync11
 } from "node:fs";
 import { access } from "node:fs/promises";
-import { homedir as homedir13, tmpdir as tmpdir4 } from "node:os";
+import { homedir as homedir12, tmpdir as tmpdir4 } from "node:os";
 import { delimiter as delimiter3, dirname as dirname12, join as join17, resolve as resolve9 } from "node:path";
 import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
 import { emitKeypressEvents } from "node:readline";
@@ -41164,8 +42780,9 @@ async function signupCommanderRunnerOptions(args, runnerId) {
     codexUrl: void 0,
     launchTui: false,
     fast: false,
-    allowedCwds: Array.from(
-      /* @__PURE__ */ new Set([args.projectPath, ...args.selectedProjectPaths])
+    allowedCwds: signupCommanderAllowedCwds(
+      args.projectPath,
+      args.selectedProjectPaths
     ),
     allowedForwardPorts: [],
     codeServerBin: editorRuntime.codeServerBin,
@@ -41182,6 +42799,12 @@ async function signupCommanderRunnerOptions(args, runnerId) {
     channelSession: void 0
   };
 }
+function signupCommanderAllowedCwds(projectPath, selectedProjectPaths) {
+  return assertConfiguredAllowedCwds([projectPath, ...selectedProjectPaths]);
+}
+function signupCommanderAllowedCwdsForTest(projectPath, selectedProjectPaths) {
+  return signupCommanderAllowedCwds(projectPath, selectedProjectPaths);
+}
 function signupConnectRestartCommand(args) {
   return [
     "npx",
@@ -42109,7 +43732,7 @@ async function runSignupPreflights(runtime) {
 function defaultPreflightRuntime() {
   return {
     cwd: process.cwd(),
-    homeDir: homedir13(),
+    homeDir: homedir12(),
     probeTool,
     readGitEmail,
     discoverCodeRoots,
@@ -42318,7 +43941,7 @@ function codexTaskSuggestionProcess2(args) {
 function signupCodexTaskSuggestionProcessForTest(args) {
   return codexTaskSuggestionProcess2(args);
 }
-async function resolveSignupCodexCommand(env = process.env, homeDir = homedir13(), executableExists = fileIsExecutable) {
+async function resolveSignupCodexCommand(env = process.env, homeDir = homedir12(), executableExists = fileIsExecutable) {
   const override = firstConfiguredValue([
     env.LINZUMI_SIGNUP_CODEX_BIN,
     env.LINZUMI_CODEX_BIN
@@ -42957,10 +44580,10 @@ function directoryExists(path2) {
 }
 function expandHomePath(path2) {
   if (path2 === "~") {
-    return homedir13();
+    return homedir12();
   }
   if (path2.startsWith("~/")) {
-    return join17(homedir13(), path2.slice(2));
+    return join17(homedir12(), path2.slice(2));
   }
   return resolve9(path2);
 }
@@ -43001,6 +44624,7 @@ var init_signupFlow = __esm({
     init_helloLinzumiProject();
     init_localEditorRuntime();
     init_runner();
+    init_localCapabilities();
     init_kandanTls();
     init_userFacingErrors();
     maxSignupVerificationCodeAttempts = 3;
@@ -43049,7 +44673,7 @@ init_runner();
 init_claudeCodeSession();
 init_authCache();
 import { existsSync as existsSync13, readFileSync as readFileSync16, realpathSync as realpathSync6 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -43112,7 +44736,7 @@ init_json();
 init_defaultUrls();
 import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname10, join as join15 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 async function runAgentCliCommand(args, deps = {
   fetchImpl: fetch,
   stdout: process.stdout,
@@ -43820,7 +45444,7 @@ function agentTokenFile(flags) {
   return flags.get("agent-token-file") ?? defaultAgentTokenFilePath();
 }
 function defaultAgentTokenFilePath() {
-  return join15(homedir11(), ".linzumi", "agent-token.json");
+  return join15(homedir10(), ".linzumi", "agent-token.json");
 }
 function normalizedApiUrl(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
@@ -43928,13 +45552,13 @@ import {
   watch,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { dirname as dirname11, join as join16, resolve as resolve8 } from "node:path";
 import { execFileSync, spawn as spawn8 } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var connectedMarkers = ["Connected to Linzumi", "Runner connected:"];
 function commanderStatusDir() {
-  return join16(homedir12(), ".linzumi", "commanders");
+  return join16(homedir11(), ".linzumi", "commanders");
 }
 function commanderStatusFile(runnerId, statusDir = commanderStatusDir()) {
   return join16(statusDir, `${safeRunnerId(runnerId)}.json`);
@@ -55982,12 +57606,14 @@ function createLinzumiMcpApiClient(options) {
     getMessage: (params) => request("GET", `${apiPrefix}/message`, params),
     getThread: (params) => request("GET", `${apiPrefix}/thread`, params),
     getChannel: (params) => request("GET", `${apiPrefix}/channel`, params),
+    listVaultSecrets: (params) => request("GET", `${apiPrefix}/vault-secrets`, params),
     sendChannelMessage: (params) => request("POST", `${apiPrefix}/channel-message`, params),
     prepareMessageUploads: (params) => request("POST", `${apiPrefix}/message-uploads/prepare`, params),
     attachMessageFiles: (params) => request("POST", `${apiPrefix}/message-files/attach`, params),
     sendThreadReply: (params) => request("POST", `${apiPrefix}/thread-reply`, params),
     sendDm: (params) => request("POST", `${apiPrefix}/dm`, params),
-    dmOwner: (params) => request("POST", `${apiPrefix}/dm-owner`, params)
+    dmOwner: (params) => request("POST", `${apiPrefix}/dm-owner`, params),
+    getVaultValues: (params) => request("POST", `${apiPrefix}/vault-values`, params)
   };
 }
 
@@ -56044,12 +57670,16 @@ Tools:
   linzumi_get_message   Read one message by scoped seq or Linzumi message URL.
   linzumi_get_thread    Read one bounded thread by ID.
   linzumi_get_channel   Read bounded recent messages and channel metadata.
+  linzumi_list_vault_secrets
+                        List vault secret names, descriptions, and owner scope.
   linzumi_send_channel_message
                         Send a plain-text message to the scoped channel.
   linzumi_send_thread_reply
                         Send a plain-text reply to an existing scoped thread.
   linzumi_send_dm       Send a plain-text DM to a visible user.
   linzumi_dm_owner      Send a plain-text DM to the configured owner username.
+  linzumi_get_vault_values
+                        Request approved named vault values for a thread.
 
 Auth:
   Uses --token, LINZUMI_MCP_ACCESS_TOKEN, or cached local runner OAuth from linzumi auth.
@@ -56065,16 +57695,16 @@ async function runMcpServer(args) {
   const kandanUrl = required(values, "api-url");
   const auth = await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue3(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue3(values, "auth-file"),
-    delegationAuthFilePath: stringValue3(values, "delegation-auth-file"),
-    workspaceSlug: stringValue3(values, "workspace"),
-    channelSlug: stringValue3(values, "channel")
-  });
-  const ownerUsername = stringValue3(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME;
-  const operatingMode = mcpOperatingMode(stringValue3(values, "mode"));
-  const cwd = stringValue3(values, "cwd") ?? process.cwd();
-  const defaultThreadId = stringValue3(values, "thread-id") ?? process.env.LINZUMI_THREAD_RUNNER_KANDAN_THREAD_ID;
+    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue5(values, "auth-file"),
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    workspaceSlug: stringValue5(values, "workspace"),
+    channelSlug: stringValue5(values, "channel")
+  });
+  const ownerUsername = stringValue5(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME;
+  const operatingMode = mcpOperatingMode(stringValue5(values, "mode"));
+  const cwd = stringValue5(values, "cwd") ?? process.cwd();
+  const defaultThreadId = stringValue5(values, "thread-id") ?? process.env.LINZUMI_THREAD_RUNNER_KANDAN_THREAD_ID;
   const client = createLinzumiMcpApiClient({
     kandanUrl,
     accessToken: auth.accessToken,
@@ -56165,6 +57795,12 @@ async function runMcpServer(args) {
       return mcpJsonResult(result);
     }
   );
+  server.tool(
+    "linzumi_list_vault_secrets",
+    "List vault secret names, descriptions, and whether each secret is personal or workspace-owned. Does not return secret values.",
+    {},
+    async (params) => mcpJsonResult(await client.listVaultSecrets(params))
+  );
   server.tool(
     "linzumi_dm_owner",
     "Send a plain-text DM to the configured Commander owner. Requires dm.write and a visible owner username.",
@@ -56221,6 +57857,23 @@ async function runMcpServer(args) {
     },
     async (params) => mcpJsonResult(await client.sendDm(params))
   );
+  server.tool(
+    "linzumi_get_vault_values",
+    "Request values for explicit vault env var names after a thread-scoped human approval. Requires vault.read; thread_id resolves the approval thread.",
+    {
+      workspace: external_exports2.string().optional().describe("Workspace slug. Omit to use the authenticated token scope."),
+      channel: external_exports2.string().optional().describe(
+        "Channel slug used to disambiguate the approval thread when needed."
+      ),
+      thread_id: external_exports2.string().uuid().describe("Existing Linzumi thread UUID for the inline approval."),
+      env_var_names: external_exports2.array(external_exports2.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/)).min(1).max(20).describe(
+        "Explicit vault env var names to request. This tool cannot list all vault keys."
+      ),
+      description: external_exports2.string().min(1).max(500).describe("Human-readable reason shown in the approval request."),
+      justification: external_exports2.string().min(10).max(1e3).describe("Agent justification shown to the approver.")
+    },
+    async (params) => mcpJsonResult(await client.getVaultValues(params))
+  );
   await server.connect(new StdioServerTransport());
 }
 async function uploadFilesWithClient(args) {
@@ -56319,22 +57972,22 @@ function registerEmptyMcpResources(server) {
 async function runMcpConfig(args) {
   const values = strictFlagValues(args);
   const kandanUrl = required(values, "api-url");
-  const format = stringValue3(values, "format") ?? "codex";
-  const operatingMode = mcpOperatingMode(stringValue3(values, "mode"));
+  const format = stringValue5(values, "format") ?? "codex";
+  const operatingMode = mcpOperatingMode(stringValue5(values, "mode"));
   const token = values.get("include-token") === true ? (await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue3(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue3(values, "auth-file"),
-    delegationAuthFilePath: stringValue3(values, "delegation-auth-file"),
-    workspaceSlug: stringValue3(values, "workspace"),
-    channelSlug: stringValue3(values, "channel")
+    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue5(values, "auth-file"),
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    workspaceSlug: stringValue5(values, "workspace"),
+    channelSlug: stringValue5(values, "channel")
   })).accessToken : void 0;
   const config = linzumiMcpServerConfig({
-    command: stringValue3(values, "command"),
+    command: stringValue5(values, "command"),
     kandanUrl,
     accessToken: token,
-    delegationAuthFilePath: stringValue3(values, "delegation-auth-file"),
-    ownerUsername: stringValue3(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME,
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    ownerUsername: stringValue5(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME,
     operatingMode
   });
   switch (format) {
@@ -56353,19 +58006,19 @@ async function runMcpDoctor(args) {
   const kandanUrl = required(values, "api-url");
   const auth = await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue3(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue3(values, "auth-file"),
-    delegationAuthFilePath: stringValue3(values, "delegation-auth-file"),
-    workspaceSlug: stringValue3(values, "workspace"),
-    channelSlug: stringValue3(values, "channel")
+    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue5(values, "auth-file"),
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    workspaceSlug: stringValue5(values, "workspace"),
+    channelSlug: stringValue5(values, "channel")
   });
   switch (auth.mode) {
     case "local-runner": {
       const ok = await validateLocalRunnerToken({
         kandanUrl,
         accessToken: auth.accessToken,
-        workspaceSlug: stringValue3(values, "workspace"),
-        channelSlug: stringValue3(values, "channel")
+        workspaceSlug: stringValue5(values, "workspace"),
+        channelSlug: stringValue5(values, "channel")
       });
       if (!ok) {
         throw new Error("Linzumi MCP auth validation failed");
@@ -56377,7 +58030,7 @@ async function runMcpDoctor(args) {
         kandanUrl,
         accessToken: auth.accessToken,
         authMode: auth.mode,
-        operatingMode: mcpOperatingMode(stringValue3(values, "mode"))
+        operatingMode: mcpOperatingMode(stringValue5(values, "mode"))
       });
       await client.validateAuth();
       break;
@@ -56448,7 +58101,7 @@ function strictFlagValues(args) {
   }
   return values;
 }
-function stringValue3(values, key) {
+function stringValue5(values, key) {
   const value = values.get(key);
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
@@ -56464,7 +58117,7 @@ function mcpOperatingMode(value) {
   }
 }
 function required(values, key) {
-  const value = stringValue3(values, key);
+  const value = stringValue5(values, key);
   if (value === void 0) {
     throw new Error(`--${key} is required`);
   }
@@ -56683,11 +58336,11 @@ function runHelloCommand(args) {
     process.stdout.write(helloHelpText());
     return;
   }
-  const rootPath = stringValue5(values, "dir");
-  const parentDir = stringValue5(values, "parent-dir");
-  const name = stringValue5(values, "name");
+  const rootPath = stringValue7(values, "dir");
+  const parentDir = stringValue7(values, "parent-dir");
+  const name = stringValue7(values, "name");
   const port = tcpPortValue(values, "port");
-  const host = stringValue5(values, "host");
+  const host = stringValue7(values, "host");
   const project = createHelloLinzumiProject({
     ...rootPath === void 0 ? {} : { rootPath },
     ...parentDir === void 0 ? {} : { parentDir: resolveUserPath(parentDir) },
@@ -56827,8 +58480,8 @@ async function runCommanderDaemonCommand(args) {
         runnerId,
         cwd,
         args: stripDaemonSupervisorFlags(flagArgs),
-        logFile: stringValue5(values, "log-file"),
-        statusDir: stringValue5(values, "status-dir")
+        logFile: stringValue7(values, "log-file"),
+        statusDir: stringValue7(values, "status-dir")
       });
       process.stdout.write("commander_status: daemon_started\n");
       process.stdout.write(`runner_id: ${record.runnerId}
@@ -56849,7 +58502,7 @@ async function runCommanderDaemonCommand(args) {
       const runnerId = ensureLocalRunnerIdForLinzumiUrl(kandanUrl);
       const status = commanderDaemonStatus(
         runnerId,
-        stringValue5(values, "status-dir")
+        stringValue7(values, "status-dir")
       );
       process.stdout.write(`${JSON.stringify(status)}
 `);
@@ -56863,7 +58516,7 @@ async function runCommanderDaemonCommand(args) {
       const result = await waitForCommanderDaemon({
         runnerId,
         timeoutMs,
-        statusDir: stringValue5(values, "status-dir")
+        statusDir: stringValue7(values, "status-dir")
       });
       if (result.ok) {
         process.stdout.write("commander_status: connected\n");
@@ -56881,7 +58534,7 @@ async function runCommanderDaemonCommand(args) {
       const runnerId = ensureLocalRunnerIdForLinzumiUrl(kandanUrl);
       const status = stopCommanderDaemon(
         runnerId,
-        stringValue5(values, "status-dir")
+        stringValue7(values, "status-dir")
       );
       process.stdout.write(`${JSON.stringify(status)}
 `);
@@ -56910,13 +58563,13 @@ async function runAuthCommand(args) {
     kandanUrl,
     workspaceSlug: target?.workspaceSlug,
     channelSlug: target?.channelSlug,
-    callbackHost: stringValue5(values, "oauth-callback-host")
+    callbackHost: stringValue7(values, "oauth-callback-host")
   });
   const cached = writeCachedLocalRunnerToken({
     kandanUrl,
     accessToken: token.accessToken,
     expiresInSeconds: token.expiresInSeconds,
-    authFilePath: stringValue5(values, "auth-file")
+    authFilePath: stringValue7(values, "auth-file")
   });
   process.stdout.write(
     `Saved Linzumi local runner auth for ${cached.kandanBaseUrl}
@@ -56943,11 +58596,11 @@ async function parseStartRunnerArgs(args, deps = {
   const requestedCwd = resolveUserPath(cwdArg ?? process.cwd());
   const cwd = assertConfiguredAllowedCwds([requestedCwd])[0] ?? requestedCwd;
   const explicitAllowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue5(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : [];
   const allowedCwds = Array.from(/* @__PURE__ */ new Set([cwd, ...explicitAllowedCwds]));
-  const requestedCodexBin = stringValue5(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue5(values, "code-server-bin");
+  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue7(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -56955,9 +58608,9 @@ async function parseStartRunnerArgs(args, deps = {
   });
   assertStartDependencies(initialDependencyStatus);
   const codexBin = initialDependencyStatus.codex.command;
-  const explicitToken = stringValue5(values, "token");
-  const authFilePath = stringValue5(values, "auth-file");
-  const callbackHost = stringValue5(values, "oauth-callback-host");
+  const explicitToken = stringValue7(values, "token");
+  const authFilePath = stringValue7(values, "auth-file");
+  const callbackHost = stringValue7(values, "oauth-callback-host");
   const reportRejectedCachedToken = () => {
     process.stderr.write(
       "Cached Linzumi local runner auth was rejected; starting OAuth.\n"
@@ -57010,13 +58663,13 @@ async function parseStartRunnerArgs(args, deps = {
     workspaceSlug: target.workspaceSlug,
     cwd,
     codexBin,
-    codexUrl: stringValue5(values, "codex-url"),
+    codexUrl: stringValue7(values, "codex-url"),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue5(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue5(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -57027,12 +58680,12 @@ async function parseStartRunnerArgs(args, deps = {
     channelSession: {
       workspaceSlug: target.workspaceSlug,
       channelSlug: target.channelSlug,
-      kandanThreadId: stringValue5(values, "linzumi-thread-id"),
-      listenUser: stringValue5(values, "listen-user") ?? defaultListenUserFromToken(targetToken),
-      model: stringValue5(values, "model"),
-      reasoningEffort: stringValue5(values, "reasoning-effort"),
-      sandbox: stringValue5(values, "sandbox"),
-      approvalPolicy: stringValue5(values, "approval-policy"),
+      kandanThreadId: stringValue7(values, "linzumi-thread-id"),
+      listenUser: stringValue7(values, "listen-user") ?? defaultListenUserFromToken(targetToken),
+      model: stringValue7(values, "model"),
+      reasoningEffort: stringValue7(values, "reasoning-effort"),
+      sandbox: stringValue7(values, "sandbox"),
+      approvalPolicy: stringValue7(values, "approval-policy"),
       allowPortForwardingByDefault: true,
       streamFlushMs: positiveIntegerValue2(values, "stream-flush-ms")
     }
@@ -57057,32 +58710,32 @@ async function parseAgentRunnerArgs(args, deps = {
       "linzumi commander accepts either <folder> or --cwd, not both"
     );
   }
-  const tokenFilePath = stringValue5(values, "agent-token-file") ?? defaultAgentTokenFilePath();
+  const tokenFilePath = stringValue7(values, "agent-token-file") ?? defaultAgentTokenFilePath();
   const tokenFile = readStoredAgentTokenFile(tokenFilePath, deps.readTextFile);
   const channelSlug = tokenFile.channelId;
   rejectWorkspaceCommanderThreadFlags(values, channelSlug);
   const channelSession = channelSlug === void 0 ? void 0 : {
     workspaceSlug: tokenFile.workspaceId,
     channelSlug,
-    kandanThreadId: stringValue5(values, "linzumi-thread-id"),
-    listenUser: stringValue5(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
-    model: stringValue5(values, "model"),
-    reasoningEffort: stringValue5(values, "reasoning-effort"),
-    sandbox: stringValue5(values, "sandbox"),
-    approvalPolicy: stringValue5(values, "approval-policy"),
+    kandanThreadId: stringValue7(values, "linzumi-thread-id"),
+    listenUser: stringValue7(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
+    model: stringValue7(values, "model"),
+    reasoningEffort: stringValue7(values, "reasoning-effort"),
+    sandbox: stringValue7(values, "sandbox"),
+    approvalPolicy: stringValue7(values, "approval-policy"),
     allowPortForwardingByDefault: true,
     streamFlushMs: positiveIntegerValue2(values, "stream-flush-ms")
   };
   const kandanUrl = kandanUrlValue(values) ?? agentApiUrlToKandanUrl(tokenFile.apiUrl);
-  const requestedCwdValue = cwdArg ?? stringValue5(values, "cwd");
+  const requestedCwdValue = cwdArg ?? stringValue7(values, "cwd");
   const requestedCwd = resolveUserPath(requestedCwdValue ?? process.cwd());
   const configuredAllowedCwds2 = requestedCwdValue === void 0 && !values.has("allowed-cwd") ? readConfiguredAllowedCwdDetailsForLinzumiUrl(kandanUrl) : { allowedCwds: [], missingAllowedCwds: [] };
   const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue5(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : requestedCwdValue === void 0 ? configuredAllowedCwds2.allowedCwds.length > 0 ? [...configuredAllowedCwds2.allowedCwds] : assertConfiguredAllowedCwds([requestedCwd]) : assertConfiguredAllowedCwds([requestedCwd]);
   const cwd = allowedCwds[0] ?? requestedCwd;
-  const requestedCodexBin = stringValue5(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue5(values, "code-server-bin");
+  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue7(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -57113,14 +58766,14 @@ async function parseAgentRunnerArgs(args, deps = {
     workspaceSlug: tokenFile.workspaceId,
     cwd,
     codexBin,
-    codexUrl: stringValue5(values, "codex-url"),
+    codexUrl: stringValue7(values, "codex-url"),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue5(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds,
     missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue5(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -57233,16 +58886,16 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   rejectConnectChannelFlags(values);
-  const workspaceSlug = stringValue5(values, "workspace");
+  const workspaceSlug = stringValue7(values, "workspace");
   const kandanUrl = kandanUrlValue(values) ?? defaultLinzumiWebSocketUrl;
-  const cwd = stringValue5(values, "cwd") ?? process.cwd();
+  const cwd = stringValue7(values, "cwd") ?? process.cwd();
   const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
   const localConfiguredAllowedCwds = values.has("allowed-cwd") ? { allowedCwds: [], missingAllowedCwds: [] } : readConfiguredAllowedCwdDetailsForLinzumiUrl(kandanUrl);
   const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue5(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : [...localConfiguredAllowedCwds.allowedCwds];
-  const requestedCodexBin = stringValue5(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue5(values, "code-server-bin");
+  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue7(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -57250,13 +58903,13 @@ async function parseRunnerArgs(args, deps = {
   });
   assertStartDependencies(initialDependencyStatus);
   const codexBin = initialDependencyStatus.codex.command;
-  const explicitToken = stringValue5(values, "token");
+  const explicitToken = stringValue7(values, "token");
   const token = await deps.resolveToken({
     kandanUrl,
     explicitToken,
     workspaceSlug,
-    authFilePath: stringValue5(values, "auth-file"),
-    callbackHost: stringValue5(values, "oauth-callback-host"),
+    authFilePath: stringValue7(values, "auth-file"),
+    callbackHost: stringValue7(values, "oauth-callback-host"),
     reportRejectedCachedToken: () => {
       process.stderr.write(
         "Cached Linzumi local runner auth was rejected; starting OAuth.\n"
@@ -57285,16 +58938,16 @@ async function parseRunnerArgs(args, deps = {
     ),
     cwd,
     codexBin,
-    codexUrl: stringValue5(values, "codex-url"),
+    codexUrl: stringValue7(values, "codex-url"),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue5(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds: Array.from(
       /* @__PURE__ */ new Set([...cwdAllowedCwds, ...configuredAllowedCwds2])
     ),
     missingAllowedCwds: localConfiguredAllowedCwds.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue5(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -57308,16 +58961,16 @@ async function parseRunnerArgs(args, deps = {
 }
 function runnerRuntimeDefaultsFromValues(values) {
   return {
-    model: stringValue5(values, "model"),
-    reasoningEffort: stringValue5(values, "reasoning-effort"),
-    approvalPolicy: stringValue5(values, "approval-policy"),
-    sandbox: stringValue5(values, "sandbox"),
+    model: stringValue7(values, "model"),
+    reasoningEffort: stringValue7(values, "reasoning-effort"),
+    approvalPolicy: stringValue7(values, "approval-policy"),
+    sandbox: stringValue7(values, "sandbox"),
     allowPortForwardingByDefault: true
   };
 }
 function kandanUrlValue(values) {
-  const apiUrl = stringValue5(values, "api-url");
-  const linzumiUrl = stringValue5(values, "linzumi-url");
+  const apiUrl = stringValue7(values, "api-url");
+  const linzumiUrl = stringValue7(values, "linzumi-url");
   if (apiUrl !== void 0 && linzumiUrl !== void 0 && apiUrl !== linzumiUrl) {
     throw new Error("use only one of --api-url or --linzumi-url");
   }
@@ -57426,10 +59079,10 @@ function rejectStartTargetingFlags(values) {
 }
 function resolveUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir14();
+    return homedir13();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve10(homedir14(), pathValue.slice(2));
+    return resolve10(homedir13(), pathValue.slice(2));
   }
   return resolve10(pathValue);
 }
@@ -57456,8 +59109,8 @@ function rejectConnectChannelFlags(values) {
   );
 }
 function parseOptionalChannelTarget(values) {
-  const channel = stringValue5(values, "channel");
-  const workspace = stringValue5(values, "workspace");
+  const channel = stringValue7(values, "channel");
+  const workspace = stringValue7(values, "workspace");
   if (channel === void 0) {
     if (workspace === void 0) {
       return void 0;
@@ -57491,9 +59144,9 @@ function withLocalMachineId(options) {
 function parseThreadCodexWorkerArgs(args) {
   const values = strictFlagValues2(args);
   const kandanUrl = kandanUrlValue(values) ?? defaultLinzumiWebSocketUrl;
-  const cwd = stringValue5(values, "cwd") ?? process.cwd();
+  const cwd = stringValue7(values, "cwd") ?? process.cwd();
   const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue5(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : assertConfiguredAllowedCwds([cwd]);
   const kandanThreadId = requiredThreadRunnerKandanThreadId();
   const token = requiredThreadRunnerToken();
@@ -57503,17 +59156,17 @@ function parseThreadCodexWorkerArgs(args) {
     runnerId: `thread-codex-worker:${kandanThreadId}`,
     machineId: void 0,
     runnerLockConfigPath: void 0,
-    workspaceSlug: stringValue5(values, "workspace"),
+    workspaceSlug: stringValue7(values, "workspace"),
     cwd,
-    codexBin: stringValue5(values, "codex-bin") ?? "codex",
+    codexBin: stringValue7(values, "codex-bin") ?? "codex",
     codexUrl: void 0,
     launchTui: false,
     fast: values.get("fast") === true ? true : void 0,
-    logFile: stringValue5(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds: configuredAllowedCwds2.allowedCwds,
     missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue5(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: void 0,
     editorRuntime: void 0,
@@ -57543,13 +59196,13 @@ function requiredThreadRunnerToken() {
   return token;
 }
 function required2(values, key) {
-  const value = stringValue5(values, key);
+  const value = stringValue7(values, key);
   if (value === void 0) {
     throw new Error(`missing --${key}`);
   }
   return value;
 }
-function stringValue5(values, key) {
+function stringValue7(values, key) {
   const value = values.get(key);
   if (typeof value === "string" && value.trim() !== "") {
     return value;
@@ -57557,7 +59210,7 @@ function stringValue5(values, key) {
   return void 0;
 }
 function positiveIntegerValue2(values, key) {
-  const value = stringValue5(values, key);
+  const value = stringValue7(values, key);
   if (value === void 0) {
     return void 0;
   }
@@ -57568,7 +59221,7 @@ function positiveIntegerValue2(values, key) {
   throw new Error(`--${key} must be a positive integer`);
 }
 function tcpPortValue(values, key) {
-  const value = stringValue5(values, key);
+  const value = stringValue7(values, key);
   if (value === void 0) {
     return void 0;
   }