@linzumi/cli 0.0.73-beta → 0.0.74-beta

package/dist/index.js

@@ -140,6 +140,7 @@ function parseKandanChatEvent(value) {
     actorSlug: stringValue(actor?.slug),
     actorUserId: integerValue(value.actor_user_id),
     threadId: stringValue(payload.thread_id),
+    threadTitle: kandanThreadTitle(value, payload),
     replyToSeq: integerValue(payload.reply_to_seq),
     localRunnerEventType: localRunnerEventType(payload),
     body: stringValue(value.body) ?? stringValue(value.text) ?? stringValue(payload.body) ?? stringValue(payload.text) ?? "",
@@ -148,6 +149,11 @@ function parseKandanChatEvent(value) {
     )
   };
 }
+function kandanThreadTitle(value, payload) {
+  const payloadThread = objectValue(payload.thread);
+  const eventThread = objectValue(value.thread);
+  return stringValue(payload.thread_title) ?? stringValue(payload.threadTitle) ?? stringValue(payload.title) ?? stringValue(payloadThread?.thread_title) ?? stringValue(payloadThread?.threadTitle) ?? stringValue(payloadThread?.title) ?? stringValue(value.thread_title) ?? stringValue(value.threadTitle) ?? stringValue(value.title) ?? stringValue(eventThread?.thread_title) ?? stringValue(eventThread?.threadTitle) ?? stringValue(eventThread?.title);
+}
 function parseKandanChatAttachments(attachments) {
   return attachments.flatMap((attachment) => {
     const value = objectValue(attachment);
@@ -797,6 +803,130 @@ var init_commanderAttachments = __esm({
   }
 });
 
+// src/codexNotificationDiagnostics.ts
+function codexNotificationDiagnosticDetails(method, params) {
+  switch (method) {
+    case "warning":
+    case "error":
+      return {
+        diagnostic_summary: codexNotificationDiagnosticSummary(method, params) ?? `${method}: seen (no details)`,
+        diagnostic_payload: redactedJsonValue(params, 0),
+        diagnostic_payload_keys: Object.keys(params).sort()
+      };
+    default:
+      return {};
+  }
+}
+function codexNotificationDiagnosticSummary(method, params) {
+  const error = objectValue2(params.error);
+  const item = objectValue2(params.item);
+  const code = stringValue2(params.code) ?? numberStringValue(params.code) ?? stringValue2(error?.code) ?? numberStringValue(error?.code) ?? stringValue2(params.status) ?? numberStringValue(params.status);
+  const message = stringValue2(params.message) ?? stringValue2(params.detail) ?? stringValue2(params.reason) ?? stringValue2(error?.message) ?? stringValue2(error?.detail) ?? stringValue2(error?.reason);
+  const itemType = stringValue2(item?.type);
+  const redactedCode = code === void 0 ? void 0 : redactedDiagnosticText(code);
+  const prefix = redactedCode === void 0 ? method : `${method} ${redactedCode}`;
+  const detail = message === void 0 ? itemType === void 0 ? void 0 : `item.type=${itemType}` : redactedDiagnosticText(message);
+  return detail === void 0 ? void 0 : `${prefix}: ${detail}`;
+}
+function redactedJsonValue(value, depth) {
+  if (value === void 0) {
+    return null;
+  }
+  if (typeof value === "string") {
+    const redacted = redactedDiagnosticText(value);
+    return redacted.length <= maxDiagnosticStringLength ? redacted : `${redacted.slice(0, maxDiagnosticStringLength)}...`;
+  }
+  if (value === null || typeof value === "boolean" || typeof value === "number") {
+    return value;
+  }
+  if (depth >= maxDiagnosticDepth) {
+    return "[max-depth]";
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactedJsonValue(entry, depth + 1));
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      sensitiveKey(key) ? redactedValue : redactedJsonValue(entry, depth + 1)
+    ])
+  );
+}
+function sensitiveKey(key) {
+  const normalizedKey = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[\s-]+/g, "_").toLowerCase();
+  switch (normalizedKey) {
+    case "authorization":
+    case "cookie":
+    case "cookies":
+    case "credential":
+    case "credentials":
+    case "password":
+    case "secret":
+    case "token":
+    case "access_key":
+    case "api_key":
+    case "auth_token":
+    case "bearer_token":
+    case "client_secret":
+    case "id_token":
+    case "private_key":
+    case "proxy_authorization":
+    case "refresh_token":
+    case "secret_key":
+    case "session_token":
+    case "set_cookie":
+    case "sig":
+    case "signature":
+    case "signing_key":
+    case "x_amz_signature":
+    case "x_api_key":
+      return true;
+    default:
+      return normalizedKey.endsWith("_api_key") || normalizedKey.endsWith("_access_key") || normalizedKey.endsWith("_private_key") || normalizedKey.endsWith("_secret_key") || normalizedKey.endsWith("_authorization") || normalizedKey.endsWith("_cookie") || normalizedKey.endsWith("_cookies") || normalizedKey.endsWith("_token") || normalizedKey.endsWith("_secret") || normalizedKey.endsWith("_password") || normalizedKey.endsWith("_signature") || normalizedKey.endsWith("_sig") || normalizedKey.endsWith("_credential") || normalizedKey.endsWith("_credentials");
+  }
+}
+function redactedDiagnosticText(value) {
+  return value.replace(
+    /https?:\/\/\S*(?:token|secret|signature|sig|x-amz-signature|api[_-]?key|access[_-]?key|private[_-]?key|refresh)\S*/gi,
+    redactedUrl
+  ).replace(
+    /(^|[^A-Za-z0-9_-])(["']?)(set-cookie|cookie)\2\s*(:|=)\s*(["']?)[^\r\n"']*\5/gi,
+    (_match, prefix, keyQuote, key, separator, valueQuote) => {
+      const spacing = separator === ":" && valueQuote === "" ? " " : "";
+      return `${prefix}${keyQuote}${key}${keyQuote}${separator}${spacing}${valueQuote}${redactedValue}${valueQuote}`;
+    }
+  ).replace(
+    new RegExp(
+      `(^|[^A-Za-z0-9_-])(["']?)(${credentialTextKeyPattern})\\2\\s*(:|=)\\s*(["']?)(?:(?:Bearer|Basic|Digest|Token|ApiKey|OAuth|Negotiate)\\s+)?[^"'\\s,;}&]+\\5`,
+      "gi"
+    ),
+    (_match, prefix, keyQuote, key, separator, valueQuote) => {
+      const spacing = separator === ":" && valueQuote === "" ? " " : "";
+      return `${prefix}${keyQuote}${key}${keyQuote}${separator}${spacing}${valueQuote}${redactedValue}${valueQuote}`;
+    }
+  ).replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]");
+}
+function objectValue2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function stringValue2(value) {
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function numberStringValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value.toString() : void 0;
+}
+var redactedValue, redactedUrl, maxDiagnosticDepth, maxDiagnosticStringLength, credentialTextKeyPattern;
+var init_codexNotificationDiagnostics = __esm({
+  "src/codexNotificationDiagnostics.ts"() {
+    "use strict";
+    redactedValue = "[redacted]";
+    redactedUrl = "[redacted-url]";
+    maxDiagnosticDepth = 12;
+    maxDiagnosticStringLength = 8e3;
+    credentialTextKeyPattern = "(?:(?:[A-Za-z0-9]+[_-]+)*(?:proxy-authorization|authorization|set-cookie|cookie|x-api-key|api[_-]?key|access[_-]?key|access[_-]?token|private[_-]?key|refresh(?:[_-]?token)?|auth[_-]?token|id[_-]?token|client[_-]?secret|bearer[_-]?token|session[_-]?token|secret[_-]?key|signing[_-]?key|credential|credentials|token|secret|password|signature|sig))";
+  }
+});
+
 // src/codexRuntimeOptions.ts
 function codexThreadRuntimeOverrides(options) {
   const session = options.channelSession;
@@ -2351,6 +2481,7 @@ function coalesceAssistantDeltas(deltas) {
   return coalesceTextDeltas(deltas, (delta) => ({
     itemKey: delta.itemKey,
     turnId: delta.turnId,
+    sourceMessageSeq: delta.sourceMessageSeq,
     delta: delta.delta
   }));
 }
@@ -3653,8 +3784,15 @@ async function attachChannelSession(args) {
     handleCodexNotification: (method, params) => {
       const turnId = codexNotificationTurnId(params);
       const threadId = codexNotificationThreadId(params);
-      const routedTurnId = turnId ?? codexNotificationActiveTurnFallback(method, state, params);
+      const routedTurnId = turnId ?? codexNotificationActiveTurnFallback(method, state, params, threadId);
       if (codexNotificationBelongsToSession(state, threadId, routedTurnId)) {
+        rememberRecentCodexDiagnostic(
+          state,
+          method,
+          params,
+          threadId,
+          routedTurnId
+        );
         const processingReason = processingReasonForCodexNotification(
           method,
           params
@@ -3718,7 +3856,15 @@ async function attachChannelSession(args) {
             break;
           }
           case "item/agentMessage/delta":
-            enqueueAssistantDelta(args, state, params, payloadContext);
+            const assistantDeltaSourceSeq = routedTurnId === void 0 ? startingSourceMessageSeq(state) : void 0;
+            enqueueAssistantDelta(
+              args,
+              state,
+              params,
+              payloadContext,
+              routedTurnId,
+              assistantDeltaSourceSeq
+            );
             break;
           case "item/reasoning/textDelta":
             enqueueReasoningDelta(args, state, params, payloadContext);
@@ -3739,16 +3885,26 @@ async function attachChannelSession(args) {
           case "item/completed":
             enqueueWebSearchProgress(args, state, params, payloadContext);
             enqueueCompletedFileChange(args, state, params, payloadContext);
+            const pendingCompletedAssistantSourceSeq = routedTurnId === void 0 ? startingSourceMessageSeq(state) : void 0;
             const completedAssistantItemForward = forwardCompletedAssistantItem(
               args,
               state,
               params,
-              payloadContext
+              payloadContext,
+              routedTurnId,
+              pendingCompletedAssistantSourceSeq
             );
-            if (turnId !== void 0) {
+            if (routedTurnId !== void 0) {
               rememberPendingCompletedAssistantItemForward(
                 state,
-                turnId,
+                routedTurnId,
+                completedAssistantItemForward
+              );
+            }
+            if (pendingCompletedAssistantSourceSeq !== void 0) {
+              rememberPendingCompletedAssistantItemSourceForward(
+                state,
+                pendingCompletedAssistantSourceSeq,
                 completedAssistantItemForward
               );
             }
@@ -3757,29 +3913,38 @@ async function attachChannelSession(args) {
                 message: error instanceof Error ? error.message : String(error)
               });
             }).finally(() => {
-              if (turnId !== void 0) {
+              if (routedTurnId !== void 0) {
                 forgetPendingCompletedAssistantItemForward(
                   state,
-                  turnId,
+                  routedTurnId,
+                  completedAssistantItemForward
+                );
+              }
+              if (pendingCompletedAssistantSourceSeq !== void 0) {
+                forgetPendingCompletedAssistantItemSourceForward(
+                  state,
+                  pendingCompletedAssistantSourceSeq,
                   completedAssistantItemForward
                 );
               }
             });
-            if (turnId !== void 0) {
+            if (routedTurnId !== void 0) {
               const promise = mirrorLocalTuiInputFromNotification(
                 args,
                 state,
-                turnId,
+                routedTurnId,
                 params,
                 payloadContext
               );
-              rememberPendingTuiInputMirror(state, turnId, promise);
+              rememberPendingTuiInputMirror(state, routedTurnId, promise);
               void promise.catch((error) => {
                 args.log("codex.tui_input_mirror_failed", {
-                  turn_id: turnId,
+                  turn_id: routedTurnId,
                   message: error instanceof Error ? error.message : String(error)
                 });
-              }).finally(() => forgetPendingTuiInputMirror(state, turnId));
+              }).finally(
+                () => forgetPendingTuiInputMirror(state, routedTurnId)
+              );
             }
             break;
           case "response_item":
@@ -3850,6 +4015,7 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
   return {
     rootSeq,
     kandanThreadId,
+    kandanThreadTitle: void 0,
     codexThreadId,
     turn: { status: "idle" },
     closed: false,
@@ -3860,7 +4026,10 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     recoveredCompletingTurnIds: /* @__PURE__ */ new Set(),
     retryableTurnIds: /* @__PURE__ */ new Set(),
     completedAssistantItemKeys: /* @__PURE__ */ new Set(),
+    completedAssistantItemTurns: createBoundedCache(maxForwardedTurnIds),
+    completedAssistantItemSourceSeqs: createBoundedCache(maxForwardedTurnIds),
     pendingCompletedAssistantItemForwards: /* @__PURE__ */ new Map(),
+    pendingCompletedAssistantItemSourceForwards: /* @__PURE__ */ new Map(),
     claimedKandanMessageKeys: /* @__PURE__ */ new Set(),
     localTuiTurnIds: /* @__PURE__ */ new Set(),
     mirroredTuiInputProjections: createBoundedCache(maxForwardedTurnIds),
@@ -3872,6 +4041,7 @@ function initialChannelSessionState(cursor, rootSeq, kandanThreadId, codexThread
     pendingCommandOutputs: createBoundedCache(maxForwardedTurnIds),
     observedCommandOutputCommands: createBoundedCache(maxForwardedTurnIds * 3),
     streamingFileChangeOutputs: createBoundedCache(maxForwardedTurnIds),
+    recentCodexDiagnostics: createBoundedCache(maxForwardedTurnIds * 3),
     assistantDeltaQueue: createStreamDeltaQueue(),
     reasoningDeltaQueue: createStreamDeltaQueue(),
     commandOutputQueue: createStreamDeltaQueue(),
@@ -3974,6 +4144,7 @@ async function bindChannelSession(args, state, payloadContext) {
       state.minSeq = Math.max(state.minSeq, state.rootSeq);
     }
   } else if (state.codexThreadId !== void 0) {
+    await hydrateKandanThreadTitleFromThreadContext(args, state);
     await bindCurrentCodexThread(args, state);
   } else {
     const resolved = await pushOk2(
@@ -3988,6 +4159,10 @@ async function bindChannelSession(args, state, payloadContext) {
     );
     state.rootSeq = integerValue(resolved.seq);
     state.codexThreadId = stringValue(resolved.codex_thread_id);
+    updateKandanThreadTitle(
+      state,
+      kandanThreadTitleFromResolvedMessage(resolved.message)
+    );
     if (state.codexThreadId === void 0) {
       throw new Error(
         "Kandan thread root metadata did not include a Codex thread id"
@@ -4923,6 +5098,46 @@ function runnerConsoleBodyPreview(body) {
   const normalized = body.replace(/\s+/g, " ").trim();
   return normalized.length <= 50 ? normalized : `${normalized.slice(0, 47)}...`;
 }
+function updateKandanThreadTitle(state, title) {
+  if (title !== void 0) {
+    state.kandanThreadTitle = title;
+  }
+}
+function kandanThreadTitleFromResolvedMessage(message) {
+  return message === void 0 ? void 0 : parseKandanChatEvent(message)?.threadTitle;
+}
+function kandanThreadTitleFromWireMessages(messages) {
+  if (!Array.isArray(messages)) {
+    return void 0;
+  }
+  for (const message of messages) {
+    const title = parseKandanChatEvent(message)?.threadTitle;
+    if (title !== void 0) {
+      return title;
+    }
+  }
+  return void 0;
+}
+async function hydrateKandanThreadTitleFromThreadContext(args, state) {
+  if (state.kandanThreadId === void 0 || state.kandanThreadTitle !== void 0) {
+    return;
+  }
+  const session = args.options.channelSession;
+  const reply = await pushOk2(
+    args.kandan,
+    args.topic,
+    "session:thread_context",
+    {
+      workspace: session.workspaceSlug,
+      channel: session.channelSlug,
+      thread_id: state.kandanThreadId
+    }
+  );
+  updateKandanThreadTitle(
+    state,
+    kandanThreadTitleFromWireMessages(reply.messages)
+  );
+}
 async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext, event) {
   const session = args.options.channelSession;
   if (event.type !== "thread.message") {
@@ -5032,6 +5247,7 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
     });
     return;
   }
+  updateKandanThreadTitle(state, event.threadTitle);
   if (!claimKandanMessage(args, state, event)) {
     args.log("kandan.message_ignored", {
       seq: event.seq,
@@ -5058,7 +5274,8 @@ async function handleKandanChatEvent(args, state, runnerIdentity, payloadContext
     codex_thread_id: state.codexThreadId ?? null,
     runner_console: {
       body_preview: runnerConsoleBodyPreview(event.body),
-      message_received_at_ms: receivedAtMs
+      message_received_at_ms: receivedAtMs,
+      ...state.kandanThreadTitle === void 0 ? {} : { linzumi_thread_title: state.kandanThreadTitle }
     },
     queue_depth: pendingKandanMessageQueueLength(state.queue)
   });
@@ -5140,7 +5357,8 @@ async function startThreadMessageTurn(args, state, payloadContext, message) {
     codex_thread_id: state.codexThreadId ?? null,
     runner_console: {
       body_preview: runnerConsoleBodyPreview(queued.body),
-      message_received_at_ms: queued.receivedAtMs ?? Date.now()
+      message_received_at_ms: queued.receivedAtMs ?? Date.now(),
+      ...state.kandanThreadTitle === void 0 ? {} : { linzumi_thread_title: state.kandanThreadTitle }
     },
     queue_depth: pendingKandanMessageQueueLength(state.queue)
   });
@@ -5165,11 +5383,15 @@ async function bindUnboundHistoricalThread(args, state, event) {
     );
     const rootSeq = integerValue(resolved.seq);
     const codexThreadId = stringValue(resolved.codex_thread_id);
+    const resolvedThreadTitle = kandanThreadTitleFromResolvedMessage(
+      resolved.message
+    );
     if (rootSeq !== event.replyToSeq || codexThreadId === void 0) {
       return false;
     }
     state.rootSeq = rootSeq;
     state.kandanThreadId = event.threadId;
+    updateKandanThreadTitle(state, event.threadTitle ?? resolvedThreadTitle);
     state.codexThreadId = codexThreadId;
     await bindCurrentCodexThread(args, state);
     args.log("kandan.thread_bound_from_historical_reply", {
@@ -5268,7 +5490,8 @@ async function drainKandanMessageQueue(args, state, payloadContext) {
     codex_thread_id: state.codexThreadId ?? null,
     runner_console: {
       body_preview: runnerConsoleBodyPreview(next.body),
-      message_received_at_ms: next.receivedAtMs ?? Date.now()
+      message_received_at_ms: next.receivedAtMs ?? Date.now(),
+      ...state.kandanThreadTitle === void 0 ? {} : { linzumi_thread_title: state.kandanThreadTitle }
     },
     queue_depth: pendingKandanMessageQueueLength(state.queue)
   });
@@ -5581,6 +5804,15 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
   if (completingTurnWasRecovered(state, turnId)) {
     return;
   }
+  if (completingQueuedSeq !== void 0) {
+    await waitForPendingCompletedAssistantItemSourceForwards(
+      state,
+      completingQueuedSeq
+    );
+  }
+  if (completingTurnWasRecovered(state, turnId)) {
+    return;
+  }
   await waitForStreamingForwardChains(args, state, payloadContext);
   if (completingTurnWasRecovered(state, turnId)) {
     return;
@@ -5643,6 +5875,13 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
     );
     const sourceMessageSeq = sourceMessageSeqForTurn(state, turnId);
     const rootSeq = state.rootSeq;
+    const completedAssistantOutputCount = completedOutputs.filter(
+      completedOutputProjectionIsAssistant
+    ).length;
+    const completedForwardedAssistantSnapshotCount = forwardedAssistantSnapshotOutputCount(state, messages);
+    const completedSourceSeqAssistantItemCount = sourceMessageSeq === void 0 ? 0 : completedAssistantItemForwardedForSourceSeq(state, sourceMessageSeq);
+    const completedStreamingAssistantOutputCount = completedAssistantOutputCount === 0 ? await completeStreamingAssistantOutputsForTurn(args, state, turnId) : 0;
+    const completedAssistantResponseSeen = completedAssistantOutputCount > 0 || completedForwardedAssistantSnapshotCount > 0 || completedSourceSeqAssistantItemCount > 0 || completedStreamingAssistantOutputCount > 0 || completedAssistantItemForwardedForTurn(state, turnId);
     for (const output of completedOutputs) {
       if (completingTurnWasRecovered(state, turnId)) {
         return;
@@ -5660,6 +5899,35 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
     if (completingTurnWasRecovered(state, turnId)) {
       return;
     }
+    if (!completedAssistantResponseSeen) {
+      const recentError = recentCodexDiagnosticSummaryForTurn(
+        state,
+        "error",
+        state.codexThreadId,
+        turnId
+      );
+      const recentWarning = recentCodexDiagnosticSummaryForTurn(
+        state,
+        "warning",
+        state.codexThreadId,
+        turnId
+      );
+      args.log("codex.turn_completed_without_assistant_output", {
+        turn_id: turnId,
+        codex_thread_id: state.codexThreadId,
+        kandan_thread_id: state.kandanThreadId,
+        source_seq: sourceMessageSeq ?? null,
+        output_count: completedOutputs.length,
+        assistant_output_count: completedAssistantOutputCount,
+        forwarded_assistant_snapshot_output_count: completedForwardedAssistantSnapshotCount,
+        source_seq_assistant_item_count: completedSourceSeqAssistantItemCount,
+        completed_streaming_assistant_output_count: completedStreamingAssistantOutputCount,
+        thread_read_output_count: readMessages.length,
+        session_log_output_count: sessionLogMessages.length,
+        recent_error: recentError ?? null,
+        recent_warning: recentWarning ?? null
+      });
+    }
     rememberForwardedTurnId(state, turnId);
     forgetLocalTuiTurnId(state, turnId);
     if (completingQueuedSeq !== void 0) {
@@ -5667,8 +5935,9 @@ async function forwardCompletedCodexTurn(args, state, turnId, payloadContext) {
         args,
         state.kandanThreadId,
         completingQueuedSeq,
-        {
-          status: "processed"
+        completedAssistantResponseSeen ? { status: "processed" } : {
+          status: "failed",
+          reason: "Codex completed without producing a response."
         }
       );
       clearActiveProcessingState(state, completingQueuedSeq);
@@ -5818,6 +6087,21 @@ function completedOutputProjectionsForTurn(state, turnId, messages) {
     compareCompletedOutputProjection
   );
 }
+function completedOutputProjectionIsAssistant(output) {
+  switch (output.kind) {
+    case "snapshot":
+      return stringValue(output.message.structured.kind) === "codex_assistant_message";
+    case "cached_reasoning":
+    case "cached_command":
+    case "cached_file_change":
+      return false;
+  }
+}
+function forwardedAssistantSnapshotOutputCount(state, messages) {
+  return messages.filter(
+    (message) => stringValue(message.structured.kind) === "codex_assistant_message" && completedAssistantItemForwarded(state, message.itemKey)
+  ).length;
+}
 async function sessionLogOutputMessagesForTurn(args, codexThreadId, turnId) {
   try {
     return await codexSessionLogOutputMessagesForTurn({
@@ -5834,39 +6118,76 @@ async function sessionLogOutputMessagesForTurn(args, codexThreadId, turnId) {
   }
 }
 function completedMessagesWithSessionLog(readMessages, sessionLogMessages) {
-  const readExactKeys = new Set(readMessages.map(completedMessageExactKey));
-  const readSemanticCounts = completedMessageSemanticCounts(readMessages);
-  const missingSessionStructuredMessages = [];
-  for (const message of sessionLogMessages) {
-    if (stringValue(message.structured.kind) === "codex_assistant_message") {
-      continue;
-    }
-    if (readExactKeys.has(completedMessageExactKey(message))) {
-      continue;
+  if (sessionLogMessages.length === 0) {
+    return [...readMessages];
+  }
+  const consumedReadIndexes = /* @__PURE__ */ new Set();
+  const sessionOrderedEntries = sessionLogMessages.map((message) => {
+    const readIndex = findUnconsumedCompletedMessageIndex(
+      readMessages,
+      consumedReadIndexes,
+      completedMessageExactKey(message)
+    );
+    if (readIndex >= 0) {
+      consumedReadIndexes.add(readIndex);
+      return { kind: "read", readIndex };
     }
-    const semanticKey = completedMessageSemanticKey(message);
-    const remainingReadCount = readSemanticCounts.get(semanticKey) ?? 0;
-    if (remainingReadCount > 0) {
-      readSemanticCounts.set(semanticKey, remainingReadCount - 1);
-      continue;
+    const semanticReadIndex = findUnconsumedCompletedMessageSemanticIndex(
+      readMessages,
+      consumedReadIndexes,
+      completedMessageSemanticKey(message)
+    );
+    if (semanticReadIndex >= 0) {
+      consumedReadIndexes.add(semanticReadIndex);
+      return { kind: "read", readIndex: semanticReadIndex };
+    }
+    return { kind: "session", message };
+  });
+  const mergedMessages = [];
+  let nextReadIndex = 0;
+  for (const entry of sessionOrderedEntries) {
+    switch (entry.kind) {
+      case "read":
+        while (nextReadIndex < entry.readIndex) {
+          if (!consumedReadIndexes.has(nextReadIndex)) {
+            const message = readMessages[nextReadIndex];
+            if (message !== void 0) {
+              mergedMessages.push(message);
+            }
+          }
+          nextReadIndex += 1;
+        }
+        mergedMessages.push(readMessages[entry.readIndex]);
+        nextReadIndex = Math.max(nextReadIndex, entry.readIndex + 1);
+        break;
+      case "session":
+        mergedMessages.push(entry.message);
+        break;
     }
-    missingSessionStructuredMessages.push(message);
   }
-  if (missingSessionStructuredMessages.length === 0) {
-    return [...readMessages];
+  while (nextReadIndex < readMessages.length) {
+    if (!consumedReadIndexes.has(nextReadIndex)) {
+      const message = readMessages[nextReadIndex];
+      if (message !== void 0) {
+        mergedMessages.push(message);
+      }
+    }
+    nextReadIndex += 1;
   }
-  return [...missingSessionStructuredMessages, ...readMessages];
+  return mergedMessages;
 }
 function completedMessageExactKey(message) {
   return `${stringValue(message.structured.kind) ?? ""}:${message.itemKey}`;
 }
-function completedMessageSemanticCounts(messages) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const message of messages) {
-    const key = completedMessageSemanticKey(message);
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-  }
-  return counts;
+function findUnconsumedCompletedMessageIndex(messages, consumedIndexes, exactKey) {
+  return messages.findIndex(
+    (message, index) => !consumedIndexes.has(index) && completedMessageExactKey(message) === exactKey
+  );
+}
+function findUnconsumedCompletedMessageSemanticIndex(messages, consumedIndexes, semanticKey) {
+  return messages.findIndex(
+    (message, index) => !consumedIndexes.has(index) && completedMessageSemanticKey(message) === semanticKey
+  );
 }
 function completedMessageSemanticKey(message) {
   const kind = stringValue(message.structured.kind) ?? "";
@@ -6091,12 +6412,13 @@ function logCompletedCodexOutput(args, state, turnId, message) {
     file_paths: fileChangePaths(message.structured)
   });
 }
-async function forwardCompletedAssistantItem(args, state, params, payloadContext) {
+async function forwardCompletedAssistantItem(args, state, params, payloadContext, fallbackTurnId = void 0, fallbackSourceMessageSeq = void 0) {
   if (state.kandanThreadId === void 0 || state.codexThreadId === void 0) {
     return;
   }
-  const turnId = stringValue(params.turnId) ?? stringValue(params.turn_id) ?? stringValue(objectValue(params.turn)?.id);
   const item = objectValue(params.item) ?? params;
+  const itemTurn = objectValue(item.turn);
+  const turnId = stringValue(params.turnId) ?? stringValue(params.turn_id) ?? stringValue(objectValue(params.turn)?.id) ?? stringValue(item.turnId) ?? stringValue(item.turn_id) ?? stringValue(itemTurn?.id) ?? fallbackTurnId;
   const completedItemKey = stringValue(params.itemId) ?? stringValue(params.item_id) ?? stringValue(objectValue(params.item)?.id);
   if (turnId !== void 0) {
     await waitForPendingTuiInputMirror(state, turnId);
@@ -6128,7 +6450,7 @@ async function forwardCompletedAssistantItem(args, state, params, payloadContext
   if (message === void 0 || completedAssistantItemForwarded(state, message.itemKey)) {
     return;
   }
-  const sourceMessageSeq = messageTurnId === void 0 ? void 0 : sourceMessageSeqForTurn(state, messageTurnId);
+  const sourceMessageSeq = messageTurnId === void 0 ? fallbackSourceMessageSeq ?? startingSourceMessageSeq(state) : sourceMessageSeqForTurn(state, messageTurnId);
   if (messageTurnId !== void 0 && sourceMessageSeq === void 0) {
     args.log("codex.completed_assistant_item_without_source_message", {
       turn_id: messageTurnId,
@@ -6176,11 +6498,21 @@ async function forwardCompletedAssistantItem(args, state, params, payloadContext
         `Cannot reconcile completed assistant item ${message.itemKey} from item notification; ${streamed.candidateCount} active streamed assistant outputs exist`
       );
   }
-  rememberCompletedAssistantItemKey(state, message.itemKey);
-  logCompletedCodexOutput(args, messageTurnId ?? `item:${message.itemKey}`, {
-    ...message,
-    structured
-  });
+  rememberCompletedAssistantItemKey(
+    state,
+    message.itemKey,
+    messageTurnId,
+    sourceMessageSeq
+  );
+  logCompletedCodexOutput(
+    args,
+    state,
+    messageTurnId ?? `item:${message.itemKey}`,
+    {
+      ...message,
+      structured
+    }
+  );
 }
 function compareCompletedOutputProjection(left, right) {
   if (left.kind === "snapshot" && right.kind === "snapshot" && left.match.kind !== right.match.kind && (left.match.kind === "none" || right.match.kind === "none")) {
@@ -6252,7 +6584,7 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
   }
   const existing = findStreamingAssistantOutput(state, delta.itemKey);
   const nextContent = `${existing?.content ?? ""}${delta.delta}`;
-  const sourceMessageSeq = delta.turnId === void 0 ? void 0 : sourceMessageSeqForTurn(state, delta.turnId);
+  const sourceMessageSeq = delta.turnId === void 0 ? delta.sourceMessageSeq : sourceMessageSeqForTurn(state, delta.turnId);
   const rootSeq = state.rootSeq;
   if (delta.turnId !== void 0 && sourceMessageSeq === void 0) {
     args.log("codex.delta_without_source_message", {
@@ -6299,6 +6631,7 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
       rememberStreamingAssistantOutput(state, {
         itemKey: delta.itemKey,
         turnId: delta.turnId,
+        sourceMessageSeq,
         seq,
         content: nextContent
       });
@@ -6314,6 +6647,7 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
     );
     rememberStreamingAssistantOutput(state, {
       ...existing,
+      sourceMessageSeq: existing.sourceMessageSeq ?? sourceMessageSeq,
       content: nextContent
     });
   }
@@ -6325,11 +6659,12 @@ async function forwardAssistantDeltaPayload(args, state, delta, payloadContext)
     content_length: nextContent.length
   });
 }
-function enqueueAssistantDelta(args, state, params, payloadContext) {
-  const delta = codexAssistantDeltaFromNotification(params);
-  if (delta === void 0) {
+function enqueueAssistantDelta(args, state, params, payloadContext, fallbackTurnId = void 0, fallbackSourceMessageSeq = void 0) {
+  const parsedDelta = codexAssistantDeltaFromNotification(params);
+  if (parsedDelta === void 0) {
     return;
   }
+  const delta = parsedDelta.turnId === void 0 && fallbackTurnId !== void 0 ? { ...parsedDelta, turnId: fallbackTurnId } : { ...parsedDelta, sourceMessageSeq: fallbackSourceMessageSeq };
   enqueueStreamDelta(
     state.assistantDeltaQueue,
     delta,
@@ -7129,8 +7464,42 @@ async function completeInterruptedAssistantOutputs(args, state, turnId, payloadC
       "completed"
     );
     forgetStreamingAssistantOutput(state, output.itemKey);
-    rememberCompletedAssistantItemKey(state, output.itemKey);
+    rememberCompletedAssistantItemKey(state, output.itemKey, turnId);
+  }
+}
+async function completeStreamingAssistantOutputsForTurn(args, state, turnId) {
+  const sourceMessageSeq = sourceMessageSeqForTurn(state, turnId);
+  const outputs = boundedCacheValues(state.streamingAssistantOutputs).filter(
+    (output) => output.turnId === turnId || sourceMessageSeq !== void 0 && output.sourceMessageSeq === sourceMessageSeq
+  );
+  for (const output of outputs) {
+    const message = {
+      itemKey: output.itemKey,
+      body: output.content,
+      structured: codexAssistantStructuredMessage(
+        output.itemKey,
+        output.content,
+        "completed"
+      )
+    };
+    await editStreamedCodexOutput(
+      args,
+      state,
+      output.seq,
+      output.itemKey,
+      output.content,
+      "completed"
+    );
+    forgetStreamingAssistantOutput(state, output.itemKey);
+    rememberCompletedAssistantItemKey(
+      state,
+      output.itemKey,
+      turnId,
+      output.sourceMessageSeq
+    );
+    logCompletedCodexOutput(args, state, turnId, message);
   }
+  return outputs.length;
 }
 function streamingClientMessageId(instanceId, delta) {
   const digest = createHash("sha256").update(`${instanceId}:${delta.turnId ?? "turn"}:${delta.itemKey}`).digest("hex").slice(0, 32);
@@ -7508,12 +7877,34 @@ function forgetStreamingAssistantOutput(state, itemKey) {
 function completedAssistantItemForwarded(state, itemKey) {
   return state.completedAssistantItemKeys.has(itemKey);
 }
-function rememberCompletedAssistantItemKey(state, itemKey) {
+function completedAssistantItemForwardedForTurn(state, turnId) {
+  return boundedCacheValues(state.completedAssistantItemTurns).some(
+    (item) => item.turnId === turnId
+  );
+}
+function completedAssistantItemForwardedForSourceSeq(state, sourceSeq) {
+  return boundedCacheValues(state.completedAssistantItemSourceSeqs).filter(
+    (item) => item.sourceSeq === sourceSeq
+  ).length;
+}
+function rememberCompletedAssistantItemKey(state, itemKey, turnId = void 0, sourceSeq = void 0) {
   rememberBoundedStringSet(
     state.completedAssistantItemKeys,
     itemKey,
     maxForwardedTurnIds
   );
+  if (turnId !== void 0) {
+    rememberBoundedCacheValue(state.completedAssistantItemTurns, itemKey, {
+      itemKey,
+      turnId
+    });
+  }
+  if (sourceSeq !== void 0) {
+    rememberBoundedCacheValue(state.completedAssistantItemSourceSeqs, itemKey, {
+      itemKey,
+      sourceSeq
+    });
+  }
 }
 function rememberStreamingReasoningOutput(state, output) {
   rememberBoundedCacheValue(
@@ -7588,7 +7979,9 @@ function mergeWebSearchQueries(existing, incoming) {
 }
 function codexNotificationTurnId(params) {
   const turn = objectValue(params.turn);
-  return stringValue(turn?.id) ?? stringValue(params.turnId) ?? stringValue(params.turn_id);
+  const item = objectValue(params.item);
+  const itemTurn = objectValue(item?.turn);
+  return stringValue(turn?.id) ?? stringValue(params.turnId) ?? stringValue(params.turn_id) ?? stringValue(item?.turnId) ?? stringValue(item?.turn_id) ?? stringValue(itemTurn?.id);
 }
 function codexNotificationThreadId(params) {
   const thread = objectValue(params.thread);
@@ -7628,11 +8021,58 @@ function inferThreadOnlyCompletedTurnId(args, state, threadId) {
       return void 0;
   }
 }
-function codexNotificationActiveTurnFallback(method, state, params) {
-  if (method !== "response_item" || codexCompletedFileChangeFromNotification(params) === void 0) {
+function codexNotificationActiveTurnFallback(method, state, params, threadId) {
+  if (threadId === void 0 || state.codexThreadId !== threadId) {
     return void 0;
   }
-  return activeTurnId(state.turn);
+  switch (method) {
+    case "response_item":
+      return codexCompletedFileChangeFromNotification(params) === void 0 ? void 0 : activeTurnId(state.turn);
+    case "item/agentMessage/delta":
+    case "item/completed":
+    case "warning":
+    case "error":
+      return activeTurnId(state.turn);
+    default:
+      return void 0;
+  }
+}
+function rememberRecentCodexDiagnostic(state, method, params, threadId, turnId) {
+  switch (method) {
+    case "warning":
+    case "error": {
+      const summary = codexNotificationDiagnosticSummary(method, params) ?? `${method}: seen (no details)`;
+      const cacheKey = [
+        method,
+        threadId ?? "no-thread",
+        turnId ?? "no-turn"
+      ].join(":");
+      if (getBoundedCacheValue(state.recentCodexDiagnostics, cacheKey)) {
+        break;
+      }
+      rememberBoundedCacheValue(state.recentCodexDiagnostics, cacheKey, {
+        method,
+        threadId,
+        turnId,
+        summary
+      });
+      break;
+    }
+    default:
+      break;
+  }
+}
+function recentCodexDiagnosticSummaryForTurn(state, method, threadId, turnId) {
+  return getBoundedCacheValue(
+    state.recentCodexDiagnostics,
+    [method, threadId, turnId].join(":")
+  )?.summary ?? getBoundedCacheValue(
+    state.recentCodexDiagnostics,
+    [method, "no-thread", turnId].join(":")
+  )?.summary ?? getBoundedCacheValue(
+    state.recentCodexDiagnostics,
+    [method, threadId, "no-turn"].join(":")
+  )?.summary;
 }
 function rememberLocalTuiTurnIfNeeded(args, state, threadId, turnId) {
   if (args.options.launchTui !== true || state.codexThreadId !== threadId || state.turn.status !== "idle") {
@@ -7696,6 +8136,35 @@ function forgetPendingCompletedAssistantItemForward(state, turnId, promise) {
     state.pendingCompletedAssistantItemForwards.delete(turnId);
   }
 }
+function rememberPendingCompletedAssistantItemSourceForward(state, sourceMessageSeq, promise) {
+  const existing = state.pendingCompletedAssistantItemSourceForwards.get(sourceMessageSeq);
+  const pending = existing ?? /* @__PURE__ */ new Set();
+  pending.add(promise);
+  state.pendingCompletedAssistantItemSourceForwards.set(
+    sourceMessageSeq,
+    pending
+  );
+  trimBoundedMap(
+    state.pendingCompletedAssistantItemSourceForwards,
+    maxForwardedTurnIds
+  );
+}
+function forgetPendingCompletedAssistantItemSourceForward(state, sourceMessageSeq, promise) {
+  const pending = state.pendingCompletedAssistantItemSourceForwards.get(sourceMessageSeq);
+  if (pending === void 0) {
+    return;
+  }
+  pending.delete(promise);
+  if (pending.size === 0) {
+    state.pendingCompletedAssistantItemSourceForwards.delete(sourceMessageSeq);
+  }
+}
+async function waitForPendingCompletedAssistantItemSourceForwards(state, sourceMessageSeq) {
+  const pending = state.pendingCompletedAssistantItemSourceForwards.get(sourceMessageSeq);
+  if (pending !== void 0) {
+    await Promise.allSettled([...pending]);
+  }
+}
 async function waitForPendingCompletedAssistantItemForwards(state, turnId) {
   const pending = state.pendingCompletedAssistantItemForwards.get(turnId);
   if (pending !== void 0) {
@@ -7746,6 +8215,16 @@ function rememberTurnReplyTarget(state, turnId, replyToSeq) {
 function sourceMessageSeqForTurn(state, turnId) {
   return getBoundedCacheValue(state.turnReplyTargets, turnId)?.replyToSeq;
 }
+function startingSourceMessageSeq(state) {
+  switch (state.turn.status) {
+    case "starting":
+      return state.turn.queuedSeq;
+    case "active":
+    case "completing":
+    case "idle":
+      return void 0;
+  }
+}
 function fileChangePaths(structured) {
   const changes = arrayValue(structured.changes) ?? [];
   return changes.filter(isJsonObject).map((change) => stringValue(change.path) ?? "").filter((path2) => path2.trim() !== "");
@@ -8228,6 +8707,7 @@ var init_channelSession = __esm({
     "use strict";
     init_channelSessionSupport();
     init_commanderAttachments();
+    init_codexNotificationDiagnostics();
     init_codexRuntimeOptions();
     init_codexOutput();
     init_codexSessionLog();
@@ -8986,7 +9466,7 @@ function redactForCliLog(value) {
   return redactObject(value);
 }
 function redactValue(value, key) {
-  if (sensitiveKey(key)) {
+  if (sensitiveKey2(key)) {
     return sensitiveMarker;
   }
   if (typeof value === "string") {
@@ -9011,10 +9491,10 @@ function redactObject(value) {
   );
 }
 function runnerConsolePayload(redacted, original) {
-  const consoleFields = objectValue2(original.runner_console);
+  const consoleFields = objectValue3(original.runner_console);
   return consoleFields === void 0 ? redacted : { ...redacted, ...redactForCliLog(consoleFields) };
 }
-function objectValue2(value) {
+function objectValue3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function redactArgs(args) {
@@ -9043,7 +9523,7 @@ function splitArgAssignment(value) {
   const index = value.indexOf("=");
   return index === -1 ? [value, void 0] : [value.slice(0, index), value.slice(index + 1)];
 }
-function sensitiveKey(key) {
+function sensitiveKey2(key) {
   if (key === void 0) {
     return false;
   }
@@ -9286,10 +9766,15 @@ async function chooseLoopbackPort() {
   });
 }
 async function startCodexAppServer(codexBin, cwd, options = {}) {
+  return startCodexAppServerAttempt(codexBin, cwd, options, 1);
+}
+async function startCodexAppServerAttempt(codexBin, cwd, options, attempt) {
   const port = await chooseLoopbackPort();
   const url = `ws://127.0.0.1:${port}`;
   const args = codexAppServerArgs(url, options);
-  const stdio = codexAppServerStdio(process.stdout.isTTY === true);
+  let stderrText = "";
+  const configuredStdio = codexAppServerStdio(process.stdout.isTTY === true);
+  const stdio = [configuredStdio[0], configuredStdio[1], "pipe"];
   writeCliAuditEvent("process.spawn", {
     command: codexBin,
     args,
@@ -9306,7 +9791,12 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
     drainCodexAppServerOutput(child, "stdout");
   }
   if (stdio[2] === "pipe") {
-    drainCodexAppServerOutput(child, "stderr");
+    drainCodexAppServerOutput(child, "stderr", (chunk) => {
+      stderrText = boundedText(`${stderrText}${chunk}`);
+      if (configuredStdio[2] === "inherit") {
+        process.stderr.write(chunk);
+      }
+    });
   }
   const stop = () => stopCodexAppServerProcess(child);
   writeCliAuditEvent("process.spawned", {
@@ -9337,20 +9827,40 @@ async function startCodexAppServer(codexBin, cwd, options = {}) {
     await waitForReadyz(url, child);
   } catch (error) {
     stop();
+    if (shouldRetryCodexAppServerBindFailure(error, stderrText, attempt)) {
+      writeCliAuditEvent("process.spawn.retry", {
+        command: codexBin,
+        cwd,
+        attempt,
+        reason: "loopback_bind_in_use",
+        purpose: "codex.app_server"
+      });
+      return startCodexAppServerAttempt(codexBin, cwd, options, attempt + 1);
+    }
     throw error;
   }
   return { url, process: child, stop };
 }
+function boundedText(value) {
+  const maxBytes = 12e3;
+  return value.length > maxBytes ? value.slice(value.length - maxBytes) : value;
+}
+function shouldRetryCodexAppServerBindFailure(error, stderrText, attempt) {
+  const maxAttempts = 3;
+  const message = error instanceof Error ? error.message : String(error);
+  return attempt < maxAttempts && message.includes("codex app-server exited before readyz") && stderrText.includes("EADDRINUSE") && stderrText.includes("listen");
+}
 function codexAppServerStdio(stdoutIsTty) {
   return stdoutIsTty ? ["ignore", "pipe", "pipe"] : ["ignore", "inherit", "inherit"];
 }
-function drainCodexAppServerOutput(child, streamName) {
+function drainCodexAppServerOutput(child, streamName, onText = void 0) {
   const stream = child[streamName];
   if (stream === null) {
     return;
   }
   stream.on("data", (chunk) => {
     const text2 = chunk.toString();
+    onText?.(text2);
     writeCliAuditEvent("process.output", {
       pid: child.pid,
       purpose: "codex.app_server",
@@ -9752,14 +10262,17 @@ function codexNotificationConsoleStats(method, params) {
       return {
         rate_limit_summary: rateLimitSummary(params) ?? "seen (no details)"
       };
+    case "warning":
+    case "error":
+      return codexNotificationDiagnosticDetails(method, params);
     default:
       return {};
   }
 }
 function tokenUsageSummary(params) {
-  const usage = objectValue3(params.tokenUsage) ?? objectValue3(params.token_usage) ?? objectValue3(params.usage) ?? params;
-  const total = tokenUsageBreakdownSummary(objectValue3(usage.total)) ?? tokenUsageBreakdownSummary(objectValue3(usage.totalUsage)) ?? tokenUsageBreakdownSummary(objectValue3(usage.total_usage)) ?? tokenUsageBreakdownSummary(objectValue3(params.totalTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue3(params.total_token_usage)) ?? tokenUsageBreakdownSummary(usage);
-  const last = tokenUsageBreakdownSummary(objectValue3(usage.last)) ?? tokenUsageBreakdownSummary(objectValue3(usage.lastUsage)) ?? tokenUsageBreakdownSummary(objectValue3(usage.last_usage)) ?? tokenUsageBreakdownSummary(objectValue3(params.lastTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue3(params.last_token_usage));
+  const usage = objectValue4(params.tokenUsage) ?? objectValue4(params.token_usage) ?? objectValue4(params.usage) ?? params;
+  const total = tokenUsageBreakdownSummary(objectValue4(usage.total)) ?? tokenUsageBreakdownSummary(objectValue4(usage.totalUsage)) ?? tokenUsageBreakdownSummary(objectValue4(usage.total_usage)) ?? tokenUsageBreakdownSummary(objectValue4(params.totalTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue4(params.total_token_usage)) ?? tokenUsageBreakdownSummary(usage);
+  const last = tokenUsageBreakdownSummary(objectValue4(usage.last)) ?? tokenUsageBreakdownSummary(objectValue4(usage.lastUsage)) ?? tokenUsageBreakdownSummary(objectValue4(usage.last_usage)) ?? tokenUsageBreakdownSummary(objectValue4(params.lastTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue4(params.last_token_usage));
   const summary = [
     total === void 0 ? void 0 : `total ${total}`,
     last === void 0 ? void 0 : `last ${last}`
@@ -9770,8 +10283,8 @@ function tokenUsageBreakdownSummary(breakdown) {
   if (breakdown === void 0) {
     return void 0;
   }
-  const inputDetails = objectValue3(breakdown.inputTokensDetails) ?? objectValue3(breakdown.input_tokens_details);
-  const outputDetails = objectValue3(breakdown.outputTokensDetails) ?? objectValue3(breakdown.output_tokens_details);
+  const inputDetails = objectValue4(breakdown.inputTokensDetails) ?? objectValue4(breakdown.input_tokens_details);
+  const outputDetails = objectValue4(breakdown.outputTokensDetails) ?? objectValue4(breakdown.output_tokens_details);
   const input = integerValue2(breakdown.inputTokens) ?? integerValue2(breakdown.input_tokens) ?? integerValue2(breakdown.promptTokens) ?? integerValue2(breakdown.prompt_tokens);
   const output = integerValue2(breakdown.outputTokens) ?? integerValue2(breakdown.output_tokens) ?? integerValue2(breakdown.completionTokens) ?? integerValue2(breakdown.completion_tokens);
   const total = integerValue2(breakdown.totalTokens) ?? integerValue2(breakdown.total_tokens);
@@ -9787,10 +10300,10 @@ function tokenUsageBreakdownSummary(breakdown) {
   return values.length === 0 ? void 0 : values.join(" / ");
 }
 function rateLimitSummary(params) {
-  const rateLimits = objectValue3(params.rateLimits) ?? objectValue3(params.rate_limits) ?? objectValue3(params.limits) ?? params;
+  const rateLimits = objectValue4(params.rateLimits) ?? objectValue4(params.rate_limits) ?? objectValue4(params.limits) ?? params;
   const direct = rateLimitBucketSummary(rateLimits, void 0);
   const children = Object.entries(rateLimits).flatMap(([name, value]) => {
-    const bucket = objectValue3(value);
+    const bucket = objectValue4(value);
     return bucket === void 0 ? [] : [rateLimitBucketSummary(bucket, name)];
   });
   const summaries = [direct, ...children].filter(
@@ -9799,11 +10312,11 @@ function rateLimitSummary(params) {
   return summaries.length === 0 ? void 0 : summaries.join(" | ");
 }
 function rateLimitBucketSummary(bucket, fallbackName) {
-  const name = stringValue2(bucket.limitName) ?? stringValue2(bucket.limit_name) ?? stringValue2(bucket.name) ?? stringValue2(bucket.type) ?? fallbackName;
-  const plan = stringValue2(bucket.planType) ?? stringValue2(bucket.plan_type) ?? stringValue2(bucket.plan);
+  const name = stringValue3(bucket.limitName) ?? stringValue3(bucket.limit_name) ?? stringValue3(bucket.name) ?? stringValue3(bucket.type) ?? fallbackName;
+  const plan = stringValue3(bucket.planType) ?? stringValue3(bucket.plan_type) ?? stringValue3(bucket.plan);
   const remaining = integerValue2(bucket.remaining) ?? integerValue2(bucket.remainingRequests) ?? integerValue2(bucket.remaining_requests) ?? integerValue2(bucket.remainingTokens) ?? integerValue2(bucket.remaining_tokens);
   const limit = integerValue2(bucket.limit) ?? integerValue2(bucket.requestLimit) ?? integerValue2(bucket.request_limit) ?? integerValue2(bucket.limitRequests) ?? integerValue2(bucket.limit_requests) ?? integerValue2(bucket.tokenLimit) ?? integerValue2(bucket.token_limit) ?? integerValue2(bucket.limitTokens) ?? integerValue2(bucket.limit_tokens);
-  const reset = stringValue2(bucket.resetAt) ?? stringValue2(bucket.reset_at) ?? stringValue2(bucket.resetsAt) ?? stringValue2(bucket.resets_at) ?? unixTimestampValue(bucket.resetsAt) ?? unixTimestampValue(bucket.resets_at) ?? secondsValue(bucket.resetAfterSeconds) ?? secondsValue(bucket.reset_after_seconds) ?? secondsValue(bucket.retryAfterSeconds) ?? secondsValue(bucket.retry_after_seconds);
+  const reset = stringValue3(bucket.resetAt) ?? stringValue3(bucket.reset_at) ?? stringValue3(bucket.resetsAt) ?? stringValue3(bucket.resets_at) ?? unixTimestampValue(bucket.resetsAt) ?? unixTimestampValue(bucket.resets_at) ?? secondsValue(bucket.resetAfterSeconds) ?? secondsValue(bucket.reset_after_seconds) ?? secondsValue(bucket.retryAfterSeconds) ?? secondsValue(bucket.retry_after_seconds);
   const usedPercent = integerValue2(bucket.usedPercent) ?? integerValue2(bucket.used_percent);
   const windowDurationMins = integerValue2(bucket.windowDurationMins) ?? integerValue2(bucket.window_duration_mins);
   const label = [name, plan].filter((value) => value !== void 0).join(" ");
@@ -9830,10 +10343,10 @@ function unixTimestampValue(value) {
   const seconds = integerValue2(value);
   return seconds === void 0 ? void 0 : new Date(seconds * 1e3).toISOString();
 }
-function objectValue3(value) {
+function objectValue4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function stringValue2(value) {
+function stringValue3(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function integerValue2(value) {
@@ -9849,6 +10362,7 @@ function integerValue2(value) {
 var init_codexNotificationConsoleStats = __esm({
   "src/codexNotificationConsoleStats.ts"() {
     "use strict";
+    init_codexNotificationDiagnostics();
     init_protocol();
   }
 });
@@ -9895,13 +10409,17 @@ function assertConfiguredAllowedCwds(paths) {
 }
 function expandUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir6();
+    return currentHomeDirectory();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve3(homedir6(), pathValue.slice(2));
+    return resolve3(currentHomeDirectory(), pathValue.slice(2));
   }
   return pathValue;
 }
+function currentHomeDirectory() {
+  const configuredHome = process.env.HOME;
+  return configuredHome === void 0 || configuredHome.trim() === "" ? homedir6() : configuredHome;
+}
 function resolveAllowedCwd(requestedCwd, allowedRoots) {
   if (requestedCwd === void 0 || requestedCwd.trim() === "") {
     return { ok: false, reason: "missing_cwd" };
@@ -13321,7 +13839,8 @@ var init_dependencyStatus = __esm({
 });
 
 // src/phoenix.ts
-function phoenixWebsocketUrl(baseUrl, token) {
+import { Buffer as Buffer3 } from "node:buffer";
+function phoenixWebsocketUrl(baseUrl) {
   const parsed = new URL(baseUrl);
   switch (parsed.protocol) {
     case "http:":
@@ -13332,11 +13851,18 @@ function phoenixWebsocketUrl(baseUrl, token) {
       break;
   }
   parsed.pathname = parsed.pathname.replace(/\/$/, "") + "/socket/websocket";
-  parsed.searchParams.set("token", token);
   parsed.searchParams.set("vsn", "2.0.0");
   return parsed.toString();
 }
-async function connectPhoenixClient(baseUrl, token, socketFactory = (url) => new WebSocket(url), options = {}) {
+function phoenixWebsocketProtocols(token) {
+  return [
+    `${phoenixAuthTokenProtocolPrefix}${Buffer3.from(token, "utf8").toString(
+      "base64url"
+    )}`,
+    "phoenix"
+  ];
+}
+async function connectPhoenixClient(baseUrl, token, socketFactory = (url, protocols) => new WebSocket(url, protocols), options = {}) {
   const pending = /* @__PURE__ */ new Map();
   const joins = /* @__PURE__ */ new Map();
   const controlCallbacks = /* @__PURE__ */ new Set();
@@ -13475,7 +14001,10 @@ async function connectPhoenixClient(baseUrl, token, socketFactory = (url) => new
     if (state.closed) {
       return;
     }
-    const websocket = socketFactory(phoenixWebsocketUrl(baseUrl, token));
+    const websocket = socketFactory(
+      phoenixWebsocketUrl(baseUrl),
+      phoenixWebsocketProtocols(token)
+    );
     state.websocket = websocket;
     websocket.addEventListener("message", handleMessage);
     websocket.addEventListener(
@@ -13613,12 +14142,13 @@ function waitForOpen2(websocket) {
     );
   });
 }
-var defaultPushTimeoutMs;
+var defaultPushTimeoutMs, phoenixAuthTokenProtocolPrefix;
 var init_phoenix = __esm({
   "src/phoenix.ts"() {
     "use strict";
     init_protocol();
     defaultPushTimeoutMs = 3e4;
+    phoenixAuthTokenProtocolPrefix = "base64url.bearer.phx.";
   }
 });
 
@@ -13627,7 +14157,7 @@ var linzumiCliVersion, linzumiCliVersionText;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    linzumiCliVersion = "0.0.73-beta";
+    linzumiCliVersion = "0.0.74-beta";
     linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
   }
 });
@@ -13939,9 +14469,10 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     case "kandan.message_queued":
     case "codex.turn_starting": {
       const job = dashboardJobForPayload(state, payload, nowMs);
-      job.linzumiThreadId = stringValue3(payload.linzumi_thread_id) ?? job.linzumiThreadId;
-      job.codexThreadId = stringValue3(payload.codex_thread_id) ?? job.codexThreadId;
-      job.lastIncomingPreview = stringValue3(payload.body_preview) ?? job.lastIncomingPreview;
+      job.linzumiThreadId = stringValue4(payload.linzumi_thread_id) ?? job.linzumiThreadId;
+      job.linzumiThreadTitle = dashboardLinzumiThreadTitle(payload) ?? job.linzumiThreadTitle;
+      job.codexThreadId = stringValue4(payload.codex_thread_id) ?? job.codexThreadId;
+      job.lastIncomingPreview = stringValue4(payload.body_preview) ?? job.lastIncomingPreview;
       job.lastIncomingAtMs = numberValue(payload.message_received_at_ms) ?? job.lastIncomingAtMs;
       job.queueDepth = numberValue(payload.queue_depth) ?? job.queueDepth;
       job.eventType = dashboardEventLabel(event);
@@ -13949,28 +14480,28 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
       break;
     }
     case "codex.notification": {
-      const tokenUsage = stringValue3(payload.token_usage_summary);
-      const rateLimit = stringValue3(payload.rate_limit_summary);
+      const tokenUsage = stringValue4(payload.token_usage_summary);
+      const rateLimit = stringValue4(payload.rate_limit_summary);
       if (tokenUsage !== void 0) {
         state.tokenUsage = tokenUsage;
       }
       if (rateLimit !== void 0) {
         state.rateLimit = mergeRateLimitSummary(state.rateLimit, rateLimit);
       }
-      const method = stringValue3(payload.method);
-      const metadata = objectValue4(payload.metadata);
-      const metadataHasJobSignal = stringValue3(metadata?.threadId) !== void 0 || stringValue3(metadata?.turnId) !== void 0 || stringValue3(metadata?.itemId) !== void 0;
+      const method = stringValue4(payload.method);
+      const metadata = objectValue5(payload.metadata);
+      const metadataHasJobSignal = stringValue4(metadata?.threadId) !== void 0 || stringValue4(metadata?.turnId) !== void 0 || stringValue4(metadata?.itemId) !== void 0;
       if (!metadataHasJobSignal) {
         break;
       }
-      const codexThreadId = stringValue3(metadata?.threadId);
+      const codexThreadId = stringValue4(metadata?.threadId);
       const job = codexThreadId === void 0 ? latestDashboardJob(state) : dashboardJobForKey(state, `codex:${codexThreadId}`, nowMs);
       if (job !== void 0) {
         job.codexThreadId = codexThreadId ?? job.codexThreadId;
         job.tokenUsage = tokenUsage ?? job.tokenUsage;
         job.latestCodexEventId = codexEventId(payload);
         job.eventType = method ?? event;
-        job.turnId = stringValue3(metadata?.turnId) ?? job.turnId;
+        job.turnId = stringValue4(metadata?.turnId) ?? job.turnId;
         job.updatedAtMs = nowMs;
       }
       break;
@@ -13982,11 +14513,11 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     case "kandan.codex_file_change_forwarded":
     case "kandan.codex_web_search_progress_forwarded": {
       const job = dashboardJobForPayload(state, payload, nowMs);
-      job.latestCodexEventId = stringValue3(payload.item_key) ?? job.latestCodexEventId;
+      job.latestCodexEventId = stringValue4(payload.item_key) ?? job.latestCodexEventId;
       job.eventType = codexOutputDashboardLabel(event, payload);
-      job.turnId = stringValue3(payload.turn_id) ?? job.turnId;
-      if (stringValue3(payload.structured_kind) === "codex_assistant_message") {
-        job.lastAssistantPreview = stringValue3(payload.body_preview) ?? job.lastAssistantPreview;
+      job.turnId = stringValue4(payload.turn_id) ?? job.turnId;
+      if (stringValue4(payload.structured_kind) === "codex_assistant_message") {
+        job.lastAssistantPreview = stringValue4(payload.body_preview) ?? job.lastAssistantPreview;
         job.lastAssistantAtMs = nowMs;
       }
       job.updatedAtMs = nowMs;
@@ -14001,9 +14532,7 @@ function renderRunnerConsoleDashboard(state, nowMs) {
   if (state.jobs.size === 0 && state.tokenUsage === void 0 && state.rateLimit === void 0) {
     return void 0;
   }
-  const jobs = Array.from(state.jobs.values()).sort(
-    (left, right) => right.updatedAtMs - left.updatedAtMs
-  );
+  const jobs = dashboardJobs(state);
   switch (state.mode.type) {
     case "table":
       return renderDashboardTable(state, jobs, nowMs);
@@ -14111,8 +14640,9 @@ function formatRunnerConsoleEvent(event, payload) {
       return `Codex turn started: id=${text(payload.turn_id)}`;
     case "codex.notification": {
       const summary = [
-        stringValue3(payload.token_usage_summary),
-        stringValue3(payload.rate_limit_summary)
+        stringValue4(payload.token_usage_summary),
+        stringValue4(payload.rate_limit_summary),
+        stringValue4(payload.diagnostic_summary)
       ].filter((value) => value !== void 0).join(" | ");
       const suffix = summary === "" ? "" : ` ${summary}`;
       return `Codex event [id=${codexEventId(payload)}]: ${text(payload.method)}${suffix}`;
@@ -14149,11 +14679,11 @@ function connectedRunnerMessage(payload) {
   ].filter((line) => line !== void 0).join("\n");
 }
 function optionalLine(label, value) {
-  const normalized = stringValue3(value) ?? numberValue(value)?.toString();
+  const normalized = stringValue4(value) ?? numberValue(value)?.toString();
   return normalized === void 0 ? void 0 : `${label}: ${normalized}`;
 }
 function optionalField(label, value) {
-  const normalized = stringValue3(value) ?? numberValue(value)?.toString();
+  const normalized = stringValue4(value) ?? numberValue(value)?.toString();
   return normalized === void 0 ? void 0 : `${label}=${normalized}`;
 }
 function ignoredMessage(payload) {
@@ -14177,17 +14707,17 @@ function replacementLines(value) {
       return [];
     }
     const record = entry;
-    const runnerId = stringValue3(record.runnerId);
+    const runnerId = stringValue4(record.runnerId);
     if (runnerId === void 0) {
       return [];
     }
-    const version = stringValue3(record.version);
+    const version = stringValue4(record.version);
     const suffix = version === void 0 ? "" : ` (CLI ${version})`;
     return [`Replaced older runner from this machine: ${runnerId}${suffix}`];
   });
 }
 function sender(payload) {
-  const slug = stringValue3(payload.actor_slug);
+  const slug = stringValue4(payload.actor_slug);
   const userId = numberValue(payload.actor_user_id);
   if (slug !== void 0 && userId !== void 0) {
     return `${slug}#${userId}`;
@@ -14195,7 +14725,7 @@ function sender(payload) {
   return slug ?? (userId === void 0 ? "unknown" : `user#${userId}`);
 }
 function codexOutputLabel(payload) {
-  const kind = stringValue3(payload.structured_kind) ?? "output";
+  const kind = stringValue4(payload.structured_kind) ?? "output";
   switch (kind) {
     case "codex_assistant_message":
       return "assistant_message";
@@ -14221,7 +14751,7 @@ function codexEventId(payload) {
   const metadata = payload.metadata;
   if (typeof metadata === "object" && metadata !== null && !Array.isArray(metadata)) {
     const record = metadata;
-    return stringValue3(record.turnId) ?? stringValue3(record.itemId) ?? stringValue3(record.threadId) ?? "?";
+    return stringValue4(record.turnId) ?? stringValue4(record.itemId) ?? stringValue4(record.threadId) ?? "?";
   }
   return "?";
 }
@@ -14237,8 +14767,8 @@ function rememberRawLine(state, event, payload, previousJobKey) {
   }
 }
 function dashboardRawLineJobKey(state, payload, previousJobKey) {
-  const linzumiThreadId = stringValue3(payload.linzumi_thread_id);
-  const codexThreadId = stringValue3(payload.codex_thread_id);
+  const linzumiThreadId = stringValue4(payload.linzumi_thread_id);
+  const codexThreadId = stringValue4(payload.codex_thread_id);
   if (linzumiThreadId !== void 0) {
     return `linzumi:${linzumiThreadId}`;
   }
@@ -14247,8 +14777,8 @@ function dashboardRawLineJobKey(state, payload, previousJobKey) {
       (job) => job.codexThreadId === codexThreadId
     )?.key;
   }
-  const metadata = objectValue4(payload.metadata);
-  const metadataCodexThreadId = stringValue3(metadata?.threadId);
+  const metadata = objectValue5(payload.metadata);
+  const metadataCodexThreadId = stringValue4(metadata?.threadId);
   if (metadataCodexThreadId !== void 0) {
     return Array.from(state.jobs.values()).find(
       (job) => job.codexThreadId === metadataCodexThreadId
@@ -14299,9 +14829,32 @@ function rawDashboardModel(state, mode) {
   }
 }
 function dashboardJobs(state) {
-  return Array.from(state.jobs.values()).sort(
-    (left, right) => right.updatedAtMs - left.updatedAtMs
-  );
+  return Array.from(state.jobs.values()).sort(compareDashboardJobsByCreated);
+}
+function dashboardJobsByUpdatedAt(state) {
+  return Array.from(state.jobs.values()).sort((left, right) => {
+    const updated = right.updatedAtMs - left.updatedAtMs;
+    if (updated !== 0) {
+      return updated;
+    }
+    return compareDashboardJobsByCreated(left, right);
+  });
+}
+function compareDashboardJobsByCreated(left, right) {
+  const created = right.createdAtMs - left.createdAtMs;
+  if (created !== 0) {
+    return created;
+  }
+  const ordinal = right.createdOrdinal - left.createdOrdinal;
+  if (ordinal !== 0) {
+    return ordinal;
+  }
+  return left.key.localeCompare(right.key);
+}
+function nextDashboardJobOrdinal(state) {
+  const ordinal = state.nextJobOrdinal;
+  state.nextJobOrdinal = state.nextJobOrdinal + 1;
+  return ordinal;
 }
 function selectDashboardJobAtVisibleIndex(state, index) {
   const jobs = dashboardJobs(state);
@@ -14620,8 +15173,8 @@ function updateRunnerConsoleDashboardMode(state, key) {
   }
 }
 function dashboardJobForPayload(state, payload, nowMs) {
-  const linzumiThreadId = stringValue3(payload.linzumi_thread_id);
-  const codexThreadId = stringValue3(payload.codex_thread_id);
+  const linzumiThreadId = stringValue4(payload.linzumi_thread_id);
+  const codexThreadId = stringValue4(payload.codex_thread_id);
   const existingByCodex = codexThreadId !== void 0 ? Array.from(state.jobs.values()).find(
     (job) => job.codexThreadId === codexThreadId
   ) : void 0;
@@ -14635,7 +15188,10 @@ function dashboardJobForPayload(state, payload, nowMs) {
   }
   const created = {
     key,
+    createdAtMs: numberValue(payload.message_received_at_ms) ?? nowMs,
+    createdOrdinal: nextDashboardJobOrdinal(state),
     linzumiThreadId,
+    linzumiThreadTitle: dashboardLinzumiThreadTitle(payload),
     codexThreadId,
     tokenUsage: void 0,
     lastIncomingPreview: void 0,
@@ -14694,7 +15250,10 @@ function dashboardJobForKey(state, key, nowMs) {
   }
   const created = {
     key,
+    createdAtMs: nowMs,
+    createdOrdinal: nextDashboardJobOrdinal(state),
     linzumiThreadId: void 0,
+    linzumiThreadTitle: void 0,
     codexThreadId: key.startsWith("codex:") ? key.slice("codex:".length) : void 0,
     tokenUsage: void 0,
     lastIncomingPreview: void 0,
@@ -14711,14 +15270,12 @@ function dashboardJobForKey(state, key, nowMs) {
   return created;
 }
 function latestDashboardJob(state) {
-  return Array.from(state.jobs.values()).sort(
-    (left, right) => right.updatedAtMs - left.updatedAtMs
-  )[0];
+  return dashboardJobsByUpdatedAt(state)[0];
 }
 function jobRow(job, selectedJobKey, nowMs) {
   return [
     job.key === selectedJobKey ? ">" : " ",
-    shortId(job.linzumiThreadId),
+    linzumiThreadLabel(job),
     agentId(job.codexThreadId),
     truncate(job.lastIncomingPreview ?? "?", 50),
     timeAgo(job.lastIncomingAtMs, nowMs),
@@ -14779,6 +15336,15 @@ function displayWidth(value) {
 function shortId(value) {
   return value === void 0 ? "?" : truncate(value, 18);
 }
+function linzumiThreadLabel(job) {
+  if (job.linzumiThreadTitle === void 0) {
+    return shortId(job.linzumiThreadId);
+  }
+  return firstN(job.linzumiThreadTitle, 30);
+}
+function dashboardLinzumiThreadTitle(payload) {
+  return stringValue4(payload.linzumi_thread_title) ?? stringValue4(payload.thread_title) ?? stringValue4(payload.threadTitle) ?? stringValue4(payload.title);
+}
 function agentId(codexThreadId) {
   if (codexThreadId === void 0) {
     return "?";
@@ -14794,6 +15360,9 @@ function truncate(value, maxLength) {
   }
   return `${value.slice(0, Math.max(0, maxLength - 3))}...`;
 }
+function firstN(value, maxLength) {
+  return value.length <= maxLength ? value : value.slice(0, maxLength);
+}
 function lastFour(value) {
   if (value === void 0) {
     return "?";
@@ -14817,13 +15386,13 @@ function timeAgo(valueMs, nowMs) {
   }
   return `${Math.floor(minutes / 60)}h`;
 }
-function objectValue4(value) {
+function objectValue5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function text(value) {
-  return stringValue3(value) ?? numberValue(value)?.toString() ?? "?";
+  return stringValue4(value) ?? numberValue(value)?.toString() ?? "?";
 }
-function stringValue3(value) {
+function stringValue4(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function numberValue(value) {
@@ -14836,6 +15405,7 @@ var init_runnerConsoleReporter = __esm({
     dashboardState = {
       jobs: /* @__PURE__ */ new Map(),
       rawLines: [],
+      nextJobOrdinal: 0,
       mode: { type: "table" },
       selectedJobKey: void 0,
       tokenUsage: void 0,
@@ -14850,7 +15420,7 @@ var init_runnerConsoleReporter = __esm({
     downKey = "\x1B[B";
     dashboardTableColumns = [
       { width: 1 },
-      { width: 20 },
+      { width: 30 },
       { width: 16 },
       { width: 38 },
       { width: 6 },
@@ -15579,8 +16149,8 @@ import {
   statSync
 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { homedir as homedir10, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname9, join as join14, resolve as resolve7 } from "node:path";
+import { hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join14, resolve as resolve7 } from "node:path";
 async function runLocalCodexRunner(options) {
   const log = makeRunnerLogger(options);
   const cleanup = {
@@ -16743,6 +17313,11 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
     }
     const spawnThreadRunner = options.spawnThreadRunner ?? spawnLocalThreadRunnerProcess;
     const readyTimeoutMs = threadRunnerReadyTimeoutMs(options);
+    log("runner.thread_process_starting", {
+      kandanThreadId,
+      cwd,
+      readyTimeoutMs
+    });
     const startingEntry = {
       kind: "starting",
       promise: withThreadRunnerReadyTimeout(
@@ -16770,6 +17345,11 @@ async function openLocalCodexRunner(options, log, cleanup, close) {
       if (threadRunnerProcesses.get(kandanThreadId) === startingEntry) {
         threadRunnerProcesses.delete(kandanThreadId);
       }
+      log("runner.thread_process_start_failed", {
+        kandanThreadId,
+        cwd,
+        message: error instanceof Error ? error.message : String(error)
+      });
       throw error;
     }
     for (const port of handle.commanderManagedPorts ?? []) {
@@ -17538,6 +18118,11 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
       }
       const agentProvider = agentProviderResult.provider;
       if (!cwd.ok) {
+        log("kandan.start_instance_cwd_rejected", {
+          thread_id: controlThreadId(control) ?? null,
+          reason: cwd.reason,
+          allowedCwdCount: allowedCwds.value.length
+        });
         try {
           await publishStartInstanceCwdFailureMessageState(
             kandan,
@@ -19757,13 +20342,8 @@ async function closeThreadRunnerEntry(entry) {
   }
 }
 async function spawnLocalThreadRunnerProcess(options) {
-  const scriptPath = process.argv[1];
+  const scriptPath = threadRunnerScriptPath(process.argv[1], process.cwd());
   const kandanThreadId = options.threadProcess?.kandanThreadId ?? "";
-  if (scriptPath === void 0 || scriptPath.trim() === "") {
-    throw new Error(
-      "cannot fork thread runner without current CLI script path"
-    );
-  }
   const args = ["run", ...threadRunnerCliArgs(options)];
   const nodeArgs = threadRunnerNodeArgs(scriptPath, args);
   const redactedNodeArgs = threadRunnerNodeArgs(
@@ -19891,6 +20471,14 @@ async function spawnLocalThreadRunnerProcess(options) {
 function threadRunnerNodeArgs(scriptPath, args) {
   return [...threadRunnerLoaderExecArgv(process.execArgv), scriptPath, ...args];
 }
+function threadRunnerScriptPath(scriptPath, cwd) {
+  if (scriptPath === void 0 || scriptPath.trim() === "") {
+    throw new Error(
+      "cannot fork thread runner without current CLI script path"
+    );
+  }
+  return isAbsolute3(scriptPath) ? scriptPath : resolve7(cwd, scriptPath);
+}
 function threadRunnerLoaderExecArgv(execArgv, index = 0) {
   const current = execArgv[index];
   if (current === void 0) {
@@ -20269,7 +20857,7 @@ function isGitProjectDirectory(cwd) {
 }
 function browseRunnerDirectory(control, options) {
   const requestId = stringValue(control.requestId) ?? null;
-  const requestedPath = stringValue(control.path) ?? homedir10();
+  const requestedPath = stringValue(control.path) ?? currentHomeDirectory();
   try {
     const currentPath = realpathSync5(resolve7(expandUserPath(requestedPath)));
     const stats = statSync(currentPath);
@@ -20300,7 +20888,7 @@ function browseRunnerDirectory(control, options) {
       ok: true,
       currentPath,
       parentPath: parent === currentPath ? null : parent,
-      homePath: homedir10(),
+      homePath: currentHomeDirectory(),
       runnerCwd: resolve7(options.cwd),
       entries,
       isGit: isGitProjectDirectory(currentPath)
@@ -20353,7 +20941,7 @@ function createRunnerProject(control, options, allowedCwds) {
       error: "invalid_project_template"
     };
   }
-  const projectsRoot = join14(homedir10(), "linzumi");
+  const projectsRoot = join14(currentHomeDirectory(), "linzumi");
   const resolvedProjectDirName = template === "hello_linzumi_demo" ? availableProjectDirectoryName(projectsRoot, projectDirName) : projectDirName;
   const projectPath = join14(projectsRoot, resolvedProjectDirName);
   let createdProjectPath = false;
@@ -20380,16 +20968,18 @@ function createRunnerProject(control, options, allowedCwds) {
     }
     const git = spawnSync4("git", ["init"], {
       cwd: projectPath,
-      encoding: "utf8"
+      encoding: "utf8",
+      env: process.env
     });
     if (git.status !== 0) {
       const cleanupError = removeCreatedProjectDirectory(projectPath);
+      const gitFailure = git.error instanceof Error ? git.error.message : git.stderr || git.stdout || git.status;
       return {
         instanceId: options.runnerId,
         controlType: control.type,
         requestId,
         ok: false,
-        error: cleanupError === void 0 ? `git_init_failed:${git.stderr || git.stdout || git.status}` : `git_init_cleanup_failed:${cleanupError}`
+        error: cleanupError === void 0 ? `git_init_failed:${gitFailure}` : `git_init_cleanup_failed:${cleanupError}`
       };
     }
     const projectRealPath = realpathSync5(projectPath);
@@ -20569,9 +21159,12 @@ function trustedWebSocketFactory(trust, WebSocketImpl = WsWebSocket) {
   if (trust === void 0) {
     return void 0;
   }
-  return (url) => new WebSocketImpl(url, {
-    ca: trust.ca
-  });
+  return (url, protocols) => {
+    const options = {
+      ca: trust.ca
+    };
+    return protocols === void 0 ? new WebSocketImpl(url, options) : new WebSocketImpl(url, protocols, options);
+  };
 }
 var init_kandanTls = __esm({
   "src/kandanTls.ts"() {
@@ -35491,7 +36084,7 @@ var require_safer = __commonJS({
   "../../node_modules/safer-buffer/safer.js"(exports, module) {
     "use strict";
     var buffer = __require("buffer");
-    var Buffer3 = buffer.Buffer;
+    var Buffer4 = buffer.Buffer;
     var safer = {};
     var key;
     for (key in buffer) {
@@ -35500,12 +36093,12 @@ var require_safer = __commonJS({
       safer[key] = buffer[key];
     }
     var Safer = safer.Buffer = {};
-    for (key in Buffer3) {
-      if (!Buffer3.hasOwnProperty(key)) continue;
+    for (key in Buffer4) {
+      if (!Buffer4.hasOwnProperty(key)) continue;
       if (key === "allocUnsafe" || key === "allocUnsafeSlow") continue;
-      Safer[key] = Buffer3[key];
+      Safer[key] = Buffer4[key];
     }
-    safer.Buffer.prototype = Buffer3.prototype;
+    safer.Buffer.prototype = Buffer4.prototype;
     if (!Safer.from || Safer.from === Uint8Array.from) {
       Safer.from = function(value, encodingOrOffset, length) {
         if (typeof value === "number") {
@@ -35514,7 +36107,7 @@ var require_safer = __commonJS({
         if (value && typeof value.length === "undefined") {
           throw new TypeError("The first argument must be one of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type " + typeof value);
         }
-        return Buffer3(value, encodingOrOffset, length);
+        return Buffer4(value, encodingOrOffset, length);
       };
     }
     if (!Safer.alloc) {
@@ -35525,7 +36118,7 @@ var require_safer = __commonJS({
         if (size < 0 || size >= 2 * (1 << 30)) {
           throw new RangeError('The value "' + size + '" is invalid for option "size"');
         }
-        var buf = Buffer3(size);
+        var buf = Buffer4(size);
         if (!fill || fill.length === 0) {
           buf.fill(0);
         } else if (typeof encoding === "string") {
@@ -35620,7 +36213,7 @@ var require_merge_exports = __commonJS({
 var require_internal = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/internal.js"(exports, module) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     module.exports = {
       // Encodings
       utf8: { type: "_internal", bomAware: true },
@@ -35644,7 +36237,7 @@ var require_internal = __commonJS({
       } else if (this.enc === "cesu8") {
         this.enc = "utf8";
         this.encoder = InternalEncoderCesu8;
-        if (Buffer3.from("eda0bdedb2a9", "hex").toString() !== "\u{1F4A9}") {
+        if (Buffer4.from("eda0bdedb2a9", "hex").toString() !== "\u{1F4A9}") {
           this.decoder = InternalDecoderCesu8;
           this.defaultCharUnicode = iconv2.defaultCharUnicode;
         }
@@ -35657,8 +36250,8 @@ var require_internal = __commonJS({
       this.decoder = new StringDecoder(codec.enc);
     }
     InternalDecoder.prototype.write = function(buf) {
-      if (!Buffer3.isBuffer(buf)) {
-        buf = Buffer3.from(buf);
+      if (!Buffer4.isBuffer(buf)) {
+        buf = Buffer4.from(buf);
       }
       return this.decoder.write(buf);
     };
@@ -35669,7 +36262,7 @@ var require_internal = __commonJS({
       this.enc = codec.enc;
     }
     InternalEncoder.prototype.write = function(str) {
-      return Buffer3.from(str, this.enc);
+      return Buffer4.from(str, this.enc);
     };
     InternalEncoder.prototype.end = function() {
     };
@@ -35681,15 +36274,15 @@ var require_internal = __commonJS({
       var completeQuads = str.length - str.length % 4;
       this.prevStr = str.slice(completeQuads);
       str = str.slice(0, completeQuads);
-      return Buffer3.from(str, "base64");
+      return Buffer4.from(str, "base64");
     };
     InternalEncoderBase64.prototype.end = function() {
-      return Buffer3.from(this.prevStr, "base64");
+      return Buffer4.from(this.prevStr, "base64");
     };
     function InternalEncoderCesu8(options, codec) {
     }
     InternalEncoderCesu8.prototype.write = function(str) {
-      var buf = Buffer3.alloc(str.length * 3);
+      var buf = Buffer4.alloc(str.length * 3);
       var bufIdx = 0;
       for (var i = 0; i < str.length; i++) {
         var charCode = str.charCodeAt(i);
@@ -35785,13 +36378,13 @@ var require_internal = __commonJS({
           str = str.slice(0, str.length - 1);
         }
       }
-      return Buffer3.from(str, this.enc);
+      return Buffer4.from(str, this.enc);
     };
     InternalEncoderUtf8.prototype.end = function() {
       if (this.highSurrogate) {
         var str = this.highSurrogate;
         this.highSurrogate = "";
-        return Buffer3.from(str, this.enc);
+        return Buffer4.from(str, this.enc);
       }
     };
   }
@@ -35801,7 +36394,7 @@ var require_internal = __commonJS({
 var require_utf32 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/utf32.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports._utf32 = Utf32Codec;
     function Utf32Codec(codecOptions, iconv2) {
       this.iconv = iconv2;
@@ -35819,8 +36412,8 @@ var require_utf32 = __commonJS({
       this.highSurrogate = 0;
     }
     Utf32Encoder.prototype.write = function(str) {
-      var src = Buffer3.from(str, "ucs2");
-      var dst = Buffer3.alloc(src.length * 2);
+      var src = Buffer4.from(str, "ucs2");
+      var dst = Buffer4.alloc(src.length * 2);
       var write32 = this.isLE ? dst.writeUInt32LE : dst.writeUInt32BE;
       var offset = 0;
       for (var i = 0; i < src.length; i += 2) {
@@ -35856,7 +36449,7 @@ var require_utf32 = __commonJS({
       if (!this.highSurrogate) {
         return;
       }
-      var buf = Buffer3.alloc(4);
+      var buf = Buffer4.alloc(4);
       if (this.isLE) {
         buf.writeUInt32LE(this.highSurrogate, 0);
       } else {
@@ -35876,7 +36469,7 @@ var require_utf32 = __commonJS({
       }
       var i = 0;
       var codepoint = 0;
-      var dst = Buffer3.alloc(src.length + 4);
+      var dst = Buffer4.alloc(src.length + 4);
       var offset = 0;
       var isLE = this.isLE;
       var overflow = this.overflow;
@@ -36032,7 +36625,7 @@ var require_utf32 = __commonJS({
 var require_utf16 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/utf16.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports.utf16be = Utf16BECodec;
     function Utf16BECodec() {
     }
@@ -36042,7 +36635,7 @@ var require_utf16 = __commonJS({
     function Utf16BEEncoder() {
     }
     Utf16BEEncoder.prototype.write = function(str) {
-      var buf = Buffer3.from(str, "ucs2");
+      var buf = Buffer4.from(str, "ucs2");
       for (var i = 0; i < buf.length; i += 2) {
         var tmp = buf[i];
         buf[i] = buf[i + 1];
@@ -36059,7 +36652,7 @@ var require_utf16 = __commonJS({
       if (buf.length == 0) {
         return "";
       }
-      var buf2 = Buffer3.alloc(buf.length + 1);
+      var buf2 = Buffer4.alloc(buf.length + 1);
       var i = 0;
       var j = 0;
       if (this.overflowByte !== -1) {
@@ -36175,7 +36768,7 @@ var require_utf16 = __commonJS({
 var require_utf7 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/utf7.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports.utf7 = Utf7Codec;
     exports.unicode11utf7 = "utf7";
     function Utf7Codec(codecOptions, iconv2) {
@@ -36189,7 +36782,7 @@ var require_utf7 = __commonJS({
       this.iconv = codec.iconv;
     }
     Utf7Encoder.prototype.write = function(str) {
-      return Buffer3.from(str.replace(nonDirectChars, function(chunk) {
+      return Buffer4.from(str.replace(nonDirectChars, function(chunk) {
         return "+" + (chunk === "+" ? "" : this.iconv.encode(chunk, "utf16-be").toString("base64").replace(/=+$/, "")) + "-";
       }.bind(this)));
     };
@@ -36227,7 +36820,7 @@ var require_utf7 = __commonJS({
               res += "+";
             } else {
               var b64str = base64Accum + this.iconv.decode(buf.slice(lastI, i2), "ascii");
-              res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+              res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
             }
             if (buf[i2] != minusChar) {
               i2--;
@@ -36245,7 +36838,7 @@ var require_utf7 = __commonJS({
         var canBeDecoded = b64str.length - b64str.length % 8;
         base64Accum = b64str.slice(canBeDecoded);
         b64str = b64str.slice(0, canBeDecoded);
-        res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+        res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
       }
       this.inBase64 = inBase64;
       this.base64Accum = base64Accum;
@@ -36254,7 +36847,7 @@ var require_utf7 = __commonJS({
     Utf7Decoder.prototype.end = function() {
       var res = "";
       if (this.inBase64 && this.base64Accum.length > 0) {
-        res = this.iconv.decode(Buffer3.from(this.base64Accum, "base64"), "utf16-be");
+        res = this.iconv.decode(Buffer4.from(this.base64Accum, "base64"), "utf16-be");
       }
       this.inBase64 = false;
       this.base64Accum = "";
@@ -36270,14 +36863,14 @@ var require_utf7 = __commonJS({
     function Utf7IMAPEncoder(options, codec) {
       this.iconv = codec.iconv;
       this.inBase64 = false;
-      this.base64Accum = Buffer3.alloc(6);
+      this.base64Accum = Buffer4.alloc(6);
       this.base64AccumIdx = 0;
     }
     Utf7IMAPEncoder.prototype.write = function(str) {
       var inBase64 = this.inBase64;
       var base64Accum = this.base64Accum;
       var base64AccumIdx = this.base64AccumIdx;
-      var buf = Buffer3.alloc(str.length * 5 + 10);
+      var buf = Buffer4.alloc(str.length * 5 + 10);
       var bufIdx = 0;
       for (var i2 = 0; i2 < str.length; i2++) {
         var uChar = str.charCodeAt(i2);
@@ -36316,7 +36909,7 @@ var require_utf7 = __commonJS({
       return buf.slice(0, bufIdx);
     };
     Utf7IMAPEncoder.prototype.end = function() {
-      var buf = Buffer3.alloc(10);
+      var buf = Buffer4.alloc(10);
       var bufIdx = 0;
       if (this.inBase64) {
         if (this.base64AccumIdx > 0) {
@@ -36353,7 +36946,7 @@ var require_utf7 = __commonJS({
               res += "&";
             } else {
               var b64str = base64Accum + this.iconv.decode(buf.slice(lastI, i2), "ascii").replace(/,/g, "/");
-              res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+              res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
             }
             if (buf[i2] != minusChar) {
               i2--;
@@ -36371,7 +36964,7 @@ var require_utf7 = __commonJS({
         var canBeDecoded = b64str.length - b64str.length % 8;
         base64Accum = b64str.slice(canBeDecoded);
         b64str = b64str.slice(0, canBeDecoded);
-        res += this.iconv.decode(Buffer3.from(b64str, "base64"), "utf16-be");
+        res += this.iconv.decode(Buffer4.from(b64str, "base64"), "utf16-be");
       }
       this.inBase64 = inBase64;
       this.base64Accum = base64Accum;
@@ -36380,7 +36973,7 @@ var require_utf7 = __commonJS({
     Utf7IMAPDecoder.prototype.end = function() {
       var res = "";
       if (this.inBase64 && this.base64Accum.length > 0) {
-        res = this.iconv.decode(Buffer3.from(this.base64Accum, "base64"), "utf16-be");
+        res = this.iconv.decode(Buffer4.from(this.base64Accum, "base64"), "utf16-be");
       }
       this.inBase64 = false;
       this.base64Accum = "";
@@ -36393,7 +36986,7 @@ var require_utf7 = __commonJS({
 var require_sbcs_codec = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/sbcs-codec.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports._sbcs = SBCSCodec;
     function SBCSCodec(codecOptions, iconv2) {
       if (!codecOptions) {
@@ -36409,8 +37002,8 @@ var require_sbcs_codec = __commonJS({
         }
         codecOptions.chars = asciiString + codecOptions.chars;
       }
-      this.decodeBuf = Buffer3.from(codecOptions.chars, "ucs2");
-      var encodeBuf = Buffer3.alloc(65536, iconv2.defaultCharSingleByte.charCodeAt(0));
+      this.decodeBuf = Buffer4.from(codecOptions.chars, "ucs2");
+      var encodeBuf = Buffer4.alloc(65536, iconv2.defaultCharSingleByte.charCodeAt(0));
       for (var i = 0; i < codecOptions.chars.length; i++) {
         encodeBuf[codecOptions.chars.charCodeAt(i)] = i;
       }
@@ -36422,7 +37015,7 @@ var require_sbcs_codec = __commonJS({
       this.encodeBuf = codec.encodeBuf;
     }
     SBCSEncoder.prototype.write = function(str) {
-      var buf = Buffer3.alloc(str.length);
+      var buf = Buffer4.alloc(str.length);
       for (var i = 0; i < str.length; i++) {
         buf[i] = this.encodeBuf[str.charCodeAt(i)];
       }
@@ -36435,7 +37028,7 @@ var require_sbcs_codec = __commonJS({
     }
     SBCSDecoder.prototype.write = function(buf) {
       var decodeBuf = this.decodeBuf;
-      var newBuf = Buffer3.alloc(buf.length * 2);
+      var newBuf = Buffer4.alloc(buf.length * 2);
       var idx1 = 0;
       var idx2 = 0;
       for (var i = 0; i < buf.length; i++) {
@@ -37063,7 +37656,7 @@ var require_sbcs_data_generated = __commonJS({
 var require_dbcs_codec = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/encodings/dbcs-codec.js"(exports) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     exports._dbcs = DBCSCodec;
     var UNASSIGNED = -1;
     var GB18030_CODE = -2;
@@ -37299,7 +37892,7 @@ var require_dbcs_codec = __commonJS({
       this.gb18030 = codec.gb18030;
     }
     DBCSEncoder.prototype.write = function(str) {
-      var newBuf = Buffer3.alloc(str.length * (this.gb18030 ? 4 : 3));
+      var newBuf = Buffer4.alloc(str.length * (this.gb18030 ? 4 : 3));
       var leadSurrogate = this.leadSurrogate;
       var seqObj = this.seqObj;
       var nextChar = -1;
@@ -37403,7 +37996,7 @@ var require_dbcs_codec = __commonJS({
       if (this.leadSurrogate === -1 && this.seqObj === void 0) {
         return;
       }
-      var newBuf = Buffer3.alloc(10);
+      var newBuf = Buffer4.alloc(10);
       var j = 0;
       if (this.seqObj) {
         var dbcsCode = this.seqObj[DEF_CHAR];
@@ -37434,7 +38027,7 @@ var require_dbcs_codec = __commonJS({
       this.gb18030 = codec.gb18030;
     }
     DBCSDecoder.prototype.write = function(buf) {
-      var newBuf = Buffer3.alloc(buf.length * 2);
+      var newBuf = Buffer4.alloc(buf.length * 2);
       var nodeIdx = this.nodeIdx;
       var prevBytes = this.prevBytes;
       var prevOffset = this.prevBytes.length;
@@ -39043,7 +39636,7 @@ var require_encodings = __commonJS({
 var require_streams = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/lib/streams.js"(exports, module) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     module.exports = function(streamModule) {
       var Transform = streamModule.Transform;
       function IconvLiteEncoderStream(conv, options) {
@@ -39083,7 +39676,7 @@ var require_streams = __commonJS({
           chunks.push(chunk);
         });
         this.on("end", function() {
-          cb(null, Buffer3.concat(chunks));
+          cb(null, Buffer4.concat(chunks));
         });
         return this;
       };
@@ -39097,7 +39690,7 @@ var require_streams = __commonJS({
         constructor: { value: IconvLiteDecoderStream }
       });
       IconvLiteDecoderStream.prototype._transform = function(chunk, encoding, done) {
-        if (!Buffer3.isBuffer(chunk) && !(chunk instanceof Uint8Array)) {
+        if (!Buffer4.isBuffer(chunk) && !(chunk instanceof Uint8Array)) {
           return done(new Error("Iconv decoding stream needs buffers as its input."));
         }
         try {
@@ -39140,7 +39733,7 @@ var require_streams = __commonJS({
 var require_lib3 = __commonJS({
   "../../node_modules/@inquirer/external-editor/node_modules/iconv-lite/lib/index.js"(exports, module) {
     "use strict";
-    var Buffer3 = require_safer().Buffer;
+    var Buffer4 = require_safer().Buffer;
     var bomHandling = require_bom_handling();
     var mergeModules = require_merge_exports();
     var iconv2 = module.exports;
@@ -39152,7 +39745,7 @@ var require_lib3 = __commonJS({
       var encoder = iconv2.getEncoder(encoding, options);
       var res = encoder.write(str);
       var trail = encoder.end();
-      return trail && trail.length > 0 ? Buffer3.concat([res, trail]) : res;
+      return trail && trail.length > 0 ? Buffer4.concat([res, trail]) : res;
     };
     iconv2.decode = function decode(buf, encoding, options) {
       if (typeof buf === "string") {
@@ -39160,7 +39753,7 @@ var require_lib3 = __commonJS({
           console.error("Iconv-lite warning: decode()-ing strings is deprecated. Refer to https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding");
           iconv2.skipDecodeWarning = true;
         }
-        buf = Buffer3.from("" + (buf || ""), "binary");
+        buf = Buffer4.from("" + (buf || ""), "binary");
       }
       var decoder = iconv2.getDecoder(encoding, options);
       var res = decoder.write(buf);
@@ -40590,15 +41183,15 @@ function signupErrorCodeFromResponseText(text2) {
 function renderEmailCodeStart(value) {
   const body = objectRecord(value, "signup email-code start response");
   return {
-    pendingId: stringValue5(body, "pending_id"),
-    email: stringValue5(body, "email")
+    pendingId: stringValue6(body, "pending_id"),
+    email: stringValue6(body, "email")
   };
 }
 function renderEmailCodeVerify(value) {
   const body = objectRecord(value, "signup email-code verify response");
   return {
-    accessToken: stringValue5(body, "access_token"),
-    refreshToken: stringValue5(body, "refresh_token"),
+    accessToken: stringValue6(body, "access_token"),
+    refreshToken: stringValue6(body, "refresh_token"),
     expiresInSeconds: positiveIntegerValue(body, "expires_in"),
     user: renderUserRef(requiredValue(body, "user")),
     isNewUser: booleanValue(body, "is_new_user"),
@@ -40638,7 +41231,7 @@ function renderMissionControlComplete(value) {
     localRunnerToken: renderLocalRunnerToken(
       requiredValue(body, "local_runner_token")
     ),
-    launchUrl: stringValue5(body, "launch_url"),
+    launchUrl: stringValue6(body, "launch_url"),
     ...missionControlUrl === void 0 ? {} : { missionControlUrl },
     config: {
       allowedCwds: arrayValue2(config, "allowed_cwds").map(
@@ -40658,21 +41251,21 @@ function renderLocalRunnerToken(value) {
   const body = objectRecord(value, "signup local runner token");
   const expiresInSeconds = optionalPositiveIntegerValue(body, "expires_in");
   return {
-    accessToken: stringValue5(body, "access_token"),
+    accessToken: stringValue6(body, "access_token"),
     ...expiresInSeconds === void 0 ? {} : { expiresInSeconds },
-    workspaceSlug: stringValue5(body, "workspace"),
-    channelSlug: stringValue5(body, "channel")
+    workspaceSlug: stringValue6(body, "workspace"),
+    channelSlug: stringValue6(body, "channel")
   };
 }
 function renderTaskStartResult(value) {
   const body = objectRecord(value, "signup task start");
-  const status = stringValue5(body, "status");
+  const status = stringValue6(body, "status");
   if (status !== "queued" && status !== "started" && status !== "failed") {
     throw new Error("signup task start status was incomplete");
   }
   return {
-    threadId: stringValue5(body, "thread_id"),
-    title: stringValue5(body, "title"),
+    threadId: stringValue6(body, "thread_id"),
+    title: stringValue6(body, "title"),
     status,
     ...optionalStringValue(body, "runner_id") === void 0 ? {} : { runnerId: optionalStringValue(body, "runner_id") },
     ...optionalStringValue(body, "error") === void 0 ? {} : { error: optionalStringValue(body, "error") }
@@ -40682,7 +41275,7 @@ function renderUserRef(value) {
   const body = objectRecord(value, "signup user");
   return {
     id: positiveIntegerValue(body, "id"),
-    username: stringValue5(body, "username"),
+    username: stringValue6(body, "username"),
     ...optionalStringValue(body, "display_name") === void 0 ? {} : { displayName: optionalStringValue(body, "display_name") },
     ...optionalStringValue(body, "primary_email") === void 0 ? {} : { primaryEmail: optionalStringValue(body, "primary_email") }
   };
@@ -40691,23 +41284,23 @@ function renderWorkspaceRef(value) {
   const body = objectRecord(value, "signup workspace");
   return {
     id: positiveIntegerValue(body, "id"),
-    slug: stringValue5(body, "slug"),
-    name: stringValue5(body, "name")
+    slug: stringValue6(body, "slug"),
+    name: stringValue6(body, "name")
   };
 }
 function renderChannelRef(value) {
   const body = objectRecord(value, "signup channel");
   return {
     id: positiveIntegerValue(body, "id"),
-    slug: stringValue5(body, "slug"),
-    name: stringValue5(body, "name")
+    slug: stringValue6(body, "slug"),
+    name: stringValue6(body, "name")
   };
 }
 function renderThreadRef(value) {
   const body = objectRecord(value, "signup thread");
   return {
-    threadId: stringValue5(body, "thread_id"),
-    title: stringValue5(body, "title"),
+    threadId: stringValue6(body, "thread_id"),
+    title: stringValue6(body, "title"),
     rootSeq: positiveIntegerValue(body, "root_seq"),
     threadSeq: positiveIntegerValue(body, "thread_seq")
   };
@@ -40725,7 +41318,7 @@ function requiredValue(record, key) {
   }
   return value;
 }
-function stringValue5(record, key) {
+function stringValue6(record, key) {
   return stringFromUnknown(requiredValue(record, key), `signup ${key}`);
 }
 function optionalStringValue(record, key) {
@@ -40800,6 +41393,7 @@ __export(signupFlow_exports, {
   resolveSignupCodexCommandForTest: () => resolveSignupCodexCommandForTest,
   runSignupFlow: () => runSignupFlow,
   signupCodexTaskSuggestionProcessForTest: () => signupCodexTaskSuggestionProcessForTest,
+  signupCommanderAllowedCwdsForTest: () => signupCommanderAllowedCwdsForTest,
   signupDiscoverProjectsForStartForTest: () => signupDiscoverProjectsForStartForTest,
   signupEmailPickerChoiceNamesForTest: () => signupEmailPickerChoiceNamesForTest,
   signupHelpText: () => signupHelpText,
@@ -40828,7 +41422,7 @@ import {
   writeFileSync as writeFileSync11
 } from "node:fs";
 import { access } from "node:fs/promises";
-import { homedir as homedir13, tmpdir as tmpdir4 } from "node:os";
+import { homedir as homedir12, tmpdir as tmpdir4 } from "node:os";
 import { delimiter as delimiter3, dirname as dirname12, join as join17, resolve as resolve9 } from "node:path";
 import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
 import { emitKeypressEvents } from "node:readline";
@@ -42186,8 +42780,9 @@ async function signupCommanderRunnerOptions(args, runnerId) {
     codexUrl: void 0,
     launchTui: false,
     fast: false,
-    allowedCwds: Array.from(
-      /* @__PURE__ */ new Set([args.projectPath, ...args.selectedProjectPaths])
+    allowedCwds: signupCommanderAllowedCwds(
+      args.projectPath,
+      args.selectedProjectPaths
     ),
     allowedForwardPorts: [],
     codeServerBin: editorRuntime.codeServerBin,
@@ -42204,6 +42799,12 @@ async function signupCommanderRunnerOptions(args, runnerId) {
     channelSession: void 0
   };
 }
+function signupCommanderAllowedCwds(projectPath, selectedProjectPaths) {
+  return assertConfiguredAllowedCwds([projectPath, ...selectedProjectPaths]);
+}
+function signupCommanderAllowedCwdsForTest(projectPath, selectedProjectPaths) {
+  return signupCommanderAllowedCwds(projectPath, selectedProjectPaths);
+}
 function signupConnectRestartCommand(args) {
   return [
     "npx",
@@ -43131,7 +43732,7 @@ async function runSignupPreflights(runtime) {
 function defaultPreflightRuntime() {
   return {
     cwd: process.cwd(),
-    homeDir: homedir13(),
+    homeDir: homedir12(),
     probeTool,
     readGitEmail,
     discoverCodeRoots,
@@ -43340,7 +43941,7 @@ function codexTaskSuggestionProcess2(args) {
 function signupCodexTaskSuggestionProcessForTest(args) {
   return codexTaskSuggestionProcess2(args);
 }
-async function resolveSignupCodexCommand(env = process.env, homeDir = homedir13(), executableExists = fileIsExecutable) {
+async function resolveSignupCodexCommand(env = process.env, homeDir = homedir12(), executableExists = fileIsExecutable) {
   const override = firstConfiguredValue([
     env.LINZUMI_SIGNUP_CODEX_BIN,
     env.LINZUMI_CODEX_BIN
@@ -43979,10 +44580,10 @@ function directoryExists(path2) {
 }
 function expandHomePath(path2) {
   if (path2 === "~") {
-    return homedir13();
+    return homedir12();
   }
   if (path2.startsWith("~/")) {
-    return join17(homedir13(), path2.slice(2));
+    return join17(homedir12(), path2.slice(2));
   }
   return resolve9(path2);
 }
@@ -44023,6 +44624,7 @@ var init_signupFlow = __esm({
     init_helloLinzumiProject();
     init_localEditorRuntime();
     init_runner();
+    init_localCapabilities();
     init_kandanTls();
     init_userFacingErrors();
     maxSignupVerificationCodeAttempts = 3;
@@ -44071,7 +44673,7 @@ init_runner();
 init_claudeCodeSession();
 init_authCache();
 import { existsSync as existsSync13, readFileSync as readFileSync16, realpathSync as realpathSync6 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 import { resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -44134,7 +44736,7 @@ init_json();
 init_defaultUrls();
 import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname10, join as join15 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 async function runAgentCliCommand(args, deps = {
   fetchImpl: fetch,
   stdout: process.stdout,
@@ -44842,7 +45444,7 @@ function agentTokenFile(flags) {
   return flags.get("agent-token-file") ?? defaultAgentTokenFilePath();
 }
 function defaultAgentTokenFilePath() {
-  return join15(homedir11(), ".linzumi", "agent-token.json");
+  return join15(homedir10(), ".linzumi", "agent-token.json");
 }
 function normalizedApiUrl(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
@@ -44950,13 +45552,13 @@ import {
   watch,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { dirname as dirname11, join as join16, resolve as resolve8 } from "node:path";
 import { execFileSync, spawn as spawn8 } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var connectedMarkers = ["Connected to Linzumi", "Runner connected:"];
 function commanderStatusDir() {
-  return join16(homedir12(), ".linzumi", "commanders");
+  return join16(homedir11(), ".linzumi", "commanders");
 }
 function commanderStatusFile(runnerId, statusDir = commanderStatusDir()) {
   return join16(statusDir, `${safeRunnerId(runnerId)}.json`);
@@ -57004,12 +57606,14 @@ function createLinzumiMcpApiClient(options) {
     getMessage: (params) => request("GET", `${apiPrefix}/message`, params),
     getThread: (params) => request("GET", `${apiPrefix}/thread`, params),
     getChannel: (params) => request("GET", `${apiPrefix}/channel`, params),
+    listVaultSecrets: (params) => request("GET", `${apiPrefix}/vault-secrets`, params),
     sendChannelMessage: (params) => request("POST", `${apiPrefix}/channel-message`, params),
     prepareMessageUploads: (params) => request("POST", `${apiPrefix}/message-uploads/prepare`, params),
     attachMessageFiles: (params) => request("POST", `${apiPrefix}/message-files/attach`, params),
     sendThreadReply: (params) => request("POST", `${apiPrefix}/thread-reply`, params),
     sendDm: (params) => request("POST", `${apiPrefix}/dm`, params),
-    dmOwner: (params) => request("POST", `${apiPrefix}/dm-owner`, params)
+    dmOwner: (params) => request("POST", `${apiPrefix}/dm-owner`, params),
+    getVaultValues: (params) => request("POST", `${apiPrefix}/vault-values`, params)
   };
 }
 
@@ -57066,12 +57670,16 @@ Tools:
   linzumi_get_message   Read one message by scoped seq or Linzumi message URL.
   linzumi_get_thread    Read one bounded thread by ID.
   linzumi_get_channel   Read bounded recent messages and channel metadata.
+  linzumi_list_vault_secrets
+                        List vault secret names, descriptions, and owner scope.
   linzumi_send_channel_message
                         Send a plain-text message to the scoped channel.
   linzumi_send_thread_reply
                         Send a plain-text reply to an existing scoped thread.
   linzumi_send_dm       Send a plain-text DM to a visible user.
   linzumi_dm_owner      Send a plain-text DM to the configured owner username.
+  linzumi_get_vault_values
+                        Request approved named vault values for a thread.
 
 Auth:
   Uses --token, LINZUMI_MCP_ACCESS_TOKEN, or cached local runner OAuth from linzumi auth.
@@ -57087,16 +57695,16 @@ async function runMcpServer(args) {
   const kandanUrl = required(values, "api-url");
   const auth = await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue4(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue4(values, "auth-file"),
-    delegationAuthFilePath: stringValue4(values, "delegation-auth-file"),
-    workspaceSlug: stringValue4(values, "workspace"),
-    channelSlug: stringValue4(values, "channel")
-  });
-  const ownerUsername = stringValue4(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME;
-  const operatingMode = mcpOperatingMode(stringValue4(values, "mode"));
-  const cwd = stringValue4(values, "cwd") ?? process.cwd();
-  const defaultThreadId = stringValue4(values, "thread-id") ?? process.env.LINZUMI_THREAD_RUNNER_KANDAN_THREAD_ID;
+    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue5(values, "auth-file"),
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    workspaceSlug: stringValue5(values, "workspace"),
+    channelSlug: stringValue5(values, "channel")
+  });
+  const ownerUsername = stringValue5(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME;
+  const operatingMode = mcpOperatingMode(stringValue5(values, "mode"));
+  const cwd = stringValue5(values, "cwd") ?? process.cwd();
+  const defaultThreadId = stringValue5(values, "thread-id") ?? process.env.LINZUMI_THREAD_RUNNER_KANDAN_THREAD_ID;
   const client = createLinzumiMcpApiClient({
     kandanUrl,
     accessToken: auth.accessToken,
@@ -57187,6 +57795,12 @@ async function runMcpServer(args) {
       return mcpJsonResult(result);
     }
   );
+  server.tool(
+    "linzumi_list_vault_secrets",
+    "List vault secret names, descriptions, and whether each secret is personal or workspace-owned. Does not return secret values.",
+    {},
+    async (params) => mcpJsonResult(await client.listVaultSecrets(params))
+  );
   server.tool(
     "linzumi_dm_owner",
     "Send a plain-text DM to the configured Commander owner. Requires dm.write and a visible owner username.",
@@ -57243,6 +57857,23 @@ async function runMcpServer(args) {
     },
     async (params) => mcpJsonResult(await client.sendDm(params))
   );
+  server.tool(
+    "linzumi_get_vault_values",
+    "Request values for explicit vault env var names after a thread-scoped human approval. Requires vault.read; thread_id resolves the approval thread.",
+    {
+      workspace: external_exports2.string().optional().describe("Workspace slug. Omit to use the authenticated token scope."),
+      channel: external_exports2.string().optional().describe(
+        "Channel slug used to disambiguate the approval thread when needed."
+      ),
+      thread_id: external_exports2.string().uuid().describe("Existing Linzumi thread UUID for the inline approval."),
+      env_var_names: external_exports2.array(external_exports2.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/)).min(1).max(20).describe(
+        "Explicit vault env var names to request. This tool cannot list all vault keys."
+      ),
+      description: external_exports2.string().min(1).max(500).describe("Human-readable reason shown in the approval request."),
+      justification: external_exports2.string().min(10).max(1e3).describe("Agent justification shown to the approver.")
+    },
+    async (params) => mcpJsonResult(await client.getVaultValues(params))
+  );
   await server.connect(new StdioServerTransport());
 }
 async function uploadFilesWithClient(args) {
@@ -57341,22 +57972,22 @@ function registerEmptyMcpResources(server) {
 async function runMcpConfig(args) {
   const values = strictFlagValues(args);
   const kandanUrl = required(values, "api-url");
-  const format = stringValue4(values, "format") ?? "codex";
-  const operatingMode = mcpOperatingMode(stringValue4(values, "mode"));
+  const format = stringValue5(values, "format") ?? "codex";
+  const operatingMode = mcpOperatingMode(stringValue5(values, "mode"));
   const token = values.get("include-token") === true ? (await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue4(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue4(values, "auth-file"),
-    delegationAuthFilePath: stringValue4(values, "delegation-auth-file"),
-    workspaceSlug: stringValue4(values, "workspace"),
-    channelSlug: stringValue4(values, "channel")
+    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue5(values, "auth-file"),
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    workspaceSlug: stringValue5(values, "workspace"),
+    channelSlug: stringValue5(values, "channel")
   })).accessToken : void 0;
   const config = linzumiMcpServerConfig({
-    command: stringValue4(values, "command"),
+    command: stringValue5(values, "command"),
     kandanUrl,
     accessToken: token,
-    delegationAuthFilePath: stringValue4(values, "delegation-auth-file"),
-    ownerUsername: stringValue4(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME,
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    ownerUsername: stringValue5(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME,
     operatingMode
   });
   switch (format) {
@@ -57375,19 +58006,19 @@ async function runMcpDoctor(args) {
   const kandanUrl = required(values, "api-url");
   const auth = await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue4(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue4(values, "auth-file"),
-    delegationAuthFilePath: stringValue4(values, "delegation-auth-file"),
-    workspaceSlug: stringValue4(values, "workspace"),
-    channelSlug: stringValue4(values, "channel")
+    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue5(values, "auth-file"),
+    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
+    workspaceSlug: stringValue5(values, "workspace"),
+    channelSlug: stringValue5(values, "channel")
   });
   switch (auth.mode) {
     case "local-runner": {
       const ok = await validateLocalRunnerToken({
         kandanUrl,
         accessToken: auth.accessToken,
-        workspaceSlug: stringValue4(values, "workspace"),
-        channelSlug: stringValue4(values, "channel")
+        workspaceSlug: stringValue5(values, "workspace"),
+        channelSlug: stringValue5(values, "channel")
       });
       if (!ok) {
         throw new Error("Linzumi MCP auth validation failed");
@@ -57399,7 +58030,7 @@ async function runMcpDoctor(args) {
         kandanUrl,
         accessToken: auth.accessToken,
         authMode: auth.mode,
-        operatingMode: mcpOperatingMode(stringValue4(values, "mode"))
+        operatingMode: mcpOperatingMode(stringValue5(values, "mode"))
       });
       await client.validateAuth();
       break;
@@ -57470,7 +58101,7 @@ function strictFlagValues(args) {
   }
   return values;
 }
-function stringValue4(values, key) {
+function stringValue5(values, key) {
   const value = values.get(key);
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
@@ -57486,7 +58117,7 @@ function mcpOperatingMode(value) {
   }
 }
 function required(values, key) {
-  const value = stringValue4(values, key);
+  const value = stringValue5(values, key);
   if (value === void 0) {
     throw new Error(`--${key} is required`);
   }
@@ -57705,11 +58336,11 @@ function runHelloCommand(args) {
     process.stdout.write(helloHelpText());
     return;
   }
-  const rootPath = stringValue6(values, "dir");
-  const parentDir = stringValue6(values, "parent-dir");
-  const name = stringValue6(values, "name");
+  const rootPath = stringValue7(values, "dir");
+  const parentDir = stringValue7(values, "parent-dir");
+  const name = stringValue7(values, "name");
   const port = tcpPortValue(values, "port");
-  const host = stringValue6(values, "host");
+  const host = stringValue7(values, "host");
   const project = createHelloLinzumiProject({
     ...rootPath === void 0 ? {} : { rootPath },
     ...parentDir === void 0 ? {} : { parentDir: resolveUserPath(parentDir) },
@@ -57849,8 +58480,8 @@ async function runCommanderDaemonCommand(args) {
         runnerId,
         cwd,
         args: stripDaemonSupervisorFlags(flagArgs),
-        logFile: stringValue6(values, "log-file"),
-        statusDir: stringValue6(values, "status-dir")
+        logFile: stringValue7(values, "log-file"),
+        statusDir: stringValue7(values, "status-dir")
       });
       process.stdout.write("commander_status: daemon_started\n");
       process.stdout.write(`runner_id: ${record.runnerId}
@@ -57871,7 +58502,7 @@ async function runCommanderDaemonCommand(args) {
       const runnerId = ensureLocalRunnerIdForLinzumiUrl(kandanUrl);
       const status = commanderDaemonStatus(
         runnerId,
-        stringValue6(values, "status-dir")
+        stringValue7(values, "status-dir")
       );
       process.stdout.write(`${JSON.stringify(status)}
 `);
@@ -57885,7 +58516,7 @@ async function runCommanderDaemonCommand(args) {
       const result = await waitForCommanderDaemon({
         runnerId,
         timeoutMs,
-        statusDir: stringValue6(values, "status-dir")
+        statusDir: stringValue7(values, "status-dir")
       });
       if (result.ok) {
         process.stdout.write("commander_status: connected\n");
@@ -57903,7 +58534,7 @@ async function runCommanderDaemonCommand(args) {
       const runnerId = ensureLocalRunnerIdForLinzumiUrl(kandanUrl);
       const status = stopCommanderDaemon(
         runnerId,
-        stringValue6(values, "status-dir")
+        stringValue7(values, "status-dir")
       );
       process.stdout.write(`${JSON.stringify(status)}
 `);
@@ -57932,13 +58563,13 @@ async function runAuthCommand(args) {
     kandanUrl,
     workspaceSlug: target?.workspaceSlug,
     channelSlug: target?.channelSlug,
-    callbackHost: stringValue6(values, "oauth-callback-host")
+    callbackHost: stringValue7(values, "oauth-callback-host")
   });
   const cached = writeCachedLocalRunnerToken({
     kandanUrl,
     accessToken: token.accessToken,
     expiresInSeconds: token.expiresInSeconds,
-    authFilePath: stringValue6(values, "auth-file")
+    authFilePath: stringValue7(values, "auth-file")
   });
   process.stdout.write(
     `Saved Linzumi local runner auth for ${cached.kandanBaseUrl}
@@ -57965,11 +58596,11 @@ async function parseStartRunnerArgs(args, deps = {
   const requestedCwd = resolveUserPath(cwdArg ?? process.cwd());
   const cwd = assertConfiguredAllowedCwds([requestedCwd])[0] ?? requestedCwd;
   const explicitAllowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue6(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : [];
   const allowedCwds = Array.from(/* @__PURE__ */ new Set([cwd, ...explicitAllowedCwds]));
-  const requestedCodexBin = stringValue6(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue6(values, "code-server-bin");
+  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue7(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -57977,9 +58608,9 @@ async function parseStartRunnerArgs(args, deps = {
   });
   assertStartDependencies(initialDependencyStatus);
   const codexBin = initialDependencyStatus.codex.command;
-  const explicitToken = stringValue6(values, "token");
-  const authFilePath = stringValue6(values, "auth-file");
-  const callbackHost = stringValue6(values, "oauth-callback-host");
+  const explicitToken = stringValue7(values, "token");
+  const authFilePath = stringValue7(values, "auth-file");
+  const callbackHost = stringValue7(values, "oauth-callback-host");
   const reportRejectedCachedToken = () => {
     process.stderr.write(
       "Cached Linzumi local runner auth was rejected; starting OAuth.\n"
@@ -58032,13 +58663,13 @@ async function parseStartRunnerArgs(args, deps = {
     workspaceSlug: target.workspaceSlug,
     cwd,
     codexBin,
-    codexUrl: stringValue6(values, "codex-url"),
+    codexUrl: stringValue7(values, "codex-url"),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue6(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue6(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -58049,12 +58680,12 @@ async function parseStartRunnerArgs(args, deps = {
     channelSession: {
       workspaceSlug: target.workspaceSlug,
       channelSlug: target.channelSlug,
-      kandanThreadId: stringValue6(values, "linzumi-thread-id"),
-      listenUser: stringValue6(values, "listen-user") ?? defaultListenUserFromToken(targetToken),
-      model: stringValue6(values, "model"),
-      reasoningEffort: stringValue6(values, "reasoning-effort"),
-      sandbox: stringValue6(values, "sandbox"),
-      approvalPolicy: stringValue6(values, "approval-policy"),
+      kandanThreadId: stringValue7(values, "linzumi-thread-id"),
+      listenUser: stringValue7(values, "listen-user") ?? defaultListenUserFromToken(targetToken),
+      model: stringValue7(values, "model"),
+      reasoningEffort: stringValue7(values, "reasoning-effort"),
+      sandbox: stringValue7(values, "sandbox"),
+      approvalPolicy: stringValue7(values, "approval-policy"),
       allowPortForwardingByDefault: true,
       streamFlushMs: positiveIntegerValue2(values, "stream-flush-ms")
     }
@@ -58079,32 +58710,32 @@ async function parseAgentRunnerArgs(args, deps = {
       "linzumi commander accepts either <folder> or --cwd, not both"
     );
   }
-  const tokenFilePath = stringValue6(values, "agent-token-file") ?? defaultAgentTokenFilePath();
+  const tokenFilePath = stringValue7(values, "agent-token-file") ?? defaultAgentTokenFilePath();
   const tokenFile = readStoredAgentTokenFile(tokenFilePath, deps.readTextFile);
   const channelSlug = tokenFile.channelId;
   rejectWorkspaceCommanderThreadFlags(values, channelSlug);
   const channelSession = channelSlug === void 0 ? void 0 : {
     workspaceSlug: tokenFile.workspaceId,
     channelSlug,
-    kandanThreadId: stringValue6(values, "linzumi-thread-id"),
-    listenUser: stringValue6(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
-    model: stringValue6(values, "model"),
-    reasoningEffort: stringValue6(values, "reasoning-effort"),
-    sandbox: stringValue6(values, "sandbox"),
-    approvalPolicy: stringValue6(values, "approval-policy"),
+    kandanThreadId: stringValue7(values, "linzumi-thread-id"),
+    listenUser: stringValue7(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
+    model: stringValue7(values, "model"),
+    reasoningEffort: stringValue7(values, "reasoning-effort"),
+    sandbox: stringValue7(values, "sandbox"),
+    approvalPolicy: stringValue7(values, "approval-policy"),
     allowPortForwardingByDefault: true,
     streamFlushMs: positiveIntegerValue2(values, "stream-flush-ms")
   };
   const kandanUrl = kandanUrlValue(values) ?? agentApiUrlToKandanUrl(tokenFile.apiUrl);
-  const requestedCwdValue = cwdArg ?? stringValue6(values, "cwd");
+  const requestedCwdValue = cwdArg ?? stringValue7(values, "cwd");
   const requestedCwd = resolveUserPath(requestedCwdValue ?? process.cwd());
   const configuredAllowedCwds2 = requestedCwdValue === void 0 && !values.has("allowed-cwd") ? readConfiguredAllowedCwdDetailsForLinzumiUrl(kandanUrl) : { allowedCwds: [], missingAllowedCwds: [] };
   const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue6(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : requestedCwdValue === void 0 ? configuredAllowedCwds2.allowedCwds.length > 0 ? [...configuredAllowedCwds2.allowedCwds] : assertConfiguredAllowedCwds([requestedCwd]) : assertConfiguredAllowedCwds([requestedCwd]);
   const cwd = allowedCwds[0] ?? requestedCwd;
-  const requestedCodexBin = stringValue6(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue6(values, "code-server-bin");
+  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue7(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -58135,14 +58766,14 @@ async function parseAgentRunnerArgs(args, deps = {
     workspaceSlug: tokenFile.workspaceId,
     cwd,
     codexBin,
-    codexUrl: stringValue6(values, "codex-url"),
+    codexUrl: stringValue7(values, "codex-url"),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue6(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds,
     missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue6(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -58255,16 +58886,16 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   rejectConnectChannelFlags(values);
-  const workspaceSlug = stringValue6(values, "workspace");
+  const workspaceSlug = stringValue7(values, "workspace");
   const kandanUrl = kandanUrlValue(values) ?? defaultLinzumiWebSocketUrl;
-  const cwd = stringValue6(values, "cwd") ?? process.cwd();
+  const cwd = stringValue7(values, "cwd") ?? process.cwd();
   const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
   const localConfiguredAllowedCwds = values.has("allowed-cwd") ? { allowedCwds: [], missingAllowedCwds: [] } : readConfiguredAllowedCwdDetailsForLinzumiUrl(kandanUrl);
   const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue6(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : [...localConfiguredAllowedCwds.allowedCwds];
-  const requestedCodexBin = stringValue6(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue6(values, "code-server-bin");
+  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue7(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -58272,13 +58903,13 @@ async function parseRunnerArgs(args, deps = {
   });
   assertStartDependencies(initialDependencyStatus);
   const codexBin = initialDependencyStatus.codex.command;
-  const explicitToken = stringValue6(values, "token");
+  const explicitToken = stringValue7(values, "token");
   const token = await deps.resolveToken({
     kandanUrl,
     explicitToken,
     workspaceSlug,
-    authFilePath: stringValue6(values, "auth-file"),
-    callbackHost: stringValue6(values, "oauth-callback-host"),
+    authFilePath: stringValue7(values, "auth-file"),
+    callbackHost: stringValue7(values, "oauth-callback-host"),
     reportRejectedCachedToken: () => {
       process.stderr.write(
         "Cached Linzumi local runner auth was rejected; starting OAuth.\n"
@@ -58307,16 +58938,16 @@ async function parseRunnerArgs(args, deps = {
     ),
     cwd,
     codexBin,
-    codexUrl: stringValue6(values, "codex-url"),
+    codexUrl: stringValue7(values, "codex-url"),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue6(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds: Array.from(
       /* @__PURE__ */ new Set([...cwdAllowedCwds, ...configuredAllowedCwds2])
     ),
     missingAllowedCwds: localConfiguredAllowedCwds.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue6(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -58330,16 +58961,16 @@ async function parseRunnerArgs(args, deps = {
 }
 function runnerRuntimeDefaultsFromValues(values) {
   return {
-    model: stringValue6(values, "model"),
-    reasoningEffort: stringValue6(values, "reasoning-effort"),
-    approvalPolicy: stringValue6(values, "approval-policy"),
-    sandbox: stringValue6(values, "sandbox"),
+    model: stringValue7(values, "model"),
+    reasoningEffort: stringValue7(values, "reasoning-effort"),
+    approvalPolicy: stringValue7(values, "approval-policy"),
+    sandbox: stringValue7(values, "sandbox"),
     allowPortForwardingByDefault: true
   };
 }
 function kandanUrlValue(values) {
-  const apiUrl = stringValue6(values, "api-url");
-  const linzumiUrl = stringValue6(values, "linzumi-url");
+  const apiUrl = stringValue7(values, "api-url");
+  const linzumiUrl = stringValue7(values, "linzumi-url");
   if (apiUrl !== void 0 && linzumiUrl !== void 0 && apiUrl !== linzumiUrl) {
     throw new Error("use only one of --api-url or --linzumi-url");
   }
@@ -58448,10 +59079,10 @@ function rejectStartTargetingFlags(values) {
 }
 function resolveUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir14();
+    return homedir13();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve10(homedir14(), pathValue.slice(2));
+    return resolve10(homedir13(), pathValue.slice(2));
   }
   return resolve10(pathValue);
 }
@@ -58478,8 +59109,8 @@ function rejectConnectChannelFlags(values) {
   );
 }
 function parseOptionalChannelTarget(values) {
-  const channel = stringValue6(values, "channel");
-  const workspace = stringValue6(values, "workspace");
+  const channel = stringValue7(values, "channel");
+  const workspace = stringValue7(values, "workspace");
   if (channel === void 0) {
     if (workspace === void 0) {
       return void 0;
@@ -58513,9 +59144,9 @@ function withLocalMachineId(options) {
 function parseThreadCodexWorkerArgs(args) {
   const values = strictFlagValues2(args);
   const kandanUrl = kandanUrlValue(values) ?? defaultLinzumiWebSocketUrl;
-  const cwd = stringValue6(values, "cwd") ?? process.cwd();
+  const cwd = stringValue7(values, "cwd") ?? process.cwd();
   const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue6(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
   ) : assertConfiguredAllowedCwds([cwd]);
   const kandanThreadId = requiredThreadRunnerKandanThreadId();
   const token = requiredThreadRunnerToken();
@@ -58525,17 +59156,17 @@ function parseThreadCodexWorkerArgs(args) {
     runnerId: `thread-codex-worker:${kandanThreadId}`,
     machineId: void 0,
     runnerLockConfigPath: void 0,
-    workspaceSlug: stringValue6(values, "workspace"),
+    workspaceSlug: stringValue7(values, "workspace"),
     cwd,
-    codexBin: stringValue6(values, "codex-bin") ?? "codex",
+    codexBin: stringValue7(values, "codex-bin") ?? "codex",
     codexUrl: void 0,
     launchTui: false,
     fast: values.get("fast") === true ? true : void 0,
-    logFile: stringValue6(values, "log-file"),
+    logFile: stringValue7(values, "log-file"),
     allowedCwds: configuredAllowedCwds2.allowedCwds,
     missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue6(values, "forward-port")
+      stringValue7(values, "forward-port")
     ),
     codeServerBin: void 0,
     editorRuntime: void 0,
@@ -58565,13 +59196,13 @@ function requiredThreadRunnerToken() {
   return token;
 }
 function required2(values, key) {
-  const value = stringValue6(values, key);
+  const value = stringValue7(values, key);
   if (value === void 0) {
     throw new Error(`missing --${key}`);
   }
   return value;
 }
-function stringValue6(values, key) {
+function stringValue7(values, key) {
   const value = values.get(key);
   if (typeof value === "string" && value.trim() !== "") {
     return value;
@@ -58579,7 +59210,7 @@ function stringValue6(values, key) {
   return void 0;
 }
 function positiveIntegerValue2(values, key) {
-  const value = stringValue6(values, key);
+  const value = stringValue7(values, key);
   if (value === void 0) {
     return void 0;
   }
@@ -58590,7 +59221,7 @@ function positiveIntegerValue2(values, key) {
   throw new Error(`--${key} must be a positive integer`);
 }
 function tcpPortValue(values, key) {
-  const value = stringValue6(values, key);
+  const value = stringValue7(values, key);
   if (value === void 0) {
     return void 0;
   }