@logicseek/hello-cc 1.0.5 → 1.1.0-rc.3

package/lib/web/browser/project-data.mjs

@@ -0,0 +1,158 @@
+/** Read-only project data broker. Pane drafts, selection and control tokens never enter it. */
+const SHARED_PATHS = new Set(['/api/projects', '/api/sessions', '/api/detected', '/api/state']);
+const aborted = () => Object.assign(new Error('Request superseded'), { name: 'AbortError', code: 'REQUEST_SUPERSEDED' });
+
+export function createReadBroker({ fetchJson, now = Date.now, ttlMs = 2400, maxEntries = 64 } = {}) {
+  if (typeof fetchJson !== 'function' || !Number.isSafeInteger(maxEntries) || maxEntries < 1 || !Number.isFinite(ttlMs) || ttlMs < 0) throw new TypeError('Invalid read broker options');
+  const entries = new Map();
+  const pending = new Set();
+  function read(url, options = {}) {
+    const parsed = new URL(url, 'http://hcc.local');
+    if (!SHARED_PATHS.has(parsed.pathname)) throw new TypeError('Only project read endpoints can be shared');
+    const { signal, headers = {} } = options;
+    if (signal?.aborted) return Promise.reject(aborted());
+    const requestHeaders = Object.fromEntries(new globalThis.Headers(headers));
+    const key = JSON.stringify([url, Object.entries(requestHeaders).sort(([a], [b]) => a.localeCompare(b))]);
+    let entry = entries.get(key);
+    if (entry && entry.done && now() - entry.completedAt >= ttlMs) { entries.delete(key); entry = null; }
+    if (!entry) {
+      // Never forget a pending request and silently create unlimited work.
+      // Saturation rejects new distinct reads; existing shared consumers finish.
+      if (pending.size >= maxEntries) return Promise.reject(Object.assign(new Error('Too many pending project reads'), { code: 'READ_BROKER_BUSY' }));
+      if (entries.size >= maxEntries) {
+        const completed = [...entries].find(([, value]) => value.done);
+        if (completed) entries.delete(completed[0]);
+      }
+      const controller = new globalThis.AbortController();
+      entry = { controller, users: 0, done: false, completedAt: 0 };
+      const owned = entry;
+      entries.set(key, entry);
+      pending.add(entry);
+      entry.promise = Promise.resolve().then(() => fetchJson(url, { headers: requestHeaders, signal: controller.signal }))
+        .then(value => { pending.delete(owned); owned.done = true; owned.completedAt = now(); return value; }, error => {
+          pending.delete(owned);
+          owned.done = true;
+          if (entries.get(key) === owned) entries.delete(key);
+          throw error;
+        });
+    }
+    entry.users++;
+    const owned = entry;
+    return new Promise((resolve, reject) => {
+      let finished = false;
+      function release() {
+        if (finished) return false;
+        finished = true; signal?.removeEventListener('abort', cancel); owned.controller.signal.removeEventListener('abort', cancel); owned.users--;
+        if (!owned.done && owned.users === 0) {
+          owned.controller.abort();
+          if (entries.get(key) === owned) entries.delete(key);
+        }
+        return true;
+      }
+      function cancel() { if (release()) reject(aborted()); }
+      signal?.addEventListener('abort', cancel, { once: true });
+      owned.controller.signal.addEventListener('abort', cancel, { once: true });
+      owned.promise.then(value => { if (release()) resolve(structuredClone(value)); }, error => { if (release()) reject(error); });
+    });
+  }
+  return Object.freeze({ read, invalidate() {
+    // Include completed cache entries: their current consumers may still be
+    // waiting for a promise microtask when a write invalidates the read.
+    const stale = new Set([...entries.values(), ...pending]);
+    entries.clear();
+    for (const entry of stale) entry.controller.abort();
+  } });
+}
+
+export async function fetchJson(url, options = {}, { fetchImpl = globalThis.fetch, timeoutMs = 30000 } = {}) {
+  const controller = new globalThis.AbortController();
+  let timedOut = false;
+  const cancel = () => controller.abort();
+  if (options.signal?.aborted) throw aborted();
+  options.signal?.addEventListener('abort', cancel, { once: true });
+  const timer = setTimeout(() => { timedOut = true; controller.abort(); }, timeoutMs);
+  try {
+    const response = await fetchImpl(url, { ...options, signal: controller.signal });
+    const json = await response.json();
+    if (!response.ok) throw Object.assign(new Error(json.error?.message || json.message || 'Request failed'), {
+      code: json.error?.code, detail: json.error?.message, status: response.status,
+      ...(json.error?.extra && typeof json.error.extra === 'object' && !Array.isArray(json.error.extra) ? { extra: json.error.extra } : {})
+    });
+    return json;
+  } catch (error) {
+    if (timedOut) throw Object.assign(new Error('Request timed out; check the session before retrying a write.'), { code: 'REQUEST_TIMEOUT' });
+    if (options.signal?.aborted) throw aborted();
+    throw error;
+  } finally { clearTimeout(timer); options.signal?.removeEventListener('abort', cancel); }
+}
+
+export function sharedProjectBroker(surface = globalThis.window) {
+  // Only the existing same-origin parent may lend its broker. No BroadcastChannel
+  // or postMessage credential transfer, and no write/lease APIs are exposed.
+  try { if (surface.parent !== surface && surface.parent.location.origin === surface.location.origin && surface.parent.hccProjectReads) return surface.parent.hccProjectReads; } catch {}
+  if (surface.hccProjectReads) return surface.hccProjectReads;
+  const broker = createReadBroker({ fetchJson });
+  Object.defineProperty(surface, 'hccProjectReads', { value: broker, configurable: true });
+  return broker;
+}
+
+export function createProjectRequests({ broker, fetcher = fetchJson, root = '', rootIdentity = '', headers = {}, requireIdentity = false }) {
+  let scope = root, selectedIdentity = rootIdentity, generation = 0;
+  const pending = new Set();
+  const cancel = () => { generation++; for (const controller of pending) controller.abort(); pending.clear(); };
+  return {
+    rootIdentity() { return selectedIdentity; },
+    setRoot(value, identity = scope === value ? selectedIdentity : '') {
+      if (scope !== value || selectedIdentity !== identity) { cancel(); scope = value; selectedIdentity = identity; }
+    },
+    dispose: cancel,
+    async request(path, options = {}) {
+      const visit = generation, controller = new globalThis.AbortController();
+      const url = new URL(path, 'http://hcc.local');
+      const { explicitSelection = false, ...fetchOptions } = options;
+      if (requireIdentity && !explicitSelection && !selectedIdentity) {
+        throw Object.assign(new Error('Select a project before requesting its data'), { code: 'PROJECT_IDENTITY_REQUIRED' });
+      }
+      if (scope && !explicitSelection) url.searchParams.set('root', scope);
+      const target = url.pathname + url.search;
+      const read = !fetchOptions.method || fetchOptions.method.toUpperCase() === 'GET';
+      const externalAbort = () => controller.abort();
+      if (options.signal?.aborted) throw aborted();
+      options.signal?.addEventListener('abort', externalAbort, { once: true });
+      pending.add(controller);
+      const requestHeaders = { 'Content-Type': 'application/json', ...headers, ...options.headers };
+      // Never let an auxiliary caller replace the selection attached to this
+      // visit. Explicit selection has no prior project identity by design.
+      for (const key of Object.keys(requestHeaders)) {
+        if (['x-hcc-root-identity', 'x-hcc-browser'].includes(key.toLowerCase())) delete requestHeaders[key];
+      }
+      if (requireIdentity) requestHeaders['X-HCC-Browser'] = '1';
+      if (!explicitSelection && selectedIdentity) requestHeaders['X-HCC-Root-Identity'] = selectedIdentity;
+      const requestOptions = { ...fetchOptions, signal: controller.signal, headers: requestHeaders };
+      if (!read) broker.invalidate();
+      try {
+        const data = await (read && SHARED_PATHS.has(url.pathname) ? broker.read(target, requestOptions) : fetcher(target, requestOptions));
+        if (visit !== generation || controller.signal.aborted) throw aborted();
+        return data;
+      } finally {
+        if (!read) broker.invalidate();
+        pending.delete(controller); options.signal?.removeEventListener('abort', externalAbort);
+      }
+    }
+  };
+}
+
+/** No overlapping polls; hidden tabs reduce their refresh rate and wake immediately. */
+export function scheduleVisiblePoll(run, { intervalMs, hiddenMs = 30000, document: doc = globalThis.document, surface = globalThis.window, onError = console.error }) {
+  let timer, stopped = false, running = false;
+  const schedule = () => { clearTimeout(timer); if (!stopped) timer = setTimeout(tick, doc.hidden ? hiddenMs : intervalMs); };
+  async function tick() {
+    if (stopped || running) return;
+    running = true;
+    try { if (surface.navigator?.onLine !== false) await run(); } catch (error) { if (error.name !== 'AbortError') onError(error); }
+    finally { running = false; schedule(); }
+  }
+  function wake() { if (!doc.hidden) { clearTimeout(timer); void tick(); } else schedule(); }
+  doc.addEventListener('visibilitychange', wake); surface.addEventListener('online', wake); schedule();
+  return () => { stopped = true; clearTimeout(timer); doc.removeEventListener('visibilitychange', wake); surface.removeEventListener('online', wake); };
+}

package/lib/web/browser/session-sync.mjs

@@ -0,0 +1,82 @@
+/** Structured session wire protocol. This module is shared by Node and browsers. */
+export const SESSION_SYNC_PROTOCOL = 1;
+const forbidden = new Set(['__proto__', 'prototype', 'constructor']);
+
+/** @typedef {{op:'set'|'delete'|'append'|'splice', path:(string|number)[], value?:unknown, start?:number, deleteCount?:number, values?:unknown[]}} StateOperation */
+
+/** Copy only changed ancestors. Never mutate a previously delivered UI state. */
+export function applyStateOperations(state, operations) {
+  if (!Array.isArray(operations) || operations.length > 2048) throw new Error('Invalid operations');
+  let result = state;
+  for (const operation of operations) {
+    const path = operation.path;
+    if (!Array.isArray(path) || path.length > 32 || path.some(key =>
+      !(typeof key === 'string' || Number.isSafeInteger(key) && key >= 0) || forbidden.has(String(key)))) throw new Error('Invalid path');
+    const update = (value, depth) => {
+      if (depth === path.length) {
+        if (operation.op === 'set') return structuredClone(operation.value);
+        if (operation.op === 'append' && typeof value === 'string' && typeof operation.value === 'string') return value + operation.value;
+        if (operation.op === 'splice' && Array.isArray(value) && Array.isArray(operation.values) &&
+            Number.isSafeInteger(operation.start) && operation.start >= 0 && operation.start <= value.length &&
+            Number.isSafeInteger(operation.deleteCount) && operation.deleteCount >= 0 && operation.deleteCount <= value.length - operation.start) {
+          const copy = value.slice(); copy.splice(operation.start, operation.deleteCount, ...structuredClone(operation.values)); return copy;
+        }
+        throw new Error('Invalid operation');
+      }
+      if (!value || typeof value !== 'object') throw new Error('Missing path');
+      const key = path[depth], last = depth === path.length - 1;
+      if (Array.isArray(value) && (!Number.isSafeInteger(key) || key >= value.length)) throw new Error('Invalid array path');
+      if (!Object.hasOwn(value, key) && !(last && operation.op === 'set' && !Array.isArray(value))) throw new Error('Missing path');
+      const copy = Array.isArray(value) ? value.slice() : { ...value };
+      if (last && operation.op === 'delete' && !Array.isArray(value)) delete copy[key];
+      else copy[key] = update(value[key], depth + 1);
+      return copy;
+    };
+    result = update(result, 0);
+  }
+  return result;
+}
+
+/**
+ * One receiver per WebSocket. Reconnection must create a receiver or reset it.
+ * onState receives immutable-by-convention state; recovery never sends input.
+ * @param {{root:string,sessionId:string,onState?:(state:object,channel:string)=>void,requestSnapshot?:(frame:object)=>void}} options
+ */
+export function createSessionSync({ root, sessionId, onState = () => {}, requestSnapshot = () => {} }) {
+  let state = null, generation = null, executorId = null, revision = -1, channel = null, requestId = null, sequence = 0;
+  function recover(reason) {
+    if (!requestId) {
+      requestId = 'sync-' + ++sequence;
+      requestSnapshot({ type: 'state_sync_request', protocol: SESSION_SYNC_PROTOCOL, requestId });
+    }
+    return { accepted: false, recovery: true, reason };
+  }
+  function receive(frame) {
+    if (frame?.type !== 'state_sync') return { accepted: false, ignored: true };
+    if (frame.protocol !== SESSION_SYNC_PROTOCOL || frame.root !== root || frame.sessionId !== sessionId ||
+        !['codex', 'native'].includes(frame.channel) || typeof frame.generation !== 'string' || !frame.generation ||
+        typeof frame.executorId !== 'string' || !Number.isSafeInteger(frame.revision) || frame.revision < 0) return recover('scope-or-version');
+    if (generation && (frame.generation !== generation || frame.executorId !== executorId || frame.channel !== channel)) return recover('executor-or-generation');
+    if (frame.mode === 'snapshot') {
+      if (!frame.state || typeof frame.state !== 'object' || Array.isArray(frame.state)) return recover('invalid-snapshot');
+      if (frame.state.executorId != null && frame.state.executorId !== frame.executorId) return recover('executor-state-mismatch');
+      if (generation && (!requestId || frame.requestId !== requestId || frame.revision < revision)) return recover('unsolicited-or-stale-snapshot');
+      if (requestId && frame.requestId !== requestId) return { accepted: false, recovery: true, reason: 'waiting-for-recovery' };
+      state = structuredClone(frame.state); generation = frame.generation; executorId = frame.executorId; channel = frame.channel;
+    } else if (frame.mode === 'patch') {
+      if (requestId) return { accepted: false, recovery: true, reason: 'waiting-for-recovery' };
+      if (!generation || frame.baseRevision !== revision || frame.revision !== revision + 1) return recover('revision-gap');
+      try {
+        const next = applyStateOperations(state, frame.operations);
+        if (next.executorId != null && next.executorId !== executorId) return recover('executor-state-mismatch');
+        state = next;
+      } catch { return recover('invalid-patch'); }
+    } else return recover('unknown-mode');
+    revision = frame.revision; requestId = null;
+    onState(state, channel);
+    return { accepted: true, revision, generation };
+  }
+  const api = { receive, reset() { state = null; generation = null; executorId = null; revision = -1; channel = null; requestId = null; } };
+  Object.defineProperties(api, { state: { get: () => state }, revision: { get: () => revision }, recovering: { get: () => Boolean(requestId) } });
+  return api;
+}

package/lib/web/browser-assets.mjs

@@ -0,0 +1,19 @@
+import { fileURLToPath } from 'node:url';
+
+// Explicit public module graph. Never resolve a request path against lib/.
+const names = [
+  'browser/core.mjs', 'browser/project-data.mjs', 'browser/session-sync.mjs',
+  'api-version.mjs', 'ui-agent-start.mjs', 'ui-agent-defaults.mjs', 'ui-command-palette.mjs', 'ui-files.mjs', 'ui-file-writes.mjs',
+  'ui-codex.mjs', 'ui-codex-account.mjs', 'ui-handoff.mjs', 'ui-history.mjs',
+  'ui-interactions.mjs', 'ui-i18n.mjs', 'ui-native.mjs', 'ui-native-timeline.mjs',
+  'ui-preferences.mjs', 'ui-review.mjs', 'ui-safe-markdown.mjs',
+  'ui-session-tools.mjs', 'ui-terminal-find.mjs', 'ui-workbench.mjs', 'ui-workspace.mjs'
+];
+const assets = new Map(names.map(name => ['/assets/web/' + name, fileURLToPath(new URL(name, import.meta.url))]));
+// These shared validators are pure JavaScript and imported by the interaction
+// panel. Keep the two integration paths explicit; other integrations stay private.
+for (const name of ['mcp-elicitation.mjs', 'mcp-url-elicitation.mjs']) {
+  assets.set('/assets/integrations/' + name, fileURLToPath(new URL('../integrations/' + name, import.meta.url)));
+}
+export function browserAssetPath(pathname) { return assets.get(pathname) || null; }
+export const BROWSER_ASSET_PATHS = Object.freeze([...assets.keys()]);

package/lib/web/buffer-gc-runtime.mjs

@@ -12,7 +12,7 @@ import { bufferPlanGcCutoffs, planBufferFiles } from '../runtime/buffer-gc.mjs';
 
 export function createBufferGcRuntime(deps) {
   const {
-    sessions,
+    sessions, isStopping = () => false,
     connectWebProject, runtimeProjectContexts,
     now, runGc, bufferDirectory,
     canonicalRoot, observePeerEvidence, redactedLogText, sameResolvedPath
@@ -136,7 +136,7 @@ export function createBufferGcRuntime(deps) {
   }
 
   function runAutoGc() {
-    if (autoGcInFlight) return;
+    if (isStopping() || autoGcInFlight) return;
     autoGcInFlight = true;
     try {
       for (const projectCtx of runtimeProjectContexts()) {

package/lib/web/codex-app-server.mjs

@@ -1,5 +1,8 @@
-import { spawn } from 'node:child_process';
+import { spawnPinnedCwdProcess } from '../process/pinned-cwd.mjs';
+import { captureSelectedCwdIdentity } from '../process/selected-cwd-identity.mjs';
+import { createCodexAccountState } from '../integrations/codex-account.mjs';
 import { randomUUID } from 'node:crypto';
+import { redactMcpUrlInteraction } from '../integrations/mcp-url-elicitation.mjs';
 import path from 'node:path';
 import { CODEX_INTERACTION_METHODS, codexInteractionKind, codexInteractionResponse, cancelCodexInteraction, codexInteractiveConfig } from '../integrations/codex-interactions.mjs';
 
@@ -52,13 +55,18 @@ function rpcKey(id) {
 
 export function createCodexAppServer({
   cwd, env = process.env, onChange = () => {},
+  expectedCwdIdentity = null,
+  // Internal synchronous observers may consume a borrowed read-only view.
+  // Public callers retain isolated snapshots by default; never retain a view.
+  changeView = false,
   onSpawn = async () => null,
   requestTimeoutMs = 30000, closeTimeoutMs = 1000, clientVersion = '1.0.1',
   // Test seam. The production command and its arguments are always fixed below.
-  spawnProcess = spawn
+  spawnProcess = spawnPinnedCwdProcess
 } = {}) {
   const root = path.resolve(cwd || process.cwd());
   if (!Number.isFinite(requestTimeoutMs) || requestTimeoutMs <= 0) throw new TypeError('requestTimeoutMs must be positive');
+  const cwdBinding = captureSelectedCwdIdentity(root, expectedCwdIdentity);
   const executorId = randomUUID();
   let status = 'new';
   let child = null;
@@ -73,6 +81,11 @@ export function createCodexAppServer({
   let closePromise = null;
   let streamTimer = null;
   let streamEvent = null;
+  let updateSequence = 0;
+  const textItems = new Map();
+  let textHintsComplete = true;
+  const turnSizes = new WeakMap();
+  let runtimeMetadata = {}, metadataThreadId = null, metrics = null, metricsThreadId = null;
   const threads = new Map();
   const pending = new Map();
   const approvals = new Map();
@@ -80,6 +93,8 @@ export function createCodexAppServer({
   const submittingThreads = new Set();
   const threadNotificationSequences = new Map();
   const events = [];
+  const account = createCodexAccountState({ request: (method, params) => call(method, params),
+    onChange: value => changed('account.status', { account: value }) });
 
   function bounded(value, limit = MAX_TEXT, depth = 0) {
     if (typeof value === 'string') {
@@ -100,9 +115,9 @@ export function createCodexAppServer({
     return value;
   }
 
-  function snapshot() {
+  function stateView() {
     const current = threads.get(currentThreadId);
-    return structuredClone({
+    return {
       executorId, backend: 'codex-app-server', status, cwd: root, pid: child?.pid || null,
       processExited: Boolean(child && (child.exitCode != null || child.signalCode != null)),
       metadata, currentThreadId, threadId: currentThreadId, turnId: current?.activeTurnId || null,
@@ -110,17 +125,24 @@ export function createCodexAppServer({
       pendingApprovals: [...approvals.values()].filter((approval) => approval.status === 'pending'),
       uncertainSubmissions: [...uncertain.values()].map(({ params, ...entry }) => entry),
       uncertainRecovery: uncertain.size ? 'stop-executor-and-resume-history' : null,
-      events, truncated
-    });
+      account: account.snapshot(), events, truncated, updateSequence,
+      ...(metadataThreadId === currentThreadId && Object.keys(runtimeMetadata).length ? { runtimeMetadata } : {}),
+      ...(metrics && metricsThreadId === currentThreadId ? { metrics } : {})
+    };
   }
+  function snapshot() { return structuredClone(stateView()); }
 
   function publishChange(event) {
     clearTimeout(streamTimer); streamTimer = null; streamEvent = null;
-    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+    const change = { textOnly: textHintsComplete && event?.method === 'item/agentMessage/delta', textItems: [...textItems.values()] };
+    textItems.clear();
+    textHintsComplete = true;
+    try { onChange(changeView ? stateView() : snapshot(), structuredClone(event), change); } catch { /* UI observers do not own transport. */ }
   }
 
   function changed(method, params = {}) {
-    const event = { method, params: bounded(params, 8192), at: Date.now() };
+    updateSequence++;
+    const event = { method, params: bounded(redactMcpUrlInteraction(params), 8192), at: Date.now() };
     events.push(event);
     if (events.length > 100) events.shift();
     // Keep protocol state current on every token, but copy/broadcast its complete
@@ -128,6 +150,9 @@ export function createCodexAppServer({
     // Approval, completion, error and connection changes publish immediately;
     // their snapshot includes all pending text and cancels the trailing timer.
     if (method === 'item/agentMessage/delta') {
+      const identity = { threadId: params.threadId, turnId: params.turnId, itemId: params.itemId };
+      if (textItems.size < 1024) textItems.set(JSON.stringify(identity), identity);
+      else textHintsComplete = false;
       streamEvent = event;
       if (!streamTimer) {
         streamTimer = setTimeout(() => publishChange(streamEvent), STREAM_UPDATE_MS);
@@ -172,9 +197,21 @@ export function createCodexAppServer({
     }
   }
 
-  function boundItems(turn) {
-    while (turn.items.length > 100 || JSON.stringify(turn.items).length > 1024 * 1024) {
-      turn.items.shift(); truncated = true;
+  function boundItems(turn, changedItem = null) {
+    let cache = turnSizes.get(turn);
+    if (!cache || !changedItem || cache.array !== turn.items) {
+      const sizes = new Map(turn.items.map(item => [item, JSON.stringify(item).length]));
+      cache = { array: turn.items, sizes, total: 2 + Math.max(0, turn.items.length - 1) + [...sizes.values()].reduce((sum, size) => sum + size, 0) };
+      turnSizes.set(turn, cache);
+    } else {
+      const old = cache.sizes.get(changedItem), size = JSON.stringify(changedItem).length;
+      cache.total += size - (old || 0) + (old == null && cache.sizes.size ? 1 : 0);
+      cache.sizes.set(changedItem, size);
+    }
+    while (turn.items.length > 100 || cache.total > 1024 * 1024) {
+      const removed = turn.items.shift();
+      cache.total -= (cache.sizes.get(removed) || 0) + (turn.items.length ? 1 : 0);
+      cache.sizes.delete(removed); truncated = true;
     }
   }
 
@@ -235,6 +272,12 @@ export function createCodexAppServer({
   }
 
   function applyResult(method, params, result, requestSequence) {
+    if (['thread/start', 'thread/resume'].includes(method)) {
+      const policy = result?.approvalPolicy;
+      metadataThreadId = result?.thread?.id || null;
+      runtimeMetadata = { ...(typeof result?.model === 'string' ? { model: result.model } : {}),
+        ...(policy != null ? { permissionMode: typeof policy === 'string' ? policy : JSON.stringify(policy) } : {}) };
+    }
     if (['thread/start', 'thread/resume', 'thread/read'].includes(method)) absorbThread(result?.thread, requestSequence);
     if (method === 'turn/start') absorbTurn(params.threadId, result?.turn);
   }
@@ -251,6 +294,7 @@ export function createCodexAppServer({
   function disconnect(code, message) {
     if (status === 'disconnected' || status === 'closed') return;
     status = 'disconnected';
+    account.close();
     for (const entry of pending.values()) {
       clearTimeout(entry.timer);
       const isUncertain = entry.mutation && entry.sent;
@@ -333,7 +377,8 @@ export function createCodexAppServer({
     if (approvals.has(key)) throw new CodexAppServerError('CODEX_PROTOCOL_ERROR', 'server reused an unresolved request id');
     if (approvals.size >= 64) throw new CodexAppServerError('CODEX_PROTOCOL_ERROR', 'too many unresolved approvals');
     thread.activeTurnId = turnId;
-    thread.status = { type: 'active', activeFlags: [codexInteractionKind(message.method) === 'userInput' ? 'waitingOnUserInput' : 'waitingOnApproval'] };
+    const inputRequired = codexInteractionKind(message.method) === 'userInput' || (message.method === 'mcpServer/elicitation/request' && params.mode === 'form' && Object.keys(params.requestedSchema?.properties || {}).length > 0);
+    thread.status = { type: 'active', activeFlags: [inputRequired ? 'waitingOnUserInput' : 'waitingOnApproval'] };
     const preview = bounded(params);
     approvals.set(key, {
       executorId, requestId: message.id, threadId, turnId, itemId: params.itemId || null,
@@ -346,9 +391,22 @@ export function createCodexAppServer({
 
   function notification(method, params) {
     notificationSequence += 1;
+    if (account.notification(method, params)) return;
     const notifiedThread = params.threadId || params.thread?.id;
     if (notifiedThread) threadNotificationSequences.set(notifiedThread, notificationSequence);
     if (method === 'thread/started') absorbThread(params.thread);
+    if (method === 'thread/tokenUsage/updated' && params.threadId === currentThreadId) {
+      const usage = params.tokenUsage?.total;
+      if (usage && typeof usage === 'object') {
+        const values = {};
+        for (const name of ['inputTokens', 'outputTokens', 'cachedInputTokens', 'totalTokens']) {
+          if (Number.isFinite(usage[name]) && usage[name] >= 0) values[name] = usage[name];
+        }
+        if (Number.isFinite(params.tokenUsage.modelContextWindow) && params.tokenUsage.modelContextWindow > 0) values.contextWindow = params.tokenUsage.modelContextWindow;
+        metrics = { source: 'codex thread/tokenUsage/updated', scope: 'session', observedAt: Date.now(), ...values };
+        metricsThreadId = params.threadId;
+      }
+    }
     if (method === 'thread/status/changed') {
       const thread = ensureThread(params.threadId);
       thread.status = bounded(params.status);
@@ -374,7 +432,7 @@ export function createCodexAppServer({
       if (!item) { item = { id: itemId, type: 'agentMessage', text: '' }; turn.items.push(item); }
       if (params.item) Object.assign(item, bounded(params.item));
       else item.text = bounded((item.text || '') + (params.delta || ''));
-      boundItems(turn);
+      boundItems(turn, item);
     }
     changed(method, params);
   }
@@ -408,7 +466,8 @@ export function createCodexAppServer({
       entry?.resolve(message.result);
     }
     uncertain.delete(key);
-    changed(late ? 'request.reconciled' : 'request.completed', { requestId: message.id, method: operation.method, error: message.error || null });
+    changed(late ? 'request.reconciled' : 'request.completed', { requestId: message.id, method: operation.method,
+      error: operation.method.startsWith('account/') ? (message.error ? { code: message.error.code } : null) : message.error || null });
   }
 
   function initialize() {
@@ -417,8 +476,10 @@ export function createCodexAppServer({
     initialization = (async () => {
       status = 'connecting';
       try {
+        cwdBinding.assertUnchanged();
         child = spawnProcess('codex', ['app-server', '--listen', 'stdio://'], {
-          cwd: root, env: { ...env }, stdio: ['pipe', 'pipe', 'pipe']
+          cwd: root, expectedIdentity: cwdBinding,
+          env: { ...env }, stdio: ['pipe', 'pipe', 'pipe']
         });
         if (!child?.stdin || !child.stdout) throw new CodexAppServerError('CODEX_START_FAILED', 'Codex process has no stdio transport');
         child.stdout.setEncoding('utf8');
@@ -442,8 +503,8 @@ export function createCodexAppServer({
         child.stdin.on('error', () => disconnect('CODEX_DISCONNECTED', 'Codex input closed'));
         // Drain diagnostics, but never publish environment/auth data or stderr in UI state.
         child.stderr?.on('data', () => {});
-        child.on('error', () => disconnect('CODEX_START_FAILED', 'Could not start the installed codex executable'));
-        child.on('exit', () => disconnect('CODEX_DISCONNECTED', 'Codex App Server exited'));
+        child.on('error', () => { cwdBinding.release(); disconnect('CODEX_START_FAILED', 'Could not start the installed codex executable'); });
+        child.on('exit', () => { cwdBinding.release(); disconnect('CODEX_DISCONNECTED', 'Codex App Server exited'); });
         child.stdout.on('end', () => disconnect('CODEX_DISCONNECTED', 'Codex App Server output ended'));
         changed('transport.connecting');
         metadata = bounded(await request('initialize', {
@@ -473,9 +534,15 @@ export function createCodexAppServer({
 
   async function call(method, params, mutation = false, absorb = true) {
     await initialize();
+    if (method === 'thread/list') assertCwdHandoff();
     return request(method, params, mutation, absorb);
   }
 
+  function assertCwdHandoff() {
+    if (status !== 'ready') throw new CodexAppServerError('CODEX_DISCONNECTED', 'Executor is not ready for a directory handoff');
+    cwdBinding.assertUnchanged();
+  }
+
   function assertActiveTurn(threadId, turnId) {
     requiredId(threadId, 'threadId'); requiredId(turnId, 'turnId');
     if (threads.get(threadId)?.activeTurnId !== turnId) {
@@ -486,33 +553,38 @@ export function createCodexAppServer({
   async function close() {
     if (closePromise) return closePromise;
     closePromise = (async () => {
-      disconnect('CODEX_CLOSED', 'Codex App Server was closed');
-      status = 'closed'; approvals.clear();
-      changed('transport.closed');
-      if (!child || child.exitCode != null || child.signalCode != null) return;
-      await new Promise((resolve) => {
-        let timer;
-        const done = () => { clearTimeout(timer); child.removeListener('exit', done); resolve(); };
-        child.once('exit', done);
-        timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} done(); }, closeTimeoutMs);
-        try { child.stdin?.end(); child.kill('SIGTERM'); } catch { done(); }
-      });
+      try {
+        disconnect('CODEX_CLOSED', 'Codex App Server was closed');
+        status = 'closed'; approvals.clear();
+        changed('transport.closed');
+        if (!child || child.exitCode != null || child.signalCode != null) return;
+        await new Promise((resolve) => {
+          let timer;
+          const done = () => { clearTimeout(timer); child.removeListener('exit', done); resolve(); };
+          child.once('exit', done);
+          timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} done(); }, closeTimeoutMs);
+          try { child.stdin?.end(); child.kill('SIGTERM'); } catch { done(); }
+        });
+      } finally { cwdBinding.release(); }
     })();
     return closePromise;
   }
 
   return {
     initialize, snapshot, close,
+    async readAccount() { await initialize(); return account.refresh(); },
     async startThread(params = {}) {
       await initialize();
-      return request('thread/start', { cwd: root, sandbox: 'workspace-write', approvalPolicy: 'on-request', approvalsReviewer: 'user',
-        ...objectParams(params), config: codexInteractiveConfig({ ...objectParams(params).config, ...threadConfig }) }, true);
+      assertCwdHandoff();
+      return request('thread/start', { sandbox: 'workspace-write', approvalPolicy: 'on-request', approvalsReviewer: 'user',
+        ...objectParams(params), cwd: root, config: codexInteractiveConfig({ ...objectParams(params).config, ...threadConfig }) }, true);
     },
     async resumeThread(threadId, params = {}) {
       await initialize();
-      return request('thread/resume', { cwd: root, approvalPolicy: 'on-request', approvalsReviewer: 'user',
+      assertCwdHandoff();
+      return request('thread/resume', { approvalPolicy: 'on-request', approvalsReviewer: 'user',
         ...objectParams(params), config: codexInteractiveConfig({ ...objectParams(params).config, ...threadConfig }),
-        threadId: requiredId(threadId, 'threadId') }, true);
+        cwd: root, threadId: requiredId(threadId, 'threadId') }, true);
     },
     readThread(threadId, params = {}) {
       return call('thread/read', { includeTurns: true, ...objectParams(params), threadId: requiredId(threadId, 'threadId') });
@@ -523,11 +595,12 @@ export function createCodexAppServer({
     async forkThread(threadId, params = {}, beforeSubmit = () => {}) {
       await initialize();
       beforeSubmit();
-      return request('thread/fork', { cwd: root, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write',
+      assertCwdHandoff();
+      return request('thread/fork', { approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write',
         ...objectParams(params), config: codexInteractiveConfig({ ...objectParams(params).config, ...threadConfig }),
-        threadId: requiredId(threadId, 'threadId') }, true, false);
+        cwd: root, threadId: requiredId(threadId, 'threadId') }, true, false);
     },
-    listThreads(params = {}) { return call('thread/list', { limit: 50, cwd: root, ...objectParams(params) }); },
+    listThreads(params = {}) { return call('thread/list', { limit: 50, ...objectParams(params), cwd: root }); },
     async startTurn(threadId, input, params = {}) {
       requiredId(threadId, 'threadId');
       const normalized = normalizeInput(input);
@@ -551,7 +624,7 @@ export function createCodexAppServer({
       assertActiveTurn(threadId, turnId);
       return call('turn/interrupt', { threadId, turnId }, true).then(result => { expireApprovals(threadId, turnId); changed('approval.expired', { threadId, turnId }); return result; });
     },
-    async approve({ executorId: submittedExecutorId, threadId, turnId, requestId, decision, permissions, scope, answers } = {}) {
+    async approve({ executorId: submittedExecutorId, threadId, turnId, requestId, decision, permissions, scope, answers, content } = {}) {
       if (submittedExecutorId !== executorId) throw new CodexAppServerError('CODEX_APPROVAL_MISMATCH', 'approval identity or decision is invalid');
       assertActiveTurn(threadId, turnId);
       const approval = approvals.get(rpcKey(requestId));
@@ -561,13 +634,14 @@ export function createCodexAppServer({
       if (approval.truncated && decision === 'accept') {
         throw new CodexAppServerError('CODEX_APPROVAL_TRUNCATED', 'approval details exceed the preview limit; decline or cancel instead');
       }
-      const result = codexInteractionResponse({ ...approval, kind: approval.kind || codexInteractionKind(approval.method) }, { decision, permissions, scope, answers });
+      const result = codexInteractionResponse({ ...approval, kind: approval.kind || codexInteractionKind(approval.method) }, { decision, permissions, scope, answers, content });
       await initialize();
       // No await between checking a live request and replying to its exact RPC id.
       assertActiveTurn(threadId, turnId);
       if (approvals.get(rpcKey(requestId)) !== approval) throw new CodexAppServerError('CODEX_APPROVAL_MISMATCH', 'approval was resolved');
       write({ id: requestId, result });
       approval.status = 'submitted';
+      approval.params = redactMcpUrlInteraction(approval).params;
       changed('approval.submitted', { executorId, threadId, turnId, requestId, decision });
       return { executorId, threadId, turnId, requestId, decision, status: 'submitted' };
     }