@linzumi/cli 0.0.83-beta → 0.0.84-beta

package/dist/index.js

@@ -11564,6 +11564,21 @@ function createClaudeCodeSessionPipeline(host) {
         handleToolResult(ensureTurn(), event);
         return;
       }
+      case "command_output_delta": {
+        const turn = activeTurn;
+        const pending = turn?.pendingTools.get(event.itemKey);
+        if (turn === void 0 || pending === void 0) {
+          return;
+        }
+        submit("item/commandExecution/outputDelta", {
+          turnId: turn.turnId,
+          itemId: `tool:${event.itemKey}`,
+          command: claudeToolCommandLabel(pending.toolName, pending.input),
+          stream: "stdout",
+          delta: event.delta
+        });
+        return;
+      }
       case "command_output": {
         const turn = ensureTurn();
         const item = {
@@ -11945,13 +11960,304 @@ var init_claudeCodePlanMirror = __esm({
   }
 });
 
+// src/claudeCodeLiveBashOutput.ts
+import {
+  mkdirSync as mkdirSync2,
+  rmSync,
+  writeFileSync,
+  promises as fsPromises
+} from "node:fs";
+import { join as join6 } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+function shellSingleQuoted(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function claudeLiveBashWrappedCommand(command, captureFile) {
+  return `__lz_live_out=${shellSingleQuoted(captureFile)}; if ! : >> "$__lz_live_out" 2>/dev/null; then __lz_live_out=/dev/null; fi; { ${command}${wrapperTail}`;
+}
+function isClaudeLiveBashWrappedCommand(command) {
+  return wrapperHeadPattern.test(command) && command.endsWith(wrapperTail);
+}
+function claudeLiveBashOriginalCommand(command) {
+  const head = command.match(wrapperHeadPattern)?.[0];
+  if (head === void 0 || !command.endsWith(wrapperTail)) {
+    return command;
+  }
+  return command.slice(head.length, command.length - wrapperTail.length);
+}
+function claudeLiveBashCaptureEnabled(env) {
+  const value = env.LINZUMI_CLAUDE_LIVE_BASH?.trim().toLowerCase();
+  return !(value === "0" || value === "false" || value === "off" || value === "no");
+}
+function createClaudeCodeLiveBashCapture(host) {
+  const pollIntervalMs = host.pollIntervalMs ?? defaultPollIntervalMs;
+  const maxEmittedBytes = host.maxEmittedBytesPerTool ?? defaultMaxEmittedBytesPerTool;
+  const tails = /* @__PURE__ */ new Map();
+  let closed = false;
+  const stopTail = (toolUseId) => {
+    const tail = tails.get(toolUseId);
+    if (tail === void 0) {
+      return;
+    }
+    tails.delete(toolUseId);
+    if (tail.timer !== void 0) {
+      clearInterval(tail.timer);
+      tail.timer = void 0;
+    }
+    try {
+      rmSync(tail.file, { force: true });
+    } catch (_error) {
+    }
+  };
+  const pollTail = async (toolUseId, tail) => {
+    if (tail.reading) {
+      return;
+    }
+    tail.reading = true;
+    try {
+      const stat2 = await fsPromises.stat(tail.file);
+      if (stat2.size <= tail.offset) {
+        return;
+      }
+      const length = Math.min(
+        stat2.size - tail.offset,
+        maxReadBytesPerPoll,
+        maxEmittedBytes - tail.emittedBytes
+      );
+      if (length <= 0) {
+        stopTail(toolUseId);
+        return;
+      }
+      const handle = await fsPromises.open(tail.file, "r");
+      try {
+        const buffer = Buffer.alloc(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, tail.offset);
+        if (bytesRead <= 0) {
+          return;
+        }
+        tail.offset += bytesRead;
+        tail.emittedBytes += bytesRead;
+        const delta = tail.decoder.write(buffer.subarray(0, bytesRead));
+        if (delta !== "" && tails.get(toolUseId) === tail) {
+          host.onOutputDelta(toolUseId, delta);
+        }
+        if (tail.emittedBytes >= maxEmittedBytes) {
+          host.log?.("claude_live_bash.output_budget_exhausted", {
+            tool_use_id: toolUseId,
+            emitted_bytes: tail.emittedBytes
+          });
+          stopTail(toolUseId);
+        }
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      if (tails.get(toolUseId) === tail) {
+        host.log?.("claude_live_bash.tail_read_failed", {
+          tool_use_id: toolUseId,
+          message: error instanceof Error ? error.message : String(error)
+        });
+        stopTail(toolUseId);
+      }
+    } finally {
+      tail.reading = false;
+    }
+  };
+  const startTail = (toolUseId, file) => {
+    stopTail(toolUseId);
+    const tail = {
+      file,
+      decoder: new StringDecoder("utf8"),
+      offset: 0,
+      emittedBytes: 0,
+      reading: false,
+      timer: void 0
+    };
+    tails.set(toolUseId, tail);
+    const timer = setInterval(() => {
+      void pollTail(toolUseId, tail);
+    }, pollIntervalMs);
+    timer.unref?.();
+    tail.timer = timer;
+  };
+  const wrapToolInput = (toolUseId, toolInput) => {
+    if (closed) {
+      return void 0;
+    }
+    const command = toolInput.command;
+    if (typeof command !== "string" || command.trim() === "" || // Background commands are polled by the model itself (TaskOutput);
+    // the foreground live stream does not apply.
+    toolInput.run_in_background === true || // Defensive: never double-wrap (e.g. a model echoing a wrapped
+    // command back from its own transcript).
+    isClaudeLiveBashWrappedCommand(command)) {
+      return void 0;
+    }
+    const file = join6(
+      host.captureDir,
+      `${toolUseId.replaceAll(/[^\w-]/g, "_")}.out`
+    );
+    try {
+      mkdirSync2(host.captureDir, { recursive: true });
+      writeFileSync(file, "");
+    } catch (error) {
+      host.log?.("claude_live_bash.capture_file_failed", {
+        tool_use_id: toolUseId,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      return void 0;
+    }
+    startTail(toolUseId, file);
+    return {
+      ...toolInput,
+      command: claudeLiveBashWrappedCommand(command, file)
+    };
+  };
+  const preToolUseHook = async (input) => {
+    const passthrough = { continue: true };
+    if (typeof input !== "object" || input === null) {
+      return passthrough;
+    }
+    const hookInput = input;
+    if (hookInput.hook_event_name !== "PreToolUse" || hookInput.tool_name !== "Bash" || typeof hookInput.tool_use_id !== "string" || hookInput.tool_use_id === "" || typeof hookInput.tool_input !== "object" || hookInput.tool_input === null || // Hook-path wrapping ONLY in bypassPermissions, where every command
+    // auto-allows and the rewrite cannot perturb a permission decision.
+    // In ask-capable modes, PreToolUse updatedInput propagates into rule
+    // matching and sandbox auto-allow analysis (verified empirically
+    // 2026-06-12: a sandbox-auto-allowed `false` started prompting once
+    // wrapped), so those modes wrap at canUseTool-allow time instead
+    // (wrapApprovedTool below) - the command was already being asked, so
+    // wrapping there adds zero prompts.
+    hookInput.permission_mode !== "bypassPermissions") {
+      return passthrough;
+    }
+    const updatedInput = wrapToolInput(
+      hookInput.tool_use_id,
+      hookInput.tool_input
+    );
+    if (updatedInput === void 0) {
+      return passthrough;
+    }
+    return {
+      continue: true,
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        updatedInput
+      }
+    };
+  };
+  return {
+    hookMatchers: [{ matcher: "Bash", hooks: [preToolUseHook] }],
+    wrapApprovedTool: wrapToolInput,
+    settleTool: stopTail,
+    settleAll: () => {
+      for (const toolUseId of [...tails.keys()]) {
+        stopTail(toolUseId);
+      }
+    },
+    close: () => {
+      closed = true;
+      for (const toolUseId of [...tails.keys()]) {
+        stopTail(toolUseId);
+      }
+      try {
+        rmSync(host.captureDir, { recursive: true, force: true });
+      } catch (_error) {
+      }
+    }
+  };
+}
+var wrapperHeadPattern, wrapperTail, defaultPollIntervalMs, defaultMaxEmittedBytesPerTool, maxReadBytesPerPoll;
+var init_claudeCodeLiveBashOutput = __esm({
+  "src/claudeCodeLiveBashOutput.ts"() {
+    "use strict";
+    wrapperHeadPattern = /^__lz_live_out='(?:[^']|'\\'')*'; if ! : >> "\$__lz_live_out" 2>\/dev\/null; then __lz_live_out=\/dev\/null; fi; \{ /;
+    wrapperTail = '\n} > >(tee -a -- "$__lz_live_out") 2> >(tee -a -- "$__lz_live_out" >&2)';
+    defaultPollIntervalMs = 200;
+    defaultMaxEmittedBytesPerTool = 262144;
+    maxReadBytesPerPoll = 65536;
+  }
+});
+
 // src/claudeCodeSession.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function claudeCodeSettingSources() {
   return ["user", "project", "local"];
 }
+function claudeCodeTokenUsageSummaryText(usage) {
+  const cached = usage.cacheReadInputTokens === void 0 && usage.cacheCreationInputTokens === void 0 ? void 0 : (usage.cacheReadInputTokens ?? 0) + (usage.cacheCreationInputTokens ?? 0);
+  const parts = [
+    usage.inputTokens === void 0 ? void 0 : `${usage.inputTokens} in`,
+    usage.outputTokens === void 0 ? void 0 : `${usage.outputTokens} out`,
+    cached === void 0 ? void 0 : `${cached} cached`,
+    usage.totalCostUsd === void 0 ? void 0 : `$${usage.totalCostUsd.toFixed(4)}`
+  ].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(" / ");
+}
+function createClaudeCodeStreamUsageTracker() {
+  const completed = {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheCreationInputTokens: 0,
+    cacheReadInputTokens: 0
+  };
+  let current;
+  let lastEmittedKey;
+  const totalsFromUsage = (usage, previous) => ({
+    inputTokens: integerValue(usage.input_tokens) ?? previous?.inputTokens ?? 0,
+    outputTokens: integerValue(usage.output_tokens) ?? previous?.outputTokens ?? 0,
+    cacheCreationInputTokens: integerValue(usage.cache_creation_input_tokens) ?? previous?.cacheCreationInputTokens ?? 0,
+    cacheReadInputTokens: integerValue(usage.cache_read_input_tokens) ?? previous?.cacheReadInputTokens ?? 0
+  });
+  const snapshotIfChanged = () => {
+    const inputTokens = completed.inputTokens + (current?.inputTokens ?? 0);
+    const outputTokens = completed.outputTokens + (current?.outputTokens ?? 0);
+    const cacheCreationInputTokens = completed.cacheCreationInputTokens + (current?.cacheCreationInputTokens ?? 0);
+    const cacheReadInputTokens = completed.cacheReadInputTokens + (current?.cacheReadInputTokens ?? 0);
+    const key = `${inputTokens}:${outputTokens}:${cacheCreationInputTokens}:${cacheReadInputTokens}`;
+    if (key === lastEmittedKey) {
+      return void 0;
+    }
+    lastEmittedKey = key;
+    return {
+      inputTokens,
+      outputTokens,
+      cacheCreationInputTokens,
+      cacheReadInputTokens,
+      totalCostUsd: void 0
+    };
+  };
+  return {
+    observeStreamEvent: (event) => {
+      switch (stringValue(event?.type)) {
+        case "message_start": {
+          const usage = objectValue(objectValue(event?.message)?.usage);
+          if (usage === void 0) {
+            return void 0;
+          }
+          if (current !== void 0) {
+            completed.inputTokens += current.inputTokens;
+            completed.outputTokens += current.outputTokens;
+            completed.cacheCreationInputTokens += current.cacheCreationInputTokens;
+            completed.cacheReadInputTokens += current.cacheReadInputTokens;
+          }
+          current = totalsFromUsage(usage, void 0);
+          return snapshotIfChanged();
+        }
+        case "message_delta": {
+          const usage = objectValue(event?.usage);
+          if (usage === void 0) {
+            return void 0;
+          }
+          current = totalsFromUsage(usage, current);
+          return snapshotIfChanged();
+        }
+        default:
+          return void 0;
+      }
+    }
+  };
+}
 function parseClaudeCodeRateLimitInfo(info) {
   if (info === void 0) {
     return void 0;
@@ -12051,7 +12357,7 @@ async function probeClaudeCodeAvailability(args) {
   }
 }
 function hasClaudeCodeAuthHint(env, deps) {
-  const configDir = env.CLAUDE_CONFIG_DIR ?? join6(deps.homeDir, ".claude");
+  const configDir = env.CLAUDE_CONFIG_DIR ?? join7(deps.homeDir, ".claude");
   return hasAnthropicCredentialEnv(env) || hasClaudeCloudProviderEnv(env) || hasClaudeCodeFileCredential(configDir, deps) || hasClaudeCodeApiKeyHelper(configDir, deps) || hasMacClaudeCodeKeychainAnchor(deps);
 }
 function claudeCodePolicyDeferHooks() {
@@ -12086,14 +12392,14 @@ function hasClaudeCloudProviderEnv(env) {
   return trueishEnv(env.CLAUDE_CODE_USE_BEDROCK) || trueishEnv(env.CLAUDE_CODE_USE_VERTEX) || trueishEnv(env.CLAUDE_CODE_USE_FOUNDRY) || trueishEnv(env.CLAUDE_CODE_USE_ANTHROPIC_AWS) || trueishEnv(env.CLAUDE_CODE_USE_MANTLE);
 }
 function hasClaudeCodeFileCredential(configDir, deps) {
-  return deps.fileExists(join6(configDir, ".credentials.json")) || deps.fileExists(join6(configDir, ".claude.json")) || deps.fileExists(join6(deps.homeDir, ".claude.json"));
+  return deps.fileExists(join7(configDir, ".credentials.json")) || deps.fileExists(join7(configDir, ".claude.json")) || deps.fileExists(join7(deps.homeDir, ".claude.json"));
 }
 function hasClaudeCodeApiKeyHelper(configDir, deps) {
   return [
-    join6(configDir, "settings.json"),
-    join6(configDir, "settings.local.json"),
-    join6(deps.cwd, ".claude", "settings.json"),
-    join6(deps.cwd, ".claude", "settings.local.json")
+    join7(configDir, "settings.json"),
+    join7(configDir, "settings.local.json"),
+    join7(deps.cwd, ".claude", "settings.json"),
+    join7(deps.cwd, ".claude", "settings.local.json")
   ].some((path2) => settingsFileHasApiKeyHelper(path2, deps));
 }
 function settingsFileHasApiKeyHelper(path2, deps) {
@@ -12113,9 +12419,9 @@ function hasMacClaudeCodeKeychainAnchor(deps) {
     return false;
   }
   return [
-    join6(deps.homeDir, "Library", "Application Support", "claude-cli-nodejs"),
-    join6(deps.homeDir, "Library", "Application Support", "Claude"),
-    join6(deps.homeDir, "Library", "Preferences", "claude-cli-nodejs")
+    join7(deps.homeDir, "Library", "Application Support", "claude-cli-nodejs"),
+    join7(deps.homeDir, "Library", "Application Support", "Claude"),
+    join7(deps.homeDir, "Library", "Preferences", "claude-cli-nodejs")
   ].some((path2) => deps.fileExists(path2));
 }
 function readTextFileIfPresent(path2) {
@@ -12136,6 +12442,7 @@ async function startClaudeCodeSession(options) {
     startedSessionIds: /* @__PURE__ */ new Set(),
     completedTurnCount: 0
   };
+  const streamUsageTracker = createClaudeCodeStreamUsageTracker();
   for await (const message of runner(options)) {
     state.sessionId = state.sessionId ?? extractClaudeSessionId(message);
     const sessionId = extractClaudeSessionId(message) ?? state.sessionId;
@@ -12143,7 +12450,11 @@ async function startClaudeCodeSession(options) {
       state.startedSessionIds.add(sessionId);
       await options.onTranscriptEvent?.({ type: "session_started", sessionId });
     }
-    for (const event of transcriptEventsForClaudeMessage(message, sessionId)) {
+    for (const event of transcriptEventsForClaudeMessage(
+      message,
+      sessionId,
+      streamUsageTracker
+    )) {
       if (event.type === "assistant_message") {
         recordClaudeAssistantAggregate(state, event);
       }
@@ -12314,6 +12625,11 @@ async function failClaudeCodeSession(options, sessionId, reason) {
 async function* defaultClaudeCodeRunner(options) {
   const sdk = await import("@anthropic-ai/claude-agent-sdk");
   const prompt = options.streamingInput?.messages ?? options.prompt;
+  const preToolUseMatchers = [
+    ...options.preToolUseHookMatchers ?? [],
+    ...options.canUseTool === void 0 ? claudeCodePolicyDeferHooks().PreToolUse ?? [] : []
+  ];
+  const hooks = preToolUseMatchers.length === 0 ? void 0 : { PreToolUse: preToolUseMatchers };
   const query = sdk.query({
     prompt,
     options: {
@@ -12334,7 +12650,13 @@ async function* defaultClaudeCodeRunner(options) {
       },
       ...options.allowedTools === void 0 ? {} : { allowedTools: [...options.allowedTools] },
       ...options.env === void 0 ? {} : { env: options.env },
-      ...options.canUseTool === void 0 ? { hooks: claudeCodePolicyDeferHooks() } : { canUseTool: claudeCodeCanUseTool(options.canUseTool) },
+      ...hooks === void 0 ? {} : { hooks },
+      ...options.canUseTool === void 0 ? {} : {
+        canUseTool: claudeCodeCanUseTool(
+          options.canUseTool,
+          options.wrapApprovedToolInput
+        )
+      },
       ...options.model === void 0 ? {} : { model: options.model }
       // exactOptionalPropertyTypes: the conditional spreads build a union the
       // SDK's Options cannot absorb verbatim; the shape is correct field-wise.
@@ -12425,7 +12747,7 @@ function boundedPositiveInteger(value, fallback, min, max) {
   }
   return value;
 }
-function claudeCodeCanUseTool(handler) {
+function claudeCodeCanUseTool(handler, wrapApprovedToolInput) {
   return async (toolName2, input, options) => {
     const decision = await handler(
       {
@@ -12436,7 +12758,11 @@ function claudeCodeCanUseTool(handler) {
         description: options.description,
         decisionReason: options.decisionReason,
         blockedPath: options.blockedPath,
-        input
+        // Approval prompts render the human-facing command: when the live
+        // Bash output capture wrapped it (PreToolUse updatedInput), show
+        // the original. The SDK still receives the raw input on allow so
+        // the wrapped (live-streaming) command is what executes.
+        input: displayClaudeToolInput(toolName2, input)
       },
       options.signal
     );
@@ -12445,7 +12771,11 @@ function claudeCodeCanUseTool(handler) {
         return {
           behavior: "allow",
           toolUseID: options.toolUseID,
-          updatedInput: input
+          // Live Bash output for ask-capable permission modes: the approved
+          // command gains the tee wrapper HERE (it was already prompting,
+          // so wrapping at this point can never add a prompt - see
+          // claudeCodeLiveBashOutput).
+          updatedInput: wrapApprovedToolInput?.(options.toolUseID, toolName2, input) ?? input
         };
       case "deny":
         return {
@@ -12456,6 +12786,17 @@ function claudeCodeCanUseTool(handler) {
     }
   };
 }
+function displayClaudeToolInput(toolName2, input) {
+  if (toolName2 !== "Bash") {
+    return input;
+  }
+  const command = stringValue(input.command);
+  if (command === void 0) {
+    return input;
+  }
+  const original = claudeLiveBashOriginalCommand(command);
+  return original === command ? input : { ...input, command: original };
+}
 function extractClaudeSessionId(message) {
   const messageObject = objectValue(message);
   const directSessionId = stringValue(messageObject?.session_id) ?? stringValue(messageObject?.sessionId);
@@ -12492,11 +12833,11 @@ function extractClaudeResultErrorReason(message, subtype) {
   const explicitErrors = arrayValue(message.errors)?.map((error) => stringValue(error)).filter((error) => nonEmptyText(error) !== void 0).join("; ");
   return nonEmptyText(explicitErrors) ?? nonEmptyText(stringValue(message.result)) ?? nonEmptyText(stringValue(message.error)) ?? subtype ?? "error";
 }
-function transcriptEventsForClaudeMessage(message, sessionId) {
+function transcriptEventsForClaudeMessage(message, sessionId, usageTracker) {
   const messageObject = objectValue(message);
   switch (stringValue(messageObject?.type)) {
     case "stream_event":
-      return streamTranscriptEvents(messageObject, sessionId);
+      return streamTranscriptEvents(messageObject, sessionId, usageTracker);
     case "assistant":
       return assistantTranscriptEvents(messageObject, sessionId);
     case "user":
@@ -12513,11 +12854,16 @@ function transcriptEventsForClaudeMessage(message, sessionId) {
       return unknownTranscriptEvent(messageObject, sessionId);
   }
 }
-function streamTranscriptEvents(message, sessionId) {
+function streamTranscriptEvents(message, sessionId, usageTracker) {
   if (sessionId === void 0) {
     return [];
   }
   const event = objectValue(message?.event);
+  const runningUsage = usageTracker?.observeStreamEvent(event);
+  const usageEvents = runningUsage === void 0 ? [] : [{ type: "usage", sessionId, usage: runningUsage }];
+  return [...usageEvents, ...streamContentEvents(event, message, sessionId)];
+}
+function streamContentEvents(event, message, sessionId) {
   switch (stringValue(event?.type)) {
     case "content_block_delta": {
       const delta = objectValue(event?.delta);
@@ -12719,6 +13065,7 @@ var init_claudeCodeSession = __esm({
   "src/claudeCodeSession.ts"() {
     "use strict";
     init_json();
+    init_claudeCodeLiveBashOutput();
     claudeRateLimitWindowLabels = {
       five_hour: "5h window",
       seven_day: "7d window",
@@ -12733,10 +13080,10 @@ var init_claudeCodeSession = __esm({
 import { appendFileSync, openSync as openSync2 } from "node:fs";
 import { createWriteStream } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
-import { mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
+import { mkdirSync as mkdirSync3 } from "node:fs";
 function createRunnerLogger(logFile, consoleReporter) {
-  mkdirSync2(dirname3(logFile), { recursive: true });
+  mkdirSync3(dirname3(logFile), { recursive: true });
   const fd = openSync2(logFile, "a");
   const stream = createWriteStream("", { fd, flags: "a", autoClose: true });
   const logger = ((event, payload) => {
@@ -12756,7 +13103,7 @@ function createRunnerLogger(logFile, consoleReporter) {
 function writeCliAuditEvent(event, payload, options = {}) {
   const logFile = options.logFile ?? defaultCliAuditLogFile();
   try {
-    mkdirSync2(dirname3(logFile), { recursive: true });
+    mkdirSync3(dirname3(logFile), { recursive: true });
     appendFileSync(
       logFile,
       `${JSON.stringify({
@@ -12774,10 +13121,10 @@ function writeCliAuditEvent(event, payload, options = {}) {
 }
 function defaultCliAuditLogFile() {
   const override = process.env.LINZUMI_CLI_AUDIT_LOG?.trim();
-  return override === void 0 || override === "" ? join7(homedir6(), ".linzumi", "logs", "command-events.jsonl") : override;
+  return override === void 0 || override === "" ? join8(homedir6(), ".linzumi", "logs", "command-events.jsonl") : override;
 }
 function defaultRunnerLogFile() {
-  return join7(homedir6(), ".linzumi", "logs", "linzumi-runner.log");
+  return join8(homedir6(), ".linzumi", "logs", "linzumi-runner.log");
 }
 function redactForCliLog(value) {
   return redactObject(value);
@@ -13060,7 +13407,10 @@ var init_mcpConfig = __esm({
 import {
   spawn as spawn2
 } from "node:child_process";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { createServer } from "node:net";
+import { homedir as homedir7 } from "node:os";
+import { join as join9 } from "node:path";
 import { WebSocket as NodeWebSocket } from "ws";
 async function chooseLoopbackPort() {
   return new Promise((resolve12, reject) => {
@@ -13277,10 +13627,46 @@ function codexModelProviderConfigArgs(provider) {
       "-c",
       `model_providers.${provider.id}.http_headers.${header}=${JSON.stringify(value)}`
     ]),
+    // env_http_headers values are env var NAMES, not secrets: codex resolves
+    // them from its environment per request, keeping tokens out of argv.
+    ...Object.entries(provider.envHttpHeaders ?? {}).flatMap(
+      ([header, envVar]) => [
+        "-c",
+        `model_providers.${provider.id}.env_http_headers.${header}=${JSON.stringify(envVar)}`
+      ]
+    ),
     "-c",
     `model_provider=${JSON.stringify(provider.id)}`
   ];
 }
+function resolveForwardableOpenAiApiKey(env = process.env) {
+  const fromEnv = env.OPENAI_API_KEY?.trim();
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    return fromEnv;
+  }
+  const codexHomeRaw = env.CODEX_HOME?.trim();
+  const codexHome = codexHomeRaw !== void 0 && codexHomeRaw !== "" ? codexHomeRaw : join9(homedir7(), ".codex");
+  let raw;
+  try {
+    raw = readFileSync6(join9(codexHome, "auth.json"), "utf8");
+  } catch (_error) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (_error) {
+    return void 0;
+  }
+  if (!isJsonObject(parsed)) {
+    return void 0;
+  }
+  const apiKey = parsed.OPENAI_API_KEY;
+  if (typeof apiKey === "string" && apiKey.trim() !== "") {
+    return apiKey.trim();
+  }
+  return void 0;
+}
 async function connectCodexAppServer(websocketUrl, socketFactory = (url) => new NodeWebSocket(url)) {
   const websocket = await openCodexAppServerWebSocket(
     websocketUrl,
@@ -13604,22 +13990,22 @@ var init_codexAppServer = __esm({
 // src/codexProjectTrust.ts
 import {
   existsSync as existsSync5,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync6,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync7,
   realpathSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join8, resolve as resolve3 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join10, resolve as resolve3 } from "node:path";
 function ensureCodexProjectTrusted(projectPath, options = {}) {
   const trustedPath = realpathSync(resolve3(projectPath));
-  const configHome = options.configHome ?? process.env.CODEX_HOME ?? join8(homedir7(), ".codex");
-  const configPath = join8(configHome, "config.toml");
-  const currentConfig = existsSync5(configPath) ? readFileSync6(configPath, "utf8") : "";
+  const configHome = options.configHome ?? process.env.CODEX_HOME ?? join10(homedir8(), ".codex");
+  const configPath = join10(configHome, "config.toml");
+  const currentConfig = existsSync5(configPath) ? readFileSync7(configPath, "utf8") : "";
   const nextConfig = codexConfigWithTrustedProject(currentConfig, trustedPath);
   if (nextConfig !== currentConfig) {
-    mkdirSync3(configHome, { recursive: true });
-    writeFileSync(configPath, nextConfig);
+    mkdirSync4(configHome, { recursive: true });
+    writeFileSync2(configPath, nextConfig);
   }
   return trustedPath;
 }
@@ -13964,7 +14350,7 @@ var init_codexNotificationConsoleStats = __esm({
 
 // src/localCapabilities.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve4 } from "node:path";
 function parseAllowedCwdList(value) {
   if (value === void 0) {
@@ -14013,7 +14399,7 @@ function expandUserPath(pathValue) {
 }
 function currentHomeDirectory() {
   const configuredHome = process.env.HOME;
-  return configuredHome === void 0 || configuredHome.trim() === "" ? homedir8() : configuredHome;
+  return configuredHome === void 0 || configuredHome.trim() === "" ? homedir9() : configuredHome;
 }
 function resolveAllowedCwd(requestedCwd, allowedRoots) {
   if (requestedCwd === void 0 || requestedCwd.trim() === "") {
@@ -14413,17 +14799,17 @@ import {
   chmodSync,
   existsSync as existsSync6,
   linkSync,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync7,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync8,
   realpathSync as realpathSync3,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { basename as basename5, dirname as dirname4, join as join9, resolve as resolve5 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename5, dirname as dirname4, join as join11, resolve as resolve5 } from "node:path";
 function localConfigPath(env = process.env) {
   const override = env.LINZUMI_CONFIG_FILE;
-  return override !== void 0 && override.trim() !== "" ? resolve5(expandUserPath(override)) : resolve5(homedir9(), ".linzumi", "config.json");
+  return override !== void 0 && override.trim() !== "" ? resolve5(expandUserPath(override)) : resolve5(homedir10(), ".linzumi", "config.json");
 }
 function localConfigScopeKey(linzumiUrl) {
   const normalizedUrl = kandanHttpBaseUrl(linzumiUrl);
@@ -14504,21 +14890,21 @@ function ensureLocalRunnerId(path2 = localConfigPath(), createRunnerId = default
 }
 function localMachineIdSeedPath(configPath = localConfigPath(), linzumiUrl) {
   if (linzumiUrl !== void 0 && localConfigScopeKey(linzumiUrl) !== prodConfigScope) {
-    return join9(
+    return join11(
       dirname4(configPath),
       `${basename5(configPath)}.${localConfigScopeFileStem(linzumiUrl)}.machine-id`
     );
   }
-  return join9(dirname4(configPath), `${basename5(configPath)}.machine-id`);
+  return join11(dirname4(configPath), `${basename5(configPath)}.machine-id`);
 }
 function localRunnerIdSeedPath(configPath = localConfigPath(), linzumiUrl) {
   if (linzumiUrl !== void 0 && localConfigScopeKey(linzumiUrl) !== prodConfigScope) {
-    return join9(
+    return join11(
       dirname4(configPath),
       `${basename5(configPath)}.${localConfigScopeFileStem(linzumiUrl)}.runner-id`
     );
   }
-  return join9(dirname4(configPath), `${basename5(configPath)}.runner-id`);
+  return join11(dirname4(configPath), `${basename5(configPath)}.runner-id`);
 }
 function readConfiguredAllowedCwdDetailsForLinzumiUrl(linzumiUrl, path2 = localConfigPath()) {
   return readConfiguredAllowedCwdDetailsFromConfig(
@@ -14648,7 +15034,7 @@ function writeLocalSignupAuth(auth, path2 = localConfigPath()) {
     version: 1,
     signupAuth: nextSignupAuth
   };
-  mkdirSync4(dirname4(path2), { recursive: true });
+  mkdirSync5(dirname4(path2), { recursive: true });
   writeLocalConfigJson(path2, next);
   return signupAuthFromJson(nextSignupAuth);
 }
@@ -14656,7 +15042,7 @@ function writeLocalConfigJson(path2, payload) {
   if (existsSync6(path2)) {
     chmodSync(path2, localConfigFileMode);
   }
-  writeFileSync2(path2, `${JSON.stringify(payload, null, 2)}
+  writeFileSync3(path2, `${JSON.stringify(payload, null, 2)}
 `, {
     encoding: "utf8",
     mode: localConfigFileMode
@@ -14683,7 +15069,7 @@ function readLocalConfigFile(path2) {
   if (!existsSync6(path2)) {
     return { version: 1, allowedCwds: [] };
   }
-  const parsed = JSON.parse(readFileSync7(path2, "utf8"));
+  const parsed = JSON.parse(readFileSync8(path2, "utf8"));
   if (!isConfigPayload(parsed)) {
     throw new Error(`invalid Linzumi config: ${path2}`);
   }
@@ -14712,7 +15098,7 @@ function writeLocalConfigSection(config, path2, linzumiUrl) {
     version: 1,
     [scopeKey]: nextSection
   };
-  mkdirSync4(dirname4(path2), { recursive: true });
+  mkdirSync5(dirname4(path2), { recursive: true });
   writeLocalConfigJson(path2, next);
 }
 function isConfigPayload(value) {
@@ -14787,12 +15173,12 @@ function ensureLocalMachineIdSeed(configPath, createMachineId, linzumiUrl) {
   if (!machineIdValid(machineId)) {
     throw new Error(`invalid generated Linzumi machine id: ${machineId}`);
   }
-  mkdirSync4(dirname4(seedPath), { recursive: true });
-  const tempPath = join9(
+  mkdirSync5(dirname4(seedPath), { recursive: true });
+  const tempPath = join11(
     dirname4(seedPath),
     `.${basename5(seedPath)}.${process.pid}.${randomUUID2()}.tmp`
   );
-  writeFileSync2(tempPath, `${machineId}
+  writeFileSync3(tempPath, `${machineId}
 `, { encoding: "utf8", flag: "wx" });
   try {
     linkSync(tempPath, seedPath);
@@ -14815,12 +15201,12 @@ function ensureLocalRunnerIdSeed(configPath, createRunnerId, linzumiUrl) {
   if (!runnerIdValid(runnerId)) {
     throw new Error(`invalid generated Linzumi runner id: ${runnerId}`);
   }
-  mkdirSync4(dirname4(seedPath), { recursive: true });
-  const tempPath = join9(
+  mkdirSync5(dirname4(seedPath), { recursive: true });
+  const tempPath = join11(
     dirname4(seedPath),
     `.${basename5(seedPath)}.${process.pid}.${randomUUID2()}.tmp`
   );
-  writeFileSync2(tempPath, `${runnerId}
+  writeFileSync3(tempPath, `${runnerId}
 `, { encoding: "utf8", flag: "wx" });
   try {
     linkSync(tempPath, seedPath);
@@ -14835,14 +15221,14 @@ function ensureLocalRunnerIdSeed(configPath, createRunnerId, linzumiUrl) {
   }
 }
 function readMachineIdSeed(seedPath) {
-  const machineId = readFileSync7(seedPath, "utf8").trim();
+  const machineId = readFileSync8(seedPath, "utf8").trim();
   if (!machineIdValid(machineId)) {
     throw new Error(`invalid Linzumi machine id seed: ${seedPath}`);
   }
   return machineId;
 }
 function readRunnerIdSeed(seedPath) {
-  const runnerId = readFileSync7(seedPath, "utf8").trim();
+  const runnerId = readFileSync8(seedPath, "utf8").trim();
   if (!runnerIdValid(runnerId)) {
     throw new Error(`invalid Linzumi runner id seed: ${seedPath}`);
   }
@@ -15141,8 +15527,8 @@ var init_remoteCodexExecutionContext = __esm({
 });
 
 // src/helloLinzumiProject.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname5, join as join10, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname5, join as join12, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function createHelloLinzumiProject(input = {}) {
   const options = typeof input === "string" ? { rootPath: input } : input;
@@ -15151,9 +15537,9 @@ function createHelloLinzumiProject(input = {}) {
   const host = normalizeHost(options.host);
   assertTcpPort(port);
   assertWritableDemoRoot(root, options.reset === true);
-  mkdirSync5(join10(root, "src"), { recursive: true });
+  mkdirSync6(join12(root, "src"), { recursive: true });
   for (const file of demoFiles({ root, port, host })) {
-    writeFileSync3(join10(root, file.path), file.content, "utf8");
+    writeFileSync4(join12(root, file.path), file.content, "utf8");
   }
   return {
     root,
@@ -15197,10 +15583,10 @@ function assertWritableDemoRoot(root, reset) {
   if (!existsSync7(root)) {
     return;
   }
-  const markerPath = join10(root, markerFile);
-  const isDemoRoot = existsSync7(markerPath) && readFileSync8(markerPath, "utf8").trim() === "hello-linzumi";
+  const markerPath = join12(root, markerFile);
+  const isDemoRoot = existsSync7(markerPath) && readFileSync9(markerPath, "utf8").trim() === "hello-linzumi";
   if (isDemoRoot && reset) {
-    rmSync(root, { recursive: true, force: true });
+    rmSync2(root, { recursive: true, force: true });
     return;
   }
   if (isDemoRoot) {
@@ -15233,7 +15619,7 @@ var init_helloLinzumiProject = __esm({
     defaultHelloLinzumiHost = "0.0.0.0";
     markerFile = ".linzumi-demo-project";
     moduleDir = dirname5(fileURLToPath2(import.meta.url));
-    linzumiLogoSvg = readFileSync8(join10(moduleDir, "assets", "linzumi-logo.svg"), "utf8");
+    linzumiLogoSvg = readFileSync9(join12(moduleDir, "assets", "linzumi-logo.svg"), "utf8");
     packageJson = `${JSON.stringify(
       {
         name: "hello-linzumi",
@@ -16035,14 +16421,14 @@ import {
   copyFileSync,
   cpSync,
   existsSync as existsSync8,
-  mkdirSync as mkdirSync6,
+  mkdirSync as mkdirSync7,
   mkdtempSync,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   realpathSync as realpathSync4,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename6, delimiter, dirname as dirname6, join as join11 } from "node:path";
+import { basename as basename6, delimiter, dirname as dirname6, join as join13 } from "node:path";
 function isStartLocalEditorControl(control) {
   return control.type === "start_local_editor";
 }
@@ -16260,24 +16646,24 @@ function codeServerArgs(port, cwd, userDataDir, extensionsDir) {
 }
 function prepareCodeServerProfile(collaboration, editorRuntime) {
   try {
-    const userDataDir = mkdtempSync(join11(tmpdir(), "kandan-local-editor-"));
-    const extensionsDir = join11(userDataDir, "extensions");
-    const collaborationServerDir = join11(userDataDir, "collaboration-server");
-    const tempDir = join11(userDataDir, "tmp");
-    const userSettingsDir = join11(userDataDir, "User");
-    mkdirSync6(userSettingsDir, { recursive: true });
-    mkdirSync6(extensionsDir, { recursive: true });
-    mkdirSync6(collaborationServerDir, { recursive: true });
-    mkdirSync6(tempDir, { recursive: true });
+    const userDataDir = mkdtempSync(join13(tmpdir(), "kandan-local-editor-"));
+    const extensionsDir = join13(userDataDir, "extensions");
+    const collaborationServerDir = join13(userDataDir, "collaboration-server");
+    const tempDir = join13(userDataDir, "tmp");
+    const userSettingsDir = join13(userDataDir, "User");
+    mkdirSync7(userSettingsDir, { recursive: true });
+    mkdirSync7(extensionsDir, { recursive: true });
+    mkdirSync7(collaborationServerDir, { recursive: true });
+    mkdirSync7(tempDir, { recursive: true });
     if (editorRuntime !== void 0) {
       ensureCodeServerBrowserExtensionAssets(editorRuntime);
       installDirectory(
         editorRuntime.assets.documentStateExtensionDir,
-        join11(extensionsDir, "kandan.document-state-telemetry")
+        join13(extensionsDir, "kandan.document-state-telemetry")
       );
     }
-    writeFileSync4(
-      join11(userSettingsDir, "settings.json"),
+    writeFileSync5(
+      join13(userSettingsDir, "settings.json"),
       JSON.stringify(codeServerSettings(collaboration), null, 2)
     );
     return { ok: true, userDataDir, extensionsDir, collaborationServerDir };
@@ -16289,14 +16675,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
   const vscodeRoot = codeServerVscodeRoot(runtime);
   const repairs = [
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "git-base",
         "dist",
         "extension.js"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "git-base",
@@ -16307,14 +16693,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       required: true
     },
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "git-base",
         "dist",
         "extension.js.map"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "git-base",
@@ -16325,14 +16711,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       required: false
     },
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
         "dist",
         "mergeConflictMain.js"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
@@ -16343,14 +16729,14 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       required: true
     },
     {
-      source: join11(
+      source: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
         "dist",
         "mergeConflictMain.js.map"
       ),
-      target: join11(
+      target: join13(
         vscodeRoot,
         "extensions",
         "merge-conflict",
@@ -16368,7 +16754,7 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
       case (!required3 && !existsSync8(source)):
         return;
       default:
-        mkdirSync6(dirname6(target), { recursive: true });
+        mkdirSync7(dirname6(target), { recursive: true });
         copyFileSync(source, target);
         return;
     }
@@ -16376,10 +16762,10 @@ function ensureCodeServerBrowserExtensionAssets(runtime) {
 }
 function codeServerVscodeRoot(runtime) {
   const roots = uniquePaths([
-    join11(runtime.root, "lib", "vscode"),
-    join11(dirname6(dirname6(runtime.codeServerBin)), "lib", "vscode"),
+    join13(runtime.root, "lib", "vscode"),
+    join13(dirname6(dirname6(runtime.codeServerBin)), "lib", "vscode"),
     ...wrappedCodeServerBin(runtime.codeServerBin).map(
-      (codeServerBin) => join11(dirname6(dirname6(codeServerBin)), "lib", "vscode")
+      (codeServerBin) => join13(dirname6(dirname6(codeServerBin)), "lib", "vscode")
     )
   ]);
   const rootWithRequiredAssets = roots.find(
@@ -16395,7 +16781,7 @@ function codeServerVscodeRoot(runtime) {
 }
 function wrappedCodeServerBin(codeServerBin) {
   try {
-    const script = readFileSync9(codeServerBin, "utf8");
+    const script = readFileSync10(codeServerBin, "utf8");
     const match = script.match(
       /exec\s+(?:"([^"]+)"|'([^']+)'|([^\s]+))\s+"\$@"/u
     );
@@ -16407,8 +16793,8 @@ function wrappedCodeServerBin(codeServerBin) {
 }
 function codeServerBrowserAssetSources(vscodeRoot) {
   return [
-    join11(vscodeRoot, "extensions", "git-base", "dist", "extension.js"),
-    join11(
+    join13(vscodeRoot, "extensions", "git-base", "dist", "extension.js"),
+    join13(
       vscodeRoot,
       "extensions",
       "merge-conflict",
@@ -16487,10 +16873,10 @@ function prepareLinuxCodeServerLaunch(options) {
     options.cwd,
     "--setenv",
     "XDG_DATA_HOME",
-    join11(options.userDataDir, "data"),
+    join13(options.userDataDir, "data"),
     "--setenv",
     "XDG_CONFIG_HOME",
-    join11(options.userDataDir, "config"),
+    join13(options.userDataDir, "config"),
     ...readOnlyRoots.flatMap((path2) => ["--ro-bind-try", path2, path2]),
     "--bind",
     options.cwd,
@@ -16531,7 +16917,7 @@ function resolveCodeServerExecutable(command, envPath) {
     if (directory.trim() === "") {
       continue;
     }
-    const candidate = join11(directory, command);
+    const candidate = join13(directory, command);
     if (!existsSync8(candidate)) {
       continue;
     }
@@ -16617,7 +17003,7 @@ async function startCollaborationSidecar(collaboration, profile, editorRuntime,
     ]);
     const command = nodeRuntimeExecutable();
     const args = [
-      join11(
+      join13(
         profile.collaborationServerDir,
         "open-collaboration-server",
         "bundle",
@@ -16712,11 +17098,11 @@ function nodeRuntimeExecutable(env = process.env, execPath = process.execPath) {
   return basename6(execPath).toLowerCase().includes("bun") ? "node" : execPath;
 }
 async function installLocalTarball(archivePath, destinationDir) {
-  mkdirSync6(destinationDir, { recursive: true });
+  mkdirSync7(destinationDir, { recursive: true });
   await runProcess("tar", ["-xzf", archivePath, "-C", destinationDir]);
 }
 function installDirectory(sourceDir, destinationDir) {
-  mkdirSync6(dirname6(destinationDir), { recursive: true });
+  mkdirSync7(dirname6(destinationDir), { recursive: true });
   cpSync(sourceDir, destinationDir, { recursive: true });
 }
 function codeServerEnv(env, cwd, userDataDir, collaboration) {
@@ -16734,7 +17120,7 @@ function codeServerEnv(env, cwd, userDataDir, collaboration) {
     KANDAN_EDITOR_COLLABORATION_ENTRY_MODE: "kandan_auto_host_or_join",
     KANDAN_EDITOR_COLLABORATION_ROOM_ID: collaboration.roomId,
     KANDAN_EDITOR_COLLABORATION_SERVER_URL: collaboration.bootstrapServerUrl,
-    KANDAN_EDITOR_COLLABORATION_AUTO_HOST_CLAIM_PATH: join11(
+    KANDAN_EDITOR_COLLABORATION_AUTO_HOST_CLAIM_PATH: join13(
       userDataDir,
       "kandan-oct-auto-host.lock"
     )
@@ -16943,15 +17329,15 @@ import {
   createReadStream,
   createWriteStream as createWriteStream2,
   existsSync as existsSync9,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync5
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { dirname as dirname7, join as join12, resolve as resolve7 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { dirname as dirname7, join as join14, resolve as resolve7 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 async function resolveEditorRuntime(options) {
@@ -17142,14 +17528,14 @@ function normalizeRuntimeAssets(value) {
 }
 function installedRuntime(cacheRoot, manifest) {
   const runtimeRoot = runtimeInstallRoot(cacheRoot, manifest);
-  const manifestPath = join12(runtimeRoot, manifest.manifestPath);
-  const codeServerBin = join12(runtimeRoot, manifest.codeServerBinPath);
+  const manifestPath = join14(runtimeRoot, manifest.manifestPath);
+  const codeServerBin = join14(runtimeRoot, manifest.codeServerBinPath);
   const assets = verifiedRuntimeAssetPaths(runtimeRoot, manifest);
   if (!existsSync9(manifestPath) || !existsSync9(codeServerBin) || assets === void 0) {
     return { ok: false };
   }
   try {
-    const installed = JSON.parse(readFileSync10(manifestPath, "utf8"));
+    const installed = JSON.parse(readFileSync11(manifestPath, "utf8"));
     if (isJsonObject(installed) && installed.version === manifest.version && installed.platform === manifest.platform && (installed.archiveSha256 === void 0 || installed.archiveSha256 === manifest.archiveSha256)) {
       return {
         ok: true,
@@ -17167,10 +17553,10 @@ function installedRuntime(cacheRoot, manifest) {
   return { ok: false };
 }
 async function installRuntime(args) {
-  mkdirSync7(args.cacheRoot, { recursive: true });
-  const tempRoot = mkdtempSync2(join12(args.cacheRoot, ".install-"));
-  const archivePath = join12(tempRoot, "runtime.tar.gz");
-  const extractRoot = join12(tempRoot, "runtime");
+  mkdirSync8(args.cacheRoot, { recursive: true });
+  const tempRoot = mkdtempSync2(join14(args.cacheRoot, ".install-"));
+  const archivePath = join14(tempRoot, "runtime.tar.gz");
+  const extractRoot = join14(tempRoot, "runtime");
   try {
     const downloaded = await downloadArchive({
       kandanUrl: args.kandanUrl,
@@ -17182,7 +17568,7 @@ async function installRuntime(args) {
     if (!downloaded.ok) {
       return downloaded;
     }
-    mkdirSync7(extractRoot, { recursive: true });
+    mkdirSync8(extractRoot, { recursive: true });
     if (!await args.extractArchive(archivePath, extractRoot)) {
       return { ok: false, reason: "archive_extract_failed" };
     }
@@ -17195,14 +17581,14 @@ async function installRuntime(args) {
     if (!assetsInstalled) {
       return { ok: false, reason: "install_failed" };
     }
-    const manifestPath = join12(extractRoot, args.manifest.manifestPath);
-    const codeServerBin = join12(extractRoot, args.manifest.codeServerBinPath);
+    const manifestPath = join14(extractRoot, args.manifest.manifestPath);
+    const codeServerBin = join14(extractRoot, args.manifest.codeServerBinPath);
     const assets = verifiedRuntimeAssetPaths(extractRoot, args.manifest);
     if (!existsSync9(codeServerBin) || assets === void 0) {
       return { ok: false, reason: "invalid_archive" };
     }
-    mkdirSync7(dirname7(manifestPath), { recursive: true });
-    writeFileSync5(
+    mkdirSync8(dirname7(manifestPath), { recursive: true });
+    writeFileSync6(
       manifestPath,
       JSON.stringify(
         {
@@ -17219,29 +17605,29 @@ async function installRuntime(args) {
       )
     );
     const targetRoot = runtimeInstallRoot(args.cacheRoot, args.manifest);
-    rmSync2(targetRoot, { recursive: true, force: true });
-    mkdirSync7(dirname7(targetRoot), { recursive: true });
+    rmSync3(targetRoot, { recursive: true, force: true });
+    mkdirSync8(dirname7(targetRoot), { recursive: true });
     renameSync(extractRoot, targetRoot);
     return {
       ok: true,
       runtime: {
         mode: "server_managed",
         root: targetRoot,
-        codeServerBin: join12(targetRoot, args.manifest.codeServerBinPath),
+        codeServerBin: join14(targetRoot, args.manifest.codeServerBinPath),
         assets: {
-          collaborationExtensionTarball: join12(
+          collaborationExtensionTarball: join14(
             targetRoot,
             "kandan",
             "editor_extensions",
             "typefox.open-collaboration-tools.tar.gz"
           ),
-          collaborationServerTarball: join12(
+          collaborationServerTarball: join14(
             targetRoot,
             "kandan",
             "editor_servers",
             "open-collaboration-server.tar.gz"
           ),
-          documentStateExtensionDir: join12(
+          documentStateExtensionDir: join14(
             targetRoot,
             "kandan",
             "editor_extensions",
@@ -17253,12 +17639,12 @@ async function installRuntime(args) {
   } catch (_error) {
     return { ok: false, reason: "install_failed" };
   } finally {
-    rmSync2(tempRoot, { recursive: true, force: true });
+    rmSync3(tempRoot, { recursive: true, force: true });
   }
 }
 async function materializeRuntimeAssets(args) {
   for (const asset of args.manifest.assets) {
-    const targetPath = join12(args.runtimeRoot, asset.path);
+    const targetPath = join14(args.runtimeRoot, asset.path);
     try {
       const bytes = await runtimeAssetBytes({
         kandanUrl: args.kandanUrl,
@@ -17268,8 +17654,8 @@ async function materializeRuntimeAssets(args) {
       if (bytes === void 0) {
         continue;
       }
-      mkdirSync7(dirname7(targetPath), { recursive: true });
-      writeFileSync5(targetPath, bytes);
+      mkdirSync8(dirname7(targetPath), { recursive: true });
+      writeFileSync6(targetPath, bytes);
     } catch (_error) {
       return false;
     }
@@ -17359,19 +17745,19 @@ function runtimeInstallRoot(cacheRoot, manifest) {
   return resolve7(cacheRoot, manifest.platform, manifest.archiveSha256);
 }
 function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
-  const collaborationExtensionTarball = join12(
+  const collaborationExtensionTarball = join14(
     runtimeRoot,
     "kandan",
     "editor_extensions",
     "typefox.open-collaboration-tools.tar.gz"
   );
-  const collaborationServerTarball = join12(
+  const collaborationServerTarball = join14(
     runtimeRoot,
     "kandan",
     "editor_servers",
     "open-collaboration-server.tar.gz"
   );
-  const documentStateExtensionDir = join12(
+  const documentStateExtensionDir = join14(
     runtimeRoot,
     "kandan",
     "editor_extensions",
@@ -17380,7 +17766,7 @@ function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
   const codeServerRoot = codeServerRuntimeRoot(manifest.codeServerBinPath);
   const requiredPaths = [
     manifest.codeServerBinPath,
-    join12(
+    join14(
       codeServerRoot,
       "lib",
       "vscode",
@@ -17390,7 +17776,7 @@ function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
       "web",
       "vsda.js"
     ),
-    join12(
+    join14(
       codeServerRoot,
       "lib",
       "vscode",
@@ -17411,7 +17797,7 @@ function verifiedRuntimeAssetPaths(runtimeRoot, manifest) {
     if (expectedSha256 === void 0 && relativePath !== manifest.codeServerBinPath) {
       return void 0;
     }
-    const absolutePath = join12(runtimeRoot, relativePath);
+    const absolutePath = join14(runtimeRoot, relativePath);
     if (!existsSync9(absolutePath)) {
       return void 0;
     }
@@ -17440,10 +17826,10 @@ function manifestAssetChecksums(assets) {
   return checksums;
 }
 function fileSha256Sync(path2) {
-  return createHash4("sha256").update(readFileSync10(path2)).digest("hex");
+  return createHash4("sha256").update(readFileSync11(path2)).digest("hex");
 }
 function defaultEditorRuntimeCacheRoot() {
-  return join12(homedir10(), ".linzumi", "editor-runtimes");
+  return join14(homedir11(), ".linzumi", "editor-runtimes");
 }
 function nonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
@@ -17463,7 +17849,7 @@ var init_localEditorRuntime = __esm({
 
 // src/dependencyStatus.ts
 import { spawn as spawn6, spawnSync as spawnSync4 } from "node:child_process";
-import { delimiter as delimiter2, dirname as dirname8, join as join13 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname8, join as join15 } from "node:path";
 function probeTool(command, cwd) {
   return new Promise((resolve12) => {
     const args = ["--version"];
@@ -17620,8 +18006,8 @@ function voltaCommandCandidates(args) {
     new Set(
       [
         voltaBinBesideCodexShim(args.codexBin),
-        env.VOLTA_HOME === void 0 ? void 0 : join13(env.VOLTA_HOME, "bin", "volta"),
-        env.HOME === void 0 ? void 0 : join13(env.HOME, ".volta", "bin", "volta"),
+        env.VOLTA_HOME === void 0 ? void 0 : join15(env.VOLTA_HOME, "bin", "volta"),
+        env.HOME === void 0 ? void 0 : join15(env.HOME, ".volta", "bin", "volta"),
         ...pathVoltaCandidates(env.PATH)
       ].filter((candidate) => candidate !== void 0)
     )
@@ -17629,10 +18015,10 @@ function voltaCommandCandidates(args) {
 }
 function voltaBinBesideCodexShim(codexBin) {
   const normalizedCodexBin = codexBin.replaceAll("\\", "/");
-  return normalizedCodexBin.endsWith("/.volta/bin/codex") ? join13(dirname8(codexBin), "volta") : void 0;
+  return normalizedCodexBin.endsWith("/.volta/bin/codex") ? join15(dirname8(codexBin), "volta") : void 0;
 }
 function pathVoltaCandidates(pathValue) {
-  return pathValue === void 0 ? [] : pathValue.split(delimiter2).filter((entry) => entry !== "").map((entry) => join13(entry, "volta"));
+  return pathValue === void 0 ? [] : pathValue.split(delimiter2).filter((entry) => entry !== "").map((entry) => join15(entry, "volta"));
 }
 function codeServerDependencyStatus(args) {
   switch (args.editorRuntime?.status) {
@@ -17741,7 +18127,7 @@ var linzumiCliVersion, linzumiCliVersionText;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    linzumiCliVersion = "0.0.83-beta";
+    linzumiCliVersion = "0.0.84-beta";
     linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
   }
 });
@@ -17750,21 +18136,21 @@ var init_version = __esm({
 import {
   closeSync as closeSync2,
   existsSync as existsSync10,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync3,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync6,
+  writeFileSync as writeFileSync7,
   writeSync
 } from "node:fs";
-import { dirname as dirname9, join as join14 } from "node:path";
+import { dirname as dirname9, join as join16 } from "node:path";
 function isRunnerLockHeldError(error) {
   return error instanceof RunnerLockHeldError || error instanceof Error && error.name === runnerLockHeldErrorName && "lockPath" in error && "heldBy" in error;
 }
 function runnerLockPath(machineId, configPath = localConfigPath(), linzumiUrl) {
   const lockName = linzumiUrl === void 0 ? encodeURIComponent(machineId) : localConfigScopeFileStem(linzumiUrl);
-  return join14(dirname9(configPath), "runners", `${lockName}.lock`);
+  return join16(dirname9(configPath), "runners", `${lockName}.lock`);
 }
 function acquireRunnerLock(options) {
   const path2 = runnerLockPath(
@@ -17832,7 +18218,7 @@ function stampRunnerLockHeartbeat(path2, record, now) {
       heartbeatAt: now().toISOString()
     };
     const tmpPath = `${path2}.tmp`;
-    writeFileSync6(tmpPath, `${JSON.stringify(next, null, 2)}
+    writeFileSync7(tmpPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
     renameSync2(tmpPath, path2);
   } catch (_error) {
@@ -17944,7 +18330,7 @@ function writeLockOrHandleExisting(path2, record, isPidAlive, now, killPid, onTa
   });
 }
 function tryCreateLock(path2, record) {
-  mkdirSync8(dirname9(path2), { recursive: true });
+  mkdirSync9(dirname9(path2), { recursive: true });
   try {
     const fd = openSync3(path2, "wx");
     try {
@@ -18000,7 +18386,7 @@ function withStaleReplacementLock(path2, isPidAlive, callback) {
 function readReplacementLockPidIfPresent(path2) {
   let value;
   try {
-    value = readFileSync11(path2, "utf8").trim();
+    value = readFileSync12(path2, "utf8").trim();
   } catch (error) {
     if (isNodeErrorCode2(error, "ENOENT")) {
       return void 0;
@@ -18040,7 +18426,7 @@ function readRunnerLockIfPresent(path2) {
   }
 }
 function readRunnerLock(path2) {
-  const parsed = JSON.parse(readFileSync11(path2, "utf8"));
+  const parsed = JSON.parse(readFileSync12(path2, "utf8"));
   if (!isRunnerLockRecord(parsed)) {
     throw new Error(`invalid Linzumi runner lock: ${path2}`);
   }
@@ -18327,6 +18713,19 @@ function updateRunnerConsoleDashboard(state, event, payload, nowMs) {
       job.updatedAtMs = nowMs;
       break;
     }
+    // Live token counter parity with codex.notification token_usage_summary:
+    // mid-turn usage events advance the dashboard counters per model round.
+    case "claude_code.token_usage": {
+      const tokenUsage = stringValue5(payload.token_usage_summary);
+      const job = claudeDashboardJob(state, payload, nowMs);
+      if (tokenUsage !== void 0) {
+        state.tokenUsage = tokenUsage;
+        job.tokenUsage = tokenUsage;
+      }
+      job.eventType = "token_usage";
+      job.updatedAtMs = nowMs;
+      break;
+    }
     default:
       break;
   }
@@ -18787,6 +19186,8 @@ function formatRunnerConsoleEvent(event, payload) {
       return `Claude Code turn ${text(payload.outcome)}: id=${text(payload.turn_id)}`;
     case "claude_code.rate_limit":
       return `Claude Code rate limit: ${stringValue5(payload.rate_limit_summary) ?? "seen (no details)"}`;
+    case "claude_code.token_usage":
+      return `Claude Code token usage: ${stringValue5(payload.token_usage_summary) ?? "seen (no details)"}`;
     default:
       return void 0;
   }
@@ -19730,8 +20131,8 @@ var init_runnerConsoleReporter = __esm({
 });
 
 // src/telemetry.ts
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname10, basename as basename7, join as join15 } from "node:path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname10, basename as basename7, join as join17 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function peekFlagValue(args, flags) {
   for (let index = 0; index < args.length; index += 1) {
@@ -19770,12 +20171,12 @@ function telemetryBaseUrl(apiUrl, env = process.env) {
   }
 }
 function telemetryInstallIdPath(env = process.env) {
-  return join15(dirname10(localConfigPath(env)), "install-id");
+  return join17(dirname10(localConfigPath(env)), "install-id");
 }
 function ensureTelemetryInstallId(env = process.env) {
   const path2 = telemetryInstallIdPath(env);
   try {
-    const existing = readFileSync12(path2, "utf8").trim();
+    const existing = readFileSync13(path2, "utf8").trim();
     if (existing !== "" && existing.length <= 128) {
       return existing;
     }
@@ -19783,8 +20184,8 @@ function ensureTelemetryInstallId(env = process.env) {
   }
   const installId = randomUUID3();
   try {
-    mkdirSync9(dirname10(path2), { recursive: true });
-    writeFileSync7(path2, `${installId}
+    mkdirSync10(dirname10(path2), { recursive: true });
+    writeFileSync8(path2, `${installId}
 `, { mode: 384 });
   } catch {
   }
@@ -19971,17 +20372,17 @@ var init_linzumiApiClient = __esm({
 });
 
 // src/authCache.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { dirname as dirname11, join as join16 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { dirname as dirname11, join as join18 } from "node:path";
 function defaultAuthFilePath() {
-  return join16(homedir11(), ".linzumi", "auth.json");
+  return join18(homedir12(), ".linzumi", "auth.json");
 }
 function readCachedLocalRunnerToken(kandanUrl, authFilePath = defaultAuthFilePath()) {
   if (!existsSync11(authFilePath)) {
     return void 0;
   }
-  const authFile = parseAuthFile(readFileSync13(authFilePath, "utf8"));
+  const authFile = parseAuthFile(readFileSync14(authFilePath, "utf8"));
   const kandanBaseUrl = kandanHttpBaseUrl(kandanUrl);
   const entry = authFile.local_codex_runner?.[kandanBaseUrl];
   if (entry === void 0 || entry.access_token.trim() === "") {
@@ -20003,7 +20404,7 @@ function readPersonalAgentDelegationToken(authFilePath) {
       `missing personal-agent delegation auth file: ${authFilePath}`
     );
   }
-  const authFile = parseAuthFile(readFileSync13(authFilePath, "utf8"));
+  const authFile = parseAuthFile(readFileSync14(authFilePath, "utf8"));
   const entry = authFile.personal_agent_delegation;
   if (entry === void 0 || entry.access_token.trim() === "") {
     throw new Error(
@@ -20021,7 +20422,7 @@ function readPersonalAgentDelegationToken(authFilePath) {
 }
 function writeCachedLocalRunnerToken(args) {
   const authFilePath = args.authFilePath ?? defaultAuthFilePath();
-  const existing = existsSync11(authFilePath) ? parseAuthFile(readFileSync13(authFilePath, "utf8")) : { version: 1 };
+  const existing = existsSync11(authFilePath) ? parseAuthFile(readFileSync14(authFilePath, "utf8")) : { version: 1 };
   const kandanBaseUrl = kandanHttpBaseUrl(args.kandanUrl);
   const issuedAt = /* @__PURE__ */ new Date();
   const expiresAt = args.expiresInSeconds === void 0 ? void 0 : new Date(
@@ -20039,8 +20440,8 @@ function writeCachedLocalRunnerToken(args) {
       }
     }
   };
-  mkdirSync10(dirname11(authFilePath), { recursive: true });
-  writeFileSync8(authFilePath, `${JSON.stringify(next, null, 2)}
+  mkdirSync11(dirname11(authFilePath), { recursive: true });
+  writeFileSync9(authFilePath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return {
     accessToken: args.accessToken,
@@ -20485,9 +20886,9 @@ var init_threadCodexWorkerIpc = __esm({
 
 // src/signupTaskSuggestions.ts
 import { spawn as spawn7 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 async function suggestSignupTasksWithCodex(args) {
   const attempts = 2;
   let previousResponse;
@@ -20509,11 +20910,11 @@ async function suggestSignupTasksWithCodex(args) {
   );
 }
 async function runCodexTaskSuggestion(args) {
-  const tempRoot = mkdtempSync3(join17(tmpdir2(), "linzumi-signup-codex-tasks-"));
-  const schemaPath = join17(tempRoot, "task-suggestions.schema.json");
-  const outputPath = join17(tempRoot, "task-suggestions.json");
+  const tempRoot = mkdtempSync3(join19(tmpdir2(), "linzumi-signup-codex-tasks-"));
+  const schemaPath = join19(tempRoot, "task-suggestions.schema.json");
+  const outputPath = join19(tempRoot, "task-suggestions.json");
   const prompt = taskSuggestionPrompt(args.previousResponse);
-  writeFileSync9(
+  writeFileSync10(
     schemaPath,
     `${JSON.stringify(taskSuggestionJsonSchema(), null, 2)}
 `,
@@ -20530,9 +20931,9 @@ async function runCodexTaskSuggestion(args) {
         prompt
       })
     );
-    return readFileSync14(outputPath, "utf8");
+    return readFileSync15(outputPath, "utf8");
   } finally {
-    rmSync3(tempRoot, { recursive: true, force: true });
+    rmSync4(tempRoot, { recursive: true, force: true });
   }
 }
 function codexTaskSuggestionProcess(args) {
@@ -20979,25 +21380,25 @@ import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   lstatSync,
-  mkdirSync as mkdirSync11,
+  mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync6,
   renameSync as renameSync3,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   statSync as statSync3,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
 import { createServer as createServer3 } from "node:http";
-import { homedir as homedir12, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
+import { homedir as homedir13, hostname as hostname2, tmpdir as tmpdir3 } from "node:os";
 import {
   basename as basename8,
   dirname as dirname13,
   extname as extname2,
   isAbsolute as isAbsolute5,
-  join as join18,
+  join as join20,
   resolve as resolve8
 } from "node:path";
 async function runLocalCodexRunner(options) {
@@ -21243,6 +21644,9 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     defaultAgentProvider: "codex",
     startInstance: allowedCwds.value.length > 0,
     durableClaudeSessionStore: true,
+    // Honest capability: no faithful Claude Code rewind exists yet; the
+    // rewind_thread control responds with a clean rejection (spec:
+    // plans/2026-06-12-claude-steer-rewind-parity-note.md item B).
     claudeCodeCheckpointRewind: false,
     allowedCwds: allowedCwds.value,
     missingAllowedCwds: missingAllowedCwds.value,
@@ -22333,13 +22737,14 @@ async function openLocalCodexRunner(options, log2, cleanup, close) {
     if (workspaceSlug === void 0 || channelSlug === void 0 || kandanThreadId === void 0) {
       return void 0;
     }
-    const waferResolution = resolveControlWaferModelProvider(control);
-    if (waferResolution.type === "error") {
+    const providerResolution = resolveControlCodexModelProvider(control);
+    const providerResolutionError = codexModelProviderResolutionError(providerResolution);
+    if (providerResolutionError !== void 0) {
       return {
         instanceId,
         controlType: control.type,
         ok: false,
-        error: waferResolution.error,
+        error: providerResolutionError,
         kandanThreadId,
         cwd
       };
@@ -22954,14 +23359,14 @@ function commanderOutboxPersistDir() {
   if (override !== void 0 && override !== "") {
     return override;
   }
-  return join18(homedir12(), ".linzumi", "commander-outbox");
+  return join20(homedir13(), ".linzumi", "commander-outbox");
 }
 function controlCursorStorePath(runnerId) {
   const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
   const digest = createHash5("sha256").update(runnerId).digest("hex").slice(0, 8);
   const stem = sanitized === "" ? "runner" : sanitized;
-  return join18(
-    homedir12(),
+  return join20(
+    homedir13(),
     ".linzumi",
     "control-cursors",
     `${stem}.${digest}.json`
@@ -22971,8 +23376,8 @@ function appliedStartTurnStorePath(runnerId) {
   const sanitized = runnerId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
   const digest = createHash5("sha256").update(runnerId).digest("hex").slice(0, 8);
   const stem = sanitized === "" ? "runner" : sanitized;
-  return join18(
-    homedir12(),
+  return join20(
+    homedir13(),
     ".linzumi",
     "control-cursors",
     `${stem}.${digest}.start-turn.json`
@@ -23094,9 +23499,9 @@ function createControlCursorFileStore(path2, log2, options) {
     }
     dirty = false;
     try {
-      mkdirSync11(dirname13(path2), { recursive: true });
+      mkdirSync12(dirname13(path2), { recursive: true });
       const tmpPath = `${path2}.tmp`;
-      writeFileSync10(
+      writeFileSync11(
         tmpPath,
         `${JSON.stringify({
           ...epoch === void 0 ? {} : { [controlCursorEpochKey]: epoch },
@@ -23204,7 +23609,7 @@ function readControlCursorFile(path2, log2) {
   const cursors = /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = readFileSync15(path2, "utf8");
+    raw = readFileSync16(path2, "utf8");
   } catch (error) {
     if (!isErrnoCode2(error, "ENOENT")) {
       log2("control_cursor_store.read_failed", {
@@ -23798,18 +24203,18 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
           return delegated;
         }
         if (agentProvider === "codex") {
-          const waferControlError = waferModelProviderControlError(
+          const providerControlError = codexModelProviderControlError(
             options,
             control
           );
-          if (waferControlError !== void 0) {
+          if (providerControlError !== void 0) {
             try {
               await publishStartInstanceMessageState(
                 kandan,
                 topic,
                 control,
                 "failed",
-                waferControlError,
+                providerControlError,
                 { instanceId }
               );
             } catch (error) {
@@ -23821,7 +24226,7 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
               instanceId,
               controlType: control.type,
               ok: false,
-              error: waferControlError
+              error: providerControlError
             };
           }
         }
@@ -23969,16 +24374,16 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
         return delegated;
       }
       if (agentProvider === "codex") {
-        const waferControlError = waferModelProviderControlError(
+        const providerControlError = codexModelProviderControlError(
           options,
           control
         );
-        if (waferControlError !== void 0) {
+        if (providerControlError !== void 0) {
           return {
             instanceId,
             controlType: control.type,
             ok: false,
-            error: waferControlError
+            error: providerControlError
           };
         }
       }
@@ -24299,18 +24704,30 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
             error: "claude_code_steer_requires_text_input"
           };
         }
-        await claudeSession.interruptTurn("Steered by Linzumi");
-        claudeSession.enqueueInput({
-          content: `You were interrupted mid-task. Updated guidance from the user - continue the task with this in mind:
-
-${steerText}`,
-          sourceSeq: claudeSession.currentSourceSeq()
-        });
+        let steered;
+        try {
+          steered = claudeSession.steerTurn(steerText);
+        } catch (steerError) {
+          const message = steerError instanceof Error ? steerError.message : String(steerError);
+          log2("claude_code.steer_failed", {
+            thread_id: control.threadId,
+            message
+          });
+          return {
+            instanceId,
+            controlType: control.type,
+            agentProvider: "claude-code",
+            ok: false,
+            error: "claude_code_steer_failed",
+            message,
+            threadId: control.threadId
+          };
+        }
         return {
           instanceId,
           controlType: control.type,
           agentProvider: "claude-code",
-          steered: "steered_via_restart",
+          steered,
           threadId: control.threadId
         };
       }
@@ -24349,6 +24766,30 @@ ${steerText}`,
         response
       };
     }
+    case "rewind_thread": {
+      const claudeSession = activeClaudeCodeSessions.get(control.threadId);
+      if (claudeSession !== void 0 || control.agentProvider === "claude-code") {
+        return {
+          instanceId,
+          controlType: control.type,
+          agentProvider: "claude-code",
+          requestId: stringValue(control.requestId) ?? null,
+          threadId: control.threadId,
+          ok: false,
+          error: "claude_code_rewind_unsupported",
+          message: "Claude Code does not support rewind yet"
+        };
+      }
+      return {
+        instanceId,
+        controlType: control.type,
+        requestId: stringValue(control.requestId) ?? null,
+        threadId: control.threadId,
+        ok: false,
+        error: "rewind_not_supported",
+        message: "This runner does not support rewinding threads yet"
+      };
+    }
     case "interrupt_queued_messages": {
       const agentProvider = stringValue(control.agentProvider)?.trim();
       if (agentProvider !== "claude-code") {
@@ -24816,10 +25257,24 @@ function startInstanceAgentLabel(provider) {
       return "Claude Code";
   }
 }
-function resolveControlWaferModelProvider(control) {
+function resolveControlCodexModelProvider(control) {
   const modelProvider = stringValue(control.modelProvider)?.trim();
+  const llmProxy = objectValue(control.llmProxy);
+  const baseUrl = stringValue(llmProxy?.baseUrl)?.trim();
+  const token = stringValue(llmProxy?.token)?.trim();
+  const binding = baseUrl !== void 0 && baseUrl !== "" && token !== void 0 && token !== "" ? { baseUrl, token } : void 0;
   if (modelProvider === void 0 || modelProvider === "") {
-    return { type: "none" };
+    if (binding === void 0) {
+      return { type: "none" };
+    }
+    return {
+      type: "provider",
+      runtime: {
+        provider: "openai-proxy",
+        llmProxyBaseUrl: binding.baseUrl,
+        llmProxyToken: binding.token
+      }
+    };
   }
   if (modelProvider !== "wafer") {
     return {
@@ -24827,40 +25282,84 @@ function resolveControlWaferModelProvider(control) {
       error: `model_provider_unsupported:${modelProvider}`
     };
   }
-  const llmProxy = objectValue(control.llmProxy);
-  const baseUrl = stringValue(llmProxy?.baseUrl)?.trim();
-  const token = stringValue(llmProxy?.token)?.trim();
-  if (baseUrl === void 0 || baseUrl === "" || token === void 0 || token === "") {
+  if (binding === void 0) {
     return { type: "error", error: "wafer_model_provider_missing_llm_proxy" };
   }
   return {
-    type: "wafer",
+    type: "provider",
     runtime: {
       provider: "wafer",
-      llmProxyBaseUrl: baseUrl,
-      llmProxyToken: token
+      llmProxyBaseUrl: binding.baseUrl,
+      llmProxyToken: binding.token
     }
   };
 }
-function waferModelProviderControlError(options, control) {
-  const resolution = resolveControlWaferModelProvider(control);
+function codexModelProviderResolutionError(resolution) {
+  if (resolution.type === "error") {
+    return resolution.error;
+  }
+  if (resolution.type === "provider" && resolution.runtime.provider === "openai-proxy" && resolveForwardableOpenAiApiKey() === void 0) {
+    return "codex_llm_proxy_requires_openai_api_key";
+  }
+  return void 0;
+}
+function codexModelProviderControlError(options, control) {
+  const resolution = resolveControlCodexModelProvider(control);
   switch (resolution.type) {
     case "none":
       return void 0;
     case "error":
       return resolution.error;
-    case "wafer":
-      return options.codexModelProvider?.provider === "wafer" ? void 0 : "wafer_model_provider_requires_thread_worker";
+    case "provider": {
+      const gateError = codexModelProviderResolutionError(resolution);
+      if (gateError !== void 0) {
+        return gateError;
+      }
+      return options.codexModelProvider?.provider === resolution.runtime.provider ? void 0 : resolution.runtime.provider === "wafer" ? "wafer_model_provider_requires_thread_worker" : "llm_proxy_model_provider_requires_thread_worker";
+    }
   }
 }
 function linzumiCodexModelProviderConfig(runtime) {
-  return {
-    id: "linzumi",
-    name: "Linzumi Proxy",
-    baseUrl: `${runtime.llmProxyBaseUrl.replace(/\/+$/, "")}/v1`,
-    envKey: "LINZUMI_LLM_PROXY_TOKEN",
-    wireApi: "responses"
-  };
+  const baseUrl = `${runtime.llmProxyBaseUrl.replace(/\/+$/, "")}/v1`;
+  switch (runtime.provider) {
+    case "wafer":
+      return {
+        id: "linzumi",
+        name: "Linzumi Proxy",
+        baseUrl,
+        envKey: "LINZUMI_LLM_PROXY_TOKEN",
+        wireApi: "responses"
+      };
+    case "openai-proxy":
+      return {
+        id: "linzumi",
+        name: "Linzumi Proxy",
+        baseUrl,
+        envKey: "OPENAI_API_KEY",
+        wireApi: "responses",
+        envHttpHeaders: {
+          "x-linzumi-llm-proxy-token": "LINZUMI_LLM_PROXY_TOKEN"
+        }
+      };
+  }
+}
+function codexModelProviderAppServerEnv(runtime) {
+  switch (runtime.provider) {
+    case "wafer":
+      return { LINZUMI_LLM_PROXY_TOKEN: runtime.llmProxyToken };
+    case "openai-proxy": {
+      const openAiApiKey = resolveForwardableOpenAiApiKey();
+      if (openAiApiKey === void 0) {
+        throw new Error(
+          "codex llm proxy requires API-key auth (OPENAI_API_KEY in the environment or $CODEX_HOME/auth.json); ChatGPT OAuth credentials cannot be forwarded"
+        );
+      }
+      return {
+        LINZUMI_LLM_PROXY_TOKEN: runtime.llmProxyToken,
+        OPENAI_API_KEY: openAiApiKey
+      };
+    }
+  }
 }
 async function startCodexProviderInstance(args) {
   if (args.options.codexUrl === void 0) {
@@ -24985,6 +25484,23 @@ function createClaudeCodeInputQueue(input) {
     }
     waiter({ done: false, value: message });
   };
+  const enqueueSteer = (content) => {
+    if (state.closed) {
+      throw new Error("Claude Code streaming input is closed");
+    }
+    if (pendingSourceSeqs.length === 0) {
+      enqueue({ content, sourceSeq: void 0 });
+      return "steered_queued";
+    }
+    const message = claudeCodeUserInputMessage(content);
+    const waiter = waiters.shift();
+    if (waiter === void 0) {
+      pendingMessages.push(message);
+    } else {
+      waiter({ done: false, value: message });
+    }
+    return "steered_live";
+  };
   return {
     messages: {
       [Symbol.asyncIterator]() {
@@ -25010,6 +25526,7 @@ function createClaudeCodeInputQueue(input) {
       drainClosedWaiters();
     },
     enqueue,
+    enqueueSteer,
     completeTurn: () => pendingSourceSeqs.shift(),
     currentSourceSeq: () => pendingSourceSeqs[0]
   };
@@ -25331,6 +25848,24 @@ async function startClaudeCodeProviderInstance(args) {
     onTodoWriteCompleted: planMirror.handleTodoWrite,
     log: args.log
   });
+  const liveBashCapture = args.options.claudeCodeRunner === void 0 && claudeLiveBashCaptureEnabled(process.env) ? createClaudeCodeLiveBashCapture({
+    captureDir: join20(
+      tmpdir3(),
+      `linzumi-claude-live-bash-${args.instanceId}`
+    ),
+    onOutputDelta: (toolUseId, delta) => {
+      if (activeSessionId === void 0) {
+        return;
+      }
+      adapter.handleTranscriptEvent({
+        type: "command_output_delta",
+        sessionId: activeSessionId,
+        itemKey: toolUseId,
+        delta
+      });
+    },
+    log: (event, fields) => args.log(event, fields)
+  }) : void 0;
   let mcpAuthCleanup;
   let mcpServers;
   try {
@@ -25435,6 +25970,7 @@ async function startClaudeCodeProviderInstance(args) {
         threadId,
         currentSourceSeq: inputQueue.currentSourceSeq,
         enqueueInput: inputQueue.enqueue,
+        steerTurn: inputQueue.enqueueSteer,
         interruptTurn: async (reason) => {
           const aborted = adapter.interruptActiveTurn(reason);
           await sessionControls?.interrupt();
@@ -25493,6 +26029,22 @@ async function startClaudeCodeProviderInstance(args) {
     if (event.type === "rate_limit") {
       await reportClaudeCodeRateLimit(event);
     }
+    if (event.type === "tool_result") {
+      liveBashCapture?.settleTool(event.itemKey);
+    }
+    if (event.type === "turn_interrupted" || event.type === "session_failed") {
+      liveBashCapture?.settleAll();
+    }
+    if (event.type === "usage") {
+      const summary = claudeCodeTokenUsageSummaryText(event.usage);
+      if (summary !== void 0) {
+        args.log("claude_code.token_usage", {
+          linzumi_thread_id: threadId,
+          claude_session_id: event.sessionId,
+          token_usage_summary: summary
+        });
+      }
+    }
     adapter.handleTranscriptEvent(event);
   };
   const llmProxy = objectValue(args.control.llmProxy);
@@ -25539,6 +26091,10 @@ async function startClaudeCodeProviderInstance(args) {
         runner: args.options.claudeCodeRunner,
         canUseTool,
         ...mcpServers === void 0 ? {} : { mcpServers },
+        ...liveBashCapture === void 0 ? {} : {
+          preToolUseHookMatchers: liveBashCapture.hookMatchers,
+          wrapApprovedToolInput: (toolUseId, toolName2, input) => toolName2 === "Bash" ? liveBashCapture.wrapApprovedTool(toolUseId, input) : void 0
+        },
         env: sessionEnv,
         // The built-in Linzumi MCP is trusted like the codex side: its tools
         // run without an approval round-trip. SDK allowedTools matches MCP
@@ -25555,6 +26111,7 @@ async function startClaudeCodeProviderInstance(args) {
     } finally {
       inputQueue.close();
       mcpAuthCleanup?.();
+      liveBashCapture?.close();
       if (activeSessionId !== void 0) {
         args.activeClaudeCodeSessions.delete(activeSessionId);
         await args.disposeClaudeCodeForwardPortSession?.(activeSessionId);
@@ -25710,6 +26267,8 @@ function claudeSessionStoreEntryPayload(args, event) {
         itemKey: event.itemKey,
         body: event.content
       };
+    case "command_output_delta":
+      return void 0;
     case "usage":
       return { usage: event.usage };
     case "rate_limit":
@@ -26128,7 +26687,7 @@ function threadRunnerOptions(args) {
     args.options,
     args.control
   );
-  const waferResolution = resolveControlWaferModelProvider(args.control);
+  const providerResolution = resolveControlCodexModelProvider(args.control);
   return {
     ...args.options,
     clientId: void 0,
@@ -26145,7 +26704,7 @@ function threadRunnerOptions(args) {
       role: "thread",
       kandanThreadId: args.kandanThreadId
     },
-    codexModelProvider: waferResolution.type === "wafer" ? waferResolution.runtime : void 0,
+    codexModelProvider: providerResolution.type === "provider" ? providerResolution.runtime : void 0,
     spawnThreadRunner: void 0,
     threadRunnerReadyTimeoutMs: args.options.threadRunnerReadyTimeoutMs,
     runtimeDefaults: {
@@ -26182,6 +26741,7 @@ async function spawnLocalThreadRunnerProcess(options) {
     scriptPath,
     redactedThreadRunnerCliArgs(args)
   );
+  const forwardableOpenAiApiKey = options.codexModelProvider?.provider === "openai-proxy" ? resolveForwardableOpenAiApiKey() : void 0;
   const env = {
     ...process.env,
     LINZUMI_THREAD_RUNNER_ROLE: "thread",
@@ -26189,7 +26749,8 @@ async function spawnLocalThreadRunnerProcess(options) {
     LINZUMI_THREAD_RUNNER_TOKEN: options.token,
     // The LLM proxy credential travels via env (like the runner token), not
     // argv, so the spawned worker's command line never carries it.
-    ...options.codexModelProvider === void 0 ? {} : { LINZUMI_LLM_PROXY_TOKEN: options.codexModelProvider.llmProxyToken }
+    ...options.codexModelProvider === void 0 ? {} : { LINZUMI_LLM_PROXY_TOKEN: options.codexModelProvider.llmProxyToken },
+    ...forwardableOpenAiApiKey === void 0 ? {} : { OPENAI_API_KEY: forwardableOpenAiApiKey }
   };
   writeCliAuditEvent("process.spawn", {
     command: process.execPath,
@@ -27395,16 +27956,16 @@ async function startOwnedCodexAppServer(options, args = { linzumiMcp: true }) {
       model: defaults.model,
       reasoningEffort: defaults.reasoningEffort,
       fast: options.fast,
-      // Wafer-routed thread workers point their owned app-server at the
-      // Kandan LLM proxy via a custom Linzumi model provider; the proxy
-      // credential rides env_key plus the session header.
+      // Proxy-routed thread workers point their owned app-server at the
+      // Kandan LLM proxy via a custom Linzumi model provider. Wafer routes
+      // ride the session token as the bearer; openai-proxy routes (parity
+      // backlog item 50) additionally materialize the user's own
+      // OPENAI_API_KEY as the passthrough upstream credential.
       ...options.codexModelProvider === void 0 ? {} : {
         modelProvider: linzumiCodexModelProviderConfig(
           options.codexModelProvider
         ),
-        env: {
-          LINZUMI_LLM_PROXY_TOKEN: options.codexModelProvider.llmProxyToken
-        }
+        env: codexModelProviderAppServerEnv(options.codexModelProvider)
       },
       mcpServers: mcpAuth === void 0 ? [] : [
         linzumiMcpServerConfig({
@@ -27452,9 +28013,9 @@ function mcpOwnerUsername(options) {
   return options.channelSession?.listenUser ?? identityFromAccessToken(options.token).actorUsername;
 }
 function writeEphemeralMcpAuthFile(options) {
-  const directory = mkdtempSync4(join18(tmpdir3(), "linzumi-mcp-auth-"));
+  const directory = mkdtempSync4(join20(tmpdir3(), "linzumi-mcp-auth-"));
   chmodSync2(directory, 448);
-  const path2 = join18(directory, "auth.json");
+  const path2 = join20(directory, "auth.json");
   writeCachedLocalRunnerToken({
     kandanUrl: options.kandanUrl,
     accessToken: options.token,
@@ -27463,7 +28024,7 @@ function writeEphemeralMcpAuthFile(options) {
   chmodSync2(path2, 384);
   return {
     path: path2,
-    cleanup: () => rmSync4(directory, { recursive: true, force: true })
+    cleanup: () => rmSync5(directory, { recursive: true, force: true })
   };
 }
 function once(action) {
@@ -27530,7 +28091,7 @@ function configuredAllowedCwds(values, options = {}) {
     const absolutePath = resolve8(expandUserPath(value));
     try {
       if (options.createMissing === true) {
-        mkdirSync11(absolutePath, { recursive: true });
+        mkdirSync12(absolutePath, { recursive: true });
       }
       const realPath = realpathSync6(absolutePath);
       allowedCwds.push(
@@ -27567,7 +28128,7 @@ function allowedCwdProjects(allowedCwds) {
   });
 }
 function isGitProjectDirectory(cwd) {
-  const gitPath = join18(cwd, ".git");
+  const gitPath = join20(cwd, ".git");
   try {
     const gitPathStats = statSync3(gitPath);
     return gitPathStats.isDirectory() || gitPathStats.isFile();
@@ -27592,7 +28153,7 @@ function browseRunnerDirectory(control, options) {
     }
     const parent = dirname13(currentPath);
     const entries = readdirSync4(currentPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => visibleRunnerDirectoryEntryName(entry.name)).map((entry) => {
-      const path2 = join18(currentPath, entry.name);
+      const path2 = join20(currentPath, entry.name);
       return {
         name: entry.name,
         path: path2,
@@ -27633,7 +28194,7 @@ function projectDirectoryName(name) {
 function availableProjectDirectoryName(projectsRoot, baseName, suffix = 0) {
   for (let nextSuffix = suffix; ; nextSuffix += 1) {
     const candidate = nextSuffix === 0 ? baseName : `${baseName}-${nextSuffix}`;
-    if (!projectPathExists(join18(projectsRoot, candidate))) {
+    if (!projectPathExists(join20(projectsRoot, candidate))) {
       return candidate;
     }
   }
@@ -27661,9 +28222,9 @@ function createRunnerProject(control, options, allowedCwds) {
       error: "invalid_project_template"
     };
   }
-  const projectsRoot = join18(currentHomeDirectory(), "linzumi");
+  const projectsRoot = join20(currentHomeDirectory(), "linzumi");
   const resolvedProjectDirName = template === "hello_linzumi_demo" ? availableProjectDirectoryName(projectsRoot, projectDirName) : projectDirName;
-  const projectPath = join18(projectsRoot, resolvedProjectDirName);
+  const projectPath = join20(projectsRoot, resolvedProjectDirName);
   let createdProjectPath = false;
   try {
     if (template !== "hello_linzumi_demo" && projectPathExists(projectPath)) {
@@ -27675,7 +28236,7 @@ function createRunnerProject(control, options, allowedCwds) {
         error: "project_directory_exists"
       };
     }
-    mkdirSync11(projectsRoot, { recursive: true });
+    mkdirSync12(projectsRoot, { recursive: true });
     if (template === "hello_linzumi_demo") {
       createdProjectPath = true;
       createHelloLinzumiProject({
@@ -27683,7 +28244,7 @@ function createRunnerProject(control, options, allowedCwds) {
         name: resolvedProjectDirName
       });
     } else {
-      mkdirSync11(projectPath, { recursive: false });
+      mkdirSync12(projectPath, { recursive: false });
       createdProjectPath = true;
     }
     const git = spawnSync5("git", ["init"], {
@@ -27741,7 +28302,7 @@ function createRunnerProject(control, options, allowedCwds) {
 }
 function removeCreatedProjectDirectory(projectPath) {
   try {
-    rmSync4(projectPath, { recursive: true, force: true });
+    rmSync5(projectPath, { recursive: true, force: true });
     return void 0;
   } catch (error) {
     return error instanceof Error ? error.message : "cleanup_failed";
@@ -27805,6 +28366,7 @@ var init_runner = __esm({
     init_commanderAttachments();
     init_claudeCodePipeline();
     init_claudeCodePlanMirror();
+    init_claudeCodeLiveBashOutput();
     init_claudeCodeSession();
     init_codexAppServer();
     init_codexProjectTrust();
@@ -27866,7 +28428,7 @@ var init_runner = __esm({
 });
 
 // src/kandanTls.ts
-import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
 import { Agent } from "undici";
 import WsWebSocket from "ws";
 function kandanTlsTrustFromEnv() {
@@ -27880,7 +28442,7 @@ function kandanTlsTrustFromCaFile(caFile) {
   if (!existsSync13(trimmed)) {
     throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${trimmed}`);
   }
-  const ca = readFileSync16(trimmed, "utf8");
+  const ca = readFileSync17(trimmed, "utf8");
   return {
     caFile: trimmed,
     ca,
@@ -42989,9 +43551,9 @@ var require_internal = __commonJS({
     }
     InternalCodec.prototype.encoder = InternalEncoder;
     InternalCodec.prototype.decoder = InternalDecoder;
-    var StringDecoder = __require("string_decoder").StringDecoder;
+    var StringDecoder2 = __require("string_decoder").StringDecoder;
     function InternalDecoder(options, codec) {
-      this.decoder = new StringDecoder(codec.enc);
+      this.decoder = new StringDecoder2(codec.enc);
     }
     InternalDecoder.prototype.write = function(buf) {
       if (!Buffer4.isBuffer(buf)) {
@@ -46664,7 +47226,7 @@ var init_RemoveFileError = __esm({
 
 // ../../node_modules/@inquirer/external-editor/dist/esm/index.js
 import { spawn as spawn11, spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync19, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "fs";
+import { readFileSync as readFileSync20, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "fs";
 import path from "node:path";
 import os from "node:os";
 import { randomUUID as randomUUID5 } from "node:crypto";
@@ -46781,14 +47343,14 @@ var init_esm5 = __esm({
           if (Object.prototype.hasOwnProperty.call(this.fileOptions, "mode")) {
             opt.mode = this.fileOptions.mode;
           }
-          writeFileSync13(this.tempFile, this.text, opt);
+          writeFileSync14(this.tempFile, this.text, opt);
         } catch (createFileError) {
           throw new CreateFileError(createFileError);
         }
       }
       readTemporaryFile() {
         try {
-          const tempFileBuffer = readFileSync19(this.tempFile);
+          const tempFileBuffer = readFileSync20(this.tempFile);
           if (tempFileBuffer.length === 0) {
             this.text = "";
           } else {
@@ -48157,17 +48719,17 @@ import { spawn as spawn12, spawnSync as spawnSync7 } from "node:child_process";
 import {
   existsSync as existsSync16,
   constants as fsConstants,
-  mkdirSync as mkdirSync14,
+  mkdirSync as mkdirSync15,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync5,
-  rmSync as rmSync5,
+  rmSync as rmSync6,
   statSync as statSync4,
-  writeFileSync as writeFileSync14
+  writeFileSync as writeFileSync15
 } from "node:fs";
 import { access } from "node:fs/promises";
-import { homedir as homedir15, tmpdir as tmpdir4 } from "node:os";
-import { delimiter as delimiter3, dirname as dirname16, join as join21, resolve as resolve10 } from "node:path";
+import { homedir as homedir16, tmpdir as tmpdir4 } from "node:os";
+import { delimiter as delimiter3, dirname as dirname16, join as join23, resolve as resolve10 } from "node:path";
 import { stdin as defaultStdin, stdout as defaultStdout } from "node:process";
 import { emitKeypressEvents } from "node:readline";
 function signupHelpText() {
@@ -48288,7 +48850,7 @@ function defaultSignupDraftStore(serviceUrl) {
       }
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync20(path2, "utf8"));
+        parsed = JSON.parse(readFileSync21(path2, "utf8"));
       } catch (_error) {
         return void 0;
       }
@@ -48298,20 +48860,20 @@ function defaultSignupDraftStore(serviceUrl) {
       return comparableServiceUrl(parsed.serviceUrl) === comparableServiceUrl(serviceUrl) ? parsed : void 0;
     },
     write: (draft) => {
-      mkdirSync14(dirname16(path2), { recursive: true });
-      writeFileSync14(path2, `${JSON.stringify(draft, null, 2)}
+      mkdirSync15(dirname16(path2), { recursive: true });
+      writeFileSync15(path2, `${JSON.stringify(draft, null, 2)}
 `, {
         encoding: "utf8",
         mode: 384
       });
     },
     clear: () => {
-      rmSync5(path2, { force: true });
+      rmSync6(path2, { force: true });
     }
   };
 }
 function defaultSignupDraftPath(serviceUrl) {
-  return join21(
+  return join23(
     dirname16(localConfigPath()),
     `signup-draft.${localConfigScopeFileStem(serviceUrl)}.json`
   );
@@ -48346,8 +48908,8 @@ function defaultSignupTaskCacheStore(serviceUrl) {
           }
         }
       };
-      mkdirSync14(dirname16(path2), { recursive: true });
-      writeFileSync14(path2, `${JSON.stringify(next, null, 2)}
+      mkdirSync15(dirname16(path2), { recursive: true });
+      writeFileSync15(path2, `${JSON.stringify(next, null, 2)}
 `, {
         encoding: "utf8",
         mode: 384
@@ -48356,7 +48918,7 @@ function defaultSignupTaskCacheStore(serviceUrl) {
   };
 }
 function defaultSignupTaskCachePath(serviceUrl) {
-  return join21(
+  return join23(
     dirname16(localConfigPath()),
     `signup-task-cache.${localConfigScopeFileStem(serviceUrl)}.json`
   );
@@ -48367,7 +48929,7 @@ function readSignupTaskCache(path2) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(path2, "utf8"));
+    parsed = JSON.parse(readFileSync21(path2, "utf8"));
   } catch (_error) {
     return { version: 1, entries: {} };
   }
@@ -50252,7 +50814,7 @@ function autocompletePathSuggestions(pathInput) {
   try {
     const showHidden = prefix.startsWith(".");
     const currentPath = directoryExists(normalizedInput) ? [normalizedInput.replace(/\/$/, "") || "/"] : [];
-    const childPaths = readdirSync5(directoryPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => showHidden || !entry.name.startsWith(".")).map((entry) => join21(directoryPath, entry.name)).map((path2) => ({
+    const childPaths = readdirSync5(directoryPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).filter((entry) => showHidden || !entry.name.startsWith(".")).map((entry) => join23(directoryPath, entry.name)).map((path2) => ({
       path: path2,
       score: fuzzyPathSegmentScore(path2.split("/").at(-1) ?? path2, prefix)
     })).filter((candidate) => candidate.score !== void 0).sort((left, right) => {
@@ -50498,7 +51060,7 @@ async function runSignupPreflights(runtime) {
 function defaultPreflightRuntime() {
   return {
     cwd: process.cwd(),
-    homeDir: homedir15(),
+    homeDir: homedir16(),
     probeTool,
     readGitEmail,
     discoverCodeRoots,
@@ -50643,13 +51205,13 @@ async function suggestTasksWithCodex(projectPath, retryPolicy) {
   );
 }
 async function runCodexTaskSuggestion2(projectPath, previousResponse, retryPolicy) {
-  const tempRoot = mkdtempSync5(join21(tmpdir4(), "linzumi-signup-codex-tasks-"));
-  const schemaPath = join21(tempRoot, "task-suggestions.schema.json");
-  const outputPath = join21(tempRoot, "task-suggestions.json");
+  const tempRoot = mkdtempSync5(join23(tmpdir4(), "linzumi-signup-codex-tasks-"));
+  const schemaPath = join23(tempRoot, "task-suggestions.schema.json");
+  const outputPath = join23(tempRoot, "task-suggestions.json");
   const model = process.env.LINZUMI_SIGNUP_TASK_MODEL ?? "gpt-5.4-mini";
   const prompt = taskSuggestionPrompt2(previousResponse);
   const codexCommand = await resolveSignupCodexCommand();
-  writeFileSync14(
+  writeFileSync15(
     schemaPath,
     `${JSON.stringify(taskSuggestionJsonSchema2(), null, 2)}
 `,
@@ -50670,9 +51232,9 @@ async function runCodexTaskSuggestion2(projectPath, previousResponse, retryPolic
       ),
       retryPolicy
     );
-    return readFileSync20(outputPath, "utf8");
+    return readFileSync21(outputPath, "utf8");
   } finally {
-    rmSync5(tempRoot, { recursive: true, force: true });
+    rmSync6(tempRoot, { recursive: true, force: true });
   }
 }
 function codexTaskSuggestionProcess2(args) {
@@ -50707,7 +51269,7 @@ function codexTaskSuggestionProcess2(args) {
 function signupCodexTaskSuggestionProcessForTest(args) {
   return codexTaskSuggestionProcess2(args);
 }
-async function resolveSignupCodexCommand(env = process.env, homeDir = homedir15(), executableExists = fileIsExecutable) {
+async function resolveSignupCodexCommand(env = process.env, homeDir = homedir16(), executableExists = fileIsExecutable) {
   const override = firstConfiguredValue([
     env.LINZUMI_SIGNUP_CODEX_BIN,
     env.LINZUMI_CODEX_BIN
@@ -50762,7 +51324,7 @@ function resolveHomePath(path2, homeDir) {
     return homeDir;
   }
   if (path2.startsWith("~/")) {
-    return join21(homeDir, path2.slice(2));
+    return join23(homeDir, path2.slice(2));
   }
   return resolve10(path2);
 }
@@ -50775,9 +51337,9 @@ function commandLooksPathLike(command) {
 }
 function homeManagedCodexCandidates(homeDir) {
   return [
-    join21(homeDir, ".volta", "bin", "codex"),
-    join21(homeDir, ".local", "bin", "codex"),
-    join21(homeDir, "bin", "codex")
+    join23(homeDir, ".volta", "bin", "codex"),
+    join23(homeDir, ".local", "bin", "codex"),
+    join23(homeDir, "bin", "codex")
   ];
 }
 async function firstExecutablePath(paths, executableExists) {
@@ -50792,7 +51354,7 @@ function commandPathCandidates(path2) {
   if (path2 === void 0 || path2.trim() === "") {
     return [];
   }
-  return path2.split(delimiter3).filter((entry) => entry.trim() !== "").map((entry) => join21(entry, "codex"));
+  return path2.split(delimiter3).filter((entry) => entry.trim() !== "").map((entry) => join23(entry, "codex"));
 }
 async function fileIsExecutable(path2) {
   try {
@@ -51025,11 +51587,11 @@ function codexPreflightLocation(command, homeDir) {
   switch (command) {
     case "codex":
       return "on PATH";
-    case join21(homeDir, ".volta", "bin", "codex"):
+    case join23(homeDir, ".volta", "bin", "codex"):
       return "via Volta";
-    case join21(homeDir, ".local", "bin", "codex"):
+    case join23(homeDir, ".local", "bin", "codex"):
       return "via ~/.local/bin";
-    case join21(homeDir, "bin", "codex"):
+    case join23(homeDir, "bin", "codex"):
       return "via ~/bin";
     default:
       return "from configured path";
@@ -51188,7 +51750,7 @@ function probeToolWithArgs(command, args, cwd) {
 }
 async function discoverCodeRoots(homeDir) {
   const candidates = ["src", "code", "projects"].map(
-    (name) => join21(homeDir, name)
+    (name) => join23(homeDir, name)
   );
   return candidates.filter((path2) => existsSync16(path2)).flatMap((path2) => discoveredProjectNames(path2));
 }
@@ -51242,7 +51804,7 @@ function discoverProjectsFromCurrentDirectory(cwd) {
 }
 function discoverProjectsFromGuessedRoots(homeDir) {
   const guessedRoots = ["src", "code", "projects"].map(
-    (name) => join21(homeDir, name)
+    (name) => join23(homeDir, name)
   );
   const projects = guessedRoots.flatMap(
     (root) => discoverProjectsUnderRoot(root)
@@ -51294,25 +51856,25 @@ function looksLikeProject(path2) {
     "pnpm-lock.yaml",
     "yarn.lock",
     "package-lock.json"
-  ].some((name) => existsSync16(join21(path2, name)));
+  ].some((name) => existsSync16(join23(path2, name)));
 }
 function detectProjectLanguage(path2) {
-  if (existsSync16(join21(path2, "pyproject.toml")) || existsSync16(join21(path2, "requirements.txt"))) {
+  if (existsSync16(join23(path2, "pyproject.toml")) || existsSync16(join23(path2, "requirements.txt"))) {
     return "Python";
   }
-  if (existsSync16(join21(path2, "Cargo.toml"))) {
+  if (existsSync16(join23(path2, "Cargo.toml"))) {
     return "Rust";
   }
-  if (existsSync16(join21(path2, "go.mod"))) {
+  if (existsSync16(join23(path2, "go.mod"))) {
     return "Go";
   }
-  if (existsSync16(join21(path2, "mix.exs"))) {
+  if (existsSync16(join23(path2, "mix.exs"))) {
     return "Elixir";
   }
-  if (existsSync16(join21(path2, "tsconfig.json")) || packageJsonMentionsTypeScript(path2)) {
+  if (existsSync16(join23(path2, "tsconfig.json")) || packageJsonMentionsTypeScript(path2)) {
     return "TypeScript";
   }
-  if (existsSync16(join21(path2, "package.json"))) {
+  if (existsSync16(join23(path2, "package.json"))) {
     return "JavaScript";
   }
   return "Project";
@@ -51320,7 +51882,7 @@ function detectProjectLanguage(path2) {
 function packageJsonMentionsTypeScript(path2) {
   try {
     const packageJson2 = JSON.parse(
-      readFileSync20(join21(path2, "package.json"), "utf8")
+      readFileSync21(join23(path2, "package.json"), "utf8")
     );
     return packageJson2.dependencies?.typescript !== void 0 || packageJson2.devDependencies?.typescript !== void 0;
   } catch {
@@ -51328,11 +51890,11 @@ function packageJsonMentionsTypeScript(path2) {
   }
 }
 function hasGitMetadata(path2) {
-  return existsSync16(join21(path2, ".git"));
+  return existsSync16(join23(path2, ".git"));
 }
 function childDirectories(root) {
   try {
-    return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join21(root, entry.name));
+    return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join23(root, entry.name));
   } catch {
     return [];
   }
@@ -51358,10 +51920,10 @@ function directoryExists(path2) {
 }
 function expandHomePath(path2) {
   if (path2 === "~") {
-    return homedir15();
+    return homedir16();
   }
   if (path2.startsWith("~/")) {
-    return join21(homedir15(), path2.slice(2));
+    return join23(homedir16(), path2.slice(2));
   }
   return resolve10(path2);
 }
@@ -51451,8 +52013,8 @@ init_onboardingDiscoveryChildProcess();
 init_runner();
 init_claudeCodeSession();
 init_authCache();
-import { existsSync as existsSync17, readFileSync as readFileSync21, realpathSync as realpathSync7 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
+import { existsSync as existsSync17, readFileSync as readFileSync22, realpathSync as realpathSync7 } from "node:fs";
+import { homedir as homedir17 } from "node:os";
 import { resolve as resolve11 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -51547,9 +52109,9 @@ init_kandanTls();
 init_protocol();
 init_json();
 init_defaultUrls();
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname14, join as join19 } from "node:path";
-import { homedir as homedir13 } from "node:os";
+import { existsSync as existsSync14, mkdirSync as mkdirSync13, readFileSync as readFileSync18, writeFileSync as writeFileSync12 } from "node:fs";
+import { dirname as dirname14, join as join21 } from "node:path";
+import { homedir as homedir14 } from "node:os";
 async function runAgentCliCommand(args, deps = {
   fetchImpl: fetch,
   stdout: process.stdout,
@@ -52257,7 +52819,7 @@ function agentTokenFile(flags) {
   return flags.get("agent-token-file") ?? defaultAgentTokenFilePath();
 }
 function defaultAgentTokenFilePath() {
-  return join19(homedir13(), ".linzumi", "agent-token.json");
+  return join21(homedir14(), ".linzumi", "agent-token.json");
 }
 function normalizedApiUrl(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
@@ -52266,11 +52828,11 @@ function authorizationHeaders(token) {
   return { authorization: `Bearer ${token}` };
 }
 function readOptionalTextFile(path2) {
-  return existsSync14(path2) ? readFileSync17(path2, "utf8") : void 0;
+  return existsSync14(path2) ? readFileSync18(path2, "utf8") : void 0;
 }
 function writeTextFile(path2, content) {
-  mkdirSync12(dirname14(path2), { recursive: true });
-  writeFileSync11(path2, content);
+  mkdirSync13(dirname14(path2), { recursive: true });
+  writeFileSync12(path2, content);
 }
 function readStoredAgentTokenFile(path2, readTextFile = readOptionalTextFile) {
   const content = readTextFile(path2);
@@ -52359,25 +52921,25 @@ init_runnerLogger();
 import {
   existsSync as existsSync15,
   closeSync as closeSync3,
-  mkdirSync as mkdirSync13,
+  mkdirSync as mkdirSync14,
   openSync as openSync4,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   watch,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
-import { dirname as dirname15, join as join20, resolve as resolve9 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { dirname as dirname15, join as join22, resolve as resolve9 } from "node:path";
 import { execFileSync, spawn as spawn10 } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var connectedMarkers = ["Connected to Linzumi", "Runner connected:"];
 function commanderStatusDir() {
-  return join20(homedir14(), ".linzumi", "commanders");
+  return join22(homedir15(), ".linzumi", "commanders");
 }
 function commanderStatusFile(runnerId, statusDir = commanderStatusDir()) {
-  return join20(statusDir, `${safeRunnerId(runnerId)}.json`);
+  return join22(statusDir, `${safeRunnerId(runnerId)}.json`);
 }
 function defaultCommanderLogFile(runnerId) {
-  return join20(homedir14(), ".linzumi", "logs", `${safeRunnerId(runnerId)}.log`);
+  return join22(homedir15(), ".linzumi", "logs", `${safeRunnerId(runnerId)}.log`);
 }
 function commanderLogIsConnected(log2) {
   return connectedMarkers.some((marker) => log2.includes(marker));
@@ -52398,8 +52960,8 @@ function startCommanderDaemon(options) {
     "--log-file",
     logFile
   ];
-  mkdirSync13(statusDir, { recursive: true });
-  mkdirSync13(dirname15(logFile), { recursive: true });
+  mkdirSync14(statusDir, { recursive: true });
+  mkdirSync14(dirname15(logFile), { recursive: true });
   const out = openSync4(logFile, "a");
   const err = openSync4(logFile, "a");
   writeCliAuditEvent(
@@ -52445,7 +53007,7 @@ function startCommanderDaemon(options) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     command: [nodeBin, ...command]
   };
-  writeFileSync12(statusFile, `${JSON.stringify(record, null, 2)}
+  writeFileSync13(statusFile, `${JSON.stringify(record, null, 2)}
 `);
   return record;
 }
@@ -52454,12 +53016,12 @@ function commanderDaemonStatus(runnerId, statusDir = commanderStatusDir(), proce
   if (!existsSync15(statusFile)) {
     return { status: "missing", runnerId, statusFile };
   }
-  const record = parseRecord(readFileSync18(statusFile, "utf8"));
+  const record = parseRecord(readFileSync19(statusFile, "utf8"));
   return processIsRunning(record.pid) && processMatchesRecord(record, processIdentityReader) ? { status: "running", record } : { status: "stopped", record };
 }
 async function waitForCommanderDaemon(options) {
   const now = options.now ?? (() => Date.now());
-  const readTextFile = options.readTextFile ?? ((path2) => existsSync15(path2) ? readFileSync18(path2, "utf8") : void 0);
+  const readTextFile = options.readTextFile ?? ((path2) => existsSync15(path2) ? readFileSync19(path2, "utf8") : void 0);
   const statusImpl = options.statusImpl ?? commanderDaemonStatus;
   const deadline = now() + options.timeoutMs;
   while (now() <= deadline) {
@@ -66401,7 +66963,7 @@ async function parseAgentRunnerArgs(args, deps = {
   };
 }
 function readAgentTokenTextFile(path2) {
-  return existsSync17(path2) ? readFileSync21(path2, "utf8") : void 0;
+  return existsSync17(path2) ? readFileSync22(path2, "utf8") : void 0;
 }
 function rejectAgentRunnerTargetingFlags(values) {
   const unsupportedFlags = [
@@ -66711,10 +67273,10 @@ function rejectStartTargetingFlags(values) {
 }
 function resolveUserPath(pathValue) {
   if (pathValue === "~") {
-    return homedir16();
+    return homedir17();
   }
   if (pathValue.startsWith("~/")) {
-    return resolve11(homedir16(), pathValue.slice(2));
+    return resolve11(homedir17(), pathValue.slice(2));
   }
   return resolve11(pathValue);
 }
@@ -66817,21 +67379,23 @@ function threadRunnerCodexModelProvider(values) {
   if (modelProvider === void 0) {
     return void 0;
   }
-  if (modelProvider !== "wafer") {
+  if (modelProvider !== "wafer" && modelProvider !== "openai-proxy") {
     throw new Error(`unsupported --model-provider: ${modelProvider}`);
   }
   const llmProxyBaseUrl = stringValue8(values, "llm-proxy-base-url");
   const llmProxyToken = process.env.LINZUMI_LLM_PROXY_TOKEN?.trim();
   if (llmProxyBaseUrl === void 0) {
-    throw new Error("--model-provider wafer requires --llm-proxy-base-url");
+    throw new Error(
+      `--model-provider ${modelProvider} requires --llm-proxy-base-url`
+    );
   }
   if (llmProxyToken === void 0 || llmProxyToken === "") {
     throw new Error(
-      "--model-provider wafer requires the LINZUMI_LLM_PROXY_TOKEN env credential"
+      `--model-provider ${modelProvider} requires the LINZUMI_LLM_PROXY_TOKEN env credential`
     );
   }
   return {
-    provider: "wafer",
+    provider: modelProvider,
     llmProxyBaseUrl,
     llmProxyToken
   };