@linzumi/cli 0.0.82-beta → 0.0.84-beta

package/dist/index.js

@@ -11472,6 +11472,7 @@ function createClaudeCodeSessionPipeline(host) {
       return;
     }
     if (!event.isError && toolName2 === "TodoWrite") {
+      host.onTodoWriteCompleted?.(input);
       const plan = claudePlanItem(itemId, input);
       if (plan !== void 0) {
         recordItem(turn, plan);
@@ -11563,6 +11564,21 @@ function createClaudeCodeSessionPipeline(host) {
         handleToolResult(ensureTurn(), event);
         return;
       }
+      case "command_output_delta": {
+        const turn = activeTurn;
+        const pending = turn?.pendingTools.get(event.itemKey);
+        if (turn === void 0 || pending === void 0) {
+          return;
+        }
+        submit("item/commandExecution/outputDelta", {
+          turnId: turn.turnId,
+          itemId: `tool:${event.itemKey}`,
+          command: claudeToolCommandLabel(pending.toolName, pending.input),
+          stream: "stdout",
+          delta: event.delta
+        });
+        return;
+      }
       case "command_output": {
         const turn = ensureTurn();
         const item = {
@@ -11846,13 +11862,402 @@ var init_claudeCodePipeline = __esm({
   }
 });
 
+// src/claudeCodePlanMirror.ts
+function clamp(value, maxLength) {
+  return value.length <= maxLength ? value : value.slice(0, maxLength);
+}
+function stringValue2(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function objectValue2(value) {
+  return isJsonObject(value) ? value : void 0;
+}
+function claudeTodoWritePlanSteps(input) {
+  const todos = Array.isArray(input.todos) ? input.todos : [];
+  const steps = todos.flatMap((todo) => {
+    const value = objectValue2(todo);
+    if (value === void 0) {
+      return [];
+    }
+    const title = clamp(
+      (stringValue2(value.content) ?? stringValue2(value.subject) ?? stringValue2(value.activeForm) ?? "").trim(),
+      planStepTitleMaxLength
+    );
+    if (title === "") {
+      return [];
+    }
+    const activeForm = (stringValue2(value.activeForm) ?? "").trim();
+    const description = clamp(
+      activeForm === "" ? title : activeForm,
+      planStepDescriptionMaxLength
+    );
+    const status = todoStatusToPlanStepStatus[stringValue2(value.status) ?? "pending"] ?? "pending";
+    return status === "completed" ? [{ title, description, status, completed_debrief: description }] : [{ title, description, status }];
+  });
+  if (steps.length === 0) {
+    return void 0;
+  }
+  return steps.length <= planStepsMaxCount ? steps : steps.slice(0, planStepsMaxCount);
+}
+function createClaudeCodePlanMirror(args) {
+  let pendingSteps;
+  let lastPushedSignature;
+  let flight = Promise.resolve();
+  let inFlight = false;
+  const pushLoop = async () => {
+    while (pendingSteps !== void 0) {
+      const steps = pendingSteps;
+      pendingSteps = void 0;
+      const signature = JSON.stringify(steps);
+      if (signature === lastPushedSignature) {
+        continue;
+      }
+      try {
+        await args.replacePlanSteps({
+          thread_id: args.threadId,
+          goal: args.goal,
+          steps
+        });
+        lastPushedSignature = signature;
+      } catch (error) {
+        args.log("claude_code.plan_mirror_push_failed", {
+          thread_id: args.threadId,
+          message: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  };
+  return {
+    handleTodoWrite: (input) => {
+      const steps = claudeTodoWritePlanSteps(input);
+      if (steps === void 0) {
+        return;
+      }
+      pendingSteps = steps;
+      if (!inFlight) {
+        inFlight = true;
+        flight = pushLoop().finally(() => {
+          inFlight = false;
+        });
+      }
+    },
+    settle: () => flight
+  };
+}
+var todoStatusToPlanStepStatus, planStepTitleMaxLength, planStepDescriptionMaxLength, planStepsMaxCount;
+var init_claudeCodePlanMirror = __esm({
+  "src/claudeCodePlanMirror.ts"() {
+    "use strict";
+    init_protocol();
+    todoStatusToPlanStepStatus = {
+      pending: "pending",
+      in_progress: "active",
+      completed: "completed"
+    };
+    planStepTitleMaxLength = 255;
+    planStepDescriptionMaxLength = 1e4;
+    planStepsMaxCount = 50;
+  }
+});
+
+// src/claudeCodeLiveBashOutput.ts
+import {
+  mkdirSync as mkdirSync2,
+  rmSync,
+  writeFileSync,
+  promises as fsPromises
+} from "node:fs";
+import { join as join6 } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+function shellSingleQuoted(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function claudeLiveBashWrappedCommand(command, captureFile) {
+  return `__lz_live_out=${shellSingleQuoted(captureFile)}; if ! : >> "$__lz_live_out" 2>/dev/null; then __lz_live_out=/dev/null; fi; { ${command}${wrapperTail}`;
+}
+function isClaudeLiveBashWrappedCommand(command) {
+  return wrapperHeadPattern.test(command) && command.endsWith(wrapperTail);
+}
+function claudeLiveBashOriginalCommand(command) {
+  const head = command.match(wrapperHeadPattern)?.[0];
+  if (head === void 0 || !command.endsWith(wrapperTail)) {
+    return command;
+  }
+  return command.slice(head.length, command.length - wrapperTail.length);
+}
+function claudeLiveBashCaptureEnabled(env) {
+  const value = env.LINZUMI_CLAUDE_LIVE_BASH?.trim().toLowerCase();
+  return !(value === "0" || value === "false" || value === "off" || value === "no");
+}
+function createClaudeCodeLiveBashCapture(host) {
+  const pollIntervalMs = host.pollIntervalMs ?? defaultPollIntervalMs;
+  const maxEmittedBytes = host.maxEmittedBytesPerTool ?? defaultMaxEmittedBytesPerTool;
+  const tails = /* @__PURE__ */ new Map();
+  let closed = false;
+  const stopTail = (toolUseId) => {
+    const tail = tails.get(toolUseId);
+    if (tail === void 0) {
+      return;
+    }
+    tails.delete(toolUseId);
+    if (tail.timer !== void 0) {
+      clearInterval(tail.timer);
+      tail.timer = void 0;
+    }
+    try {
+      rmSync(tail.file, { force: true });
+    } catch (_error) {
+    }
+  };
+  const pollTail = async (toolUseId, tail) => {
+    if (tail.reading) {
+      return;
+    }
+    tail.reading = true;
+    try {
+      const stat2 = await fsPromises.stat(tail.file);
+      if (stat2.size <= tail.offset) {
+        return;
+      }
+      const length = Math.min(
+        stat2.size - tail.offset,
+        maxReadBytesPerPoll,
+        maxEmittedBytes - tail.emittedBytes
+      );
+      if (length <= 0) {
+        stopTail(toolUseId);
+        return;
+      }
+      const handle = await fsPromises.open(tail.file, "r");
+      try {
+        const buffer = Buffer.alloc(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, tail.offset);
+        if (bytesRead <= 0) {
+          return;
+        }
+        tail.offset += bytesRead;
+        tail.emittedBytes += bytesRead;
+        const delta = tail.decoder.write(buffer.subarray(0, bytesRead));
+        if (delta !== "" && tails.get(toolUseId) === tail) {
+          host.onOutputDelta(toolUseId, delta);
+        }
+        if (tail.emittedBytes >= maxEmittedBytes) {
+          host.log?.("claude_live_bash.output_budget_exhausted", {
+            tool_use_id: toolUseId,
+            emitted_bytes: tail.emittedBytes
+          });
+          stopTail(toolUseId);
+        }
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (tails.get(toolUseId) === tail) {
+        host.log?.("claude_live_bash.tail_read_failed", {
+          tool_use_id: toolUseId,
+          message: error instanceof Error ? error.message : String(error)
+        });
+        stopTail(toolUseId);
+      }
+    } finally {
+      tail.reading = false;
+    }
+  };
+  const startTail = (toolUseId, file) => {
+    stopTail(toolUseId);
+    const tail = {
+      file,
+      decoder: new StringDecoder("utf8"),
+      offset: 0,
+      emittedBytes: 0,
+      reading: false,
+      timer: void 0
+    };
+    tails.set(toolUseId, tail);
+    const timer = setInterval(() => {
+      void pollTail(toolUseId, tail);
+    }, pollIntervalMs);
+    timer.unref?.();
+    tail.timer = timer;
+  };
+  const wrapToolInput = (toolUseId, toolInput) => {
+    if (closed) {
+      return void 0;
+    }
+    const command = toolInput.command;
+    if (typeof command !== "string" || command.trim() === "" || // Background commands are polled by the model itself (TaskOutput);
+    // the foreground live stream does not apply.
+    toolInput.run_in_background === true || // Defensive: never double-wrap (e.g. a model echoing a wrapped
+    // command back from its own transcript).
+    isClaudeLiveBashWrappedCommand(command)) {
+      return void 0;
+    }
+    const file = join6(
+      host.captureDir,
+      `${toolUseId.replaceAll(/[^\w-]/g, "_")}.out`
+    );
+    try {
+      mkdirSync2(host.captureDir, { recursive: true });
+      writeFileSync(file, "");
+    } catch (error) {
+      host.log?.("claude_live_bash.capture_file_failed", {
+        tool_use_id: toolUseId,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      return void 0;
+    }
+    startTail(toolUseId, file);
+    return {
+      ...toolInput,
+      command: claudeLiveBashWrappedCommand(command, file)
+    };
+  };
+  const preToolUseHook = async (input) => {
+    const passthrough = { continue: true };
+    if (typeof input !== "object" || input === null) {
+      return passthrough;
+    }
+    const hookInput = input;
+    if (hookInput.hook_event_name !== "PreToolUse" || hookInput.tool_name !== "Bash" || typeof hookInput.tool_use_id !== "string" || hookInput.tool_use_id === "" || typeof hookInput.tool_input !== "object" || hookInput.tool_input === null || // Hook-path wrapping ONLY in bypassPermissions, where every command
+    // auto-allows and the rewrite cannot perturb a permission decision.
+    // In ask-capable modes, PreToolUse updatedInput propagates into rule
+    // matching and sandbox auto-allow analysis (verified empirically
+    // 2026-06-12: a sandbox-auto-allowed `false` started prompting once
+    // wrapped), so those modes wrap at canUseTool-allow time instead
+    // (wrapApprovedTool below) - the command was already being asked, so
+    // wrapping there adds zero prompts.
+    hookInput.permission_mode !== "bypassPermissions") {
+      return passthrough;
+    }
+    const updatedInput = wrapToolInput(
+      hookInput.tool_use_id,
+      hookInput.tool_input
+    );
+    if (updatedInput === void 0) {
+      return passthrough;
+    }
+    return {
+      continue: true,
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        updatedInput
+      }
+    };
+  };
+  return {
+    hookMatchers: [{ matcher: "Bash", hooks: [preToolUseHook] }],
+    wrapApprovedTool: wrapToolInput,
+    settleTool: stopTail,
+    settleAll: () => {
+      for (const toolUseId of [...tails.keys()]) {
+        stopTail(toolUseId);
+      }
+    },
+    close: () => {
+      closed = true;
+      for (const toolUseId of [...tails.keys()]) {
+        stopTail(toolUseId);
+      }
+      try {
+        rmSync(host.captureDir, { recursive: true, force: true });
+      } catch (_error) {
+      }
+    }
+  };
+}
+var wrapperHeadPattern, wrapperTail, defaultPollIntervalMs, defaultMaxEmittedBytesPerTool, maxReadBytesPerPoll;
+var init_claudeCodeLiveBashOutput = __esm({
+  "src/claudeCodeLiveBashOutput.ts"() {
+    "use strict";
+    wrapperHeadPattern = /^__lz_live_out='(?:[^']|'\\'')*'; if ! : >> "\$__lz_live_out" 2>\/dev\/null; then __lz_live_out=\/dev\/null; fi; \{ /;
+    wrapperTail = '\n} > >(tee -a -- "$__lz_live_out") 2> >(tee -a -- "$__lz_live_out" >&2)';
+    defaultPollIntervalMs = 200;
+    defaultMaxEmittedBytesPerTool = 262144;
+    maxReadBytesPerPoll = 65536;
+  }
+});
+
 // src/claudeCodeSession.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function claudeCodeSettingSources() {
   return ["user", "project", "local"];
 }
+function claudeCodeTokenUsageSummaryText(usage) {
+  const cached = usage.cacheReadInputTokens === void 0 && usage.cacheCreationInputTokens === void 0 ? void 0 : (usage.cacheReadInputTokens ?? 0) + (usage.cacheCreationInputTokens ?? 0);
+  const parts = [
+    usage.inputTokens === void 0 ? void 0 : `${usage.inputTokens} in`,
+    usage.outputTokens === void 0 ? void 0 : `${usage.outputTokens} out`,
+    cached === void 0 ? void 0 : `${cached} cached`,
+    usage.totalCostUsd === void 0 ? void 0 : `$${usage.totalCostUsd.toFixed(4)}`
+  ].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(" / ");
+}
+function createClaudeCodeStreamUsageTracker() {
+  const completed = {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheCreationInputTokens: 0,
+    cacheReadInputTokens: 0
+  };
+  let current;
+  let lastEmittedKey;
+  const totalsFromUsage = (usage, previous) => ({
+    inputTokens: integerValue(usage.input_tokens) ?? previous?.inputTokens ?? 0,
+    outputTokens: integerValue(usage.output_tokens) ?? previous?.outputTokens ?? 0,
+    cacheCreationInputTokens: integerValue(usage.cache_creation_input_tokens) ?? previous?.cacheCreationInputTokens ?? 0,
+    cacheReadInputTokens: integerValue(usage.cache_read_input_tokens) ?? previous?.cacheReadInputTokens ?? 0
+  });
+  const snapshotIfChanged = () => {
+    const inputTokens = completed.inputTokens + (current?.inputTokens ?? 0);
+    const outputTokens = completed.outputTokens + (current?.outputTokens ?? 0);
+    const cacheCreationInputTokens = completed.cacheCreationInputTokens + (current?.cacheCreationInputTokens ?? 0);
+    const cacheReadInputTokens = completed.cacheReadInputTokens + (current?.cacheReadInputTokens ?? 0);
+    const key = `${inputTokens}:${outputTokens}:${cacheCreationInputTokens}:${cacheReadInputTokens}`;
+    if (key === lastEmittedKey) {
+      return void 0;
+    }
+    lastEmittedKey = key;
+    return {
+      inputTokens,
+      outputTokens,
+      cacheCreationInputTokens,
+      cacheReadInputTokens,
+      totalCostUsd: void 0
+    };
+  };
+  return {
+    observeStreamEvent: (event) => {
+      switch (stringValue(event?.type)) {
+        case "message_start": {
+          const usage = objectValue(objectValue(event?.message)?.usage);
+          if (usage === void 0) {
+            return void 0;
+          }
+          if (current !== void 0) {
+            completed.inputTokens += current.inputTokens;
+            completed.outputTokens += current.outputTokens;
+            completed.cacheCreationInputTokens += current.cacheCreationInputTokens;
+            completed.cacheReadInputTokens += current.cacheReadInputTokens;
+          }
+          current = totalsFromUsage(usage, void 0);
+          return snapshotIfChanged();
+        }
+        case "message_delta": {
+          const usage = objectValue(event?.usage);
+          if (usage === void 0) {
+            return void 0;
+          }
+          current = totalsFromUsage(usage, current);
+          return snapshotIfChanged();
+        }
+        default:
+          return void 0;
+      }
+    }
+  };
+}
 function parseClaudeCodeRateLimitInfo(info) {
   if (info === void 0) {
     return void 0;
@@ -11952,7 +12357,7 @@ async function probeClaudeCodeAvailability(args) {
   }
 }
 function hasClaudeCodeAuthHint(env, deps) {
-  const configDir = env.CLAUDE_CONFIG_DIR ?? join6(deps.homeDir, ".claude");
+  const configDir = env.CLAUDE_CONFIG_DIR ?? join7(deps.homeDir, ".claude");
   return hasAnthropicCredentialEnv(env) || hasClaudeCloudProviderEnv(env) || hasClaudeCodeFileCredential(configDir, deps) || hasClaudeCodeApiKeyHelper(configDir, deps) || hasMacClaudeCodeKeychainAnchor(deps);
 }
 function claudeCodePolicyDeferHooks() {
@@ -11987,14 +12392,14 @@ function hasClaudeCloudProviderEnv(env) {
   return trueishEnv(env.CLAUDE_CODE_USE_BEDROCK) || trueishEnv(env.CLAUDE_CODE_USE_VERTEX) || trueishEnv(env.CLAUDE_CODE_USE_FOUNDRY) || trueishEnv(env.CLAUDE_CODE_USE_ANTHROPIC_AWS) || trueishEnv(env.CLAUDE_CODE_USE_MANTLE);
 }
 function hasClaudeCodeFileCredential(configDir, deps) {
-  return deps.fileExists(join6(configDir, ".credentials.json")) || deps.fileExists(join6(configDir, ".claude.json")) || deps.fileExists(join6(deps.homeDir, ".claude.json"));
+  return deps.fileExists(join7(configDir, ".credentials.json")) || deps.fileExists(join7(configDir, ".claude.json")) || deps.fileExists(join7(deps.homeDir, ".claude.json"));
 }
 function hasClaudeCodeApiKeyHelper(configDir, deps) {
   return [
-    join6(configDir, "settings.json"),
-    join6(configDir, "settings.local.json"),
-    join6(deps.cwd, ".claude", "settings.json"),
-    join6(deps.cwd, ".claude", "settings.local.json")
+    join7(configDir, "settings.json"),
+    join7(configDir, "settings.local.json"),
+    join7(deps.cwd, ".claude", "settings.json"),
+    join7(deps.cwd, ".claude", "settings.local.json")
   ].some((path2) => settingsFileHasApiKeyHelper(path2, deps));
 }
 function settingsFileHasApiKeyHelper(path2, deps) {
@@ -12014,9 +12419,9 @@ function hasMacClaudeCodeKeychainAnchor(deps) {
     return false;
   }
   return [
-    join6(deps.homeDir, "Library", "Application Support", "claude-cli-nodejs"),
-    join6(deps.homeDir, "Library", "Application Support", "Claude"),
-    join6(deps.homeDir, "Library", "Preferences", "claude-cli-nodejs")
+    join7(deps.homeDir, "Library", "Application Support", "claude-cli-nodejs"),
+    join7(deps.homeDir, "Library", "Application Support", "Claude"),
+    join7(deps.homeDir, "Library", "Preferences", "claude-cli-nodejs")
   ].some((path2) => deps.fileExists(path2));
 }
 function readTextFileIfPresent(path2) {
@@ -12037,6 +12442,7 @@ async function startClaudeCodeSession(options) {
     startedSessionIds: /* @__PURE__ */ new Set(),
     completedTurnCount: 0
   };
+  const streamUsageTracker = createClaudeCodeStreamUsageTracker();
   for await (const message of runner(options)) {
     state.sessionId = state.sessionId ?? extractClaudeSessionId(message);
     const sessionId = extractClaudeSessionId(message) ?? state.sessionId;
@@ -12044,7 +12450,11 @@ async function startClaudeCodeSession(options) {
       state.startedSessionIds.add(sessionId);
       await options.onTranscriptEvent?.({ type: "session_started", sessionId });
     }
-    for (const event of transcriptEventsForClaudeMessage(message, sessionId)) {
+    for (const event of transcriptEventsForClaudeMessage(
+      message,
+      sessionId,
+      streamUsageTracker
+    )) {
       if (event.type === "assistant_message") {
         recordClaudeAssistantAggregate(state, event);
       }
@@ -12215,6 +12625,11 @@ async function failClaudeCodeSession(options, sessionId, reason) {
 async function* defaultClaudeCodeRunner(options) {
   const sdk = await import("@anthropic-ai/claude-agent-sdk");
   const prompt = options.streamingInput?.messages ?? options.prompt;
+  const preToolUseMatchers = [
+    ...options.preToolUseHookMatchers ?? [],
+    ...options.canUseTool === void 0 ? claudeCodePolicyDeferHooks().PreToolUse ?? [] : []
+  ];
+  const hooks = preToolUseMatchers.length === 0 ? void 0 : { PreToolUse: preToolUseMatchers };
   const query = sdk.query({
     prompt,
     options: {
@@ -12235,7 +12650,13 @@ async function* defaultClaudeCodeRunner(options) {
       },
       ...options.allowedTools === void 0 ? {} : { allowedTools: [...options.allowedTools] },
       ...options.env === void 0 ? {} : { env: options.env },
-      ...options.canUseTool === void 0 ? { hooks: claudeCodePolicyDeferHooks() } : { canUseTool: claudeCodeCanUseTool(options.canUseTool) },
+      ...hooks === void 0 ? {} : { hooks },
+      ...options.canUseTool === void 0 ? {} : {
+        canUseTool: claudeCodeCanUseTool(
+          options.canUseTool,
+          options.wrapApprovedToolInput
+        )
+      },
       ...options.model === void 0 ? {} : { model: options.model }
       // exactOptionalPropertyTypes: the conditional spreads build a union the
       // SDK's Options cannot absorb verbatim; the shape is correct field-wise.
@@ -12326,7 +12747,7 @@ function boundedPositiveInteger(value, fallback, min, max) {
   }
   return value;
 }
-function claudeCodeCanUseTool(handler) {
+function claudeCodeCanUseTool(handler, wrapApprovedToolInput) {
   return async (toolName2, input, options) => {
     const decision = await handler(
       {
@@ -12337,7 +12758,11 @@ function claudeCodeCanUseTool(handler) {
         description: options.description,
         decisionReason: options.decisionReason,
         blockedPath: options.blockedPath,
-        input
+        // Approval prompts render the human-facing command: when the live
+        // Bash output capture wrapped it (PreToolUse updatedInput), show
+        // the original. The SDK still receives the raw input on allow so
+        // the wrapped (live-streaming) command is what executes.
+        input: displayClaudeToolInput(toolName2, input)
       },
       options.signal
     );
@@ -12346,7 +12771,11 @@ function claudeCodeCanUseTool(handler) {
         return {
           behavior: "allow",
           toolUseID: options.toolUseID,
-          updatedInput: input
+          // Live Bash output for ask-capable permission modes: the approved
+          // command gains the tee wrapper HERE (it was already prompting,
+          // so wrapping at this point can never add a prompt - see
+          // claudeCodeLiveBashOutput).
+          updatedInput: wrapApprovedToolInput?.(options.toolUseID, toolName2, input) ?? input
         };
       case "deny":
         return {
@@ -12357,6 +12786,17 @@ function claudeCodeCanUseTool(handler) {
     }
   };
 }
+function displayClaudeToolInput(toolName2, input) {
+  if (toolName2 !== "Bash") {
+    return input;
+  }
+  const command = stringValue(input.command);
+  if (command === void 0) {
+    return input;
+  }
+  const original = claudeLiveBashOriginalCommand(command);
+  return original === command ? input : { ...input, command: original };
+}
 function extractClaudeSessionId(message) {
   const messageObject = objectValue(message);
   const directSessionId = stringValue(messageObject?.session_id) ?? stringValue(messageObject?.sessionId);
@@ -12393,11 +12833,11 @@ function extractClaudeResultErrorReason(message, subtype) {
   const explicitErrors = arrayValue(message.errors)?.map((error) => stringValue(error)).filter((error) => nonEmptyText(error) !== void 0).join("; ");
   return nonEmptyText(explicitErrors) ?? nonEmptyText(stringValue(message.result)) ?? nonEmptyText(stringValue(message.error)) ?? subtype ?? "error";
 }
-function transcriptEventsForClaudeMessage(message, sessionId) {
+function transcriptEventsForClaudeMessage(message, sessionId, usageTracker) {
   const messageObject = objectValue(message);
   switch (stringValue(messageObject?.type)) {
     case "stream_event":
-      return streamTranscriptEvents(messageObject, sessionId);
+      return streamTranscriptEvents(messageObject, sessionId, usageTracker);
     case "assistant":
       return assistantTranscriptEvents(messageObject, sessionId);
     case "user":
@@ -12414,11 +12854,16 @@ function transcriptEventsForClaudeMessage(message, sessionId) {
       return unknownTranscriptEvent(messageObject, sessionId);
   }
 }
-function streamTranscriptEvents(message, sessionId) {
+function streamTranscriptEvents(message, sessionId, usageTracker) {
   if (sessionId === void 0) {
     return [];
   }
   const event = objectValue(message?.event);
+  const runningUsage = usageTracker?.observeStreamEvent(event);
+  const usageEvents = runningUsage === void 0 ? [] : [{ type: "usage", sessionId, usage: runningUsage }];
+  return [...usageEvents, ...streamContentEvents(event, message, sessionId)];
+}
+function streamContentEvents(event, message, sessionId) {
   switch (stringValue(event?.type)) {
     case "content_block_delta": {
       const delta = objectValue(event?.delta);
@@ -12620,6 +13065,7 @@ var init_claudeCodeSession = __esm({
   "src/claudeCodeSession.ts"() {
     "use strict";
     init_json();
+    init_claudeCodeLiveBashOutput();
     claudeRateLimitWindowLabels = {
       five_hour: "5h window",
       seven_day: "7d window",
@@ -12634,10 +13080,10 @@ var init_claudeCodeSession = __esm({
 import { appendFileSync, openSync as openSync2 } from "node:fs";
 import { createWriteStream } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
-import { mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
+import { mkdirSync as mkdirSync3 } from "node:fs";
 function createRunnerLogger(logFile, consoleReporter) {
-  mkdirSync2(dirname3(logFile), { recursive: true });
+  mkdirSync3(dirname3(logFile), { recursive: true });
   const fd = openSync2(logFile, "a");
   const stream = createWriteStream("", { fd, flags: "a", autoClose: true });
   const logger = ((event, payload) => {
@@ -12657,7 +13103,7 @@ function createRunnerLogger(logFile, consoleReporter) {
 function writeCliAuditEvent(event, payload, options = {}) {
   const logFile = options.logFile ?? defaultCliAuditLogFile();
   try {
-    mkdirSync2(dirname3(logFile), { recursive: true });
+    mkdirSync3(dirname3(logFile), { recursive: true });
     appendFileSync(
       logFile,
       `${JSON.stringify({
@@ -12675,10 +13121,10 @@ function writeCliAuditEvent(event, payload, options = {}) {
 }
 function defaultCliAuditLogFile() {
   const override = process.env.LINZUMI_CLI_AUDIT_LOG?.trim();
-  return override === void 0 || override === "" ? join7(homedir6(), ".linzumi", "logs", "command-events.jsonl") : override;
+  return override === void 0 || override === "" ? join8(homedir6(), ".linzumi", "logs", "command-events.jsonl") : override;
 }
 function defaultRunnerLogFile() {
-  return join7(homedir6(), ".linzumi", "logs", "linzumi-runner.log");
+  return join8(homedir6(), ".linzumi", "logs", "linzumi-runner.log");
 }
 function redactForCliLog(value) {
   return redactObject(value);
@@ -12709,10 +13155,10 @@ function redactObject(value) {
   );
 }
 function runnerConsolePayload(redacted, original) {
-  const consoleFields = objectValue2(original.runner_console);
+  const consoleFields = objectValue3(original.runner_console);
   return consoleFields === void 0 ? redacted : { ...redacted, ...redactForCliLog(consoleFields) };
 }
-function objectValue2(value) {
+function objectValue3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function redactArgs(args) {
@@ -12961,7 +13407,10 @@ var init_mcpConfig = __esm({
 import {
   spawn as spawn2
 } from "node:child_process";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { createServer } from "node:net";
+import { homedir as homedir7 } from "node:os";
+import { join as join9 } from "node:path";
 import { WebSocket as NodeWebSocket } from "ws";
 async function chooseLoopbackPort() {
   return new Promise((resolve12, reject) => {
@@ -13178,10 +13627,46 @@ function codexModelProviderConfigArgs(provider) {
       "-c",
       `model_providers.${provider.id}.http_headers.${header}=${JSON.stringify(value)}`
     ]),
+    // env_http_headers values are env var NAMES, not secrets: codex resolves
+    // them from its environment per request, keeping tokens out of argv.
+    ...Object.entries(provider.envHttpHeaders ?? {}).flatMap(
+      ([header, envVar]) => [
+        "-c",
+        `model_providers.${provider.id}.env_http_headers.${header}=${JSON.stringify(envVar)}`
+      ]
+    ),
     "-c",
     `model_provider=${JSON.stringify(provider.id)}`
   ];
 }
+function resolveForwardableOpenAiApiKey(env = process.env) {
+  const fromEnv = env.OPENAI_API_KEY?.trim();
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    return fromEnv;
+  }
+  const codexHomeRaw = env.CODEX_HOME?.trim();
+  const codexHome = codexHomeRaw !== void 0 && codexHomeRaw !== "" ? codexHomeRaw : join9(homedir7(), ".codex");
+  let raw;
+  try {
+    raw = readFileSync6(join9(codexHome, "auth.json"), "utf8");
+  } catch (_error) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (_error) {
+    return void 0;
+  }
+  if (!isJsonObject(parsed)) {
+    return void 0;
+  }
+  const apiKey = parsed.OPENAI_API_KEY;
+  if (typeof apiKey === "string" && apiKey.trim() !== "") {
+    return apiKey.trim();
+  }
+  return void 0;
+}
 async function connectCodexAppServer(websocketUrl, socketFactory = (url) => new NodeWebSocket(url)) {
   const websocket = await openCodexAppServerWebSocket(
     websocketUrl,
@@ -13505,22 +13990,22 @@ var init_codexAppServer = __esm({
 // src/codexProjectTrust.ts
 import {
   existsSync as existsSync5,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync6,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync7,
   realpathSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join8, resolve as resolve3 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join10, resolve as resolve3 } from "node:path";
 function ensureCodexProjectTrusted(projectPath, options = {}) {
   const trustedPath = realpathSync(resolve3(projectPath));
-  const configHome = options.configHome ?? process.env.CODEX_HOME ?? join8(homedir7(), ".codex");
-  const configPath = join8(configHome, "config.toml");
-  const currentConfig = existsSync5(configPath) ? readFileSync6(configPath, "utf8") : "";
+  const configHome = options.configHome ?? process.env.CODEX_HOME ?? join10(homedir8(), ".codex");
+  const configPath = join10(configHome, "config.toml");
+  const currentConfig = existsSync5(configPath) ? readFileSync7(configPath, "utf8") : "";
   const nextConfig = codexConfigWithTrustedProject(currentConfig, trustedPath);
   if (nextConfig !== currentConfig) {
-    mkdirSync3(configHome, { recursive: true });
-    writeFileSync(configPath, nextConfig);
+    mkdirSync4(configHome, { recursive: true });
+    writeFileSync2(configPath, nextConfig);
   }
   return trustedPath;
 }
@@ -13582,11 +14067,11 @@ function codexNotificationDiagnosticDetails(method, params) {
   }
 }
 function codexNotificationDiagnosticSummary(method, params) {
-  const error = objectValue3(params.error);
-  const item = objectValue3(params.item);
-  const code = stringValue2(params.code) ?? numberStringValue(params.code) ?? stringValue2(error?.code) ?? numberStringValue(error?.code) ?? stringValue2(params.status) ?? numberStringValue(params.status);
-  const message = stringValue2(params.message) ?? stringValue2(params.detail) ?? stringValue2(params.reason) ?? stringValue2(error?.message) ?? stringValue2(error?.detail) ?? stringValue2(error?.reason);
-  const itemType = stringValue2(item?.type);
+  const error = objectValue4(params.error);
+  const item = objectValue4(params.item);
+  const code = stringValue3(params.code) ?? numberStringValue(params.code) ?? stringValue3(error?.code) ?? numberStringValue(error?.code) ?? stringValue3(params.status) ?? numberStringValue(params.status);
+  const message = stringValue3(params.message) ?? stringValue3(params.detail) ?? stringValue3(params.reason) ?? stringValue3(error?.message) ?? stringValue3(error?.detail) ?? stringValue3(error?.reason);
+  const itemType = stringValue3(item?.type);
   const redactedCode = code === void 0 ? void 0 : redactedDiagnosticText(code);
   const prefix = redactedCode === void 0 ? method : `${method} ${redactedCode}`;
   const detail = message === void 0 ? itemType === void 0 ? void 0 : `item.type=${itemType}` : redactedDiagnosticText(message);
@@ -13670,10 +14155,10 @@ function redactedDiagnosticText(value) {
     }
   ).replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]");
 }
-function objectValue3(value) {
+function objectValue4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function stringValue2(value) {
+function stringValue3(value) {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
 function numberStringValue(value) {
@@ -13748,7 +14233,7 @@ function diagnosticStrings(value, depth) {
   if (Array.isArray(value)) {
     return value.flatMap((entry) => diagnosticStrings(entry, depth + 1));
   }
-  const object = objectValue4(value);
+  const object = objectValue5(value);
   if (object === void 0) {
     return [];
   }
@@ -13758,9 +14243,9 @@ function diagnosticStrings(value, depth) {
   ]);
 }
 function tokenUsageSummary(params) {
-  const usage = objectValue4(params.tokenUsage) ?? objectValue4(params.token_usage) ?? objectValue4(params.usage) ?? params;
-  const total = tokenUsageBreakdownSummary(objectValue4(usage.total)) ?? tokenUsageBreakdownSummary(objectValue4(usage.totalUsage)) ?? tokenUsageBreakdownSummary(objectValue4(usage.total_usage)) ?? tokenUsageBreakdownSummary(objectValue4(params.totalTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue4(params.total_token_usage)) ?? tokenUsageBreakdownSummary(usage);
-  const last = tokenUsageBreakdownSummary(objectValue4(usage.last)) ?? tokenUsageBreakdownSummary(objectValue4(usage.lastUsage)) ?? tokenUsageBreakdownSummary(objectValue4(usage.last_usage)) ?? tokenUsageBreakdownSummary(objectValue4(params.lastTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue4(params.last_token_usage));
+  const usage = objectValue5(params.tokenUsage) ?? objectValue5(params.token_usage) ?? objectValue5(params.usage) ?? params;
+  const total = tokenUsageBreakdownSummary(objectValue5(usage.total)) ?? tokenUsageBreakdownSummary(objectValue5(usage.totalUsage)) ?? tokenUsageBreakdownSummary(objectValue5(usage.total_usage)) ?? tokenUsageBreakdownSummary(objectValue5(params.totalTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue5(params.total_token_usage)) ?? tokenUsageBreakdownSummary(usage);
+  const last = tokenUsageBreakdownSummary(objectValue5(usage.last)) ?? tokenUsageBreakdownSummary(objectValue5(usage.lastUsage)) ?? tokenUsageBreakdownSummary(objectValue5(usage.last_usage)) ?? tokenUsageBreakdownSummary(objectValue5(params.lastTokenUsage)) ?? tokenUsageBreakdownSummary(objectValue5(params.last_token_usage));
   const summary = [
     total === void 0 ? void 0 : `total ${total}`,
     last === void 0 ? void 0 : `last ${last}`
@@ -13771,8 +14256,8 @@ function tokenUsageBreakdownSummary(breakdown) {
   if (breakdown === void 0) {
     return void 0;
   }
-  const inputDetails = objectValue4(breakdown.inputTokensDetails) ?? objectValue4(breakdown.input_tokens_details);
-  const outputDetails = objectValue4(breakdown.outputTokensDetails) ?? objectValue4(breakdown.output_tokens_details);
+  const inputDetails = objectValue5(breakdown.inputTokensDetails) ?? objectValue5(breakdown.input_tokens_details);
+  const outputDetails = objectValue5(breakdown.outputTokensDetails) ?? objectValue5(breakdown.output_tokens_details);
   const input = integerValue2(breakdown.inputTokens) ?? integerValue2(breakdown.input_tokens) ?? integerValue2(breakdown.promptTokens) ?? integerValue2(breakdown.prompt_tokens);
   const output = integerValue2(breakdown.outputTokens) ?? integerValue2(breakdown.output_tokens) ?? integerValue2(breakdown.completionTokens) ?? integerValue2(breakdown.completion_tokens);
   const total = integerValue2(breakdown.totalTokens) ?? integerValue2(breakdown.total_tokens);
@@ -13788,10 +14273,10 @@ function tokenUsageBreakdownSummary(breakdown) {
   return values.length === 0 ? void 0 : values.join(" / ");
 }
 function rateLimitSummary(params) {
-  const rateLimits = objectValue4(params.rateLimits) ?? objectValue4(params.rate_limits) ?? objectValue4(params.limits) ?? params;
+  const rateLimits = objectValue5(params.rateLimits) ?? objectValue5(params.rate_limits) ?? objectValue5(params.limits) ?? params;
   const direct = rateLimitBucketSummary(rateLimits, void 0);
   const children = Object.entries(rateLimits).flatMap(([name, value]) => {
-    const bucket = objectValue4(value);
+    const bucket = objectValue5(value);
     return bucket === void 0 ? [] : [rateLimitBucketSummary(bucket, name)];
   });
   const summaries = [direct, ...children].filter(
@@ -13800,11 +14285,11 @@ function rateLimitSummary(params) {
   return summaries.length === 0 ? void 0 : summaries.join(" | ");
 }
 function rateLimitBucketSummary(bucket, fallbackName) {
-  const name = stringValue3(bucket.limitName) ?? stringValue3(bucket.limit_name) ?? stringValue3(bucket.name) ?? stringValue3(bucket.type) ?? fallbackName;
-  const plan = stringValue3(bucket.planType) ?? stringValue3(bucket.plan_type) ?? stringValue3(bucket.plan);
+  const name = stringValue4(bucket.limitName) ?? stringValue4(bucket.limit_name) ?? stringValue4(bucket.name) ?? stringValue4(bucket.type) ?? fallbackName;
+  const plan = stringValue4(bucket.planType) ?? stringValue4(bucket.plan_type) ?? stringValue4(bucket.plan);
   const remaining = integerValue2(bucket.remaining) ?? integerValue2(bucket.remainingRequests) ?? integerValue2(bucket.remaining_requests) ?? integerValue2(bucket.remainingTokens) ?? integerValue2(bucket.remaining_tokens);
   const limit = integerValue2(bucket.limit) ?? integerValue2(bucket.requestLimit) ?? integerValue2(bucket.request_limit) ?? integerValue2(bucket.limitRequests) ?? integerValue2(bucket.limit_requests) ?? integerValue2(bucket.tokenLimit) ?? integerValue2(bucket.token_limit) ?? integerValue2(bucket.limitTokens) ?? integerValue2(bucket.limit_tokens);
-  const reset = stringValue3(bucket.resetAt) ?? stringValue3(bucket.reset_at) ?? stringValue3(bucket.resetsAt) ?? stringValue3(bucket.resets_at) ?? unixTimestampValue(bucket.resetsAt) ?? unixTimestampValue(bucket.resets_at) ?? secondsValue(bucket.resetAfterSeconds) ?? secondsValue(bucket.reset_after_seconds) ?? secondsValue(bucket.retryAfterSeconds) ?? secondsValue(bucket.retry_after_seconds);
+  const reset = stringValue4(bucket.resetAt) ?? stringValue4(bucket.reset_at) ?? stringValue4(bucket.resetsAt) ?? stringValue4(bucket.resets_at) ?? unixTimestampValue(bucket.resetsAt) ?? unixTimestampValue(bucket.resets_at) ?? secondsValue(bucket.resetAfterSeconds) ?? secondsValue(bucket.reset_after_seconds) ?? secondsValue(bucket.retryAfterSeconds) ?? secondsValue(bucket.retry_after_seconds);
   const usedPercent = integerValue2(bucket.usedPercent) ?? integerValue2(bucket.used_percent);
   const windowDurationMins = integerValue2(bucket.windowDurationMins) ?? integerValue2(bucket.window_duration_mins);
   const label = [name, plan].filter((value) => value !== void 0).join(" ");
@@ -13831,10 +14316,10 @@ function unixTimestampValue(value) {
   const seconds = integerValue2(value);
   return seconds === void 0 ? void 0 : new Date(seconds * 1e3).toISOString();
 }
-function objectValue4(value) {
+function objectValue5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function stringValue3(value) {
+function stringValue4(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function integerValue2(value) {
@@ -13865,7 +14350,7 @@ var init_codexNotificationConsoleStats = __esm({
 
 // src/localCapabilities.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve4 } from "node:path";
 function parseAllowedCwdList(value) {
   if (value === void 0) {
@@ -13914,7 +14399,7 @@ function expandUserPath(pathValue) {
 }
 function currentHomeDirectory() {
   const configuredHome = process.env.HOME;
-  return configuredHome === void 0 || configuredHome.trim() === "" ? homedir8() : configuredHome;
+  return configuredHome === void 0 || configuredHome.trim() === "" ? homedir9() : configuredHome;
 }
 function resolveAllowedCwd(requestedCwd, allowedRoots) {
   if (requestedCwd === void 0 || requestedCwd.trim() === "") {
@@ -14314,17 +14799,17 @@ import {
   chmodSync,
   existsSync as existsSync6,
   linkSync,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync7,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync8,
   realpathSync as realpathSync3,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { basename as basename5, dirname as dirname4, join as join9, resolve as resolve5 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename5, dirname as dirname4, join as join11, resolve as resolve5 } from "node:path";
 function localConfigPath(env = process.env) {
   const override = env.LINZUMI_CONFIG_FILE;
-  return override !== void 0 && override.trim() !== "" ? resolve5(expandUserPath(override)) : resolve5(homedir9(), ".linzumi", "config.json");
+  return override !== void 0 && override.trim() !== "" ? resolve5(expandUserPath(override)) : resolve5(homedir10(), ".linzumi", "config.json");
 }
 function localConfigScopeKey(linzumiUrl) {
   const normalizedUrl = kandanHttpBaseUrl(linzumiUrl);
@@ -14405,21 +14890,21 @@ function ensureLocalRunnerId(path2 = localConfigPath(), createRunnerId = default
 }
 function localMachineIdSeedPath(configPath = localConfigPath(), linzumiUrl) {
   if (linzumiUrl !== void 0 && localConfigScopeKey(linzumiUrl) !== prodConfigScope) {
-    return join9(
+    return join11(
       dirname4(configPath),
       `${basename5(configPath)}.${localConfigScopeFileStem(linzumiUrl)}.machine-id`
     );
   }
-  return join9(dirname4(configPath), `${basename5(configPath)}.machine-id`);
+  return join11(dirname4(configPath), `${basename5(configPath)}.machine-id`);
 }
 function localRunnerIdSeedPath(configPath = localConfigPath(), linzumiUrl) {
   if (linzumiUrl !== void 0 && localConfigScopeKey(linzumiUrl) !== prodConfigScope) {
-    return join9(
+    return join11(
       dirname4(configPath),
       `${basename5(configPath)}.${localConfigScopeFileStem(linzumiUrl)}.runner-id`
     );
   }
-  return join9(dirname4(configPath), `${basename5(configPath)}.runner-id`);
+  return join11(dirname4(configPath), `${basename5(configPath)}.runner-id`);
 }
 function readConfiguredAllowedCwdDetailsForLinzumiUrl(linzumiUrl, path2 = localConfigPath()) {
   return readConfiguredAllowedCwdDetailsFromConfig(
@@ -14549,7 +15034,7 @@ function writeLocalSignupAuth(auth, path2 = localConfigPath()) {
     version: 1,
     signupAuth: nextSignupAuth
   };
-  mkdirSync4(dirname4(path2), { recursive: true });
+  mkdirSync5(dirname4(path2), { recursive: true });
   writeLocalConfigJson(path2, next);
   return signupAuthFromJson(nextSignupAuth);
 }
@@ -14557,7 +15042,7 @@ function writeLocalConfigJson(path2, payload) {
   if (existsSync6(path2)) {
     chmodSync(path2, localConfigFileMode);
   }
-  writeFileSync2(path2, `${JSON.stringify(payload, null, 2)}
+  writeFileSync3(path2, `${JSON.stringify(payload, null, 2)}
 `, {
     encoding: "utf8",
     mode: localConfigFileMode
@@ -14584,7 +15069,7 @@ function readLocalConfigFile(path2) {
   if (!existsSync6(path2)) {
     return { version: 1, allowedCwds: [] };
   }
-  const parsed = JSON.parse(readFileSync7(path2, "utf8"));
+  const parsed = JSON.parse(readFileSync8(path2, "utf8"));
   if (!isConfigPayload(parsed)) {
     throw new Error(`invalid Linzumi config: ${path2}`);
   }
@@ -14613,7 +15098,7 @@ function writeLocalConfigSection(config, path2, linzumiUrl) {
     version: 1,
     [scopeKey]: nextSection
   };
-  mkdirSync4(dirname4(path2), { recursive: true });
+  mkdirSync5(dirname4(path2), { recursive: true });
   writeLocalConfigJson(path2, next);
 }
 function isConfigPayload(value) {
@@ -14688,12 +15173,12 @@ function ensureLocalMachineIdSeed(configPath, createMachineId, linzumiUrl) {
   if (!machineIdValid(machineId)) {
     throw new Error(`invalid generated Linzumi machine id: ${machineId}`);
   }
-  mkdirSync4(dirname4(seedPath), { recursive: true });
-  const tempPath = join9(
+  mkdirSync5(dirname4(seedPath), { recursive: true });
+  const tempPath = join11(
     dirname4(seedPath),
     `.${basename5(seedPath)}.${process.pid}.${randomUUID2()}.tmp`
   );
-  writeFileSync2(tempPath, `${machineId}
+  writeFileSync3(tempPath, `${machineId}
 `, { encoding: "utf8", flag: "wx" });
   try {
     linkSync(tempPath, seedPath);
@@ -14716,12 +15201,12 @@ function ensureLocalRunnerIdSeed(configPath, createRunnerId, linzumiUrl) {
   if (!runnerIdValid(runnerId)) {
     throw new Error(`invalid generated Linzumi runner id: ${runnerId}`);
   }
-  mkdirSync4(dirname4(seedPath), { recursive: true });
-  const tempPath = join9(
+  mkdirSync5(dirname4(seedPath), { recursive: true });
+  const tempPath = join11(
     dirname4(seedPath),
     `.${basename5(seedPath)}.${process.pid}.${randomUUID2()}.tmp`
   );
-  writeFileSync2(tempPath, `${runnerId}
+  writeFileSync3(tempPath, `${runnerId}
 `, { encoding: "utf8", flag: "wx" });
   try {
     linkSync(tempPath, seedPath);
@@ -14736,14 +15221,14 @@ function ensureLocalRunnerIdSeed(configPath, createRunnerId, linzumiUrl) {
   }
 }
 function readMachineIdSeed(seedPath) {
-  const machineId = readFileSync7(seedPath, "utf8").trim();
+  const machineId = readFileSync8(seedPath, "utf8").trim();
   if (!machineIdValid(machineId)) {
     throw new Error(`invalid Linzumi machine id seed: ${seedPath}`);
   }
   return machineId;
 }
 function readRunnerIdSeed(seedPath) {
-  const runnerId = readFileSync7(seedPath, "utf8").trim();
+  const runnerId = readFileSync8(seedPath, "utf8").trim();
   if (!runnerIdValid(runnerId)) {
     throw new Error(`invalid Linzumi runner id seed: ${seedPath}`);
   }
@@ -15042,8 +15527,8 @@ var init_remoteCodexExecutionContext = __esm({
 });
 
 // src/helloLinzumiProject.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname5, join as join10, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname5, join as join12, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function createHelloLinzumiProject(input = {}) {
   const options = typeof input === "string" ? { rootPath: input } : input;
@@ -15052,9 +15537,9 @@ function createHelloLinzumiProject(input = {}) {
   const host = normalizeHost(options.host);
   assertTcpPort(port);
   assertWritableDemoRoot(root, options.reset === true);
-  mkdirSync5(join10(root, "src"), { recursive: true });
+  mkdirSync6(join12(root, "src"), { recursive: true });
   for (const file of demoFiles({ root, port, host })) {
-    writeFileSync3(join10(root, file.path), file.content, "utf8");
+    writeFileSync4(join12(root, file.path), file.content, "utf8");
   }
   return {
     root,
@@ -15098,10 +15583,10 @@ function assertWritableDemoRoot(root, reset) {
   if (!existsSync7(root)) {
     return;
   }
-  const markerPath = join10(root, markerFile);
-  const isDemoRoot = existsSync7(markerPath) && readFileSync8(markerPath, "utf8").trim() === "hello-linzumi";
+  const markerPath = join12(root, markerFile);
+  const isDemoRoot = existsSync7(markerPath) && readFileSync9(markerPath, "utf8").trim() === "hello-linzumi";
   if (isDemoRoot && reset) {
-    rmSync(root, { recursive: true, force: true });
+    rmSync2(root, { recursive: true, force: true });
     return;
   }
   if (isDemoRoot) {
@@ -15134,7 +15619,7 @@ var init_helloLinzumiProject = __esm({
     defaultHelloLinzumiHost = "0.0.0.0";
     markerFile = ".linzumi-demo-project";
     moduleDir = dirname5(fileURLToPath2(import.meta.url));
-    linzumiLogoSvg = readFileSync8(join10(moduleDir, "assets", "linzumi-logo.svg"), "utf8");
+    linzumiLogoSvg = readFileSync9(join12(moduleDir, "assets", "linzumi-logo.svg"), "utf8");
     packageJson = `${JSON.stringify(
       {
         name: "hello-linzumi",
@@ -15936,14 +16421,14 @@ import {
   copyFileSync,
   cpSync,
   existsSync as existsSync8,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync7,
   mkdtempSync,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   realpathSync as realpathSync4,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename6, delimiter, dirname as dirname6, join as join11 } from "node:path";
+import { basename as basename6, delimiter, dirname as dirname6, join as join13 } from "node:path";
 function isStartLocalEditorControl(control) {
   return control.type === "start_local_editor";
 }
@@ -16161,24 +16646,24 @@ function codeServerArgs(port, cwd, userDataDir, extensionsDir) {
 }
 function prepareCodeServerProfile(collaboration, editorRuntime) {
   try {
-    const userDataDir = mkdtempSync(join11(tmpdir(), "kandan-local-editor-"));
-    const extensionsDir = join11(userDataDir, "extensions");
-    const collaborationServerDir = join11(userDataDir, "collaboration-server");
-    const tempDir = join11(userDataDir, "tmp");
-    const userSettingsDir = join11(userDataDir, "User");
-    mkdirSync6(userSettingsDir, { recursive: true });
-    mkdirSync6(extensionsDir, { recursive: true });
-    mkdirSync6(collaborationServerDir, { recursive: true });
-    mkdirSync6(tempDir, { recursive: true });
+    const userDataDir = mkdtempSync(join13(tmpdir(), "kandan-local-editor-"));
+    const extensionsDir = join13(userDataDir, "extensions");
+    const collaborationServerDir = join13(userDataDir, "collaboration-server");
+    const tempDir = join13(userDataDir, "tmp");
+    const userSettingsDir = join13(userDataDir, "User");
+    mkdirSync7(userSettingsDir, { recursive: true });
+    mkdirSync7(extensionsDir, { recursive: true });
+    mkdirSync7(collaborationServerDir, { recursive: true });
+    mkdirSync7(tempDir, { recursive: true });
     if (editorRuntime !== void 0) {
       ensureCodeServerBrowserExtensionAssets(editorRuntime);
       installDirectory(
         editorRuntime.assets.documentStateExtensionDir,
-        join11(extensionsDir, "kandan.document-state-telemetry")
+        join13(extensionsDir, "kandan.document-state-telemetry")
       );
     }
-    writeFileSync4(
-      join11(userSettingsDir, "settings.json"),
+    writeFileSync5(
+      join13(userSettingsDir, "settings.json"),
       JSON.stringify(codeServerSettings(collaboration), null, 2)
     );
     return { ok: true, userDataDir, extensionsDir, collaborationServerDir };
@@ -16190,14 +16675,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
   const vscodeRoot = codeServerVscodeRoot(runtime);
   const repairs = [
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "git-base",
         "dist",
         "extension.js"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "git-base",
@@ -16208,14 +16693,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       required: true
     },
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "git-base",
         "dist",
         "extension.js.map"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "git-base",
@@ -16226,14 +16711,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       required: false
     },
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
         "dist",
         "mergeConflictMain.js"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
@@ -16244,14 +16729,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       required: true
     },
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
         "dist",
         "mergeConflictMain.js.map"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
@@ -16269,7 +16754,7 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       case (!required3 && !existsSync8(source)):
         return;
       default:
-        mkdirSync6(dirname6(target), { recursive: true });
+        mkdirSync7(dirname6(target), { recursive: true });
         copyFileSync(source, target);
         return;
     }
@@ -16277,10 +16762,10 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
 }
 function codeServerVscodeRoot(runtime) {
   const roots = uniquePaths([
-    join11(runtime.root, "lib", "vscode"),
-    join11(dirname6(dirname6(runtime.codeServerBin)), "lib", "vscode"),
+    join13(runtime.root, "lib", "vscode"),
+    join13(dirname6(dirname6(runtime.codeServerBin)), "lib", "vscode"),
     ...wrappedCodeServerBin(runtime.codeServerBin).map(
-      (codeServerBin) => join11(dirname6(dirname6(codeServerBin)), "lib", "vscode")
+      (codeServerBin) => join13(dirname6(dirname6(codeServerBin)), "lib", "vscode")
     )
   ]);
   const rootWithRequiredAssets = roots.find(
@@ -16296,7 +16781,7 @@ function codeServerVscodeRoot(runtime) {
 }
 function wrappedCodeServerBin(codeServerBin) {
   try {
-    const script = readFileSync9(codeServerBin, "utf8");
+    const script = readFileSync10(codeServerBin, "utf8");
     const match = script.match(
       /exec\s+(?:"([^"]+)"|'([^']+)'|([^\s]+))\s+"\$@"/u
     );
@@ -16308,8 +16793,8 @@ function wrappedCodeServerBin(codeServerBin) {
 }
 function codeServerBrowserAssetSources(vscodeRoot) {
   return [
-    join11(vscodeRoot, "extensions", "git-base", "dist", "extension.js"),
-    join11(
+    join13(vscodeRoot, "extensions", "git-base", "dist", "extension.js"),
+    join13(
       vscodeRoot,
       "extensions",
       "merge-conflict",
@@ -16388,10 +16873,10 @@ function prepareLinuxCodeServerLaunch(options) {
     options.cwd,
     "--setenv",
     "XDG_DATA_HOME",
-    join11(options.userDataDir, "data"),
+    join13(options.userDataDir, "data"),
     "--setenv",
     "XDG_CONFIG_HOME",
-    join11(options.userDataDir, "config"),
+    join13(options.userDataDir, "config"),
     ...readOnlyRoots.flatMap((path2) => ["--ro-bind-try", path2, path2]),
     "--bind",
     options.cwd,
@@ -16432,7 +16917,7 @@ function resolveCodeServerExecutable(command, envPath) {
     if (directory.trim() === "") {
       continue;
     }
-    const candidate = join11(directory, command);
+    const candidate = join13(directory, command);
     if (!existsSync8(candidate)) {
       continue;
     }
@@ -16518,7 +17003,7 @@ async function startCollaborationSidecar(collaboration, profile, editorRuntime,
     ]);
     const command = nodeRuntimeExecutable();
     const args = [
-      join11(
+      join13(
         profile.collaborationServerDir,
         "open-collaboration-server",
         "bundle",
@@ -16613,11 +17098,11 @@ function nodeRuntimeExecutable(env = process.env, execPath = process.execPath) {
   return basename6(execPath).toLowerCase().includes("bun") ? "node" : execPath;
 }
 async function installLocalTarball(archivePath, destinationDir) {
-  mkdirSync6(destinationDir, { recursive: true });
+  mkdirSync7(destinationDir, { recursive: true });
   await runProcess("tar", ["-xzf", archivePath, "-C", destinationDir]);
 }
 function installDirectory(sourceDir, destinationDir) {
-  mkdirSync6(dirname6(destinationDir), { recursive: true });
+  mkdirSync7(dirname6(destinationDir), { recursive: true });
   cpSync(sourceDir, destinationDir, { recursive: true });
 }
 function codeServerEnv(env, cwd, userDataDir, collaboration) {
@@ -16635,7 +17120,7 @@ function codeServerEnv(env, cwd, userDataDir, collaboration) {
     KANDAN_EDITOR_COLLABORATION_ENTRY_MODE: "kandan_auto_host_or_join",
     KANDAN_EDITOR_COLLABORATION_ROOM_ID: collaboration.roomId,
     KANDAN_EDITOR_COLLABORATION_SERVER_URL: collaboration.bootstrapServerUrl,
-    KANDAN_EDITOR_COLLABORATION_AUTO_HOST_CLAIM_PATH: join11(
+    KANDAN_EDITOR_COLLABORATION_AUTO_HOST_CLAIM_PATH: join13(
       userDataDir,
       "kandan-oct-auto-host.lock"
     )
@@ -16844,15 +17329,15 @@ import {
   createReadStream,
   createWriteStream as createWriteStream2,
   existsSync as existsSync9,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync5
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { dirname as dirname7, join as join12, resolve as resolve7 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { dirname as dirname7, join as join14, resolve as resolve7 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 async function resolveEditorRuntime(options) {
@@ -17043,14 +17528,14 @@ function normalizeRuntimeAssets(value) {
 }
 function installedRuntime(cacheRoot, manifest) {
   const runtimeRoot = runtimeInstallRoot(cacheRoot, manifest);
-  const manifestPath = join12(runtimeRoot, manifest.manifestPath);
-  const codeServerBin = join12(runtimeRoot, manifest.codeServerBinPath);
+  const manifestPath = join14(runtimeRoot, manifest.manifestPath);
+  const codeServerBin = join14(runtimeRoot, manifest.codeServerBinPath);
   const assets = verifiedRuntimeAssetPaths(runtimeRoot, manifest);
   if (!existsSync9(manifestPath) || !existsSync9(codeServerBin) || assets === void 0) {
     return { ok: false };
   }
   try {
-    const installed = JSON.parse(readFileSync10(manifestPath, "utf8"));
+    const installed = JSON.parse(readFileSync11(manifestPath, "utf8"));
     if (isJsonObject(installed) && installed.version === manifest.version && installed.platform === manifest.platform && (installed.archiveSha256 === void 0 || installed.archiveSha256 === manifest.archiveSha256)) {
       return {
         ok: true,
@@ -17068,10 +17553,10 @@ function installedRuntime(cacheRoot, manifest) {
   return { ok: false };
 }
 async function installRuntime(args) {
-  mkdirSync7(args.cacheRoot, { recursive: true });
-  const tempRoot = mkdtempSync2(join12(args.cacheRoot, ".install-"));
-  const archivePath = join12(tempRoot, "runtime.tar.gz");
-  const extractRoot = join12(tempRoot, "runtime");
+  mkdirSync8(args.cacheRoot, { recursive: true });
+  const tempRoot = mkdtempSync2(join14(args.cacheRoot, ".install-"));
+  const archivePath = join14(tempRoot, "runtime.tar.gz");
+  const extractRoot = join14(tempRoot, "runtime");
   try {
     const downloaded = await downloadArchive({
       kandanUrl: args.kandanUrl,
@@ -17083,7 +17568,7 @@ async function installRuntime(args) {
     if (!downloaded.ok) {
       return downloaded;
     }
-    mkdirSync7(extractRoot, { recursive: true });
+    mkdirSync8(extractRoot, { recursive: true });
     if (!await args.extractArchive(archivePath, extractRoot)) {
       return { ok: false, reason: "archive_extract_failed" };
     }
@@ -17096,14 +17581,14 @@ async function installRuntime(args) {
     if (!assetsInstalled) {
       return { ok: false, reason: "install_failed" };
     }
-    const manifestPath = join12(extractRoot, args.manifest.manifestPath);
-    const codeServerBin = join12(extractRoot, args.manifest.codeServerBinPath);
+    const manifestPath = join14(extractRoot, args.manifest.manifestPath);
+    const codeServerBin = join14(extractRoot, args.manifest.codeServerBinPath);
     const assets = verifiedRuntimeAssetPaths(extractRoot, args.manifest);
     if (!existsSync9(codeServerBin) || assets === void 0) {
       return { ok: false, reason: "invalid_archive" };
     }
-    mkdirSync7(dirname7(manifestPath), { recursive: true });
-    writeFileSync5(
+    mkdirSync8(dirname7(manifestPath), { recursive: true });
+    writeFileSync6(
       manifestPath,
       JSON.stringify(
         {
@@ -17120,29 +17605,29 @@ async function installRuntime(args) {
       )
     );
     const targetRoot = runtimeInstallRoot(args.cacheRoot, args.manifest);
-    rmSync2(targetRoot, { recursive: true, force: true });
-    mkdirSync7(dirname7(targetRoot), { recursive: true });
+    rmSync3(targetRoot, { recursive: true, force: true });
+    mkdirSync8(dirname7(targetRoot), { recursive: true });
     renameSync(extractRoot, targetRoot);
     return {
       ok: true,
       runtime: {
         mode: "server_managed",
         root: targetRoot,
-        codeServerBin: join12(targetRoot, args.manifest.codeServerBinPath),
+        codeServerBin: join14(targetRoot, args.manifest.codeServerBinPath),
         assets: {
-          collaborationExtensionTarball: join12(
+          collaborationExtensionTarball: join14(
             targetRoot,
             "kandan",
             "editor_extensions",
             "typefox.open-collaboration-tools.tar.gz"
           ),
-          collaborationServerTarball: join12(
+          collaborationServerTarball: join14(
             targetRoot,
             "kandan",
             "editor_servers",
             "open-collaboration-server.tar.gz"
           ),
-          documentStateExtensionDir: join12(
+          documentStateExtensionDir: join14(
             targetRoot,
             "kandan",
             "editor_extensions",
@@ -17154,12 +17639,12 @@ async function installRuntime(args) {
   } catch (_error) {
     return { ok: false, reason: "install_failed" };
   } finally {
-    rmSync2(tempRoot, { recursive: true, force: true });
+    rmSync3(tempRoot, { recursive: true, force: true });
   }
 }
 async function materializeRuntimeAssets(args) {
   for (const asset of args.manifest.assets) {
-    const targetPath = join12(args.runtimeRoot, asset.path);
+    const targetPath = join14(args.runtimeRoot, asset.path);
     try {
       const bytes = await runtimeAssetBytes({
         kandanUrl: args.kandanUrl,
@@ -17169,8 +17654,8 @@ async function materializeRuntimeAssets(args) {
       if (bytes === void 0) {
         continue;
       }
-      mkdirSync7(dirname7(targetPath), { recursive: true });
-      writeFileSync5(targetPath, bytes);
+      mkdirSync8(dirname7(targetPath), { recursive: true });
+      writeFileSync6(targetPath, bytes);
     } catch (_error) {
       return false;
     }
@@ -17260,19 +17745,19 @@ function runtimeInstallRoot(cacheRoot, manifest) {
   return resolve7(cacheRoot, manifest.platform, manifest.archiveSha256);
 }
 function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
-  const collaborationExtensionTarball = join12(
+  const collaborationExtensionTarball = join14(
     runtimeRoot,
     "kandan",
     "editor_extensions",
     "typefox.open-collaboration-tools.tar.gz"
   );
-  const collaborationServerTarball = join12(
+  const collaborationServerTarball = join14(
     runtimeRoot,
     "kandan",
     "editor_servers",
     "open-collaboration-server.tar.gz"
   );
-  const documentStateExtensionDir = join12(
+  const documentStateExtensionDir = join14(
     runtimeRoot,
     "kandan",
     "editor_extensions",
@@ -17281,7 +17766,7 @@ function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
   const codeServerRoot = codeServerRuntimeRoot(manifest.codeServerBinPath);
   const requiredPaths = [
     manifest.codeServerBinPath,
-    join12(
+    join14(
       codeServerRoot,
       "lib",
       "vscode",
@@ -17291,7 +17776,7 @@ function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
       "web",
       "vsda.js"
     ),
-    join12(
+    join14(
       codeServerRoot,
       "lib",
       "vscode",
@@ -17312,7 +17797,7 @@ function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
     if (expectedSha256 === void 0 && relativePath !== manifest.codeServerBinPath) {
       return void 0;
     }
-    const absolutePath = join12(runtimeRoot, relativePath);
+    const absolutePath = join14(runtimeRoot, relativePath);
     if (!existsSync9(absolutePath)) {
       return void 0;
     }
@@ -17341,10 +17826,10 @@ function manifestAssetChecksums(assets) {
   return checksums;
 }
 function fileSha256Sync(path2) {
-  return createHash4("sha256").update(readFileSync10(path2)).digest("hex");
+  return createHash4("sha256").update(readFileSync11(path2)).digest("hex");
 }
 function defaultEditorRuntimeCacheRoot() {
-  return join12(homedir10(), ".linzumi", "editor-runtimes");
+  return join14(homedir11(), ".linzumi", "editor-runtimes");
 }
 function nonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
@@ -17364,7 +17849,7 @@ var init_localEditorRuntime = __esm({
 
 // src/dependencyStatus.ts
 import { spawn as spawn6, spawnSync as spawnSync4 } from "node:child_process";
-import { delimiter as delimiter2, dirname as dirname8, join as join13 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname8, join as join15 } from "node:path";
 function probeTool(command, cwd) {
   return new Promise((resolve12) => {
     const args = ["--version"];
@@ -17521,8 +18006,8 @@ function voltaCommandCandidates(args) {
     new Set(
       [
         voltaBinBesideCodexShim(args.codexBin),
-        env.VOLTA_HOME === void 0 ? void 0 : join13(env.VOLTA_HOME, "bin", "volta"),
-        env.HOME === void 0 ? void 0 : join13(env.HOME, ".volta", "bin", "volta"),
+        env.VOLTA_HOME === void 0 ? void 0 : join15(env.VOLTA_HOME, "bin", "volta"),
+        env.HOME === void 0 ? void 0 : join15(env.HOME, ".volta", "bin", "volta"),
         ...pathVoltaCandidates(env.PATH)
       ].filter((candidate) => candidate !== void 0)
     )
@@ -17530,10 +18015,10 @@ function voltaCommandCandidates(args) {
 }
 function voltaBinBesideCodexShim(codexBin) {
   const normalizedCodexBin = codexBin.replaceAll("\\", "/");
-  return normalizedCodexBin.endsWith("/.volta/bin/codex") ? join13(dirname8(codexBin), "volta") : void 0;
+  return normalizedCodexBin.endsWith("/.volta/bin/codex") ? join15(dirname8(codexBin), "volta") : void 0;
 }
 function pathVoltaCandidates(pathValue) {
-  return pathValue === void 0 ? [] : pathValue.split(delimiter2).filter((entry) => entry !== "").map((entry) => join13(entry, "volta"));
+  return pathValue === void 0 ? [] : pathValue.split(delimiter2).filter((entry) => entry !== "").map((entry) => join15(entry, "volta"));
 }
 function codeServerDependencyStatus(args) {
   switch (args.editorRuntime?.status) {
@@ -17642,7 +18127,7 @@ var linzumiCliVersion, linzumiCliVersionText;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    linzumiCliVersion = "0.0.82-beta";
+    linzumiCliVersion = "0.0.84-beta";
     linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
   }
 });
@@ -17651,19 +18136,21 @@ var init_version = __esm({
 import {
   closeSync as closeSync2,
   existsSync as existsSync10,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync3,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
+  renameSync as renameSync2,
   unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync7,
   writeSync
 } from "node:fs";
-import { dirname as dirname9, join as join14 } from "node:path";
+import { dirname as dirname9, join as join16 } from "node:path";
 function isRunnerLockHeldError(error) {
   return error instanceof RunnerLockHeldError || error instanceof Error && error.name === runnerLockHeldErrorName && "lockPath" in error && "heldBy" in error;
 }
 function runnerLockPath(machineId, configPath = localConfigPath(), linzumiUrl) {
   const lockName = linzumiUrl === void 0 ? encodeURIComponent(machineId) : localConfigScopeFileStem(linzumiUrl);
-  return join14(dirname9(configPath), "runners", `${lockName}.lock`);
+  return join16(dirname9(configPath), "runners", `${lockName}.lock`);
 }
 function acquireRunnerLock(options) {
   const path2 = runnerLockPath(
@@ -17672,6 +18159,9 @@ function acquireRunnerLock(options) {
     options.linzumiUrl
   );
   const isPidAlive = options.isPidAlive ?? processIsAlive;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const killPid = options.killPid ?? sigkillProcess;
+  const startedAt = now().toISOString();
   const record = {
     version: 1,
     machineId: options.machineId,
@@ -17681,29 +18171,95 @@ function acquireRunnerLock(options) {
     workspace: options.workspace,
     ...options.linzumiUrl === void 0 ? {} : { linzumiUrl: kandanHttpBaseUrl(options.linzumiUrl) },
     ...options.launchSource === void 0 ? {} : { launchSource: options.launchSource },
-    startedAt: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+    startedAt,
+    heartbeatAt: startedAt,
     cliVersion: options.cliVersion ?? linzumiCliVersion
   };
   rejectLiveLegacyProductionRunnerLock(
     options.machineId,
     options.configPath,
     options.linzumiUrl,
-    isPidAlive
+    isPidAlive,
+    now,
+    killPid,
+    options.onTakeover
   );
   writeLockOrHandleExisting(
     path2,
     record,
     isPidAlive,
+    now,
+    killPid,
+    options.onTakeover,
     options.beforeReadExistingLock,
     options.beforeReplaceStaleLock
   );
+  const heartbeat = () => stampRunnerLockHeartbeat(path2, record, now);
+  const heartbeatTimer = setInterval(heartbeat, runnerLockHeartbeatIntervalMs);
+  heartbeatTimer.unref();
   return {
     path: path2,
     record,
-    release: () => releaseRunnerLock(path2, record)
+    heartbeat,
+    release: () => {
+      clearInterval(heartbeatTimer);
+      releaseRunnerLock(path2, record);
+    }
   };
 }
-function rejectLiveLegacyProductionRunnerLock(machineId, configPath, linzumiUrl, isPidAlive) {
+function stampRunnerLockHeartbeat(path2, record, now) {
+  try {
+    const current = readRunnerLockIfPresent(path2);
+    if (current === void 0 || current.machineId !== record.machineId || current.runnerId !== record.runnerId || current.pid !== record.pid || current.startedAt !== record.startedAt) {
+      return;
+    }
+    const next = {
+      ...current,
+      heartbeatAt: now().toISOString()
+    };
+    const tmpPath = `${path2}.tmp`;
+    writeFileSync7(tmpPath, `${JSON.stringify(next, null, 2)}
+`, "utf8");
+    renameSync2(tmpPath, path2);
+  } catch (_error) {
+  }
+}
+function assessRunnerLockHolder(record, isPidAlive, now) {
+  if (!isPidAlive(record.pid)) {
+    return { state: "dead" };
+  }
+  const reference = record.heartbeatAt ?? record.startedAt;
+  const referenceMs = Date.parse(reference);
+  if (Number.isNaN(referenceMs) || now().getTime() - referenceMs > runnerLockTakeoverAfterMs) {
+    return {
+      state: "wedged",
+      reason: record.heartbeatAt === void 0 ? "missing_heartbeat" : "stale_heartbeat"
+    };
+  }
+  return { state: "live" };
+}
+function takeOverWedgedHolder(lockPath, holder, reason, killPid, onTakeover) {
+  try {
+    killPid(holder.pid);
+  } catch (error) {
+    const code = error !== null && typeof error === "object" && "code" in error ? error.code : void 0;
+    if (code === "ESRCH") {
+    } else if (code === "EPERM" || code === "EACCES") {
+      throw new Error(
+        `Cannot take over the runner lock at ${lockPath}: its holder process (pid ${holder.pid}) is owned by another user and cannot be stopped. Stop that process, or remove the lock file, then retry.`
+      );
+    } else {
+      throw error;
+    }
+  }
+  onTakeover?.({
+    lockPath,
+    holderPid: holder.pid,
+    holderRunnerId: holder.runnerId,
+    reason
+  });
+}
+function rejectLiveLegacyProductionRunnerLock(machineId, configPath, linzumiUrl, isPidAlive, now, killPid, onTakeover) {
   if (linzumiUrl === void 0 || localConfigScopeKey(linzumiUrl) !== localConfigScopeKey(defaultLinzumiHttpUrl)) {
     return;
   }
@@ -17712,20 +18268,31 @@ function rejectLiveLegacyProductionRunnerLock(machineId, configPath, linzumiUrl,
   if (existing === void 0) {
     return;
   }
-  if (isPidAlive(existing.pid)) {
+  if (assessRunnerLockHolder(existing, isPidAlive, now).state === "live") {
     throw new RunnerLockHeldError(legacyPath, existing);
   }
   withStaleReplacementLock(legacyPath, isPidAlive, () => {
     const latest = existsSync10(legacyPath) ? readRunnerLock(legacyPath) : void 0;
-    if (latest !== void 0 && isPidAlive(latest.pid)) {
+    if (latest === void 0) {
+      return;
+    }
+    const holder = assessRunnerLockHolder(latest, isPidAlive, now);
+    if (holder.state === "live") {
       throw new RunnerLockHeldError(legacyPath, latest);
     }
-    if (latest !== void 0) {
-      unlinkSync2(legacyPath);
+    if (holder.state === "wedged") {
+      takeOverWedgedHolder(
+        legacyPath,
+        latest,
+        holder.reason,
+        killPid,
+        onTakeover
+      );
     }
+    unlinkSync2(legacyPath);
   });
 }
-function writeLockOrHandleExisting(path2, record, isPidAlive, beforeReadExistingLock, beforeReplaceStaleLock) {
+function writeLockOrHandleExisting(path2, record, isPidAlive, now, killPid, onTakeover, beforeReadExistingLock, beforeReplaceStaleLock) {
   if (tryCreateLock(path2, record)) {
     return;
   }
@@ -17739,16 +18306,20 @@ function writeLockOrHandleExisting(path2, record, isPidAlive, beforeReadExisting
       `another Linzumi runner lock appeared while starting: ${path2}`
     );
   }
-  if (isPidAlive(existing.pid)) {
+  if (assessRunnerLockHolder(existing, isPidAlive, now).state === "live") {
     throw new RunnerLockHeldError(path2, existing);
   }
   beforeReplaceStaleLock?.();
   withStaleReplacementLock(path2, isPidAlive, () => {
     const latest = existsSync10(path2) ? readRunnerLock(path2) : void 0;
-    if (latest !== void 0 && isPidAlive(latest.pid)) {
-      throw new RunnerLockHeldError(path2, latest);
-    }
     if (latest !== void 0) {
+      const holder = assessRunnerLockHolder(latest, isPidAlive, now);
+      if (holder.state === "live") {
+        throw new RunnerLockHeldError(path2, latest);
+      }
+      if (holder.state === "wedged") {
+        takeOverWedgedHolder(path2, latest, holder.reason, killPid, onTakeover);
+      }
       unlinkSync2(path2);
     }
     if (!tryCreateLock(path2, record)) {
@@ -17759,7 +18330,7 @@ function writeLockOrHandleExisting(path2, record, isPidAlive, beforeReadExisting
   });
 }
 function tryCreateLock(path2, record) {
-  mkdirSync8(dirname9(path2), { recursive: true });
+  mkdirSync9(dirname9(path2), { recursive: true });
   try {
     const fd = openSync3(path2, "wx");
     try {
@@ -17815,7 +18386,7 @@ function withStaleReplacementLock(path2, isPidAlive, callback) {
 function readReplacementLockPidIfPresent(path2) {
   let value;
   try {
-    value = readFileSync11(path2, "utf8").trim();
+    value = readFileSync12(path2, "utf8").trim();
   } catch (error) {
     if (isNodeErrorCode2(error, "ENOENT")) {
       return void 0;
@@ -17855,14 +18426,19 @@ function readRunnerLockIfPresent(path2) {
   }
 }
 function readRunnerLock(path2) {
-  const parsed = JSON.parse(readFileSync11(path2, "utf8"));
+  const parsed = JSON.parse(readFileSync12(path2, "utf8"));
   if (!isRunnerLockRecord(parsed)) {
     throw new Error(`invalid Linzumi runner lock: ${path2}`);
   }
   return parsed;
 }
 function isRunnerLockRecord(value) {
-  return typeof value === "object" && value !== null && value.version === 1 && typeof value.machineId === "string" && value.machineId.trim() !== "" && typeof value.runnerId === "string" && value.runnerId.trim() !== "" && Number.isInteger(value.pid) && value.pid > 0 && typeof value.cwd === "string" && value.cwd.trim() !== "" && workspaceValid(value.workspace) && linzumiUrlValid(value.linzumiUrl) && typeof value.startedAt === "string" && value.startedAt.trim() !== "" && typeof value.cliVersion === "string" && value.cliVersion.trim() !== "";
+  return typeof value === "object" && value !== null && value.version === 1 && typeof value.machineId === "string" && value.machineId.trim() !== "" && typeof value.runnerId === "string" && value.runnerId.trim() !== "" && Number.isInteger(value.pid) && value.pid > 0 && typeof value.cwd === "string" && value.cwd.trim() !== "" && workspaceValid(value.workspace) && linzumiUrlValid(value.linzumiUrl) && typeof value.startedAt === "string" && value.startedAt.trim() !== "" && heartbeatAtValid(
+    value.heartbeatAt
+  ) && typeof value.cliVersion === "string" && value.cliVersion.trim() !== "";
+}
+function heartbeatAtValid(value) {
+  return value === void 0 || typeof value === "string" && value.trim() !== "";
 }
 function linzumiUrlValid(value) {
   return value === void 0 || typeof value === "string" && value.trim() !== "";
@@ -17878,6 +18454,15 @@ function processIsAlive(pid) {
     return isNodeErrorCode2(error, "ESRCH") ? false : true;
   }
 }
+function sigkillProcess(pid) {
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch (error) {
+    if (!isNodeErrorCode2(error, "ESRCH")) {
+      throw error;
+    }
+  }
+}
 function activeRunnerLockMessage(path2, record) {
   const workspace = record.workspace === null ? "workspace: unknown" : `workspace: ${record.workspace}`;
   const linzumiUrl = record.linzumiUrl === void 0 ? void 0 : `linzumi url: ${displayLinzumiUrl(record.linzumiUrl)}`;
@@ -17901,7 +18486,11 @@ function activeRunnerLockMessage(path2, record) {
     `CLI version: ${record.cliVersion}`,
     `started at: ${record.startedAt}`,
     `lock: ${path2}`,
-    "Stop that process first, then retry. If the process has already exited, remove the stale lock file and retry."
+    "Stop that process first, then retry. If the process has already exited, remove the stale lock file and retry.",
+    // Wedged-runner escape hatch: the holder above had a FRESH heartbeat, so
+    // it really is running. A holder that stops heartbeating (wedged event
+    // loop) is taken over automatically after 3 minutes - no kill -9 needed.
+    "A runner whose lock heartbeat goes stale (no update for 3 minutes) is taken over automatically on the next connect."
   ].join("\n");
 }
 function displayLinzumiUrl(linzumiUrl) {
@@ -17913,7 +18502,7 @@ function displayLinzumiUrl(linzumiUrl) {
 function isNodeErrorCode2(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
-var runnerLockHeldErrorName, RunnerLockHeldError;
+var runnerLockHeartbeatIntervalMs, runnerLockTakeoverAfterMs, runnerLockHeldErrorName, RunnerLockHeldError;
 var init_runnerLock = __esm({
   "src/runnerLock.ts"() {
     "use strict";
@@ -17921,6 +18510,8 @@ var init_runnerLock = __esm({
     init_oauth();
     init_defaultUrls();
     init_version();
+    runnerLockHeartbeatIntervalMs = 3e4;
+    runnerLockTakeoverAfterMs = 3 * 6e4;
     runnerLockHeldErrorName = "RunnerLockHeldError";
     RunnerLockHeldError = class extends Error {
       lockPath;
@@ -17974,9 +18565,9 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
   const previousJobKey = latestDashboardJob(state)?.key;
   switch (event) {
     case "onboarding.discovery_agents_started":
-      state.browserUrl = stringValue4(payload.kandanUrl);
-      state.workspace = stringValue4(payload.workspace);
-      state.runnerId = stringValue4(payload.runnerId);
+      state.browserUrl = stringValue5(payload.kandanUrl);
+      state.workspace = stringValue5(payload.workspace);
+      state.runnerId = stringValue5(payload.runnerId);
       break;
     // Half-open-socket signal (PR #1677 follow-up item 2 slice): the runner
     // logs these exactly once per stale/recovered transition.
@@ -17987,10 +18578,10 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
       state.connectionStale = false;
       break;
     case "onboarding.discovery_status": {
-      const phase = stringValue4(payload.phase);
-      const status = stringValue4(payload.status);
-      const metadata = objectValue5(payload.metadata);
-      const workerId = stringValue4(metadata?.worker_id);
+      const phase = stringValue5(payload.phase);
+      const status = stringValue5(payload.status);
+      const metadata = objectValue6(payload.metadata);
+      const workerId = stringValue5(metadata?.worker_id);
       if (phase !== void 0 && status !== void 0) {
         const isConversationPhase = phase === "conversations";
         const key = isConversationPhase ? phase : workerId ?? phase;
@@ -18004,10 +18595,10 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
             previous?.placesSearched ?? 0,
             numberValue(payload.places_searched) ?? 0
           ),
-          message: stringValue4(payload.message) ?? (isConversationPhase ? previous?.message : void 0),
-          currentPlace: stringValue4(payload.current_place) ?? (isConversationPhase ? previous?.currentPlace : void 0),
-          currentSource: stringValue4(payload.current_source) ?? (isConversationPhase ? previous?.currentSource : void 0),
-          lastError: stringValue4(payload.last_error),
+          message: stringValue5(payload.message) ?? (isConversationPhase ? previous?.message : void 0),
+          currentPlace: stringValue5(payload.current_place) ?? (isConversationPhase ? previous?.currentPlace : void 0),
+          currentSource: stringValue5(payload.current_source) ?? (isConversationPhase ? previous?.currentSource : void 0),
+          lastError: stringValue5(payload.last_error),
           metadata: mergedMetadata,
           updatedAtMs: nowMs
         });
@@ -18017,10 +18608,10 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     case "kandan.message_queued":
     case "codex.turn_starting": {
       const job = dashboardJobForPayload(state, payload, nowMs);
-      job.linzumiThreadId = stringValue4(payload.linzumi_thread_id) ?? job.linzumiThreadId;
+      job.linzumiThreadId = stringValue5(payload.linzumi_thread_id) ?? job.linzumiThreadId;
       job.linzumiThreadTitle = dashboardLinzumiThreadTitle(payload) ?? job.linzumiThreadTitle;
-      job.codexThreadId = stringValue4(payload.codex_thread_id) ?? job.codexThreadId;
-      job.lastIncomingPreview = stringValue4(payload.body_preview) ?? job.lastIncomingPreview;
+      job.codexThreadId = stringValue5(payload.codex_thread_id) ?? job.codexThreadId;
+      job.lastIncomingPreview = stringValue5(payload.body_preview) ?? job.lastIncomingPreview;
       job.lastIncomingAtMs = numberValue(payload.message_received_at_ms) ?? job.lastIncomingAtMs;
       job.queueDepth = numberValue(payload.queue_depth) ?? job.queueDepth;
       job.eventType = dashboardEventLabel(event);
@@ -18028,9 +18619,9 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
       break;
     }
     case "codex.notification": {
-      const tokenUsage = stringValue4(payload.token_usage_summary);
-      const rateLimit = stringValue4(payload.rate_limit_summary);
-      const creditExhaustion = stringValue4(payload.credit_exhaustion_summary);
+      const tokenUsage = stringValue5(payload.token_usage_summary);
+      const rateLimit = stringValue5(payload.rate_limit_summary);
+      const creditExhaustion = stringValue5(payload.credit_exhaustion_summary);
       if (tokenUsage !== void 0) {
         state.tokenUsage = tokenUsage;
       }
@@ -18040,13 +18631,13 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
       if (creditExhaustion !== void 0) {
         state.creditExhaustion = creditExhaustion;
       }
-      const method = stringValue4(payload.method);
-      const metadata = objectValue5(payload.metadata);
-      const metadataHasJobSignal = stringValue4(metadata?.threadId) !== void 0 || stringValue4(metadata?.turnId) !== void 0 || stringValue4(metadata?.itemId) !== void 0;
+      const method = stringValue5(payload.method);
+      const metadata = objectValue6(payload.metadata);
+      const metadataHasJobSignal = stringValue5(metadata?.threadId) !== void 0 || stringValue5(metadata?.turnId) !== void 0 || stringValue5(metadata?.itemId) !== void 0;
       if (!metadataHasJobSignal) {
         break;
       }
-      const codexThreadId = stringValue4(metadata?.threadId);
+      const codexThreadId = stringValue5(metadata?.threadId);
       const job = codexThreadId === void 0 ? latestDashboardJob(state) : dashboardJobForKey(state, `codex:${codexThreadId}`, nowMs);
       if (job !== void 0) {
         job.codexThreadId = codexThreadId ?? job.codexThreadId;
@@ -18054,7 +18645,7 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
         job.creditExhaustion = creditExhaustion ?? job.creditExhaustion;
         job.latestCodexEventId = codexEventId(payload);
         job.eventType = payload.credit_exhaustion_detected === true ? "credit_exhausted" : method ?? event;
-        job.turnId = stringValue4(metadata?.turnId) ?? job.turnId;
+        job.turnId = stringValue5(metadata?.turnId) ?? job.turnId;
         job.updatedAtMs = nowMs;
       }
       break;
@@ -18066,11 +18657,11 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     case "kandan.codex_file_change_forwarded":
     case "kandan.codex_web_search_progress_forwarded": {
       const job = dashboardJobForPayload(state, payload, nowMs);
-      job.latestCodexEventId = stringValue4(payload.item_key) ?? job.latestCodexEventId;
+      job.latestCodexEventId = stringValue5(payload.item_key) ?? job.latestCodexEventId;
       job.eventType = codexOutputDashboardLabel(event, payload);
-      job.turnId = stringValue4(payload.turn_id) ?? job.turnId;
-      if (stringValue4(payload.structured_kind) === "codex_assistant_message") {
-        job.lastAssistantPreview = stringValue4(payload.body_preview) ?? job.lastAssistantPreview;
+      job.turnId = stringValue5(payload.turn_id) ?? job.turnId;
+      if (stringValue5(payload.structured_kind) === "codex_assistant_message") {
+        job.lastAssistantPreview = stringValue5(payload.body_preview) ?? job.lastAssistantPreview;
         job.lastAssistantAtMs = nowMs;
       }
       job.updatedAtMs = nowMs;
@@ -18085,7 +18676,7 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     case "claude_code.turn_starting":
     case "claude_code.message_queued": {
       const job = claudeDashboardJob(state, payload, nowMs);
-      job.lastIncomingPreview = stringValue4(payload.body_preview) ?? job.lastIncomingPreview;
+      job.lastIncomingPreview = stringValue5(payload.body_preview) ?? job.lastIncomingPreview;
       job.lastIncomingAtMs = numberValue(payload.message_received_at_ms) ?? job.lastIncomingAtMs;
       job.eventType = event === "claude_code.message_queued" ? "message_queued" : "turn_starting";
       job.updatedAtMs = nowMs;
@@ -18099,7 +18690,7 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     }
     case "claude_code.turn_completed": {
       const job = claudeDashboardJob(state, payload, nowMs);
-      job.lastAssistantPreview = stringValue4(payload.body_preview) ?? job.lastAssistantPreview;
+      job.lastAssistantPreview = stringValue5(payload.body_preview) ?? job.lastAssistantPreview;
       job.lastAssistantAtMs = nowMs;
       job.eventType = "turn_completed";
       job.updatedAtMs = nowMs;
@@ -18107,13 +18698,13 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
     }
     case "claude_code.turn_terminal": {
       const job = claudeDashboardJob(state, payload, nowMs);
-      job.turnId = stringValue4(payload.turn_id) ?? job.turnId;
-      job.eventType = `turn_${stringValue4(payload.outcome) ?? "terminal"}`;
+      job.turnId = stringValue5(payload.turn_id) ?? job.turnId;
+      job.eventType = `turn_${stringValue5(payload.outcome) ?? "terminal"}`;
       job.updatedAtMs = nowMs;
       break;
     }
     case "claude_code.rate_limit": {
-      const rateLimit = stringValue4(payload.rate_limit_summary);
+      const rateLimit = stringValue5(payload.rate_limit_summary);
       if (rateLimit !== void 0) {
         state.rateLimit = mergeRateLimitSummary(state.rateLimit, rateLimit);
       }
@@ -18122,6 +18713,19 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
       job.updatedAtMs = nowMs;
       break;
     }
+    // Live token counter parity with codex.notification token_usage_summary:
+    // mid-turn usage events advance the dashboard counters per model round.
+    case "claude_code.token_usage": {
+      const tokenUsage = stringValue5(payload.token_usage_summary);
+      const job = claudeDashboardJob(state, payload, nowMs);
+      if (tokenUsage !== void 0) {
+        state.tokenUsage = tokenUsage;
+        job.tokenUsage = tokenUsage;
+      }
+      job.eventType = "token_usage";
+      job.updatedAtMs = nowMs;
+      break;
+    }
     default:
       break;
   }
@@ -18279,7 +18883,7 @@ function conversationImportProgressText(status) {
   )}] ${reportedCount} / ${totalCount} Codex/Claude Code conversations`;
 }
 function conversationImportMetadata(metadata) {
-  return stringValue4(metadata?.worker_id) === "conversations-local-import" || numberValue(metadata?.imported_count) !== void 0 || numberValue(metadata?.failed_import_count) !== void 0 || numberValue(metadata?.total_count) !== void 0;
+  return stringValue5(metadata?.worker_id) === "conversations-local-import" || numberValue(metadata?.imported_count) !== void 0 || numberValue(metadata?.failed_import_count) !== void 0 || numberValue(metadata?.total_count) !== void 0;
 }
 function conversationImportProgressBar(reportedCount, totalCount) {
   const width = 10;
@@ -18538,12 +19142,12 @@ function formatRunnerConsoleEvent(event, payload) {
     case "codex.turn_started":
       return `Codex turn started: id=${text(payload.turn_id)}`;
     case "codex.notification": {
-      const creditExhaustion = stringValue4(payload.credit_exhaustion_summary);
+      const creditExhaustion = stringValue5(payload.credit_exhaustion_summary);
       const summary = [
         creditExhaustion === void 0 ? void 0 : `URGENT ${creditExhaustion}`,
-        stringValue4(payload.token_usage_summary),
-        stringValue4(payload.rate_limit_summary),
-        stringValue4(payload.diagnostic_summary)
+        stringValue5(payload.token_usage_summary),
+        stringValue5(payload.rate_limit_summary),
+        stringValue5(payload.diagnostic_summary)
       ].filter((value) => value !== void 0).join(" | ");
       const suffix = summary === "" ? "" : ` ${summary}`;
       return `Codex event [id=${codexEventId(payload)}]: ${text(payload.method)}${suffix}`;
@@ -18581,7 +19185,9 @@ function formatRunnerConsoleEvent(event, payload) {
     case "claude_code.turn_terminal":
       return `Claude Code turn ${text(payload.outcome)}: id=${text(payload.turn_id)}`;
     case "claude_code.rate_limit":
-      return `Claude Code rate limit: ${stringValue4(payload.rate_limit_summary) ?? "seen (no details)"}`;
+      return `Claude Code rate limit: ${stringValue5(payload.rate_limit_summary) ?? "seen (no details)"}`;
+    case "claude_code.token_usage":
+      return `Claude Code token usage: ${stringValue5(payload.token_usage_summary) ?? "seen (no details)"}`;
     default:
       return void 0;
   }
@@ -18605,12 +19211,12 @@ function secondsLabel(value) {
   return ms === void 0 ? "?" : `${(ms / 1e3).toFixed(1)}s`;
 }
 function onboardingDiscoveryStatusLine(payload) {
-  const phase = discoveryPhaseLabel(stringValue4(payload.phase) ?? "discovery");
-  const status = discoveryStatusLabel(stringValue4(payload.status) ?? "unknown");
+  const phase = discoveryPhaseLabel(stringValue5(payload.phase) ?? "discovery");
+  const status = discoveryStatusLabel(stringValue5(payload.status) ?? "unknown");
   const placesSearched = numberValue(payload.places_searched) ?? 0;
-  const currentPlace = stringValue4(payload.current_place);
-  const message = stringValue4(payload.message);
-  const detail = stringValue4(payload.last_error) ?? currentPlace ?? message ?? "Checking local context";
+  const currentPlace = stringValue5(payload.current_place);
+  const message = stringValue5(payload.message);
+  const detail = stringValue5(payload.last_error) ?? currentPlace ?? message ?? "Checking local context";
   return `Onboarding discovery: ${phase} ${status} checked=${placesSearched} current=${detail}`;
 }
 function onboardingDiscoveryInitialSearchCompletedLine(payload) {
@@ -18630,11 +19236,11 @@ function connectedRunnerMessage(payload) {
   ].filter((line) => line !== void 0).join("\n");
 }
 function optionalLine(label, value) {
-  const normalized = stringValue4(value) ?? numberValue(value)?.toString();
+  const normalized = stringValue5(value) ?? numberValue(value)?.toString();
   return normalized === void 0 ? void 0 : `${label}: ${normalized}`;
 }
 function optionalField(label, value) {
-  const normalized = stringValue4(value) ?? numberValue(value)?.toString();
+  const normalized = stringValue5(value) ?? numberValue(value)?.toString();
   return normalized === void 0 ? void 0 : `${label}=${normalized}`;
 }
 function ignoredMessage(payload) {
@@ -18658,17 +19264,17 @@ function replacementLines(value) {
       return [];
     }
     const record = entry;
-    const runnerId = stringValue4(record.runnerId);
+    const runnerId = stringValue5(record.runnerId);
     if (runnerId === void 0) {
       return [];
     }
-    const version = stringValue4(record.version);
+    const version = stringValue5(record.version);
     const suffix = version === void 0 ? "" : ` (CLI ${version})`;
     return [`Replaced older runner from this machine: ${runnerId}${suffix}`];
   });
 }
 function sender(payload) {
-  const slug = stringValue4(payload.actor_slug);
+  const slug = stringValue5(payload.actor_slug);
   const userId = numberValue(payload.actor_user_id);
   if (slug !== void 0 && userId !== void 0) {
     return `${slug}#${userId}`;
@@ -18676,7 +19282,7 @@ function sender(payload) {
   return slug ?? (userId === void 0 ? "unknown" : `user#${userId}`);
 }
 function codexOutputLabel(payload) {
-  const kind = stringValue4(payload.structured_kind) ?? "output";
+  const kind = stringValue5(payload.structured_kind) ?? "output";
   switch (kind) {
     case "codex_assistant_message":
       return "assistant_message";
@@ -18702,7 +19308,7 @@ function codexEventId(payload) {
   const metadata = payload.metadata;
   if (typeof metadata === "object" && metadata !== null && !Array.isArray(metadata)) {
     const record = metadata;
-    return stringValue4(record.turnId) ?? stringValue4(record.itemId) ?? stringValue4(record.threadId) ?? "?";
+    return stringValue5(record.turnId) ?? stringValue5(record.itemId) ?? stringValue5(record.threadId) ?? "?";
   }
   return "?";
 }
@@ -18718,8 +19324,8 @@ function rememberRawLine(state, event, payload, previousJobKey) {
   }
 }
 function dashboardRawLineJobKey(state, payload, previousJobKey) {
-  const linzumiThreadId = stringValue4(payload.linzumi_thread_id);
-  const codexThreadId = stringValue4(payload.codex_thread_id);
+  const linzumiThreadId = stringValue5(payload.linzumi_thread_id);
+  const codexThreadId = stringValue5(payload.codex_thread_id);
   if (linzumiThreadId !== void 0) {
     return `linzumi:${linzumiThreadId}`;
   }
@@ -18728,7 +19334,7 @@ function dashboardRawLineJobKey(state, payload, previousJobKey) {
       (job) => job.codexThreadId === codexThreadId
     )?.key;
   }
-  const claudeSessionId = stringValue4(payload.claude_session_id);
+  const claudeSessionId = stringValue5(payload.claude_session_id);
   if (claudeSessionId !== void 0) {
     const claudeJobKey = Array.from(state.jobs.values()).find(
       (job) => job.codexThreadId === claudeSessionId
@@ -18737,8 +19343,8 @@ function dashboardRawLineJobKey(state, payload, previousJobKey) {
       return claudeJobKey;
     }
   }
-  const metadata = objectValue5(payload.metadata);
-  const metadataCodexThreadId = stringValue4(metadata?.threadId);
+  const metadata = objectValue6(payload.metadata);
+  const metadataCodexThreadId = stringValue5(metadata?.threadId);
   if (metadataCodexThreadId !== void 0) {
     return Array.from(state.jobs.values()).find(
       (job) => job.codexThreadId === metadataCodexThreadId
@@ -19197,13 +19803,13 @@ function updateRunnerConsoleDashboardMode(state, key) {
   }
 }
 function claudeDashboardJob(state, payload, nowMs) {
-  const claudeSessionId = stringValue4(payload.claude_session_id);
+  const claudeSessionId = stringValue5(payload.claude_session_id);
   const job = dashboardJobForPayload(
     state,
     {
       ...payload,
-      linzumi_thread_id: stringValue4(payload.linzumi_thread_id) ?? stringValue4(payload.thread_id),
-      codex_thread_id: stringValue4(payload.codex_thread_id) ?? claudeSessionId
+      linzumi_thread_id: stringValue5(payload.linzumi_thread_id) ?? stringValue5(payload.thread_id),
+      codex_thread_id: stringValue5(payload.codex_thread_id) ?? claudeSessionId
     },
     nowMs
   );
@@ -19214,8 +19820,8 @@ function claudeDashboardJob(state, payload, nowMs) {
   return job;
 }
 function dashboardJobForPayload(state, payload, nowMs) {
-  const linzumiThreadId = stringValue4(payload.linzumi_thread_id);
-  const codexThreadId = stringValue4(payload.codex_thread_id);
+  const linzumiThreadId = stringValue5(payload.linzumi_thread_id);
+  const codexThreadId = stringValue5(payload.codex_thread_id);
   const existingByCodex = codexThreadId !== void 0 ? Array.from(state.jobs.values()).find(
     (job) => job.codexThreadId === codexThreadId
   ) : void 0;
@@ -19388,7 +19994,7 @@ function linzumiThreadLabel(job) {
   return firstN(job.linzumiThreadTitle, 30);
 }
 function dashboardLinzumiThreadTitle(payload) {
-  return stringValue4(payload.linzumi_thread_title) ?? stringValue4(payload.thread_title) ?? stringValue4(payload.threadTitle) ?? stringValue4(payload.title);
+  return stringValue5(payload.linzumi_thread_title) ?? stringValue5(payload.thread_title) ?? stringValue5(payload.threadTitle) ?? stringValue5(payload.title);
 }
 function agentId(codexThreadId, provider) {
   if (codexThreadId === void 0) {
@@ -19432,13 +20038,13 @@ function timeAgo(valueMs, nowMs) {
   }
   return `${Math.floor(minutes / 60)}h`;
 }
-function objectValue5(value) {
+function objectValue6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function text(value) {
-  return stringValue4(value) ?? numberValue(value)?.toString() ?? "?";
+  return stringValue5(value) ?? numberValue(value)?.toString() ?? "?";
 }
-function stringValue4(value) {
+function stringValue5(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function numberValue(value) {
@@ -19525,8 +20131,8 @@ var init_runnerConsoleReporter = __esm({
 });
 
 // src/telemetry.ts
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname10, basename as basename7, join as join15 } from "node:path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname10, basename as basename7, join as join17 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function peekFlagValue(args, flags) {
   for (let index = 0; index < args.length; index += 1) {
@@ -19565,12 +20171,12 @@ function telemetryBaseUrl(apiUrl, env = process.env) {
   }
 }
 function telemetryInstallIdPath(env = process.env) {
-  return join15(dirname10(localConfigPath(env)), "install-id");
+  return join17(dirname10(localConfigPath(env)), "install-id");
 }
 function ensureTelemetryInstallId(env = process.env) {
   const path2 = telemetryInstallIdPath(env);
   try {
-    const existing = readFileSync12(path2, "utf8").trim();
+    const existing = readFileSync13(path2, "utf8").trim();
     if (existing !== "" && existing.length <= 128) {
       return existing;
     }
@@ -19578,8 +20184,8 @@ function ensureTelemetryInstallId(env = process.env) {
   }
   const installId = randomUUID3();
   try {
-    mkdirSync9(dirname10(path2), { recursive: true });
-    writeFileSync6(path2, `${installId}
+    mkdirSync10(dirname10(path2), { recursive: true });
+    writeFileSync8(path2, `${installId}
 `, { mode: 384 });
   } catch {
   }
@@ -19766,17 +20372,17 @@ var init_linzumiApiClient = __esm({
 });
 
 // src/authCache.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { dirname as dirname11, join as join16 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { dirname as dirname11, join as join18 } from "node:path";
 function defaultAuthFilePath() {
-  return join16(homedir11(), ".linzumi", "auth.json");
+  return join18(homedir12(), ".linzumi", "auth.json");
 }
 function readCachedLocalRunnerToken(kandanUrl, authFilePath = defaultAuthFilePath()) {
   if (!existsSync11(authFilePath)) {
     return void 0;
   }
-  const authFile = parseAuthFile(readFileSync13(authFilePath, "utf8"));
+  const authFile = parseAuthFile(readFileSync14(authFilePath, "utf8"));
   const kandanBaseUrl = kandanHttpBaseUrl(kandanUrl);
   const entry = authFile.local_codex_runner?.[kandanBaseUrl];
   if (entry === void 0 || entry.access_token.trim() === "") {
@@ -19798,7 +20404,7 @@ function readPersonalAgentDelegationToken(authFilePath) {
       `missing personal-agent delegation auth file: ${authFilePath}`
     );
   }
-  const authFile = parseAuthFile(readFileSync13(authFilePath, "utf8"));
+  const authFile = parseAuthFile(readFileSync14(authFilePath, "utf8"));
   const entry = authFile.personal_agent_delegation;
   if (entry === void 0 || entry.access_token.trim() === "") {
     throw new Error(
@@ -19816,7 +20422,7 @@ function readPersonalAgentDelegationToken(authFilePath) {
 }
 function writeCachedLocalRunnerToken(args) {
   const authFilePath = args.authFilePath ?? defaultAuthFilePath();
-  const existing = existsSync11(authFilePath) ? parseAuthFile(readFileSync13(authFilePath, "utf8")) : { version: 1 };
+  const existing = existsSync11(authFilePath) ? parseAuthFile(readFileSync14(authFilePath, "utf8")) : { version: 1 };
   const kandanBaseUrl = kandanHttpBaseUrl(args.kandanUrl);
   const issuedAt = /* @__PURE__ */ new Date();
   const expiresAt = args.expiresInSeconds === void 0 ? void 0 : new Date(
@@ -19834,8 +20440,8 @@ function writeCachedLocalRunnerToken(args) {
       }
     }
   };
-  mkdirSync10(dirname11(authFilePath), { recursive: true });
-  writeFileSync7(authFilePath, `${JSON.stringify(next, null, 2)}
+  mkdirSync11(dirname11(authFilePath), { recursive: true });
+  writeFileSync9(authFilePath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return {
     accessToken: args.accessToken,
@@ -20280,9 +20886,9 @@ var init_threadCodexWorkerIpc = __esm({
 
 // src/signupTaskSuggestions.ts
 import { spawn as spawn7 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 async function suggestSignupTasksWithCodex(args) {
   const attempts = 2;
   let previousResponse;
@@ -20304,11 +20910,11 @@ async function suggestSignupTasksWithCodex(args) {
   );
 }
 async function runCodexTaskSuggestion(args) {
-  const tempRoot = mkdtempSync3(join17(tmpdir2(), "linzumi-signup-codex-tasks-"));
-  const schemaPath = join17(tempRoot, "task-suggestions.schema.json");
-  const outputPath = join17(tempRoot, "task-suggestions.json");
+  const tempRoot = mkdtempSync3(join19(tmpdir2(), "linzumi-signup-codex-tasks-"));
+  const schemaPath = join19(tempRoot, "task-suggestions.schema.json");
+  const outputPath = join19(tempRoot, "task-suggestions.json");
   const prompt = taskSuggestionPrompt(args.previousResponse);
-  writeFileSync8(
+  writeFileSync10(
     schemaPath,
     `${JSON.stringify(taskSuggestionJsonSchema(), null, 2)}
 `,
@@ -20325,9 +20931,9 @@ async function runCodexTaskSuggestion(args) {
         prompt
       })
     );
-    return readFileSync14(outputPath, "utf8");
+    return readFileSync15(outputPath, "utf8");
   } finally {
-    rmSync3(tempRoot, { recursive: true, force: true });
+    rmSync4(tempRoot, { recursive: true, force: true });
   }
 }
 function codexTaskSuggestionProcess(args) {
@@ -20774,25 +21380,25 @@ import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   lstatSync,
-  mkdirSync as mkdirSync11,
+  mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync6,
-  renameSync as renameSync2,
-  rmSync as rmSync4,
+  renameSync as renameSync3,
+  rmSync as rmSync5,
   statSync as statSync3,
-  writeFileSync as writeFileSync9
+  writeFileSync as writeFileSync11
 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { homedir as homedir12, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
+import { homedir as homedir13, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
 import {
   basename as basename8,
   dirname as dirname13,
   extname as extname2,
   isAbsolute as isAbsolute5,
-  join as join18,
+  join as join20,
   resolve as resolve8
 } from "node:path";
 async function runLocalCodexRunner(options) {
@@ -20820,7 +21426,21 @@ async function runLocalCodexRunner(options) {
           workspace: runnerWorkspaceSlug(options) ?? null,
           linzumiUrl: options.kandanUrl,
           launchSource: options.launchSource,
-          configPath: options.runnerLockConfigPath
+          configPath: options.runnerLockConfigPath,
+          // Wedged-runner takeover: a lock holder whose pid is alive but
+          // whose lock heartbeat went stale (>3 min) gets SIGKILLed and its
+          // lock replaced, instead of blocking recovery until someone runs
+          // kill -9 by hand. Log it so the runner log explains where the old
+          // pid went.
+          onTakeover: (takeover) => {
+            log2("runner.lock_takeover", {
+              runnerId: options.runnerId,
+              holderRunnerId: takeover.holderRunnerId,
+              holderPid: takeover.holderPid,
+              reason: takeover.reason,
+              lockPath: takeover.lockPath
+            });
+          }
         });
       } catch (error) {
         if (isRunnerLockHeldError(error)) {
@@ -21024,6 +21644,9 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     defaultAgentProvider: "codex",
     startInstance: allowedCwds.value.length > 0,
     durableClaudeSessionStore: true,
+    // Honest capability: no faithful Claude Code rewind exists yet; the
+    // rewind_thread control responds with a clean rejection (spec:
+    // plans/2026-06-12-claude-steer-rewind-parity-note.md item B).
     claudeCodeCheckpointRewind: false,
     allowedCwds: allowedCwds.value,
     missingAllowedCwds: missingAllowedCwds.value,
@@ -22114,13 +22737,14 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     if (workspaceSlug === void 0 || channelSlug === void 0 || kandanThreadId === void 0) {
       return void 0;
     }
-    const waferResolution = resolveControlWaferModelProvider(control);
-    if (waferResolution.type === "error") {
+    const providerResolution = resolveControlCodexModelProvider(control);
+    const providerResolutionError = codexModelProviderResolutionError(providerResolution);
+    if (providerResolutionError !== void 0) {
       return {
         instanceId,
         controlType: control.type,
         ok: false,
-        error: waferResolution.error,
+        error: providerResolutionError,
         kandanThreadId,
         cwd
       };
@@ -22735,14 +23359,14 @@ function commanderOutboxPersistDir() {
   if (override !== void 0 && override !== "") {
     return override;
   }
-  return join18(homedir12(), ".linzumi", "commander-outbox");
+  return join20(homedir13(), ".linzumi", "commander-outbox");
 }
 function controlCursorStorePath(runnerId) {
   const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
   const digest = createHash5("sha256").update(runnerId).digest("hex").slice(0, 8);
   const stem = sanitized === "" ? "runner" : sanitized;
-  return join18(
-    homedir12(),
+  return join20(
+    homedir13(),
     ".linzumi",
     "control-cursors",
     `${stem}.${digest}.json`
@@ -22752,8 +23376,8 @@ function appliedStartTurnStorePath(runnerId) {
   const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
   const digest = createHash5("sha256").update(runnerId).digest("hex").slice(0, 8);
   const stem = sanitized === "" ? "runner" : sanitized;
-  return join18(
-    homedir12(),
+  return join20(
+    homedir13(),
     ".linzumi",
     "control-cursors",
     `${stem}.${digest}.start-turn.json`
@@ -22875,9 +23499,9 @@ function createControlCursorFileStore(path2, log2, options) {
     }
     dirty = false;
     try {
-      mkdirSync11(dirname13(path2), { recursive: true });
+      mkdirSync12(dirname13(path2), { recursive: true });
       const tmpPath = `${path2}.tmp`;
-      writeFileSync9(
+      writeFileSync11(
         tmpPath,
         `${JSON.stringify({
           ...epoch === void 0 ? {} : { [controlCursorEpochKey]: epoch },
@@ -22886,7 +23510,7 @@ function createControlCursorFileStore(path2, log2, options) {
 `,
         "utf8"
       );
-      renameSync2(tmpPath, path2);
+      renameSync3(tmpPath, path2);
     } catch (error) {
       log2("control_cursor_store.write_failed", {
         path: path2,
@@ -22985,7 +23609,7 @@ function readControlCursorFile(path2, log2) {
   const cursors = /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = readFileSync15(path2, "utf8");
+    raw = readFileSync16(path2, "utf8");
   } catch (error) {
     if (!isErrnoCode2(error, "ENOENT")) {
       log2("control_cursor_store.read_failed", {
@@ -23579,18 +24203,18 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
           return delegated;
         }
         if (agentProvider === "codex") {
-          const waferControlError = waferModelProviderControlError(
+          const providerControlError = codexModelProviderControlError(
             options,
             control
           );
-          if (waferControlError !== void 0) {
+          if (providerControlError !== void 0) {
             try {
               await publishStartInstanceMessageState(
                 kandan,
                 topic,
                 control,
                 "failed",
-                waferControlError,
+                providerControlError,
                 { instanceId }
               );
             } catch (error) {
@@ -23602,7 +24226,7 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
               instanceId,
               controlType: control.type,
               ok: false,
-              error: waferControlError
+              error: providerControlError
             };
           }
         }
@@ -23750,16 +24374,16 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
         return delegated;
       }
       if (agentProvider === "codex") {
-        const waferControlError = waferModelProviderControlError(
+        const providerControlError = codexModelProviderControlError(
           options,
           control
         );
-        if (waferControlError !== void 0) {
+        if (providerControlError !== void 0) {
           return {
             instanceId,
             controlType: control.type,
             ok: false,
-            error: waferControlError
+            error: providerControlError
           };
         }
       }
@@ -24080,18 +24704,30 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
             error: "claude_code_steer_requires_text_input"
           };
         }
-        await claudeSession.interruptTurn("Steered by Linzumi");
-        claudeSession.enqueueInput({
-          content: `You were interrupted mid-task. Updated guidance from the user - continue the task with this in mind:
-
-${steerText}`,
-          sourceSeq: claudeSession.currentSourceSeq()
-        });
+        let steered;
+        try {
+          steered = claudeSession.steerTurn(steerText);
+        } catch (steerError) {
+          const message = steerError instanceof Error ? steerError.message : String(steerError);
+          log2("claude_code.steer_failed", {
+            thread_id: control.threadId,
+            message
+          });
+          return {
+            instanceId,
+            controlType: control.type,
+            agentProvider: "claude-code",
+            ok: false,
+            error: "claude_code_steer_failed",
+            message,
+            threadId: control.threadId
+          };
+        }
         return {
           instanceId,
           controlType: control.type,
           agentProvider: "claude-code",
-          steered: "steered_via_restart",
+          steered,
           threadId: control.threadId
         };
       }
@@ -24130,6 +24766,30 @@ ${steerText}`,
         response
       };
     }
+    case "rewind_thread": {
+      const claudeSession = activeClaudeCodeSessions.get(control.threadId);
+      if (claudeSession !== void 0 || control.agentProvider === "claude-code") {
+        return {
+          instanceId,
+          controlType: control.type,
+          agentProvider: "claude-code",
+          requestId: stringValue(control.requestId) ?? null,
+          threadId: control.threadId,
+          ok: false,
+          error: "claude_code_rewind_unsupported",
+          message: "Claude Code does not support rewind yet"
+        };
+      }
+      return {
+        instanceId,
+        controlType: control.type,
+        requestId: stringValue(control.requestId) ?? null,
+        threadId: control.threadId,
+        ok: false,
+        error: "rewind_not_supported",
+        message: "This runner does not support rewinding threads yet"
+      };
+    }
     case "interrupt_queued_messages": {
       const agentProvider = stringValue(control.agentProvider)?.trim();
       if (agentProvider !== "claude-code") {
@@ -24397,6 +25057,15 @@ function truncateFailureDetail(message) {
 }
 function commanderDeveloperInstructions(args) {
   const agentLabel = args.agentLabel ?? "Codex";
+  const planStepsInstruction = args.planTool === "todo-write" ? `For coding-job threads, start by setting the current goal with
+linzumi_upsert_coding_job_plan, then record the plan steps with the TodoWrite
+tool. Linzumi mirrors your TodoWrite list into the coding-job plan steps
+automatically, one TodoWrite item per plan step.` : `For coding-job threads, start by setting the current goal with
+linzumi_upsert_coding_job_plan, then replace the plan steps with
+linzumi_replace_coding_job_plan_steps.`;
+  const planUpdateInstruction = args.planTool === "todo-write" ? `As work proceeds, update each step's status with TodoWrite. Do not call
+linzumi_replace_coding_job_plan_steps or linzumi_update_coding_job_plan_step
+directly; TodoWrite is the source of truth for the plan steps.` : `As work proceeds, update each step with linzumi_update_coding_job_plan_step.`;
   const customPrompt = args.developerPrompt === void 0 ? "" : `
 <invoker_developer_prompt>
 ${args.developerPrompt}
@@ -24446,13 +25115,11 @@ something else in the Linzumi thread. Start, inspect, and modify the local app
 from that folder. Report concise progress and exact blockers in the thread.
 Use the Linzumi MCP server named "linzumi" when you need authenticated
 workspace context or coding-job metadata tools.
-For coding-job threads, start by setting the current goal with
-linzumi_upsert_coding_job_plan, then replace the plan steps with
-linzumi_replace_coding_job_plan_steps.
+${planStepsInstruction}
 When the coding-job scope changes materially, call linzumi_rename_coding_job
 with a concise title so the Linzumi thread title and workflow-facing title
 match the work.
-As work proceeds, update each step with linzumi_update_coding_job_plan_step.
+${planUpdateInstruction}
 When you open, discover, or choose the primary pull request, link it with
 linzumi_link_coding_job_pull_request.
 Before stopping, confirm the metadata overview tells the truth for a user who
@@ -24590,10 +25257,24 @@ function startInstanceAgentLabel(provider) {
       return "Claude Code";
   }
 }
-function resolveControlWaferModelProvider(control) {
+function resolveControlCodexModelProvider(control) {
   const modelProvider = stringValue(control.modelProvider)?.trim();
+  const llmProxy = objectValue(control.llmProxy);
+  const baseUrl = stringValue(llmProxy?.baseUrl)?.trim();
+  const token = stringValue(llmProxy?.token)?.trim();
+  const binding = baseUrl !== void 0 && baseUrl !== "" && token !== void 0 && token !== "" ? { baseUrl, token } : void 0;
   if (modelProvider === void 0 || modelProvider === "") {
-    return { type: "none" };
+    if (binding === void 0) {
+      return { type: "none" };
+    }
+    return {
+      type: "provider",
+      runtime: {
+        provider: "openai-proxy",
+        llmProxyBaseUrl: binding.baseUrl,
+        llmProxyToken: binding.token
+      }
+    };
   }
   if (modelProvider !== "wafer") {
     return {
@@ -24601,40 +25282,84 @@ function resolveControlWaferModelProvider(control) {
       error: `model_provider_unsupported:${modelProvider}`
     };
   }
-  const llmProxy = objectValue(control.llmProxy);
-  const baseUrl = stringValue(llmProxy?.baseUrl)?.trim();
-  const token = stringValue(llmProxy?.token)?.trim();
-  if (baseUrl === void 0 || baseUrl === "" || token === void 0 || token === "") {
+  if (binding === void 0) {
     return { type: "error", error: "wafer_model_provider_missing_llm_proxy" };
   }
   return {
-    type: "wafer",
+    type: "provider",
     runtime: {
       provider: "wafer",
-      llmProxyBaseUrl: baseUrl,
-      llmProxyToken: token
+      llmProxyBaseUrl: binding.baseUrl,
+      llmProxyToken: binding.token
     }
   };
 }
-function waferModelProviderControlError(options, control) {
-  const resolution = resolveControlWaferModelProvider(control);
+function codexModelProviderResolutionError(resolution) {
+  if (resolution.type === "error") {
+    return resolution.error;
+  }
+  if (resolution.type === "provider" && resolution.runtime.provider === "openai-proxy" && resolveForwardableOpenAiApiKey() === void 0) {
+    return "codex_llm_proxy_requires_openai_api_key";
+  }
+  return void 0;
+}
+function codexModelProviderControlError(options, control) {
+  const resolution = resolveControlCodexModelProvider(control);
   switch (resolution.type) {
     case "none":
       return void 0;
     case "error":
       return resolution.error;
-    case "wafer":
-      return options.codexModelProvider?.provider === "wafer" ? void 0 : "wafer_model_provider_requires_thread_worker";
+    case "provider": {
+      const gateError = codexModelProviderResolutionError(resolution);
+      if (gateError !== void 0) {
+        return gateError;
+      }
+      return options.codexModelProvider?.provider === resolution.runtime.provider ? void 0 : resolution.runtime.provider === "wafer" ? "wafer_model_provider_requires_thread_worker" : "llm_proxy_model_provider_requires_thread_worker";
+    }
   }
 }
 function linzumiCodexModelProviderConfig(runtime) {
-  return {
-    id: "linzumi",
-    name: "Linzumi Proxy",
-    baseUrl: `${runtime.llmProxyBaseUrl.replace(/\/+$/, "")}/v1`,
-    envKey: "LINZUMI_LLM_PROXY_TOKEN",
-    wireApi: "responses"
-  };
+  const baseUrl = `${runtime.llmProxyBaseUrl.replace(/\/+$/, "")}/v1`;
+  switch (runtime.provider) {
+    case "wafer":
+      return {
+        id: "linzumi",
+        name: "Linzumi Proxy",
+        baseUrl,
+        envKey: "LINZUMI_LLM_PROXY_TOKEN",
+        wireApi: "responses"
+      };
+    case "openai-proxy":
+      return {
+        id: "linzumi",
+        name: "Linzumi Proxy",
+        baseUrl,
+        envKey: "OPENAI_API_KEY",
+        wireApi: "responses",
+        envHttpHeaders: {
+          "x-linzumi-llm-proxy-token": "LINZUMI_LLM_PROXY_TOKEN"
+        }
+      };
+  }
+}
+function codexModelProviderAppServerEnv(runtime) {
+  switch (runtime.provider) {
+    case "wafer":
+      return { LINZUMI_LLM_PROXY_TOKEN: runtime.llmProxyToken };
+    case "openai-proxy": {
+      const openAiApiKey = resolveForwardableOpenAiApiKey();
+      if (openAiApiKey === void 0) {
+        throw new Error(
+          "codex llm proxy requires API-key auth (OPENAI_API_KEY in the environment or $CODEX_HOME/auth.json); ChatGPT OAuth credentials cannot be forwarded"
+        );
+      }
+      return {
+        LINZUMI_LLM_PROXY_TOKEN: runtime.llmProxyToken,
+        OPENAI_API_KEY: openAiApiKey
+      };
+    }
+  }
 }
 async function startCodexProviderInstance(args) {
   if (args.options.codexUrl === void 0) {
@@ -24658,6 +25383,7 @@ async function startCodexProviderInstance(args) {
     personality: "pragmatic",
     developerInstructions: commanderDeveloperInstructions({
       cwd: args.cwd,
+      planTool: "linzumi-mcp",
       developerPrompt,
       linzumiContext
     }),
@@ -24758,6 +25484,23 @@ function createClaudeCodeInputQueue(input) {
     }
     waiter({ done: false, value: message });
   };
+  const enqueueSteer = (content) => {
+    if (state.closed) {
+      throw new Error("Claude Code streaming input is closed");
+    }
+    if (pendingSourceSeqs.length === 0) {
+      enqueue({ content, sourceSeq: void 0 });
+      return "steered_queued";
+    }
+    const message = claudeCodeUserInputMessage(content);
+    const waiter = waiters.shift();
+    if (waiter === void 0) {
+      pendingMessages.push(message);
+    } else {
+      waiter({ done: false, value: message });
+    }
+    return "steered_live";
+  };
   return {
     messages: {
       [Symbol.asyncIterator]() {
@@ -24783,6 +25526,7 @@ function createClaudeCodeInputQueue(input) {
       drainClosedWaiters();
     },
     enqueue,
+    enqueueSteer,
     completeTurn: () => pendingSourceSeqs.shift(),
     currentSourceSeq: () => pendingSourceSeqs[0]
   };
@@ -25033,6 +25777,18 @@ async function startClaudeCodeProviderInstance(args) {
   const abortController = new AbortController();
   let activeSessionId;
   let sessionControls;
+  const planMirrorClient = createLinzumiMcpApiClient({
+    kandanUrl: args.options.kandanUrl,
+    accessToken: args.options.token,
+    fetchImpl: args.options.fetch,
+    operatingMode: "text"
+  });
+  const planMirror = createClaudeCodePlanMirror({
+    replacePlanSteps: planMirrorClient.replaceCodingJobPlanSteps,
+    threadId,
+    goal: workDescription.trim().slice(0, 2e3),
+    log: args.log
+  });
   const adapter = createClaudeCodeSessionPipeline({
     instanceId: args.instanceId,
     cwd: args.cwd,
@@ -25089,8 +25845,27 @@ async function startClaudeCodeProviderInstance(args) {
         claude_session_id: activeSessionId ?? null
       });
     },
+    onTodoWriteCompleted: planMirror.handleTodoWrite,
     log: args.log
   });
+  const liveBashCapture = args.options.claudeCodeRunner === void 0 && claudeLiveBashCaptureEnabled(process.env) ? createClaudeCodeLiveBashCapture({
+    captureDir: join20(
+      tmpdir3(),
+      `linzumi-claude-live-bash-${args.instanceId}`
+    ),
+    onOutputDelta: (toolUseId, delta) => {
+      if (activeSessionId === void 0) {
+        return;
+      }
+      adapter.handleTranscriptEvent({
+        type: "command_output_delta",
+        sessionId: activeSessionId,
+        itemKey: toolUseId,
+        delta
+      });
+    },
+    log: (event, fields) => args.log(event, fields)
+  }) : void 0;
   let mcpAuthCleanup;
   let mcpServers;
   try {
@@ -25195,6 +25970,7 @@ async function startClaudeCodeProviderInstance(args) {
         threadId,
         currentSourceSeq: inputQueue.currentSourceSeq,
         enqueueInput: inputQueue.enqueue,
+        steerTurn: inputQueue.enqueueSteer,
         interruptTurn: async (reason) => {
           const aborted = adapter.interruptActiveTurn(reason);
           await sessionControls?.interrupt();
@@ -25253,16 +26029,36 @@ async function startClaudeCodeProviderInstance(args) {
     if (event.type === "rate_limit") {
       await reportClaudeCodeRateLimit(event);
     }
+    if (event.type === "tool_result") {
+      liveBashCapture?.settleTool(event.itemKey);
+    }
+    if (event.type === "turn_interrupted" || event.type === "session_failed") {
+      liveBashCapture?.settleAll();
+    }
+    if (event.type === "usage") {
+      const summary = claudeCodeTokenUsageSummaryText(event.usage);
+      if (summary !== void 0) {
+        args.log("claude_code.token_usage", {
+          linzumi_thread_id: threadId,
+          claude_session_id: event.sessionId,
+          token_usage_summary: summary
+        });
+      }
+    }
     adapter.handleTranscriptEvent(event);
   };
   const llmProxy = objectValue(args.control.llmProxy);
   const llmProxyBaseUrl = stringValue(llmProxy?.baseUrl)?.trim();
   const llmProxyToken = stringValue(llmProxy?.token)?.trim();
-  const sessionEnv = llmProxyBaseUrl !== void 0 && llmProxyBaseUrl !== "" && llmProxyToken !== void 0 && llmProxyToken !== "" ? claudeCodeLlmProxyEnv(
+  const baseSessionEnv = llmProxyBaseUrl !== void 0 && llmProxyBaseUrl !== "" && llmProxyToken !== void 0 && llmProxyToken !== "" ? claudeCodeLlmProxyEnv(
     process.env,
     { baseUrl: llmProxyBaseUrl, token: llmProxyToken },
     runtimeSettings.model
-  ) : void 0;
+  ) : definedProcessEnv(process.env);
+  const sessionEnv = {
+    ...baseSessionEnv,
+    CLAUDE_CODE_ENABLE_TASKS: "0"
+  };
   const canUseTool = (request, signal) => waitForClaudeCodeToolApproval({
     kandan: args.kandan,
     topic: args.topic,
@@ -25284,6 +26080,7 @@ async function startClaudeCodeProviderInstance(args) {
         developerInstructions: commanderDeveloperInstructions({
           cwd: args.cwd,
           agentLabel: "Claude Code",
+          planTool: "todo-write",
           developerPrompt,
           linzumiContext
         }),
@@ -25294,7 +26091,11 @@ async function startClaudeCodeProviderInstance(args) {
         runner: args.options.claudeCodeRunner,
         canUseTool,
         ...mcpServers === void 0 ? {} : { mcpServers },
-        ...sessionEnv === void 0 ? {} : { env: sessionEnv },
+        ...liveBashCapture === void 0 ? {} : {
+          preToolUseHookMatchers: liveBashCapture.hookMatchers,
+          wrapApprovedToolInput: (toolUseId, toolName2, input) => toolName2 === "Bash" ? liveBashCapture.wrapApprovedTool(toolUseId, input) : void 0
+        },
+        env: sessionEnv,
         // The built-in Linzumi MCP is trusted like the codex side: its tools
         // run without an approval round-trip. SDK allowedTools matches MCP
         // tools as mcp__<server>__<tool>; the __* suffix covers the server.
@@ -25310,6 +26111,7 @@ async function startClaudeCodeProviderInstance(args) {
     } finally {
       inputQueue.close();
       mcpAuthCleanup?.();
+      liveBashCapture?.close();
       if (activeSessionId !== void 0) {
         args.activeClaudeCodeSessions.delete(activeSessionId);
         await args.disposeClaudeCodeForwardPortSession?.(activeSessionId);
@@ -25321,6 +26123,12 @@ async function startClaudeCodeProviderInstance(args) {
       error instanceof Error ? error.message : String(error)
     );
     await adapter.close(5e3).catch(() => void 0);
+    await Promise.race([
+      planMirror.settle().catch(() => void 0),
+      new Promise((resolve12) => {
+        setTimeout(resolve12, 5e3).unref?.();
+      })
+    ]);
     logStartFailureTerminal(
       error instanceof Error ? error.message : String(error)
     );
@@ -25330,6 +26138,12 @@ async function startClaudeCodeProviderInstance(args) {
   args.setStartupStage("posting_claude_code_output");
   await adapter.awaitTurnsSettled(3e4);
   await adapter.close(3e4);
+  await Promise.race([
+    planMirror.settle(),
+    new Promise((resolve12) => {
+      setTimeout(resolve12, 1e4).unref?.();
+    })
+  ]);
   return {
     controlResponse: {
       instanceId: args.instanceId,
@@ -25453,6 +26267,8 @@ function claudeSessionStoreEntryPayload(args, event) {
         itemKey: event.itemKey,
         body: event.content
       };
+    case "command_output_delta":
+      return void 0;
     case "usage":
       return { usage: event.usage };
     case "rate_limit":
@@ -25483,6 +26299,15 @@ function claudeSessionStoreEntryPayload(args, event) {
       return { body: event.reason };
   }
 }
+function definedProcessEnv(baseEnv) {
+  const env = {};
+  for (const [key, value] of Object.entries(baseEnv)) {
+    if (value !== void 0) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
 function claudeCodeLlmProxyEnv(baseEnv, proxy, model) {
   const env = {};
   for (const [key, value] of Object.entries(baseEnv)) {
@@ -25514,6 +26339,7 @@ function claudeCodeRoutedProxyModel(model) {
     case "haiku":
     case "sonnet":
     case "opus":
+    case "fable-5":
       return void 0;
     default:
       return trimmed.startsWith("claude") ? void 0 : trimmed;
@@ -25530,6 +26356,8 @@ function claudeCodeModelForRuntimeModel(model) {
     case "sonnet":
     case "opus":
       return trimmed;
+    case "fable-5":
+      return "claude-fable-5";
     default:
       return isCodexRuntimeModel(trimmed) ? "sonnet" : trimmed;
   }
@@ -25859,7 +26687,7 @@ function threadRunnerOptions(args) {
     args.options,
     args.control
   );
-  const waferResolution = resolveControlWaferModelProvider(args.control);
+  const providerResolution = resolveControlCodexModelProvider(args.control);
   return {
     ...args.options,
     clientId: void 0,
@@ -25876,7 +26704,7 @@ function threadRunnerOptions(args) {
       role: "thread",
       kandanThreadId: args.kandanThreadId
     },
-    codexModelProvider: waferResolution.type === "wafer" ? waferResolution.runtime : void 0,
+    codexModelProvider: providerResolution.type === "provider" ? providerResolution.runtime : void 0,
     spawnThreadRunner: void 0,
     threadRunnerReadyTimeoutMs: args.options.threadRunnerReadyTimeoutMs,
     runtimeDefaults: {
@@ -25913,6 +26741,7 @@ async function spawnLocalThreadRunnerProcess(options) {
     scriptPath,
     redactedThreadRunnerCliArgs(args)
   );
+  const forwardableOpenAiApiKey = options.codexModelProvider?.provider === "openai-proxy" ? resolveForwardableOpenAiApiKey() : void 0;
   const env = {
     ...process.env,
     LINZUMI_THREAD_RUNNER_ROLE: "thread",
@@ -25920,7 +26749,8 @@ async function spawnLocalThreadRunnerProcess(options) {
     LINZUMI_THREAD_RUNNER_TOKEN: options.token,
     // The LLM proxy credential travels via env (like the runner token), not
     // argv, so the spawned worker's command line never carries it.
-    ...options.codexModelProvider === void 0 ? {} : { LINZUMI_LLM_PROXY_TOKEN: options.codexModelProvider.llmProxyToken }
+    ...options.codexModelProvider === void 0 ? {} : { LINZUMI_LLM_PROXY_TOKEN: options.codexModelProvider.llmProxyToken },
+    ...forwardableOpenAiApiKey === void 0 ? {} : { OPENAI_API_KEY: forwardableOpenAiApiKey }
   };
   writeCliAuditEvent("process.spawn", {
     command: process.execPath,
@@ -27126,16 +27956,16 @@ async function startOwnedCodexAppServer(options, args = { linzumiMcp: true }) {
       model: defaults.model,
       reasoningEffort: defaults.reasoningEffort,
       fast: options.fast,
-      // Wafer-routed thread workers point their owned app-server at the
-      // Kandan LLM proxy via a custom Linzumi model provider; the proxy
-      // credential rides env_key plus the session header.
+      // Proxy-routed thread workers point their owned app-server at the
+      // Kandan LLM proxy via a custom Linzumi model provider. Wafer routes
+      // ride the session token as the bearer; openai-proxy routes (parity
+      // backlog item 50) additionally materialize the user's own
+      // OPENAI_API_KEY as the passthrough upstream credential.
       ...options.codexModelProvider === void 0 ? {} : {
         modelProvider: linzumiCodexModelProviderConfig(
           options.codexModelProvider
         ),
-        env: {
-          LINZUMI_LLM_PROXY_TOKEN: options.codexModelProvider.llmProxyToken
-        }
+        env: codexModelProviderAppServerEnv(options.codexModelProvider)
       },
       mcpServers: mcpAuth === void 0 ? [] : [
         linzumiMcpServerConfig({
@@ -27183,9 +28013,9 @@ function mcpOwnerUsername(options) {
   return options.channelSession?.listenUser ?? identityFromAccessToken(options.token).actorUsername;
 }
 function writeEphemeralMcpAuthFile(options) {
-  const directory = mkdtempSync4(join18(tmpdir3(), "linzumi-mcp-auth-"));
+  const directory = mkdtempSync4(join20(tmpdir3(), "linzumi-mcp-auth-"));
   chmodSync2(directory, 448);
-  const path2 = join18(directory, "auth.json");
+  const path2 = join20(directory, "auth.json");
   writeCachedLocalRunnerToken({
     kandanUrl: options.kandanUrl,
     accessToken: options.token,
@@ -27194,7 +28024,7 @@ function writeEphemeralMcpAuthFile(options) {
   chmodSync2(path2, 384);
   return {
     path: path2,
-    cleanup: () => rmSync4(directory, { recursive: true, force: true })
+    cleanup: () => rmSync5(directory, { recursive: true, force: true })
   };
 }
 function once(action) {
@@ -27261,7 +28091,7 @@ function configuredAllowedCwds(values, options = {}) {
     const absolutePath = resolve8(expandUserPath(value));
     try {
       if (options.createMissing === true) {
-        mkdirSync11(absolutePath, { recursive: true });
+        mkdirSync12(absolutePath, { recursive: true });
       }
       const realPath = realpathSync6(absolutePath);
       allowedCwds.push(
@@ -27298,7 +28128,7 @@ function allowedCwdProjects(allowedCwds) {
   });
 }
 function isGitProjectDirectory(cwd) {
-  const gitPath = join18(cwd, ".git");
+  const gitPath = join20(cwd, ".git");
   try {
     const gitPathStats = statSync3(gitPath);
     return gitPathStats.isDirectory() || gitPathStats.isFile();
@@ -27323,7 +28153,7 @@ function browseRunnerDirectory(control, options) {
     }
     const parent = dirname13(currentPath);
     const entries = readdirSync4(currentPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => visibleRunnerDirectoryEntryName(entry.name)).map((entry) => {
-      const path2 = join18(currentPath, entry.name);
+      const path2 = join20(currentPath, entry.name);
       return {
         name: entry.name,
         path: path2,
@@ -27364,7 +28194,7 @@ function projectDirectoryName(name) {
 function availableProjectDirectoryName(projectsRoot, baseName, suffix = 0) {
   for (let nextSuffix = suffix; ; nextSuffix += 1) {
     const candidate = nextSuffix === 0 ? baseName : `${baseName}-${nextSuffix}`;
-    if (!projectPathExists(join18(projectsRoot, candidate))) {
+    if (!projectPathExists(join20(projectsRoot, candidate))) {
       return candidate;
     }
   }
@@ -27392,9 +28222,9 @@ function createRunnerProject(control, options, allowedCwds) {
       error: "invalid_project_template"
     };
   }
-  const projectsRoot = join18(currentHomeDirectory(), "linzumi");
+  const projectsRoot = join20(currentHomeDirectory(), "linzumi");
   const resolvedProjectDirName = template === "hello_linzumi_demo" ? availableProjectDirectoryName(projectsRoot, projectDirName) : projectDirName;
-  const projectPath = join18(projectsRoot, resolvedProjectDirName);
+  const projectPath = join20(projectsRoot, resolvedProjectDirName);
   let createdProjectPath = false;
   try {
     if (template !== "hello_linzumi_demo" && projectPathExists(projectPath)) {
@@ -27406,7 +28236,7 @@ function createRunnerProject(control, options, allowedCwds) {
         error: "project_directory_exists"
       };
     }
-    mkdirSync11(projectsRoot, { recursive: true });
+    mkdirSync12(projectsRoot, { recursive: true });
     if (template === "hello_linzumi_demo") {
       createdProjectPath = true;
       createHelloLinzumiProject({
@@ -27414,7 +28244,7 @@ function createRunnerProject(control, options, allowedCwds) {
         name: resolvedProjectDirName
       });
     } else {
-      mkdirSync11(projectPath, { recursive: false });
+      mkdirSync12(projectPath, { recursive: false });
       createdProjectPath = true;
     }
     const git = spawnSync5("git", ["init"], {
@@ -27472,7 +28302,7 @@ function createRunnerProject(control, options, allowedCwds) {
 }
 function removeCreatedProjectDirectory(projectPath) {
   try {
-    rmSync4(projectPath, { recursive: true, force: true });
+    rmSync5(projectPath, { recursive: true, force: true });
     return void 0;
   } catch (error) {
     return error instanceof Error ? error.message : "cleanup_failed";
@@ -27535,6 +28365,8 @@ var init_runner = __esm({
     init_channelSessionSupport();
     init_commanderAttachments();
     init_claudeCodePipeline();
+    init_claudeCodePlanMirror();
+    init_claudeCodeLiveBashOutput();
     init_claudeCodeSession();
     init_codexAppServer();
     init_codexProjectTrust();
@@ -27596,7 +28428,7 @@ var init_runner = __esm({
 });
 
 // src/kandanTls.ts
-import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
 import { Agent } from "undici";
 import WsWebSocket from "ws";
 function kandanTlsTrustFromEnv() {
@@ -27610,7 +28442,7 @@ function kandanTlsTrustFromCaFile(caFile) {
   if (!existsSync13(trimmed)) {
     throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${trimmed}`);
   }
-  const ca = readFileSync16(trimmed, "utf8");
+  const ca = readFileSync17(trimmed, "utf8");
   return {
     caFile: trimmed,
     ca,
@@ -42719,9 +43551,9 @@ var require_internal = __commonJS({
     }
     InternalCodec.prototype.encoder = InternalEncoder;
     InternalCodec.prototype.decoder = InternalDecoder;
-    var StringDecoder = __require("string_decoder").StringDecoder;
+    var StringDecoder2 = __require("string_decoder").StringDecoder;
     function InternalDecoder(options, codec) {
-      this.decoder = new StringDecoder(codec.enc);
+      this.decoder = new StringDecoder2(codec.enc);
     }
     InternalDecoder.prototype.write = function(buf) {
       if (!Buffer4.isBuffer(buf)) {
@@ -46394,7 +47226,7 @@ var init_RemoveFileError = __esm({
 
 // ../../node_modules/@inquirer/external-editor/dist/esm/index.js
 import { spawn as spawn11, spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync19, unlinkSync as unlinkSync3, writeFileSync as writeFileSync12 } from "fs";
+import { readFileSync as readFileSync20, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "fs";
 import path from "node:path";
 import os from "node:os";
 import { randomUUID as randomUUID5 } from "node:crypto";
@@ -46511,14 +47343,14 @@ var init_esm5 = __esm({
           if (Object.prototype.hasOwnProperty.call(this.fileOptions, "mode")) {
             opt.mode = this.fileOptions.mode;
           }
-          writeFileSync12(this.tempFile, this.text, opt);
+          writeFileSync14(this.tempFile, this.text, opt);
         } catch (createFileError) {
           throw new CreateFileError(createFileError);
         }
       }
       readTemporaryFile() {
         try {
-          const tempFileBuffer = readFileSync19(this.tempFile);
+          const tempFileBuffer = readFileSync20(this.tempFile);
           if (tempFileBuffer.length === 0) {
             this.text = "";
           } else {
@@ -47657,15 +48489,15 @@ function signupErrorCodeFromResponseText(text2) {
 function renderEmailCodeStart(value) {
   const body = objectRecord(value, "signup email-code start response");
   return {
-    pendingId: stringValue6(body, "pending_id"),
-    email: stringValue6(body, "email")
+    pendingId: stringValue7(body, "pending_id"),
+    email: stringValue7(body, "email")
   };
 }
 function renderEmailCodeVerify(value) {
   const body = objectRecord(value, "signup email-code verify response");
   return {
-    accessToken: stringValue6(body, "access_token"),
-    refreshToken: stringValue6(body, "refresh_token"),
+    accessToken: stringValue7(body, "access_token"),
+    refreshToken: stringValue7(body, "refresh_token"),
     expiresInSeconds: positiveIntegerValue(body, "expires_in"),
     user: renderUserRef(requiredValue(body, "user")),
     isNewUser: booleanValue(body, "is_new_user"),
@@ -47705,7 +48537,7 @@ function renderMissionControlComplete(value) {
     localRunnerToken: renderLocalRunnerToken(
       requiredValue(body, "local_runner_token")
     ),
-    launchUrl: stringValue6(body, "launch_url"),
+    launchUrl: stringValue7(body, "launch_url"),
     ...missionControlUrl === void 0 ? {} : { missionControlUrl },
     config: {
       allowedCwds: arrayValue2(config, "allowed_cwds").map(
@@ -47725,21 +48557,21 @@ function renderLocalRunnerToken(value) {
   const body = objectRecord(value, "signup local runner token");
   const expiresInSeconds = optionalPositiveIntegerValue(body, "expires_in");
   return {
-    accessToken: stringValue6(body, "access_token"),
+    accessToken: stringValue7(body, "access_token"),
     ...expiresInSeconds === void 0 ? {} : { expiresInSeconds },
-    workspaceSlug: stringValue6(body, "workspace"),
-    channelSlug: stringValue6(body, "channel")
+    workspaceSlug: stringValue7(body, "workspace"),
+    channelSlug: stringValue7(body, "channel")
   };
 }
 function renderTaskStartResult(value) {
   const body = objectRecord(value, "signup task start");
-  const status = stringValue6(body, "status");
+  const status = stringValue7(body, "status");
   if (status !== "queued" && status !== "started" && status !== "failed") {
     throw new Error("signup task start status was incomplete");
   }
   return {
-    threadId: stringValue6(body, "thread_id"),
-    title: stringValue6(body, "title"),
+    threadId: stringValue7(body, "thread_id"),
+    title: stringValue7(body, "title"),
     status,
     ...optionalStringValue(body, "runner_id") === void 0 ? {} : { runnerId: optionalStringValue(body, "runner_id") },
     ...optionalStringValue(body, "error") === void 0 ? {} : { error: optionalStringValue(body, "error") }
@@ -47749,7 +48581,7 @@ function renderUserRef(value) {
   const body = objectRecord(value, "signup user");
   return {
     id: positiveIntegerValue(body, "id"),
-    username: stringValue6(body, "username"),
+    username: stringValue7(body, "username"),
     ...optionalStringValue(body, "display_name") === void 0 ? {} : { displayName: optionalStringValue(body, "display_name") },
     ...optionalStringValue(body, "primary_email") === void 0 ? {} : { primaryEmail: optionalStringValue(body, "primary_email") }
   };
@@ -47758,23 +48590,23 @@ function renderWorkspaceRef(value) {
   const body = objectRecord(value, "signup workspace");
   return {
     id: positiveIntegerValue(body, "id"),
-    slug: stringValue6(body, "slug"),
-    name: stringValue6(body, "name")
+    slug: stringValue7(body, "slug"),
+    name: stringValue7(body, "name")
   };
 }
 function renderChannelRef(value) {
   const body = objectRecord(value, "signup channel");
   return {
     id: positiveIntegerValue(body, "id"),
-    slug: stringValue6(body, "slug"),
-    name: stringValue6(body, "name")
+    slug: stringValue7(body, "slug"),
+    name: stringValue7(body, "name")
   };
 }
 function renderThreadRef(value) {
   const body = objectRecord(value, "signup thread");
   return {
-    threadId: stringValue6(body, "thread_id"),
-    title: stringValue6(body, "title"),
+    threadId: stringValue7(body, "thread_id"),
+    title: stringValue7(body, "title"),
     rootSeq: positiveIntegerValue(body, "root_seq"),
     threadSeq: positiveIntegerValue(body, "thread_seq")
   };
@@ -47792,7 +48624,7 @@ function requiredValue(record, key) {
   }
   return value;
 }
-function stringValue6(record, key) {
+function stringValue7(record, key) {
   return stringFromUnknown(requiredValue(record, key), `signup ${key}`);
 }
 function optionalStringValue(record, key) {
@@ -47887,17 +48719,17 @@ import { spawn as spawn12, spawnSync as spawnSync7 } from "node:child_process";
 import {
   existsSync as existsSync16,
   constants as fsConstants,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync15,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync5,
-  rmSync as rmSync5,
+  rmSync as rmSync6,
   statSync as statSync4,
-  writeFileSync as writeFileSync13
+  writeFileSync as writeFileSync15
 } from "node:fs";
 import { access } from "node:fs/promises";
-import { homedir as homedir15, tmpdir as tmpdir4 } from "node:os";
-import { delimiter as delimiter3, dirname as dirname16, join as join21, resolve as resolve10 } from "node:path";
+import { homedir as homedir16, tmpdir as tmpdir4 } from "node:os";
+import { delimiter as delimiter3, dirname as dirname16, join as join23, resolve as resolve10 } from "node:path";
 import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
 import { emitKeypressEvents } from "node:readline";
 function signupHelpText() {
@@ -48018,7 +48850,7 @@ function defaultSignupDraftStore(serviceUrl) {
       }
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync20(path2, "utf8"));
+        parsed = JSON.parse(readFileSync21(path2, "utf8"));
       } catch (_error) {
         return void 0;
       }
@@ -48028,20 +48860,20 @@ function defaultSignupDraftStore(serviceUrl) {
       return comparableServiceUrl(parsed.serviceUrl) === comparableServiceUrl(serviceUrl) ? parsed : void 0;
     },
     write: (draft) => {
-      mkdirSync14(dirname16(path2), { recursive: true });
-      writeFileSync13(path2, `${JSON.stringify(draft, null, 2)}
+      mkdirSync15(dirname16(path2), { recursive: true });
+      writeFileSync15(path2, `${JSON.stringify(draft, null, 2)}
 `, {
         encoding: "utf8",
         mode: 384
       });
     },
     clear: () => {
-      rmSync5(path2, { force: true });
+      rmSync6(path2, { force: true });
     }
   };
 }
 function defaultSignupDraftPath(serviceUrl) {
-  return join21(
+  return join23(
     dirname16(localConfigPath()),
     `signup-draft.${localConfigScopeFileStem(serviceUrl)}.json`
   );
@@ -48076,8 +48908,8 @@ function defaultSignupTaskCacheStore(serviceUrl) {
           }
         }
       };
-      mkdirSync14(dirname16(path2), { recursive: true });
-      writeFileSync13(path2, `${JSON.stringify(next, null, 2)}
+      mkdirSync15(dirname16(path2), { recursive: true });
+      writeFileSync15(path2, `${JSON.stringify(next, null, 2)}
 `, {
         encoding: "utf8",
         mode: 384
@@ -48086,7 +48918,7 @@ function defaultSignupTaskCacheStore(serviceUrl) {
   };
 }
 function defaultSignupTaskCachePath(serviceUrl) {
-  return join21(
+  return join23(
     dirname16(localConfigPath()),
     `signup-task-cache.${localConfigScopeFileStem(serviceUrl)}.json`
   );
@@ -48097,7 +48929,7 @@ function readSignupTaskCache(path2) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(path2, "utf8"));
+    parsed = JSON.parse(readFileSync21(path2, "utf8"));
   } catch (_error) {
     return { version: 1, entries: {} };
   }
@@ -49982,7 +50814,7 @@ function autocompletePathSuggestions(pathInput) {
   try {
     const showHidden = prefix.startsWith(".");
     const currentPath = directoryExists(normalizedInput) ? [normalizedInput.replace(/\/$/, "") || "/"] : [];
-    const childPaths = readdirSync5(directoryPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => showHidden || !entry.name.startsWith(".")).map((entry) => join21(directoryPath, entry.name)).map((path2) => ({
+    const childPaths = readdirSync5(directoryPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => showHidden || !entry.name.startsWith(".")).map((entry) => join23(directoryPath, entry.name)).map((path2) => ({
       path: path2,
       score: fuzzyPathSegmentScore(path2.split("/").at(-1) ?? path2, prefix)
     })).filter((candidate) => candidate.score !== void 0).sort((left, right) => {
@@ -50228,7 +51060,7 @@ async function runSignupPreflights(runtime) {
 function defaultPreflightRuntime() {
   return {
     cwd: process.cwd(),
-    homeDir: homedir15(),
+    homeDir: homedir16(),
     probeTool,
     readGitEmail,
     discoverCodeRoots,
@@ -50373,13 +51205,13 @@ async function suggestTasksWithCodex(projectPath, retryPolicy) {
   );
 }
 async function runCodexTaskSuggestion2(projectPath, previousResponse, retryPolicy) {
-  const tempRoot = mkdtempSync5(join21(tmpdir4(), "linzumi-signup-codex-tasks-"));
-  const schemaPath = join21(tempRoot, "task-suggestions.schema.json");
-  const outputPath = join21(tempRoot, "task-suggestions.json");
+  const tempRoot = mkdtempSync5(join23(tmpdir4(), "linzumi-signup-codex-tasks-"));
+  const schemaPath = join23(tempRoot, "task-suggestions.schema.json");
+  const outputPath = join23(tempRoot, "task-suggestions.json");
   const model = process.env.LINZUMI_SIGNUP_TASK_MODEL ?? "gpt-5.4-mini";
   const prompt = taskSuggestionPrompt2(previousResponse);
   const codexCommand = await resolveSignupCodexCommand();
-  writeFileSync13(
+  writeFileSync15(
     schemaPath,
     `${JSON.stringify(taskSuggestionJsonSchema2(), null, 2)}
 `,
@@ -50400,9 +51232,9 @@ async function runCodexTaskSuggestion2(projectPath, previousResponse, retryPolic
       ),
       retryPolicy
     );
-    return readFileSync20(outputPath, "utf8");
+    return readFileSync21(outputPath, "utf8");
   } finally {
-    rmSync5(tempRoot, { recursive: true, force: true });
+    rmSync6(tempRoot, { recursive: true, force: true });
   }
 }
 function codexTaskSuggestionProcess2(args) {
@@ -50437,7 +51269,7 @@ function codexTaskSuggestionProcess2(args) {
 function signupCodexTaskSuggestionProcessForTest(args) {
   return codexTaskSuggestionProcess2(args);
 }
-async function resolveSignupCodexCommand(env = process.env, homeDir = homedir15(), executableExists = fileIsExecutable) {
+async function resolveSignupCodexCommand(env = process.env, homeDir = homedir16(), executableExists = fileIsExecutable) {
   const override = firstConfiguredValue([
     env.LINZUMI_SIGNUP_CODEX_BIN,
     env.LINZUMI_CODEX_BIN
@@ -50492,7 +51324,7 @@ function resolveHomePath(path2, homeDir) {
     return homeDir;
   }
   if (path2.startsWith("~/")) {
-    return join21(homeDir, path2.slice(2));
+    return join23(homeDir, path2.slice(2));
   }
   return resolve10(path2);
 }
@@ -50505,9 +51337,9 @@ function commandLooksPathLike(command) {
 }
 function homeManagedCodexCandidates(homeDir) {
   return [
-    join21(homeDir, ".volta", "bin", "codex"),
-    join21(homeDir, ".local", "bin", "codex"),
-    join21(homeDir, "bin", "codex")
+    join23(homeDir, ".volta", "bin", "codex"),
+    join23(homeDir, ".local", "bin", "codex"),
+    join23(homeDir, "bin", "codex")
   ];
 }
 async function firstExecutablePath(paths, executableExists) {
@@ -50522,7 +51354,7 @@ function commandPathCandidates(path2) {
   if (path2 === void 0 || path2.trim() === "") {
     return [];
   }
-  return path2.split(delimiter3).filter((entry) => entry.trim() !== "").map((entry) => join21(entry, "codex"));
+  return path2.split(delimiter3).filter((entry) => entry.trim() !== "").map((entry) => join23(entry, "codex"));
 }
 async function fileIsExecutable(path2) {
   try {
@@ -50755,11 +51587,11 @@ function codexPreflightLocation(command, homeDir) {
   switch (command) {
     case "codex":
       return "on PATH";
-    case join21(homeDir, ".volta", "bin", "codex"):
+    case join23(homeDir, ".volta", "bin", "codex"):
       return "via Volta";
-    case join21(homeDir, ".local", "bin", "codex"):
+    case join23(homeDir, ".local", "bin", "codex"):
       return "via ~/.local/bin";
-    case join21(homeDir, "bin", "codex"):
+    case join23(homeDir, "bin", "codex"):
       return "via ~/bin";
     default:
       return "from configured path";
@@ -50918,7 +51750,7 @@ function probeToolWithArgs(command, args, cwd) {
 }
 async function discoverCodeRoots(homeDir) {
   const candidates = ["src", "code", "projects"].map(
-    (name) => join21(homeDir, name)
+    (name) => join23(homeDir, name)
   );
   return candidates.filter((path2) => existsSync16(path2)).flatMap((path2) => discoveredProjectNames(path2));
 }
@@ -50972,7 +51804,7 @@ function discoverProjectsFromCurrentDirectory(cwd) {
 }
 function discoverProjectsFromGuessedRoots(homeDir) {
   const guessedRoots = ["src", "code", "projects"].map(
-    (name) => join21(homeDir, name)
+    (name) => join23(homeDir, name)
   );
   const projects = guessedRoots.flatMap(
     (root) => discoverProjectsUnderRoot(root)
@@ -51024,25 +51856,25 @@ function looksLikeProject(path2) {
     "pnpm-lock.yaml",
     "yarn.lock",
     "package-lock.json"
-  ].some((name) => existsSync16(join21(path2, name)));
+  ].some((name) => existsSync16(join23(path2, name)));
 }
 function detectProjectLanguage(path2) {
-  if (existsSync16(join21(path2, "pyproject.toml")) || existsSync16(join21(path2, "requirements.txt"))) {
+  if (existsSync16(join23(path2, "pyproject.toml")) || existsSync16(join23(path2, "requirements.txt"))) {
     return "Python";
   }
-  if (existsSync16(join21(path2, "Cargo.toml"))) {
+  if (existsSync16(join23(path2, "Cargo.toml"))) {
     return "Rust";
   }
-  if (existsSync16(join21(path2, "go.mod"))) {
+  if (existsSync16(join23(path2, "go.mod"))) {
     return "Go";
   }
-  if (existsSync16(join21(path2, "mix.exs"))) {
+  if (existsSync16(join23(path2, "mix.exs"))) {
     return "Elixir";
   }
-  if (existsSync16(join21(path2, "tsconfig.json")) || packageJsonMentionsTypeScript(path2)) {
+  if (existsSync16(join23(path2, "tsconfig.json")) || packageJsonMentionsTypeScript(path2)) {
     return "TypeScript";
   }
-  if (existsSync16(join21(path2, "package.json"))) {
+  if (existsSync16(join23(path2, "package.json"))) {
     return "JavaScript";
   }
   return "Project";
@@ -51050,7 +51882,7 @@ function detectProjectLanguage(path2) {
 function packageJsonMentionsTypeScript(path2) {
   try {
     const packageJson2 = JSON.parse(
-      readFileSync20(join21(path2, "package.json"), "utf8")
+      readFileSync21(join23(path2, "package.json"), "utf8")
     );
     return packageJson2.dependencies?.typescript !== void 0 || packageJson2.devDependencies?.typescript !== void 0;
   } catch {
@@ -51058,11 +51890,11 @@ function packageJsonMentionsTypeScript(path2) {
   }
 }
 function hasGitMetadata(path2) {
-  return existsSync16(join21(path2, ".git"));
+  return existsSync16(join23(path2, ".git"));
 }
 function childDirectories(root) {
   try {
-    return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join21(root, entry.name));
+    return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join23(root, entry.name));
   } catch {
     return [];
   }
@@ -51088,10 +51920,10 @@ function directoryExists(path2) {
 }
 function expandHomePath(path2) {
   if (path2 === "~") {
-    return homedir15();
+    return homedir16();
   }
   if (path2.startsWith("~/")) {
-    return join21(homedir15(), path2.slice(2));
+    return join23(homedir16(), path2.slice(2));
   }
   return resolve10(path2);
 }
@@ -51181,8 +52013,8 @@ init_onboardingDiscoveryChildProcess();
 init_runner();
 init_claudeCodeSession();
 init_authCache();
-import { existsSync as existsSync17, readFileSync as readFileSync21, realpathSync as realpathSync7 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
+import { existsSync as existsSync17, readFileSync as readFileSync22, realpathSync as realpathSync7 } from "node:fs";
+import { homedir as homedir17 } from "node:os";
 import { resolve as resolve11 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -51277,9 +52109,9 @@ init_kandanTls();
 init_protocol();
 init_json();
 init_defaultUrls();
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname14, join as join19 } from "node:path";
-import { homedir as homedir13 } from "node:os";
+import { existsSync as existsSync14, mkdirSync as mkdirSync13, readFileSync as readFileSync18, writeFileSync as writeFileSync12 } from "node:fs";
+import { dirname as dirname14, join as join21 } from "node:path";
+import { homedir as homedir14 } from "node:os";
 async function runAgentCliCommand(args, deps = {
   fetchImpl: fetch,
   stdout: process.stdout,
@@ -51987,7 +52819,7 @@ function agentTokenFile(flags) {
   return flags.get("agent-token-file") ?? defaultAgentTokenFilePath();
 }
 function defaultAgentTokenFilePath() {
-  return join19(homedir13(), ".linzumi", "agent-token.json");
+  return join21(homedir14(), ".linzumi", "agent-token.json");
 }
 function normalizedApiUrl(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
@@ -51996,11 +52828,11 @@ function authorizationHeaders(token) {
   return { authorization: `Bearer ${token}` };
 }
 function readOptionalTextFile(path2) {
-  return existsSync14(path2) ? readFileSync17(path2, "utf8") : void 0;
+  return existsSync14(path2) ? readFileSync18(path2, "utf8") : void 0;
 }
 function writeTextFile(path2, content) {
-  mkdirSync12(dirname14(path2), { recursive: true });
-  writeFileSync10(path2, content);
+  mkdirSync13(dirname14(path2), { recursive: true });
+  writeFileSync12(path2, content);
 }
 function readStoredAgentTokenFile(path2, readTextFile = readOptionalTextFile) {
   const content = readTextFile(path2);
@@ -52089,25 +52921,25 @@ init_runnerLogger();
 import {
   existsSync as existsSync15,
   closeSync as closeSync3,
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync14,
   openSync as openSync4,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   watch,
-  writeFileSync as writeFileSync11
+  writeFileSync as writeFileSync13
 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
-import { dirname as dirname15, join as join20, resolve as resolve9 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { dirname as dirname15, join as join22, resolve as resolve9 } from "node:path";
 import { execFileSync, spawn as spawn10 } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var connectedMarkers = ["Connected to Linzumi", "Runner connected:"];
 function commanderStatusDir() {
-  return join20(homedir14(), ".linzumi", "commanders");
+  return join22(homedir15(), ".linzumi", "commanders");
 }
 function commanderStatusFile(runnerId, statusDir = commanderStatusDir()) {
-  return join20(statusDir, `${safeRunnerId(runnerId)}.json`);
+  return join22(statusDir, `${safeRunnerId(runnerId)}.json`);
 }
 function defaultCommanderLogFile(runnerId) {
-  return join20(homedir14(), ".linzumi", "logs", `${safeRunnerId(runnerId)}.log`);
+  return join22(homedir15(), ".linzumi", "logs", `${safeRunnerId(runnerId)}.log`);
 }
 function commanderLogIsConnected(log2) {
   return connectedMarkers.some((marker) => log2.includes(marker));
@@ -52128,8 +52960,8 @@ function startCommanderDaemon(options) {
     "--log-file",
     logFile
   ];
-  mkdirSync13(statusDir, { recursive: true });
-  mkdirSync13(dirname15(logFile), { recursive: true });
+  mkdirSync14(statusDir, { recursive: true });
+  mkdirSync14(dirname15(logFile), { recursive: true });
   const out = openSync4(logFile, "a");
   const err = openSync4(logFile, "a");
   writeCliAuditEvent(
@@ -52175,7 +53007,7 @@ function startCommanderDaemon(options) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     command: [nodeBin, ...command]
   };
-  writeFileSync11(statusFile, `${JSON.stringify(record, null, 2)}
+  writeFileSync13(statusFile, `${JSON.stringify(record, null, 2)}
 `);
   return record;
 }
@@ -52184,12 +53016,12 @@ function commanderDaemonStatus(runnerId, statusDir = commanderStatusDir(), proce
   if (!existsSync15(statusFile)) {
     return { status: "missing", runnerId, statusFile };
   }
-  const record = parseRecord(readFileSync18(statusFile, "utf8"));
+  const record = parseRecord(readFileSync19(statusFile, "utf8"));
   return processIsRunning(record.pid) && processMatchesRecord(record, processIdentityReader) ? { status: "running", record } : { status: "stopped", record };
 }
 async function waitForCommanderDaemon(options) {
   const now = options.now ?? (() => Date.now());
-  const readTextFile = options.readTextFile ?? ((path2) => existsSync15(path2) ? readFileSync18(path2, "utf8") : void 0);
+  const readTextFile = options.readTextFile ?? ((path2) => existsSync15(path2) ? readFileSync19(path2, "utf8") : void 0);
   const statusImpl = options.statusImpl ?? commanderDaemonStatus;
   const deadline = now() + options.timeoutMs;
   while (now() <= deadline) {
@@ -64221,17 +65053,17 @@ async function runMcpServer(args) {
   const kandanUrl = required(values, "api-url");
   const auth = await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue5(values, "auth-file"),
-    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
-    workspaceSlug: stringValue5(values, "workspace"),
-    channelSlug: stringValue5(values, "channel")
+    explicitToken: stringValue6(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue6(values, "auth-file"),
+    delegationAuthFilePath: stringValue6(values, "delegation-auth-file"),
+    workspaceSlug: stringValue6(values, "workspace"),
+    channelSlug: stringValue6(values, "channel")
   });
-  const ownerUsername = stringValue5(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME;
-  const operatingMode = mcpOperatingMode(stringValue5(values, "mode"));
-  const toolScope = mcpToolScope(stringValue5(values, "tool-scope"));
-  const cwd = stringValue5(values, "cwd") ?? process.cwd();
-  const defaultThreadId = stringValue5(values, "thread-id") ?? process.env.LINZUMI_THREAD_RUNNER_KANDAN_THREAD_ID;
+  const ownerUsername = stringValue6(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME;
+  const operatingMode = mcpOperatingMode(stringValue6(values, "mode"));
+  const toolScope = mcpToolScope(stringValue6(values, "tool-scope"));
+  const cwd = stringValue6(values, "cwd") ?? process.cwd();
+  const defaultThreadId = stringValue6(values, "thread-id") ?? process.env.LINZUMI_THREAD_RUNNER_KANDAN_THREAD_ID;
   const client = createLinzumiMcpApiClient({
     kandanUrl,
     accessToken: auth.accessToken,
@@ -64852,24 +65684,24 @@ function registerEmptyMcpResources(server) {
 async function runMcpConfig(args) {
   const values = strictFlagValues(args);
   const kandanUrl = required(values, "api-url");
-  const format = stringValue5(values, "format") ?? "codex";
-  const operatingMode = mcpOperatingMode(stringValue5(values, "mode"));
+  const format = stringValue6(values, "format") ?? "codex";
+  const operatingMode = mcpOperatingMode(stringValue6(values, "mode"));
   const token = values.get("include-token") === true ? (await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue5(values, "auth-file"),
-    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
-    workspaceSlug: stringValue5(values, "workspace"),
-    channelSlug: stringValue5(values, "channel")
+    explicitToken: stringValue6(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue6(values, "auth-file"),
+    delegationAuthFilePath: stringValue6(values, "delegation-auth-file"),
+    workspaceSlug: stringValue6(values, "workspace"),
+    channelSlug: stringValue6(values, "channel")
   })).accessToken : void 0;
   const config = linzumiMcpServerConfig({
-    command: stringValue5(values, "command"),
+    command: stringValue6(values, "command"),
     kandanUrl,
     accessToken: token,
-    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
-    ownerUsername: stringValue5(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME,
+    delegationAuthFilePath: stringValue6(values, "delegation-auth-file"),
+    ownerUsername: stringValue6(values, "owner-username") ?? process.env.LINZUMI_MCP_OWNER_USERNAME,
     operatingMode,
-    toolScope: mcpToolScope(stringValue5(values, "tool-scope"))
+    toolScope: mcpToolScope(stringValue6(values, "tool-scope"))
   });
   switch (format) {
     case "codex":
@@ -64887,19 +65719,19 @@ async function runMcpDoctor(args) {
   const kandanUrl = required(values, "api-url");
   const auth = await resolveMcpAuth({
     kandanUrl,
-    explicitToken: stringValue5(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
-    authFilePath: stringValue5(values, "auth-file"),
-    delegationAuthFilePath: stringValue5(values, "delegation-auth-file"),
-    workspaceSlug: stringValue5(values, "workspace"),
-    channelSlug: stringValue5(values, "channel")
+    explicitToken: stringValue6(values, "token") ?? process.env.LINZUMI_MCP_ACCESS_TOKEN,
+    authFilePath: stringValue6(values, "auth-file"),
+    delegationAuthFilePath: stringValue6(values, "delegation-auth-file"),
+    workspaceSlug: stringValue6(values, "workspace"),
+    channelSlug: stringValue6(values, "channel")
   });
   switch (auth.mode) {
     case "local-runner": {
       const ok = await validateLocalRunnerToken({
         kandanUrl,
         accessToken: auth.accessToken,
-        workspaceSlug: stringValue5(values, "workspace"),
-        channelSlug: stringValue5(values, "channel")
+        workspaceSlug: stringValue6(values, "workspace"),
+        channelSlug: stringValue6(values, "channel")
       });
       if (!ok) {
         throw new Error("Linzumi MCP auth validation failed");
@@ -64911,7 +65743,7 @@ async function runMcpDoctor(args) {
         kandanUrl,
         accessToken: auth.accessToken,
         authMode: auth.mode,
-        operatingMode: mcpOperatingMode(stringValue5(values, "mode"))
+        operatingMode: mcpOperatingMode(stringValue6(values, "mode"))
       });
       await client.validateAuth();
       break;
@@ -64982,7 +65814,7 @@ function strictFlagValues(args) {
   }
   return values;
 }
-function stringValue5(values, key) {
+function stringValue6(values, key) {
   const value = values.get(key);
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
@@ -65009,7 +65841,7 @@ function mcpToolScope(value) {
   }
 }
 function required(values, key) {
-  const value = stringValue5(values, key);
+  const value = stringValue6(values, key);
   if (value === void 0) {
     throw new Error(`--${key} is required`);
   }
@@ -65635,11 +66467,11 @@ function runHelloCommand(args) {
     process.stdout.write(helloHelpText());
     return;
   }
-  const rootPath = stringValue7(values, "dir");
-  const parentDir = stringValue7(values, "parent-dir");
-  const name = stringValue7(values, "name");
+  const rootPath = stringValue8(values, "dir");
+  const parentDir = stringValue8(values, "parent-dir");
+  const name = stringValue8(values, "name");
   const port = tcpPortValue(values, "port");
-  const host = stringValue7(values, "host");
+  const host = stringValue8(values, "host");
   const project = createHelloLinzumiProject({
     ...rootPath === void 0 ? {} : { rootPath },
     ...parentDir === void 0 ? {} : { parentDir: resolveUserPath(parentDir) },
@@ -65779,8 +66611,8 @@ async function runCommanderDaemonCommand(args) {
         runnerId,
         cwd,
         args: stripDaemonSupervisorFlags(flagArgs),
-        logFile: stringValue7(values, "log-file"),
-        statusDir: stringValue7(values, "status-dir")
+        logFile: stringValue8(values, "log-file"),
+        statusDir: stringValue8(values, "status-dir")
       });
       process.stdout.write("commander_status: daemon_started\n");
       process.stdout.write(`runner_id: ${record.runnerId}
@@ -65801,7 +66633,7 @@ async function runCommanderDaemonCommand(args) {
       const runnerId = ensureLocalRunnerIdForLinzumiUrl(kandanUrl);
       const status = commanderDaemonStatus(
         runnerId,
-        stringValue7(values, "status-dir")
+        stringValue8(values, "status-dir")
       );
       process.stdout.write(`${JSON.stringify(status)}
 `);
@@ -65815,7 +66647,7 @@ async function runCommanderDaemonCommand(args) {
       const result = await waitForCommanderDaemon({
         runnerId,
         timeoutMs,
-        statusDir: stringValue7(values, "status-dir")
+        statusDir: stringValue8(values, "status-dir")
       });
       if (result.ok) {
         process.stdout.write("commander_status: connected\n");
@@ -65833,7 +66665,7 @@ async function runCommanderDaemonCommand(args) {
       const runnerId = ensureLocalRunnerIdForLinzumiUrl(kandanUrl);
       const status = stopCommanderDaemon(
         runnerId,
-        stringValue7(values, "status-dir")
+        stringValue8(values, "status-dir")
       );
       process.stdout.write(`${JSON.stringify(status)}
 `);
@@ -65862,13 +66694,13 @@ async function runAuthCommand(args) {
     kandanUrl,
     workspaceSlug: target?.workspaceSlug,
     channelSlug: target?.channelSlug,
-    callbackHost: stringValue7(values, "oauth-callback-host")
+    callbackHost: stringValue8(values, "oauth-callback-host")
   });
   const cached = writeCachedLocalRunnerToken({
     kandanUrl,
     accessToken: token.accessToken,
     expiresInSeconds: token.expiresInSeconds,
-    authFilePath: stringValue7(values, "auth-file")
+    authFilePath: stringValue8(values, "auth-file")
   });
   process.stdout.write(
     `Saved Linzumi local runner auth for ${cached.kandanBaseUrl}
@@ -65888,7 +66720,7 @@ async function runPublishTokenCommand(args) {
   const token = await acquireLocalRunnerTokenDetails({
     kandanUrl,
     purpose: "persisted_documents_publish",
-    callbackHost: stringValue7(values, "oauth-callback-host")
+    callbackHost: stringValue8(values, "oauth-callback-host")
   });
   process.stdout.write(`${token.accessToken}
 `);
@@ -65936,11 +66768,11 @@ async function parseStartRunnerArgs(args, deps = {
   const requestedCwd = resolveUserPath(cwdArg ?? process.cwd());
   const cwd = assertConfiguredAllowedCwds([requestedCwd])[0] ?? requestedCwd;
   const explicitAllowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue8(values, "allowed-cwd"))
   ) : [];
   const allowedCwds = Array.from(/* @__PURE__ */ new Set([cwd, ...explicitAllowedCwds]));
-  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue7(values, "code-server-bin");
+  const requestedCodexBin = stringValue8(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue8(values, "code-server-bin");
   const onboardingDiscovery = values.get("no-onboarding-discovery") === true ? void 0 : "start";
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
@@ -65949,9 +66781,9 @@ async function parseStartRunnerArgs(args, deps = {
   });
   assertRunnerConnectionDependencies(initialDependencyStatus);
   const codexBin = initialDependencyStatus.codex.command;
-  const explicitToken = stringValue7(values, "token");
-  const authFilePath = stringValue7(values, "auth-file");
-  const callbackHost = stringValue7(values, "oauth-callback-host");
+  const explicitToken = stringValue8(values, "token");
+  const authFilePath = stringValue8(values, "auth-file");
+  const callbackHost = stringValue8(values, "oauth-callback-host");
   const reportRejectedCachedToken = (outcome) => {
     process.stderr.write(`${unusableCachedTokenNotice(outcome)}
 `);
@@ -66006,14 +66838,14 @@ async function parseStartRunnerArgs(args, deps = {
     workspaceSlug: target.workspaceSlug,
     cwd,
     codexBin,
-    codexUrl: stringValue7(values, "codex-url"),
+    codexUrl: stringValue8(values, "codex-url"),
     launchSource: electronAutoConnectLaunchSource(),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue7(values, "log-file"),
+    logFile: stringValue8(values, "log-file"),
     allowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue7(values, "forward-port")
+      stringValue8(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -66025,12 +66857,12 @@ async function parseStartRunnerArgs(args, deps = {
     channelSession: {
       workspaceSlug: target.workspaceSlug,
       channelSlug: target.channelSlug,
-      kandanThreadId: stringValue7(values, "linzumi-thread-id"),
-      listenUser: stringValue7(values, "listen-user") ?? defaultListenUserFromToken(targetToken),
-      model: stringValue7(values, "model"),
-      reasoningEffort: stringValue7(values, "reasoning-effort"),
-      sandbox: stringValue7(values, "sandbox"),
-      approvalPolicy: stringValue7(values, "approval-policy"),
+      kandanThreadId: stringValue8(values, "linzumi-thread-id"),
+      listenUser: stringValue8(values, "listen-user") ?? defaultListenUserFromToken(targetToken),
+      model: stringValue8(values, "model"),
+      reasoningEffort: stringValue8(values, "reasoning-effort"),
+      sandbox: stringValue8(values, "sandbox"),
+      approvalPolicy: stringValue8(values, "approval-policy"),
       allowPortForwardingByDefault: true,
       streamFlushMs: positiveIntegerValue2(values, "stream-flush-ms")
     }
@@ -66055,32 +66887,32 @@ async function parseAgentRunnerArgs(args, deps = {
       "linzumi commander accepts either <folder> or --cwd, not both"
     );
   }
-  const tokenFilePath = stringValue7(values, "agent-token-file") ?? defaultAgentTokenFilePath();
+  const tokenFilePath = stringValue8(values, "agent-token-file") ?? defaultAgentTokenFilePath();
   const tokenFile = readStoredAgentTokenFile(tokenFilePath, deps.readTextFile);
   const channelSlug = tokenFile.channelId;
   rejectWorkspaceCommanderThreadFlags(values, channelSlug);
   const channelSession = channelSlug === void 0 ? void 0 : {
     workspaceSlug: tokenFile.workspaceId,
     channelSlug,
-    kandanThreadId: stringValue7(values, "linzumi-thread-id"),
-    listenUser: stringValue7(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
-    model: stringValue7(values, "model"),
-    reasoningEffort: stringValue7(values, "reasoning-effort"),
-    sandbox: stringValue7(values, "sandbox"),
-    approvalPolicy: stringValue7(values, "approval-policy"),
+    kandanThreadId: stringValue8(values, "linzumi-thread-id"),
+    listenUser: stringValue8(values, "listen-user") ?? requiredStoredOwnerUsername(tokenFile.ownerUsername),
+    model: stringValue8(values, "model"),
+    reasoningEffort: stringValue8(values, "reasoning-effort"),
+    sandbox: stringValue8(values, "sandbox"),
+    approvalPolicy: stringValue8(values, "approval-policy"),
     allowPortForwardingByDefault: true,
     streamFlushMs: positiveIntegerValue2(values, "stream-flush-ms")
   };
   const kandanUrl = kandanUrlValue(values) ?? agentApiUrlToKandanUrl(tokenFile.apiUrl);
-  const requestedCwdValue = cwdArg ?? stringValue7(values, "cwd");
+  const requestedCwdValue = cwdArg ?? stringValue8(values, "cwd");
   const requestedCwd = resolveUserPath(requestedCwdValue ?? process.cwd());
   const configuredAllowedCwds2 = requestedCwdValue === void 0 && !values.has("allowed-cwd") ? readConfiguredAllowedCwdDetailsForLinzumiUrl(kandanUrl) : { allowedCwds: [], missingAllowedCwds: [] };
   const allowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue8(values, "allowed-cwd"))
   ) : requestedCwdValue === void 0 ? configuredAllowedCwds2.allowedCwds.length > 0 ? [...configuredAllowedCwds2.allowedCwds] : assertConfiguredAllowedCwds([requestedCwd]) : assertConfiguredAllowedCwds([requestedCwd]);
   const cwd = allowedCwds[0] ?? requestedCwd;
-  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue7(values, "code-server-bin");
+  const requestedCodexBin = stringValue8(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue8(values, "code-server-bin");
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
     codexBin: requestedCodexBin,
@@ -66111,15 +66943,15 @@ async function parseAgentRunnerArgs(args, deps = {
     workspaceSlug: tokenFile.workspaceId,
     cwd,
     codexBin,
-    codexUrl: stringValue7(values, "codex-url"),
+    codexUrl: stringValue8(values, "codex-url"),
     launchSource: electronAutoConnectLaunchSource(),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue7(values, "log-file"),
+    logFile: stringValue8(values, "log-file"),
     allowedCwds,
     missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue7(values, "forward-port")
+      stringValue8(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -66131,7 +66963,7 @@ async function parseAgentRunnerArgs(args, deps = {
   };
 }
 function readAgentTokenTextFile(path2) {
-  return existsSync17(path2) ? readFileSync21(path2, "utf8") : void 0;
+  return existsSync17(path2) ? readFileSync22(path2, "utf8") : void 0;
 }
 function rejectAgentRunnerTargetingFlags(values) {
   const unsupportedFlags = [
@@ -66233,16 +67065,16 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   rejectConnectChannelFlags(values);
-  const workspaceSlug = stringValue7(values, "workspace");
+  const workspaceSlug = stringValue8(values, "workspace");
   const kandanUrl = kandanUrlValue(values) ?? defaultLinzumiWebSocketUrl;
-  const cwd = stringValue7(values, "cwd") ?? process.cwd();
+  const cwd = stringValue8(values, "cwd") ?? process.cwd();
   const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
   const localConfiguredAllowedCwds = values.has("allowed-cwd") ? { allowedCwds: [], missingAllowedCwds: [] } : readConfiguredAllowedCwdDetailsForLinzumiUrl(kandanUrl);
   const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue8(values, "allowed-cwd"))
   ) : [...localConfiguredAllowedCwds.allowedCwds];
-  const requestedCodexBin = stringValue7(values, "codex-bin") ?? "codex";
-  const customCodeServerBin = stringValue7(values, "code-server-bin");
+  const requestedCodexBin = stringValue8(values, "codex-bin") ?? "codex";
+  const customCodeServerBin = stringValue8(values, "code-server-bin");
   const onboardingDiscovery = values.get("no-onboarding-discovery") === true ? void 0 : "start";
   const initialDependencyStatus = await deps.buildDependencyStatus({
     cwd,
@@ -66251,13 +67083,13 @@ async function parseRunnerArgs(args, deps = {
   });
   assertRunnerConnectionDependencies(initialDependencyStatus);
   const codexBin = initialDependencyStatus.codex.command;
-  const explicitToken = stringValue7(values, "token");
+  const explicitToken = stringValue8(values, "token");
   const token = await deps.resolveToken({
     kandanUrl,
     explicitToken,
     workspaceSlug,
-    authFilePath: stringValue7(values, "auth-file"),
-    callbackHost: stringValue7(values, "oauth-callback-host"),
+    authFilePath: stringValue8(values, "auth-file"),
+    callbackHost: stringValue8(values, "oauth-callback-host"),
     requiredScopes: onboardingDiscovery === "start" ? onboardingDiscoveryRequiredScopes : void 0,
     reportRejectedCachedToken: (outcome) => {
       process.stderr.write(`${unusableCachedTokenNotice(outcome)}
@@ -66286,17 +67118,17 @@ async function parseRunnerArgs(args, deps = {
     ),
     cwd,
     codexBin,
-    codexUrl: stringValue7(values, "codex-url"),
+    codexUrl: stringValue8(values, "codex-url"),
     launchSource: electronAutoConnectLaunchSource(),
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
-    logFile: stringValue7(values, "log-file"),
+    logFile: stringValue8(values, "log-file"),
     allowedCwds: Array.from(
       /* @__PURE__ */ new Set([...cwdAllowedCwds, ...configuredAllowedCwds2])
     ),
     missingAllowedCwds: localConfiguredAllowedCwds.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue7(values, "forward-port")
+      stringValue8(values, "forward-port")
     ),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -66311,10 +67143,10 @@ async function parseRunnerArgs(args, deps = {
 }
 function runnerRuntimeDefaultsFromValues(values) {
   return {
-    model: stringValue7(values, "model"),
-    reasoningEffort: stringValue7(values, "reasoning-effort"),
-    approvalPolicy: stringValue7(values, "approval-policy"),
-    sandbox: stringValue7(values, "sandbox"),
+    model: stringValue8(values, "model"),
+    reasoningEffort: stringValue8(values, "reasoning-effort"),
+    approvalPolicy: stringValue8(values, "approval-policy"),
+    sandbox: stringValue8(values, "sandbox"),
     allowPortForwardingByDefault: true
   };
 }
@@ -66331,8 +67163,8 @@ function isHelpOrVersionInvocation(args) {
   return args.some((arg) => ["--help", "-h", "--version"].includes(arg));
 }
 function kandanUrlValue(values) {
-  const apiUrl = stringValue7(values, "api-url");
-  const linzumiUrl = stringValue7(values, "linzumi-url");
+  const apiUrl = stringValue8(values, "api-url");
+  const linzumiUrl = stringValue8(values, "linzumi-url");
   if (apiUrl !== void 0 && linzumiUrl !== void 0 && apiUrl !== linzumiUrl) {
     throw new Error("use only one of --api-url or --linzumi-url");
   }
@@ -66441,10 +67273,10 @@ function rejectStartTargetingFlags(values) {
 }
 function resolveUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir16();
+    return homedir17();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve11(homedir16(), pathValue.slice(2));
+    return resolve11(homedir17(), pathValue.slice(2));
   }
   return resolve11(pathValue);
 }
@@ -66471,8 +67303,8 @@ function rejectConnectChannelFlags(values) {
   );
 }
 function parseOptionalChannelTarget(values) {
-  const channel = stringValue7(values, "channel");
-  const workspace = stringValue7(values, "workspace");
+  const channel = stringValue8(values, "channel");
+  const workspace = stringValue8(values, "workspace");
   if (channel === void 0) {
     if (workspace === void 0) {
       return void 0;
@@ -66506,9 +67338,9 @@ function withLocalMachineId(options) {
 function parseThreadCodexWorkerArgs(args) {
   const values = strictFlagValues2(args);
   const kandanUrl = kandanUrlValue(values) ?? defaultLinzumiWebSocketUrl;
-  const cwd = stringValue7(values, "cwd") ?? process.cwd();
+  const cwd = stringValue8(values, "cwd") ?? process.cwd();
   const configuredAllowedCwds2 = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(
-    parseAllowedCwdList(stringValue7(values, "allowed-cwd"))
+    parseAllowedCwdList(stringValue8(values, "allowed-cwd"))
   ) : assertConfiguredAllowedCwds([cwd]);
   const kandanThreadId = requiredThreadRunnerKandanThreadId();
   const token = requiredThreadRunnerToken();
@@ -66518,17 +67350,17 @@ function parseThreadCodexWorkerArgs(args) {
     runnerId: `thread-codex-worker:${kandanThreadId}`,
     machineId: void 0,
     runnerLockConfigPath: void 0,
-    workspaceSlug: stringValue7(values, "workspace"),
+    workspaceSlug: stringValue8(values, "workspace"),
     cwd,
-    codexBin: stringValue7(values, "codex-bin") ?? "codex",
+    codexBin: stringValue8(values, "codex-bin") ?? "codex",
     codexUrl: void 0,
     launchTui: false,
     fast: values.get("fast") === true ? true : void 0,
-    logFile: stringValue7(values, "log-file"),
+    logFile: stringValue8(values, "log-file"),
     allowedCwds: configuredAllowedCwds2.allowedCwds,
     missingAllowedCwds: configuredAllowedCwds2.missingAllowedCwds,
     allowedForwardPorts: parseAllowedPortList(
-      stringValue7(values, "forward-port")
+      stringValue8(values, "forward-port")
     ),
     codeServerBin: void 0,
     editorRuntime: void 0,
@@ -66543,25 +67375,27 @@ function parseThreadCodexWorkerArgs(args) {
   };
 }
 function threadRunnerCodexModelProvider(values) {
-  const modelProvider = stringValue7(values, "model-provider");
+  const modelProvider = stringValue8(values, "model-provider");
   if (modelProvider === void 0) {
     return void 0;
   }
-  if (modelProvider !== "wafer") {
+  if (modelProvider !== "wafer" && modelProvider !== "openai-proxy") {
     throw new Error(`unsupported --model-provider: ${modelProvider}`);
   }
-  const llmProxyBaseUrl = stringValue7(values, "llm-proxy-base-url");
+  const llmProxyBaseUrl = stringValue8(values, "llm-proxy-base-url");
   const llmProxyToken = process.env.LINZUMI_LLM_PROXY_TOKEN?.trim();
   if (llmProxyBaseUrl === void 0) {
-    throw new Error("--model-provider wafer requires --llm-proxy-base-url");
+    throw new Error(
+      `--model-provider ${modelProvider} requires --llm-proxy-base-url`
+    );
   }
   if (llmProxyToken === void 0 || llmProxyToken === "") {
     throw new Error(
-      "--model-provider wafer requires the LINZUMI_LLM_PROXY_TOKEN env credential"
+      `--model-provider ${modelProvider} requires the LINZUMI_LLM_PROXY_TOKEN env credential`
     );
   }
   return {
-    provider: "wafer",
+    provider: modelProvider,
     llmProxyBaseUrl,
     llmProxyToken
   };
@@ -66583,13 +67417,13 @@ function requiredThreadRunnerToken() {
   return token;
 }
 function required2(values, key) {
-  const value = stringValue7(values, key);
+  const value = stringValue8(values, key);
   if (value === void 0) {
     throw new Error(`missing --${key}`);
   }
   return value;
 }
-function stringValue7(values, key) {
+function stringValue8(values, key) {
   const value = values.get(key);
   if (typeof value === "string" && value.trim() !== "") {
     return value;
@@ -66597,7 +67431,7 @@ function stringValue7(values, key) {
   return void 0;
 }
 function positiveIntegerValue2(values, key) {
-  const value = stringValue7(values, key);
+  const value = stringValue8(values, key);
   if (value === void 0) {
     return void 0;
   }
@@ -66608,7 +67442,7 @@ function positiveIntegerValue2(values, key) {
   throw new Error(`--${key} must be a positive integer`);
 }
 function tcpPortValue(values, key) {
-  const value = stringValue7(values, key);
+  const value = stringValue8(values, key);
   if (value === void 0) {
     return void 0;
   }