@murphai/murph 1.2.0 → 1.2.3

package/node_modules/@murphai/assistant-engine/dist/assistant-codex.js

@@ -1,15 +1,18 @@
 import { spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { mkdtemp, readFile, rm, stat } from 'node:fs/promises';
+import { mkdtemp, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
+import { HOSTED_CLI_BRIDGE_TOKEN_ENV } from '@murphai/hosted-execution/cli-runtime-bridge';
 import { normalizeNullableString } from '@murphai/operator-config/text/shared';
 import { VaultCliError } from '@murphai/operator-config/vault-cli-errors';
-import { extractAssistantMessageFallback, extractCodexErrorInfo, extractCodexErrorMessage, extractCodexCompletedFinalAgentMessageTextFromNormalized, extractCodexProgressEventFromNormalized, isCodexCompletedUserMessageItemFromNormalized, extractCodexSessionId, extractCodexStatusEventFromStderrLine, extractCodexTraceUpdatesFromNormalized, extractCodexCurrentChannelProgressTextFromNormalized, normalizeCodexEvent, normalizeStreamingText, } from './assistant-codex-events.js';
+import { readHostedCanonicalWritePort, withHostedCanonicalWritePort, } from '@murphai/core';
+import { registerStopWarmCodexAppServer } from './codex-lifecycle.js';
+import { extractAssistantMessageFallback, extractCodexErrorInfo, extractCodexErrorMessage, extractCodexCompletedFinalAgentMessageTextFromNormalized, extractCodexProgressEventFromNormalized, isCodexCompletedUserMessageItemFromNormalized, extractCodexStatusEventFromStderrLine, extractCodexTraceUpdatesFromNormalized, extractCodexContextCompactionProgressTextFromNormalized, normalizeCodexEvent, normalizeStreamingText, } from './assistant-codex-events.js';
 import { buildCodexTurnInterruptParams, buildCodexThreadResumeParams, buildCodexThreadStartParams, buildCodexTurnSteerParams, buildCodexTurnStartParams, mapCodexAppServerApprovalPolicy, mapCodexAppServerSandboxMode, resolveSupportedCodexAppServerApprovalPolicy, } from './assistant-codex/app-server-requests.js';
 import { buildRuntimeIssueInputForFailedCodexAction, createCodexActionDiagnosticsReducer, } from './assistant-codex/action-diagnostics.js';
-import { executeMurphDynamicToolRequest, isComputerDynamicToolRequest, readMurphDynamicToolRequest, } from './assistant-codex/dynamic-tools.js';
-import { attachCodexAppServerProcessExitCleanup, attachCodexAbortListener, consumeCompleteLines, denyUnsupportedCodexServerRequest, readCodexRpcResponseId, readCodexRpcServerRequestId, rejectPendingCodexRpcRequests, resolvePendingCodexRpcRequest, signalCodexAppServerChild, stopCodexAppServerChild, stripUndefinedRpcParams, tryParseJsonLine, waitForCodexSpawn, withCodexRpcTimeout, writeCodexRpcMessage, } from './assistant-codex/app-server-rpc.js';
+import { executeMurphDynamicToolRequest, isComputerDynamicToolRequest, MURPH_ASSISTANT_STYLE_TOOL, readMurphDynamicToolRequest, } from './assistant-codex/dynamic-tools.js';
+import { attachCodexAppServerProcessExitCleanup, attachCodexAbortListener, consumeCompleteLines, denyUnsupportedCodexServerRequest, rejectCodexServerRequest, readCodexRpcResponseId, readCodexRpcServerRequestId, rejectPendingCodexRpcRequests, resolvePendingCodexRpcRequest, signalCodexAppServerChild, stopCodexAppServerChild, stripUndefinedRpcParams, tryParseJsonLine, waitForCodexSpawn, withCodexRpcTimeout, writeCodexRpcMessage, } from './assistant-codex/app-server-rpc.js';
 import { resolveCodexChildEnv, withHostedCodexModelCatalogConfigOverride, } from './assistant-codex/config.js';
 import { buildCodexProcessExitError, buildCodexStdinFailureFallback, buildCodexTurnFailedError, extractCodexThreadIdFromMessage, extractCodexThreadIdFromResult, extractCodexThreadPathFromResult, extractCodexTurnErrorMessage, extractCodexTurnIdFromMessage, extractCodexTurnIdFromResult, extractCodexTurnStatus, isFailedCodexTurnStatus, readNodeErrorCode, } from './assistant-codex/failures.js';
 import { extractCodexSubagentUsageDrafts, isAssistantCodexTokenUsageEventType, readCodexCollabReceiverThreadIds, } from './assistant/providers/helpers.js';
@@ -22,6 +25,7 @@ const CODEX_RPC_CLIENT_NAME = 'murph';
 const CODEX_RPC_CLIENT_TITLE = 'Murph';
 const CODEX_RPC_CLIENT_VERSION = '1.0.0';
 const CODEX_RPC_DEFAULT_TIMEOUT_MS = 120_000;
+const HOSTED_CODEX_BACKGROUND_TERMINAL_CLEANUP_TIMEOUT_MS = 5_000;
 const CODEX_RPC_STEER_TIMEOUT_MS = 15_000;
 const CODEX_APP_SERVER_INTERRUPT_CLEANUP_TIMEOUT_MS = 15_000;
 const CODEX_MANAGED_ACCOUNT_LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
@@ -32,6 +36,8 @@ const CODEX_MANAGED_ACCOUNT_CONFIG_OVERRIDES = [
 const CODEX_APP_SERVER_COMMAND = 'app-server';
 const CODEX_APP_SERVER_TIMING_TRACE_SCHEMA = 'murph.assistant-codex-app-server-timing.v1';
 const CODEX_APP_SERVER_TIMING_TRACE_TYPE = 'assistant.codex.app_server_timing';
+const CODEX_TRANSPORT_DIAGNOSTICS_TRACE_SCHEMA = 'murph.assistant-codex-transport-diagnostics.v1';
+const CODEX_TRANSPORT_DIAGNOSTICS_TRACE_TYPE = 'assistant.codex.transport_diagnostics';
 const CODEX_APP_SERVER_STARTUP_STDERR_MAX_LENGTH = 16_384;
 // Bound on distinct subagent threads whose token usage is tracked per parent
 // turn. Far above any sane spawn fan-out; threads past the cap are counted
@@ -46,9 +52,9 @@ function prepareCodexRpcParams(method, params) {
     }
     return stripped;
 }
-// The 0.135 app-server reports compaction completion to v2 clients as a
-// contextCompaction item; `thread/compacted` is the legacy fan-out kept for
-// protocol drift tolerance.
+// Modern app-server clients receive compaction lifecycle as contextCompaction
+// items; `thread/compacted` is the legacy fan-out kept for protocol drift
+// tolerance.
 function isCodexContextCompactionStarted(message) {
     const method = typeof message.method === 'string' ? message.method : null;
     if (method !== 'item/started' && method !== 'item.started') {
@@ -136,19 +142,6 @@ async function waitForCodexProgressDrain(pending) {
     }
     await Promise.allSettled(pending);
 }
-function resolveCodexCurrentChannelProgressSource(normalizedEvent) {
-    if (normalizedEvent.kind === 'assistant_message' &&
-        normalizedEvent.itemState === 'completed' &&
-        normalizedEvent.messagePhase === 'commentary') {
-        return 'model';
-    }
-    if (normalizedEvent.kind === 'status_item' &&
-        normalizedEvent.itemType === 'context.compaction' &&
-        normalizedEvent.itemState === 'running') {
-        return 'system';
-    }
-    return null;
-}
 const CODEX_APP_SERVER_TURN_FAILURE_CONTEXT = Symbol('codexAppServerTurnFailureContext');
 const codexAppServerTurnFailureContexts = new WeakMap();
 export function readCodexAppServerTurnFailureContext(error) {
@@ -169,9 +162,9 @@ export function readCodexAppServerTurnFailureContext(error) {
             ...context.acceptedNoReplyDeliveryContextOrdinals,
         ],
         reactions: (context.reactions ?? []).map((entry) => ({ ...entry })),
-        codexThreadHistoryUnsafe: context.codexThreadHistoryUnsafe,
         codexThreadId: context.codexThreadId,
         providerTurnId: context.providerTurnId,
+        rolloutRelativePath: context.rolloutRelativePath,
     };
 }
 export function buildCodexAppServerSteerRequest(input) {
@@ -180,7 +173,14 @@ export function buildCodexAppServerSteerRequest(input) {
         params: buildCodexTurnSteerParams(input),
     };
 }
+function appendRequiredVaultFileApprovalUrls(message, approvalUrls) {
+    return [
+        normalizeNullableString(message),
+        ...approvalUrls,
+    ].filter((part) => part !== null).join('\n\n');
+}
 export async function executeCodexAppServerTurn(input) {
+    assertCodexAppServerPermissionRequest(input);
     const approvalPolicy = resolveSupportedCodexAppServerApprovalPolicy(input.approvalPolicy);
     const workingDirectory = path.resolve(input.workingDirectory);
     await assertCodexAppServerWorkingDirectory(workingDirectory);
@@ -201,6 +201,7 @@ export async function executeCodexAppServerTurn(input) {
             configOverrides: input.configOverrides,
             env: input.env,
         }),
+        runtimeWorkspaceRoots: input.runtimeWorkspaceRoots?.map((root) => path.resolve(root)),
     };
     const args = buildCodexAppServerArgs(normalizedInput);
     const launchKey = buildCodexAppServerLaunchKey({
@@ -212,7 +213,6 @@ export async function executeCodexAppServerTurn(input) {
     const preparedInput = {
         ...normalizedInput,
         args,
-        loadAuthorizedReferenceImageRefs: input.loadAuthorizedReferenceImageRefs ?? null,
         codexCommand,
         env: childEnv,
         fetchImpl: input.fetchImpl ?? fetch,
@@ -225,19 +225,55 @@ export async function executeCodexAppServerTurn(input) {
         voiceMemoRuntime: input.voiceMemoRuntime ?? null,
         workingDirectory,
     };
+    let oneShotProcess = null;
     try {
+        if (preparedInput.processLifetime === 'one-shot') {
+            oneShotProcess = new CodexAppServerProcess({
+                args: preparedInput.args,
+                codexCommand: preparedInput.codexCommand,
+                coldStartReason: 'node-process-first-use',
+                env: preparedInput.env,
+                launchKey: preparedInput.launchKey,
+            });
+            oneShotProcess.reserveTurn();
+            return await runCodexAppServerTurnOnProcess(oneShotProcess, preparedInput);
+        }
         const processInstance = await getOrStartWarmCodexProcess(preparedInput);
+        return await runCodexAppServerTurnOnProcess(processInstance, preparedInput);
+    }
+    finally {
         try {
-            return await runCodexAppServerTurnOnProcess(processInstance, preparedInput);
+            await oneShotProcess?.stop('one-shot-complete');
         }
         finally {
-            clearWarmCodexProcessIfUnusable(processInstance);
+            await rm(tempRoot, {
+                recursive: true,
+                force: true,
+            });
         }
     }
-    finally {
-        await rm(tempRoot, {
-            recursive: true,
-            force: true,
+}
+function assertCodexAppServerPermissionRequest(input) {
+    const permissions = normalizeNullableString(input.permissions);
+    if (!permissions) {
+        return;
+    }
+    const invalidFields = [
+        ...(input.sandbox ? ['sandbox'] : []),
+        ...(normalizeNullableString(input.resumeSessionId) ? ['resumeSessionId'] : []),
+        ...(input.ephemeral === true ? [] : ['ephemeral']),
+        ...(input.processLifetime === 'one-shot' ? [] : ['processLifetime']),
+    ];
+    if (invalidFields.length > 0) {
+        throw new VaultCliError('ASSISTANT_CODEX_APP_SERVER_REQUEST_INVALID', 'Named Codex permissions require a fresh ephemeral thread in a one-shot process without a legacy sandbox.', {
+            invalidFields,
+            retryable: false,
+        });
+    }
+    if (!input.runtimeWorkspaceRoots || input.runtimeWorkspaceRoots.length === 0) {
+        throw new VaultCliError('ASSISTANT_CODEX_APP_SERVER_REQUEST_INVALID', 'Named Codex permissions require at least one explicit runtime workspace root.', {
+            invalidFields: ['runtimeWorkspaceRoots'],
+            retryable: false,
         });
     }
 }
@@ -289,19 +325,21 @@ export function buildCodexAppServerArgs(input) {
 }
 class CodexAppServerProcess {
     child;
+    coldStartReason;
     launchKey;
     pendingRequests = new Map();
     processGroupPid;
     startedAt = Date.now();
     activeTurn = null;
     boundThreadId = null;
+    boundThreadModel = null;
     boundThreadServiceTier = null;
     cleanupProcessExitListener;
-    completedTurnCount = 0;
     lastThreadTokenUsage = null;
     codexCommand;
     ignoredResponseIds = new Set();
     initialized = false;
+    endReason = null;
     nextRequestId = 1;
     normalShutdown = false;
     poisoned = false;
@@ -313,12 +351,19 @@ class CodexAppServerProcess {
     stdinFailure = null;
     stdoutBuffer = '';
     stopPromise = null;
+    postTurnCleanupPromise = null;
     constructor(input) {
         this.codexCommand = input.codexCommand;
+        this.coldStartReason = input.coldStartReason;
         this.launchKey = input.launchKey;
         const useProcessGroup = process.platform !== 'win32';
+        // The warm app-server outlives hosted workspace restores, which delete and
+        // recreate the workspace path between invocations. A process anchored to
+        // that directory keeps a dead cwd inode, and Codex config loading then
+        // fails with ENOENT on the next thread/start. Threads receive the real
+        // workspace via the explicit per-thread `cwd` param instead.
         this.child = spawn(input.codexCommand, [...input.args], {
-            cwd: input.workingDirectory,
+            cwd: tmpdir(),
             detached: useProcessGroup,
             env: input.env,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -339,6 +384,14 @@ class CodexAppServerProcess {
         this.child.stderr.on('data', (chunk) => {
             this.handleStderrData(String(chunk));
         });
+        this.child.on('exit', () => {
+            // `exit` precedes `close`; claim the cause and sweep the exact owned
+            // group before a descendant can keep an inherited stream open forever.
+            if (!this.normalShutdown) {
+                this.endReason ??= 'previous-process-exit';
+                this.signal('SIGKILL');
+            }
+        });
         this.child.on('close', (code, signal) => {
             this.handleClose(code, signal);
         });
@@ -349,12 +402,21 @@ class CodexAppServerProcess {
     get processLifetimeMs() {
         return Math.max(0, Date.now() - this.startedAt);
     }
-    get requiresCompleteTurnCorrelation() {
-        return this.completedTurnCount > 0;
+    get nextColdStartReason() {
+        return this.endReason ?? 'previous-process-unhealthy';
+    }
+    get recordedEndReason() {
+        return this.endReason;
+    }
+    noteTurnAbort() {
+        this.endReason ??= 'previous-turn-abort';
     }
     get hasInFlightTurn() {
         return this.state === 'reserved' || this.state === 'running';
     }
+    get pendingPostTurnCleanup() {
+        return this.postTurnCleanupPromise;
+    }
     reserveTurn() {
         if (this.state !== 'idle' ||
             this.activeTurn ||
@@ -384,7 +446,6 @@ class CodexAppServerProcess {
         this.activeTurn = null;
         if (this.state === 'running') {
             this.state = 'idle';
-            this.completedTurnCount += 1;
         }
     }
     releaseReservation() {
@@ -392,6 +453,33 @@ class CodexAppServerProcess {
             this.state = 'idle';
         }
     }
+    beginHostedBackgroundTerminalCleanup(input) {
+        if (this.activeTurn !== input.binding || this.state !== 'running') {
+            throw this.buildBusyError('Codex app-server cannot start post-turn cleanup outside its completed turn.');
+        }
+        // Keep the process unavailable while cleanup runs, but detach the completed
+        // turn so its provider result can proceed to durable reply delivery.
+        this.activeTurn = null;
+        this.state = 'cleanup';
+        const cleanup = withCodexRpcTimeout(this.sendRequest('thread/backgroundTerminals/clean', {
+            threadId: input.threadId,
+        }), HOSTED_CODEX_BACKGROUND_TERMINAL_CLEANUP_TIMEOUT_MS, 'thread/backgroundTerminals/clean').then(() => undefined, async (error) => {
+            // Clear the timed-out RPC before stopping the exact owned process
+            // group. A cleanup failure never turns a completed reply into a
+            // provider failure, but the process must not become reusable.
+            this.rejectPending(error);
+            await this.poison('background-terminal-cleanup-failed');
+        }).finally(() => {
+            if (this.state === 'cleanup') {
+                this.state = 'idle';
+            }
+            if (this.postTurnCleanupPromise === cleanup) {
+                this.postTurnCleanupPromise = null;
+            }
+        });
+        this.postTurnCleanupPromise = cleanup;
+        return cleanup;
+    }
     buildBusyError(message = 'Codex app-server process is not idle.') {
         return new VaultCliError('ASSISTANT_CODEX_APP_SERVER_BUSY', message, {
             retryable: true,
@@ -483,21 +571,27 @@ class CodexAppServerProcess {
         });
     }
     async stop(reason) {
-        if (this.stopCompleted) {
+        if (this.stopPromise) {
+            await this.stopPromise;
             return;
         }
-        // Memoized so detached kills (idle-compaction abort) and a racing turn's
-        // replacement stop share one teardown instead of double-signaling; an
-        // unsuccessful teardown clears the memo so later callers retry, matching
-        // the pre-memoization semantics.
-        this.stopPromise ??= this.runStop(reason).finally(() => {
-            if (!this.stopCompleted) {
-                this.stopPromise = null;
-            }
+        if (this.stopCompleted || this.state === 'stopped') {
+            return;
+        }
+        // Memoized while in flight so concurrent callers (a failed compaction's
+        // poison and a racing turn's replacement stop) share one teardown instead
+        // of double-signaling. Once settled, later calls either observe the stopped
+        // state or retry an unsuccessful teardown.
+        this.stopPromise = this.runStop(reason).finally(() => {
+            this.stopPromise = null;
         });
         await this.stopPromise;
     }
-    async runStop(_reason) {
+    async runStop(reason) {
+        this.endReason ??= resolveCodexAppServerEndReason(reason);
+        if (this.state === 'cleanup') {
+            this.rejectPending(new VaultCliError('ASSISTANT_CODEX_APP_SERVER_STOPPED_DURING_CLEANUP', 'Codex app-server stopped during post-turn cleanup.', { retryable: true }));
+        }
         this.normalShutdown = true;
         this.state = 'stopping';
         let stopped = false;
@@ -539,29 +633,6 @@ class CodexAppServerProcess {
             this.child.exitCode === null &&
             this.child.signalCode === null);
     }
-    async snapshotExpectedRootProcess() {
-        const pid = this.child.pid;
-        if (typeof pid !== 'number' ||
-            !Number.isSafeInteger(pid) ||
-            pid <= 0 ||
-            this.child.exitCode !== null ||
-            this.child.signalCode !== null) {
-            return null;
-        }
-        const procState = await readCodexProcState(pid);
-        if (!procState?.commandLineDigest ||
-            !procState?.startTimeTicksFromProcStat) {
-            return null;
-        }
-        return {
-            commandLineDigest: procState.commandLineDigest,
-            owner: 'codex-app-server',
-            pid,
-            processGroupId: this.processGroupPid,
-            startTimeTicksFromProcStat: procState.startTimeTicksFromProcStat,
-            uid: procState.uid,
-        };
-    }
     closeStdin() {
         if (this.stdinFailure) {
             return this.stdinFailure;
@@ -593,7 +664,7 @@ class CodexAppServerProcess {
         const failure = this.stdinFailure ??
             this.activeTurn?.onStdinError(error) ??
             buildCodexProcessExitError({
-                abortRequested: false,
+                abortOwnsTermination: false,
                 code: this.child.exitCode,
                 diagnostics: this.buildStartupProcessDiagnostics(),
                 errorInfo: null,
@@ -678,13 +749,13 @@ class CodexAppServerProcess {
         }
         this.lastThreadTokenUsage = {
             lastInputTokens,
+            model: this.boundThreadModel,
             serviceTier: this.boundThreadServiceTier,
             threadId: update.threadId,
         };
     }
-    // The most recent thread this process ran a turn for. Used between turns
-    // to tell subagent-thread notifications apart from same-thread output
-    // contamination, which must still poison the warm process.
+    // The most recent parent thread this process ran. A freshly bound turn can
+    // use it to route late child-thread traffic before thread/start returns.
     noteBoundThreadId(threadId) {
         if (threadId) {
             this.boundThreadId = threadId;
@@ -693,34 +764,36 @@ class CodexAppServerProcess {
     noteBoundThreadServiceTier(serviceTier) {
         this.boundThreadServiceTier = serviceTier;
     }
+    noteBoundThreadModel(model) {
+        this.boundThreadModel = normalizeNullableString(model);
+    }
     // Exposed so a freshly bound turn can route foreign-thread events before
     // its own thread/start response has produced the new thread id.
     get lastBoundThreadId() {
         return this.boundThreadId;
     }
-    // Subagent threads can outlive the parent turn: codex broadcasts their
-    // thread-scoped notifications on this connection even when no turn is
-    // active. Tolerate (and never bill) those between turns; deny their server
-    // requests so the child does not hang. Idle output for the bound thread
-    // keeps poisoning so the contamination guard is unchanged.
-    shouldTolerateIdleSubagentMessage(message) {
-        const messageThreadId = extractCodexThreadIdFromMessage(message);
-        if (messageThreadId === null ||
-            this.boundThreadId === null ||
-            messageThreadId === this.boundThreadId) {
-            return false;
+    handleIdleServerMessage(message) {
+        const responseId = readCodexRpcResponseId(message);
+        if (responseId !== null) {
+            const resolved = resolvePendingCodexRpcRequest({
+                message,
+                pendingRequests: this.pendingRequests,
+                responseId,
+            });
+            if (resolved === 'unknown_response_id') {
+                this.consumeIgnoredResponseId(responseId);
+            }
+            return;
         }
         const requestId = readCodexRpcServerRequestId(message);
-        if (requestId !== null) {
-            void this.writeRpcMessage({
-                id: requestId,
-                error: {
-                    code: -32000,
-                    message: 'Server requests from codex subagent threads are not supported.',
-                },
-            });
+        if (requestId === null) {
+            return;
         }
-        return true;
+        rejectCodexServerRequest({
+            message: 'Server requests outside an active Codex turn are not supported.',
+            requestId,
+            writeRpcMessage: (payload) => void this.writeRpcMessage(payload),
+        });
     }
     handleStdoutLine(line) {
         const parsed = tryParseJsonLine(line);
@@ -729,9 +802,8 @@ class CodexAppServerProcess {
             if (this.activeTurn) {
                 this.activeTurn.onParsedMessage(parsed.value);
             }
-            else if (line.trim().length > 0 &&
-                !this.shouldTolerateIdleSubagentMessage(parsed.value)) {
-                void this.poison('off-turn-output');
+            else {
+                this.handleIdleServerMessage(parsed.value);
             }
             return;
         }
@@ -743,7 +815,8 @@ class CodexAppServerProcess {
             this.activeTurn.onFramingError(line);
             return;
         }
-        void this.poison('off-turn-framing-error');
+        // Codex may emit lifecycle text while no Murph turn is bound. Do not kill
+        // the resident app-server for output that cannot affect the current user.
     }
     handleClose(code, signal) {
         if (this.stderrBuffer.trim().length > 0) {
@@ -756,6 +829,10 @@ class CodexAppServerProcess {
         this.stdoutBuffer = '';
         if (!this.normalShutdown) {
             this.poisoned = true;
+            this.endReason ??= 'previous-process-exit';
+            // Retain the exact-group signal as an idempotent fallback before
+            // releasing parent-exit cleanup.
+            this.signal('SIGKILL');
         }
         this.state = 'stopped';
         this.cleanupProcessExitListener();
@@ -767,7 +844,7 @@ class CodexAppServerProcess {
             return;
         }
         const failure = buildCodexProcessExitError({
-            abortRequested: false,
+            abortOwnsTermination: false,
             code,
             diagnostics: this.buildStartupProcessDiagnostics(),
             errorInfo: null,
@@ -806,7 +883,7 @@ class CodexAppServerProcess {
         if (spawnClosedBeforeReady &&
             (this.child.exitCode !== null || this.child.signalCode !== null)) {
             return buildCodexProcessExitError({
-                abortRequested: false,
+                abortOwnsTermination: false,
                 code: this.child.exitCode,
                 diagnostics: this.buildStartupProcessDiagnostics(),
                 errorInfo: null,
@@ -825,8 +902,36 @@ class CodexAppServerProcess {
         }
     }
 }
+function resolveCodexAppServerEndReason(reason) {
+    switch (reason) {
+        case 'idle-compaction-failed':
+            return 'previous-idle-compaction-failure';
+        case 'launch-identity-changed':
+            return 'previous-launch-identity-change';
+        case 'process-exited':
+            return 'previous-process-exit';
+        case 'process-unhealthy':
+            return 'previous-process-unhealthy';
+        case 'turn-completed-after-abort':
+            return 'previous-turn-abort';
+        case 'turn-failure':
+            return 'previous-turn-failure';
+        default:
+            return 'previous-explicit-stop';
+    }
+}
 let warmCodexProcess = null;
 let warmCodexSlotLock = Promise.resolve();
+const hostedCodexPostTurnCleanupBarriers = new Set();
+function trackHostedCodexPostTurnCleanup(cleanup) {
+    hostedCodexPostTurnCleanupBarriers.add(cleanup);
+    void cleanup.finally(() => {
+        hostedCodexPostTurnCleanupBarriers.delete(cleanup);
+    });
+}
+export async function drainHostedCodexPostTurnCleanups() {
+    await Promise.all([...hostedCodexPostTurnCleanupBarriers]);
+}
 async function withWarmCodexSlotLock(operation) {
     const previous = warmCodexSlotLock;
     let release;
@@ -844,30 +949,36 @@ async function withWarmCodexSlotLock(operation) {
 async function getOrStartWarmCodexProcess(input) {
     const launchKey = input.launchKey;
     return await withWarmCodexSlotLock(async () => {
+        await warmCodexProcess?.pendingPostTurnCleanup;
         if (warmCodexProcess?.isReusableFor(launchKey)) {
             warmCodexProcess.reserveTurn();
             return warmCodexProcess;
         }
-        if (warmCodexProcess) {
-            if (warmCodexProcess.hasInFlightTurn) {
-                throw warmCodexProcess.buildBusyError('Codex app-server process is already serving a turn.');
+        const previousProcess = warmCodexProcess;
+        let coldStartReason = 'node-process-first-use';
+        if (previousProcess) {
+            if (previousProcess.hasInFlightTurn) {
+                throw previousProcess.buildBusyError('Codex app-server process is already serving a turn.');
             }
-            await warmCodexProcess.stop('identity-or-health-mismatch');
-            warmCodexProcess = null;
-        }
-        warmCodexProcess = new CodexAppServerProcess(input);
+            const processExited = previousProcess.child.exitCode !== null ||
+                previousProcess.child.signalCode !== null;
+            const stopReason = processExited
+                ? 'process-exited'
+                : previousProcess.launchKey !== launchKey
+                    ? 'launch-identity-changed'
+                    : 'process-unhealthy';
+            await previousProcess.stop(stopReason);
+            coldStartReason = previousProcess.nextColdStartReason;
+        }
+        const processInstance = new CodexAppServerProcess({
+            ...input,
+            coldStartReason,
+        });
+        warmCodexProcess = processInstance;
         warmCodexProcess.reserveTurn();
         return warmCodexProcess;
     });
 }
-function clearWarmCodexProcessIfUnusable(processInstance) {
-    const launchKey = processInstance.launchKey;
-    if (warmCodexProcess === processInstance &&
-        !processInstance.isReusableFor(launchKey) &&
-        (processInstance.child.exitCode !== null || processInstance.child.signalCode !== null)) {
-        warmCodexProcess = null;
-    }
-}
 export async function stopWarmCodexAppServer(reason = 'external-stop') {
     await withWarmCodexSlotLock(async () => {
         const processInstance = warmCodexProcess;
@@ -878,11 +989,9 @@ export async function stopWarmCodexAppServer(reason = 'external-stop') {
             throw processInstance.buildBusyError('Codex app-server process is serving a turn and cannot be stopped directly.');
         }
         await processInstance.stop(reason);
-        if (warmCodexProcess === processInstance) {
-            warmCodexProcess = null;
-        }
     });
 }
+registerStopWarmCodexAppServer(stopWarmCodexAppServer);
 /**
  * Runs one managed ChatGPT account operation through the same app-server
  * transport used by turns. The child is intentionally short lived: account
@@ -912,7 +1021,6 @@ export async function executeCodexManagedAccountOperation(input) {
         codexCommand,
         env,
         launchKey,
-        workingDirectory,
     });
     let settleAccountUpdate;
     let rejectAccountUpdate;
@@ -1081,11 +1189,6 @@ export async function executeCodexManagedAccountOperation(input) {
         processInstance.releaseTurn(binding);
         processInstance.releaseReservation();
         await processInstance.stop('managed-account-operation-complete').catch(() => undefined);
-        await withWarmCodexSlotLock(async () => {
-            if (warmCodexProcess === processInstance) {
-                warmCodexProcess = null;
-            }
-        });
     }
 }
 async function readCodexManagedAccount(processInstance) {
@@ -1102,7 +1205,7 @@ function normalizeCodexManagedAccountTimeout(value) {
         : CODEX_MANAGED_ACCOUNT_LOGIN_TIMEOUT_MS;
 }
 function estimateCodexWarmThreadCompactionUsage(threadContextTokensBefore) {
-    // Codex 0.135 compact_remote_v2 consumes the provider response without
+    // Codex idle compaction consumes the provider response without
     // surfacing ResponseEvent::Completed.token_usage, then emits a recomputed
     // post-compact context-size update whose request input/output buckets are
     // zero. Until Codex surfaces real compact request usage, store the
@@ -1178,11 +1281,9 @@ function readCodexUsageNumber(value, camelKey, snakeKey) {
 // deliberately blunt: any non-success poisons (kills) the warm process, which
 // is always safe because rollouts only contain completed entries — an aborted
 // compact leaves the thread uncompacted and the next turn spawns a fresh
-// process and resumes natively. A pending wake therefore never waits on the
-// in-flight provider call or the compact timeout; it is bounded only by the
-// old process's kill teardown (SIGTERM, 3s ceiling, then SIGKILL — typically
-// milliseconds), which the next turn must join via the memoized stop because
-// two app-server processes must never write the same rollout concurrently.
+// process and resumes natively. Teardown is awaited on every failure path
+// because the idle checkpoint that follows snapshots the Codex home,
+// including rollout files, and must never capture a rollout mid-teardown.
 export async function compactWarmCodexThread(input) {
     const reservation = await withWarmCodexSlotLock(async () => {
         const processInstance = warmCodexProcess;
@@ -1195,6 +1296,14 @@ export async function compactWarmCodexThread(input) {
         if (!vitals) {
             return { kind: 'skipped', reason: 'no_thread_vitals', threadContextTokensBefore: null };
         }
+        if (input.canAccountForModel && !input.canAccountForModel(vitals.model)) {
+            return {
+                kind: 'skipped',
+                model: vitals.model,
+                reason: 'model_not_accountable',
+                threadContextTokensBefore: vitals.lastInputTokens,
+            };
+        }
         if (vitals.lastInputTokens < input.minThreadTokens) {
             return {
                 kind: 'skipped',
@@ -1253,7 +1362,17 @@ export async function compactWarmCodexThread(input) {
                 }
                 return;
             }
-            if (processInstance.shouldTolerateIdleSubagentMessage(message)) {
+            const requestId = readCodexRpcServerRequestId(message);
+            if (requestId !== null) {
+                rejectCodexServerRequest({
+                    message: 'Server requests during idle Codex compaction are not supported.',
+                    requestId,
+                    writeRpcMessage: (payload) => void processInstance.writeRpcMessage(payload),
+                });
+                return;
+            }
+            const messageThreadId = extractCodexThreadIdFromMessage(message);
+            if (messageThreadId !== null && messageThreadId !== vitals.threadId) {
                 return;
             }
             const update = readCodexThreadTokenUsageUpdate(message);
@@ -1338,6 +1457,7 @@ export async function compactWarmCodexThread(input) {
             return {
                 kind: 'compacted',
                 durationMs: Date.now() - startedAt,
+                model: vitals.model,
                 threadContextTokensBefore: vitals.lastInputTokens,
                 threadId: vitals.threadId,
                 serviceTier: vitals.serviceTier,
@@ -1345,19 +1465,7 @@ export async function compactWarmCodexThread(input) {
                     ?? estimateCodexWarmThreadCompactionUsage(vitals.lastInputTokens),
             };
         }
-        // Abort (pending wake or shutdown) detaches teardown: poison() flags the
-        // process unusable synchronously and SIGTERM->SIGKILL completes out of
-        // band; a racing turn joins it via the memoized stop (3s ceiling,
-        // typically milliseconds) and never waits on the provider call or the
-        // compact timeout. Non-abort failures (timeout/rpc_error/process_exit)
-        // have no wake racing and an idle checkpoint next, so they await
-        // teardown — the snapshot must never capture a rollout mid-teardown.
-        if (settledReason === 'aborted') {
-            void processInstance.poison('idle-compaction-failed');
-        }
-        else {
-            await processInstance.poison('idle-compaction-failed');
-        }
+        await processInstance.poison('idle-compaction-failed');
         return {
             kind: 'failed',
             reason: settledReason,
@@ -1381,20 +1489,8 @@ export async function compactWarmCodexThread(input) {
         input.signal?.removeEventListener('abort', onAbort);
         processInstance.releaseTurn(binding);
         processInstance.releaseReservation();
-        await withWarmCodexSlotLock(async () => {
-            clearWarmCodexProcessIfUnusable(processInstance);
-        });
     }
 }
-export async function snapshotExpectedCodexRootProcess() {
-    return await withWarmCodexSlotLock(async () => {
-        const processInstance = warmCodexProcess;
-        if (!processInstance?.isReusableFor(processInstance.launchKey)) {
-            return null;
-        }
-        return await processInstance.snapshotExpectedRootProcess();
-    });
-}
 function hashCodexRawString(value) {
     return createHash('sha256')
         .update(value)
@@ -1409,70 +1505,138 @@ function readCodexEventMethod(message) {
                 ? message.event
                 : null;
 }
-function codexEventMethodRequiresTurnCorrelation(method) {
-    const normalizedMethod = normalizeNullableString(method);
-    if (!normalizedMethod) {
-        return true;
-    }
-    return (normalizedMethod === 'error' ||
-        normalizedMethod === 'thread/compacted' ||
-        isCodexThreadTokenUsageUpdatedMethod(normalizedMethod) ||
-        normalizedMethod.startsWith('turn/') ||
-        normalizedMethod.startsWith('item/') ||
-        normalizedMethod.startsWith('rawResponseItem/') ||
-        normalizedMethod.startsWith('command/exec/') ||
-        normalizedMethod.startsWith('process/') ||
-        normalizedMethod.startsWith('model/') ||
-        normalizedMethod.startsWith('turn.') ||
-        normalizedMethod.startsWith('item.') ||
-        normalizedMethod.startsWith('rawResponseItem.') ||
-        normalizedMethod.startsWith('command.exec.') ||
-        normalizedMethod.startsWith('process.') ||
-        normalizedMethod.startsWith('model.') ||
-        normalizedMethod.includes('assistant.message.delta') ||
-        normalizedMethod.includes('agent.message.delta'));
-}
 function isCodexTurnStartedMethod(method) {
     return method === 'turn/started' || method === 'turn.started';
 }
 function isCodexTurnCompletedMethod(method) {
     return method === 'turn/completed' || method === 'turn.completed';
 }
-async function readCodexProcState(pid) {
-    try {
-        const [cmdline, stat, status] = await Promise.all([
-            readFile(`/proc/${pid}/cmdline`, 'utf8').catch(() => null),
-            readFile(`/proc/${pid}/stat`, 'utf8'),
-            readFile(`/proc/${pid}/status`, 'utf8').catch(() => null),
-        ]);
+function buildCodexTransportDiagnosticsTraceEvent(input) {
+    const source = readCodexTransportDiagnosticSource(input.message, input.method);
+    if (!source) {
+        return null;
+    }
+    const diagnosticText = [source.message, source.additionalDetails]
+        .filter((value) => typeof value === 'string')
+        .join('\n')
+        .slice(0, 4096);
+    const normalizedText = diagnosticText.toLowerCase();
+    const retryProgress = readCodexTransportRetryProgress(diagnosticText);
+    const fallbackActivated = normalizedText.includes('falling back from websockets to https transport');
+    const idleTimeout = normalizedText.includes('idle timeout waiting for websocket') ||
+        normalizedText.includes('idle timeout waiting for sse');
+    const streamDisconnected = normalizedText.includes('stream disconnected') ||
+        normalizedText.includes('response stream disconnected');
+    if (!fallbackActivated && !idleTimeout && !streamDisconnected && !retryProgress) {
+        return null;
+    }
+    const transport = normalizedText.includes('websocket')
+        ? 'websocket'
+        : normalizedText.includes('https') ||
+            normalizedText.includes('http') ||
+            normalizedText.includes('sse')
+            ? 'http'
+            : 'unknown';
+    const eventKind = fallbackActivated
+        ? 'transport-fallback'
+        : idleTimeout
+            ? 'stream-idle-timeout'
+            : retryProgress
+                ? 'stream-retry'
+                : 'stream-disconnected';
+    const terminalStreamFailure = source.willRetry === false && (idleTimeout || streamDisconnected);
+    return {
+        schema: CODEX_TRANSPORT_DIAGNOSTICS_TRACE_SCHEMA,
+        type: CODEX_TRANSPORT_DIAGNOSTICS_TRACE_TYPE,
+        codexTransportAdditionalDetailsPresent: source.additionalDetails !== null,
+        codexTransportErrorMessageLength: diagnosticText.length,
+        codexTransportErrorMessagePresent: source.message.length > 0,
+        codexTransportEventKind: eventKind,
+        codexTransportFallbackActivated: fallbackActivated,
+        codexTransportIdleTimeout: idleTimeout,
+        codexTransportProviderActionCount: input.providerActionCount,
+        codexTransportRetryCount: retryProgress?.retryCount ?? null,
+        codexTransportRetryMax: retryProgress?.retryMax ?? null,
+        codexTransportRetryExhausted: terminalStreamFailure,
+        codexTransportSourceMethod: source.sourceMethod,
+        codexTransportStreamDisconnected: streamDisconnected,
+        codexTransportTerminalAfterProviderAction: terminalStreamFailure && input.providerActionCount > 0,
+        codexTransportThreadIdPresent: source.threadIdPresent || input.codexThreadId !== null,
+        codexTransportTransport: transport,
+        codexTransportTurnIdPresent: source.turnIdPresent || input.turnId !== null,
+        codexTransportWillRetry: source.willRetry,
+    };
+}
+function readCodexTransportDiagnosticSource(message, method) {
+    const params = readCodexRecordField(message, 'params');
+    if (method === 'warning') {
+        const warningMessage = readCodexStringField(params, 'message');
+        if (!warningMessage) {
+            return null;
+        }
         return {
-            commandLineDigest: cmdline ? hashCodexRawString(cmdline) : null,
-            startTimeTicksFromProcStat: readCodexProcStartTimeTicks(stat),
-            uid: status ? readCodexProcUid(status) : null,
+            additionalDetails: null,
+            message: warningMessage,
+            sourceMethod: 'warning',
+            threadIdPresent: readCodexStringField(params, 'threadId') !== null,
+            turnIdPresent: false,
+            willRetry: null,
         };
     }
-    catch {
+    if (method !== 'error') {
+        return null;
+    }
+    const error = readCodexRecordField(params, 'error');
+    const errorMessage = readCodexStringField(error, 'message');
+    if (!errorMessage) {
+        return null;
+    }
+    return {
+        additionalDetails: readCodexStringField(error, 'additionalDetails'),
+        message: errorMessage,
+        sourceMethod: 'error',
+        threadIdPresent: readCodexStringField(params, 'threadId') !== null,
+        turnIdPresent: readCodexStringField(params, 'turnId') !== null,
+        willRetry: readCodexBooleanField(params, 'willRetry'),
+    };
+}
+function readCodexTransportRetryProgress(value) {
+    const match = /\bReconnecting\.\.\.\s+(\d+)\/(\d+)\b/iu.exec(value);
+    if (!match) {
         return null;
     }
+    const retryCount = Number(match[1]);
+    const retryMax = Number(match[2]);
+    return Number.isSafeInteger(retryCount) &&
+        retryCount >= 0 &&
+        Number.isSafeInteger(retryMax) &&
+        retryMax >= 0
+        ? { retryCount, retryMax }
+        : null;
 }
-function readCodexProcStartTimeTicks(stat) {
-    const commandEnd = stat.lastIndexOf(') ');
-    if (commandEnd === -1 || commandEnd + 2 >= stat.length) {
+function readCodexRecordField(value, key) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return null;
     }
-    const fields = stat.slice(commandEnd + 2).trim().split(/\s+/u);
-    const startTime = fields[19];
-    return typeof startTime === 'string' && /^[0-9]+$/u.test(startTime)
-        ? startTime
+    const fieldValue = value[key];
+    return fieldValue && typeof fieldValue === 'object' && !Array.isArray(fieldValue)
+        ? fieldValue
         : null;
 }
-function readCodexProcUid(status) {
-    const uidLine = status.split('\n').find((line) => line.startsWith('Uid:'));
-    const uidRaw = uidLine?.trim().split(/\s+/u)[1];
-    const uid = Number.parseInt(uidRaw ?? '', 10);
-    return Number.isInteger(uid) && uid >= 0 ? uid : null;
+function readCodexStringField(value, key) {
+    const fieldValue = value?.[key];
+    if (typeof fieldValue !== 'string') {
+        return null;
+    }
+    const normalized = fieldValue.trim();
+    return normalized.length > 0 ? normalized : null;
+}
+function readCodexBooleanField(value, key) {
+    const fieldValue = value?.[key];
+    return typeof fieldValue === 'boolean' ? fieldValue : null;
 }
 async function runCodexAppServerTurnOnProcess(codexProcess, input) {
+    const hostedCanonicalWritePort = readHostedCanonicalWritePort();
     let stdout = '';
     let stderr = '';
     let settled = false;
@@ -1480,25 +1644,28 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     let abortRequested = false;
     let lifecycleStage = 'spawn_start';
     let terminationSignalSent = null;
-    let codexThreadId = normalizeNullableString(input.resumeSessionId) ?? null;
+    const requestedResumeThreadId = normalizeNullableString(input.resumeSessionId) ?? null;
+    let codexThreadId = null;
     let turnId = null;
-    let expectedTurnId = null;
-    let lastAgentMessage = null;
+    const isReusedWarmProcess = codexProcess.initializedForRpc;
     // Completed final-phase agent messages that were followed by a steered
-    // user-message item and then superseded by a newer final message in the
-    // same turn. A closed segment is held as a candidate until a later final
-    // appears; if the turn ends at the steer boundary, that segment remains the
-    // final reply rather than a preceding duplicate.
+    // user-message item and then superseded by a newer response segment in the
+    // same turn. A closed segment is held as a candidate until newer text or
+    // media appears; if the turn ends at the steer boundary, that segment remains
+    // the final reply rather than a preceding duplicate.
     const precedingAgentMessageSegments = [];
     let completedFinalAgentMessage = null;
     let trailingSteerCandidate = null;
-    let trailingSteerCandidateDeliveryContextOrdinal = null;
-    let trailingSteerCandidateMedia = null;
     let completedUserMessageOrdinal = -1;
     let lastEventError = null;
     let lastEventErrorInfo = null;
     let responseMedia = [];
+    const assistantStyleSettingsOverlay = {
+        settings: {},
+    };
     let finalActionPatches = [];
+    const acceptedNoReplyDeliveryContextOrdinals = [];
+    let noReplySettlementStarted = false;
     let reactionPatches = [];
     const reservedNoReplyDeliveryContextOrdinals = new Set();
     const additionalUsages = [];
@@ -1515,6 +1682,7 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     const jsonEvents = [];
     const runtimeIssueInputs = [];
     let computerToolsLockedAfterUserPause = false;
+    const requiredVaultFileApprovalUrls = [];
     const actionDiagnostics = input.onTraceEvent
         ? createCodexActionDiagnosticsReducer()
         : null;
@@ -1525,6 +1693,8 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     const pendingExternallyVisibleAssistantOutputDeliveryContextCounts = new Map();
     let stdinFailure = null;
     let lastTimingAt = Date.now();
+    const codexAppServerTurnStartedAt = lastTimingAt;
+    const codexAppServerProviderStartTiming = {};
     let liveInterruptRequested = false;
     let completeTurn = null;
     let failTurn = null;
@@ -1537,7 +1707,6 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     const pendingProgressDeliveries = new Set();
     let dynamicToolExecutionChain = Promise.resolve();
     const dynamicToolAbortController = new AbortController();
-    const pendingPreStartMessages = [];
     const turnCompleted = new Promise((resolve, reject) => {
         completeTurn = resolve;
         failTurn = reject;
@@ -1562,6 +1731,24 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         stderrBytes: Buffer.byteLength(stderr, 'utf8'),
         terminationSignalSent,
     });
+    const buildRecordedTerminationError = (fallback) => {
+        const recordedEndReason = codexProcess.recordedEndReason;
+        if (recordedEndReason !== 'previous-process-exit' &&
+            recordedEndReason !== 'previous-turn-abort') {
+            return null;
+        }
+        return buildCodexProcessExitError({
+            abortOwnsTermination: recordedEndReason === 'previous-turn-abort',
+            code: codexProcess.child.exitCode,
+            diagnostics: buildProcessExitDiagnostics(),
+            errorInfo: lastEventErrorInfo,
+            fallback,
+            providerActionCount,
+            codexThreadId,
+            signal: codexProcess.child.signalCode ?? null,
+            stderr,
+        });
+    };
     // Subagent usage drafts are derived lazily from the buffered per-thread
     // samples so both the success result and the failure context can include
     // whatever child usage was observed before the turn settled.
@@ -1577,6 +1764,22 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     const listNoReplyFinalActionPatchOrdinals = () => [...new Set(finalActionPatches
             .filter((entry) => entry.patch.kind === 'none')
             .map((entry) => entry.deliveryContextOrdinal))].sort((left, right) => left - right);
+    const hasRequiredUserVisibleOutput = () => computerToolsLockedAfterUserPause || requiredVaultFileApprovalUrls.length > 0;
+    const settleNoReplyFinalActions = async () => {
+        if (hasRequiredUserVisibleOutput() || noReplySettlementStarted) {
+            return;
+        }
+        noReplySettlementStarted = true;
+        for (const deliveryContextOrdinal of listNoReplyFinalActionPatchOrdinals()) {
+            await input.onFinishWithoutReplyAccepted?.({
+                deliveryContextOrdinal,
+            });
+            acceptedNoReplyDeliveryContextOrdinals.push(deliveryContextOrdinal);
+            await input.onFinishWithoutReplyRecorded?.({
+                deliveryContextOrdinal,
+            });
+        }
+    };
     const annotateTurnFailureContext = (error) => {
         if (!error || typeof error !== 'object') {
             return;
@@ -1586,14 +1789,14 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             additionalUsages: [...additionalUsages, ...buildSubagentUsageDrafts()],
             providerActionCount,
             runtimeIssueInputs: [...runtimeIssueInputs],
-            acceptedNoReplyDeliveryContextOrdinals: listNoReplyFinalActionPatchOrdinals(),
+            acceptedNoReplyDeliveryContextOrdinals: [...acceptedNoReplyDeliveryContextOrdinals],
             reactions: reactionPatches.map((entry) => ({
                 deliveryContextOrdinal: entry.deliveryContextOrdinal,
                 reaction: entry.patch.reaction,
             })),
-            codexThreadHistoryUnsafe: hasNoReplyFinalActionPatch(),
             codexThreadId,
             providerTurnId: turnId,
+            rolloutRelativePath,
         };
         codexAppServerTurnFailureContexts.set(error, context);
         try {
@@ -1627,23 +1830,47 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         interruptCleanupTimer = setTimeout(() => {
             interruptCleanupTimer = null;
             lifecycleStage = 'interrupt_timeout_cleanup';
-            normalShutdown = true;
+            if (codexProcess.recordedEndReason !== 'previous-process-exit') {
+                normalShutdown = true;
+            }
             rejectOnce(buildInterruptCleanupTimeoutError());
         }, CODEX_APP_SERVER_INTERRUPT_CLEANUP_TIMEOUT_MS);
         interruptCleanupTimer.unref?.();
     };
     const emitAppServerTimingTrace = (stage) => {
+        const now = Date.now();
+        const elapsedMs = Math.max(0, now - lastTimingAt);
+        if (stage === 'spawn-ready') {
+            codexAppServerProviderStartTiming.codexAppServerSpawnReadyMs = elapsedMs;
+        }
+        else if (stage === 'initialized') {
+            codexAppServerProviderStartTiming.codexAppServerInitializeMs = elapsedMs;
+        }
+        else if (stage === 'warm-reused') {
+            codexAppServerProviderStartTiming.codexAppServerWarmReuseMs = elapsedMs;
+        }
+        else if (stage === 'thread-resumed') {
+            codexAppServerProviderStartTiming.codexAppServerThreadResumeMs = elapsedMs;
+        }
+        else if (stage === 'thread-started') {
+            codexAppServerProviderStartTiming.codexAppServerThreadStartMs = elapsedMs;
+        }
+        lastTimingAt = now;
         if (!input.onTraceEvent) {
             return;
         }
-        const now = Date.now();
         try {
             input.onTraceEvent({
                 codexThreadId,
                 rawEvent: {
                     schema: CODEX_APP_SERVER_TIMING_TRACE_SCHEMA,
                     type: CODEX_APP_SERVER_TIMING_TRACE_TYPE,
-                    codexTimingElapsedMs: Math.max(0, now - lastTimingAt),
+                    ...(stage === 'initialized'
+                        ? {
+                            codexTimingColdStartReason: codexProcess.coldStartReason,
+                        }
+                        : {}),
+                    codexTimingElapsedMs: elapsedMs,
                     codexTimingProviderActionCount: providerActionCount,
                     codexTimingThreadIdPresent: codexThreadId !== null,
                     codexTimingStage: stage,
@@ -1652,7 +1879,6 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
                 },
                 updates: [],
             });
-            lastTimingAt = now;
         }
         catch {
             // Timing traces are diagnostic-only and must not block assistant turns.
@@ -1695,17 +1921,18 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         if (normalShutdown && readNodeErrorCode(error) === 'EPIPE') {
             return null;
         }
+        const fallback = buildCodexStdinFailureFallback({
+            error,
+            lastEventError,
+            stderr,
+        });
         const failure = stdinFailure ??
             buildCodexProcessExitError({
-                abortRequested,
+                abortOwnsTermination: false,
                 code: codexProcess.child.exitCode,
                 diagnostics: buildProcessExitDiagnostics(),
                 errorInfo: lastEventErrorInfo,
-                fallback: buildCodexStdinFailureFallback({
-                    error,
-                    lastEventError,
-                    stderr,
-                }),
+                fallback,
                 providerActionCount,
                 codexThreadId,
                 signal: codexProcess.child.signalCode ?? null,
@@ -1728,6 +1955,7 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         abortSignal: input.abortSignal,
         onAbort: () => {
             abortRequested = true;
+            codexProcess.noteTurnAbort();
             if (codexThreadId && turnId) {
                 codexProcess.sendUntrackedRequest('turn/interrupt', buildCodexTurnInterruptParams({
                     threadId: codexThreadId,
@@ -1780,14 +2008,40 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             ? `${previousText}${normalizedText}`
             : normalizedText);
     };
+    const removeAssistantTraceUpdateFromFinalFallback = (update) => {
+        if (update.kind !== 'assistant') {
+            return;
+        }
+        const streamKey = normalizeAssistantTraceStreamKey(update);
+        assistantStreams.delete(streamKey);
+        const streamOrderIndex = assistantStreamOrder.indexOf(streamKey);
+        if (streamOrderIndex >= 0) {
+            assistantStreamOrder.splice(streamOrderIndex, 1);
+        }
+    };
+    // App-server events mutate this state inside the asynchronous message
+    // handler, so finalization reads it through an explicitly typed boundary.
+    const readTrailingSteerCandidate = () => trailingSteerCandidate;
+    const promoteTrailingSteerCandidate = () => {
+        if (!trailingSteerCandidate) {
+            return;
+        }
+        precedingAgentMessageSegments.push(trailingSteerCandidate);
+        trailingSteerCandidate = null;
+    };
     const notifyProviderRequestStarted = () => {
         if (providerRequestStartedNotified) {
             return;
         }
         providerRequestStartedNotified = true;
+        const startedAtMs = Date.now();
         notifyCodexAppServerProviderRequestStartedBestEffort({
             hook: input.onProviderRequestStarted ?? null,
-            startedAt: new Date().toISOString(),
+            startedAt: new Date(startedAtMs).toISOString(),
+            timing: {
+                ...codexAppServerProviderStartTiming,
+                codexAppServerPreProviderMs: Math.max(0, startedAtMs - codexAppServerTurnStartedAt),
+            },
         });
     };
     const trackExternallyVisibleProgressDelivery = (input) => {
@@ -1803,43 +2057,37 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             releasePending();
         });
     };
-    const notifyCurrentChannelProgress = (deliveryContextOrdinal, text, source) => {
+    const notifyContextCompactionProgress = (deliveryContextOrdinal, text) => {
         const progressDelivery = resolveCodexAppServerProgressDelivery(input);
         if (!progressDelivery ||
-            (source === 'system' &&
-                (contextCompactionProgressNotified || contextCompactionProgressPending))) {
+            contextCompactionProgressNotified ||
+            contextCompactionProgressPending) {
             return false;
         }
         let progressPromise;
         try {
-            if (source === 'system') {
-                contextCompactionProgressPending = true;
-            }
+            contextCompactionProgressPending = true;
             progressPromise = progressDelivery.send(text, {
-                ...(source === 'system' ? { required: true } : {}),
-                source,
+                required: true,
+                source: 'system',
             });
         }
         catch {
-            if (source === 'system') {
-                contextCompactionProgressPending = false;
-            }
+            contextCompactionProgressPending = false;
             return false;
         }
-        if (source === 'system') {
-            progressPromise = progressPromise.then((result) => {
-                if (result.kind === 'sent') {
-                    contextCompactionProgressNotified = true;
-                }
-                else {
-                    contextCompactionProgressPending = false;
-                }
-                return result;
-            }, (error) => {
+        progressPromise = progressPromise.then((result) => {
+            if (result.kind === 'sent') {
+                contextCompactionProgressNotified = true;
+            }
+            else {
                 contextCompactionProgressPending = false;
-                throw error;
-            });
-        }
+            }
+            return result;
+        }, (error) => {
+            contextCompactionProgressPending = false;
+            throw error;
+        });
         trackProgressDelivery(trackExternallyVisibleProgressDelivery({
             deliveryContextOrdinal,
             promise: progressPromise,
@@ -1862,8 +2110,8 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         }
     };
     // Stateful dynamic tools run serialized in request order so response media,
-    // final-action patches, and computer pause barriers apply deterministically
-    // even if Codex issues overlapping tool requests.
+    // preference and configuration writes, final-action patches, and computer
+    // pause barriers apply deterministically even if Codex overlaps tool requests.
     const trackDynamicToolExecution = (run) => {
         dynamicToolExecutionChain = dynamicToolExecutionChain
             .then(run)
@@ -1889,20 +2137,19 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             : normalizeAssistantResponseMediaList([...responseMedia, ...patch.media]);
     };
     const canApplyNoReplyPatch = (deliveryContextOrdinal) => {
+        const trailingSteerCandidateOrdinal = trailingSteerCandidate?.deliveryContextOrdinal;
         if (externallyVisibleAssistantOutputDeliveryContexts.has(deliveryContextOrdinal) ||
             hasPendingExternallyVisibleAssistantOutput(deliveryContextOrdinal)) {
             return false;
         }
-        if (trailingSteerCandidate !== null &&
-            trailingSteerCandidateDeliveryContextOrdinal !== null &&
-            trailingSteerCandidateDeliveryContextOrdinal < deliveryContextOrdinal) {
+        if (typeof trailingSteerCandidateOrdinal === 'number' &&
+            trailingSteerCandidateOrdinal < deliveryContextOrdinal) {
             return false;
         }
         if (responseMedia.length > 0) {
             return false;
         }
-        if (precedingAgentMessageSegments.some((segment) => typeof segment.deliveryContextOrdinal !== 'number' ||
-            segment.deliveryContextOrdinal < deliveryContextOrdinal)) {
+        if (precedingAgentMessageSegments.some((segment) => segment.deliveryContextOrdinal < deliveryContextOrdinal)) {
             return false;
         }
         return true;
@@ -1922,113 +2169,34 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         };
     };
     const applyFinalActionPatch = async (patch, deliveryContextOrdinal) => {
-        if (patch.kind === 'none' && !canApplyNoReplyPatch(deliveryContextOrdinal)) {
+        if (patch.kind === 'none' &&
+            (computerToolsLockedAfterUserPause ||
+                !canApplyNoReplyPatch(deliveryContextOrdinal))) {
             return false;
         }
         if (finalActionPatches.some((action) => action.deliveryContextOrdinal === deliveryContextOrdinal)) {
             return true;
         }
-        let reservedNoReply = false;
-        try {
-            if (patch.kind === 'none') {
-                reserveNoReplyDeliveryContext(deliveryContextOrdinal);
-                reservedNoReply = true;
-                await input.onFinishWithoutReplyAccepted?.({
-                    deliveryContextOrdinal,
-                });
-            }
-            finalActionPatches = [
-                ...finalActionPatches,
-                {
-                    deliveryContextOrdinal,
-                    patch,
-                },
-            ];
-            if (patch.kind === 'none') {
-                reservedNoReplyDeliveryContextOrdinals.delete(deliveryContextOrdinal);
-                await input.onCodexThreadHistoryUnsafe?.({
-                    deliveryContextOrdinal,
-                });
-            }
-            return true;
-        }
-        catch (error) {
-            if (reservedNoReply &&
-                !finalActionPatches.some((action) => action.deliveryContextOrdinal === deliveryContextOrdinal)) {
-                reservedNoReplyDeliveryContextOrdinals.delete(deliveryContextOrdinal);
-            }
-            throw error;
+        finalActionPatches = [
+            ...finalActionPatches,
+            {
+                deliveryContextOrdinal,
+                patch,
+            },
+        ];
+        if (patch.kind === 'none') {
+            reservedNoReplyDeliveryContextOrdinals.delete(deliveryContextOrdinal);
         }
+        return true;
     };
     const resolveFinalActionPatch = (deliveryContextOrdinal) => finalActionPatches.find((action) => action.deliveryContextOrdinal === deliveryContextOrdinal)?.patch ?? null;
     const shouldSuppressDeliveryContext = (deliveryContextOrdinal) => {
-        if (reservedNoReplyDeliveryContextOrdinals.has(deliveryContextOrdinal ?? 0)) {
+        if (reservedNoReplyDeliveryContextOrdinals.has(deliveryContextOrdinal)) {
             return true;
         }
-        const patch = resolveFinalActionPatch(deliveryContextOrdinal ?? 0);
+        const patch = resolveFinalActionPatch(deliveryContextOrdinal);
         return patch?.kind === 'none';
     };
-    const buildUnknownRpcResponseError = () => new VaultCliError('ASSISTANT_CODEX_APP_SERVER_LATE_RESPONSE', 'Codex app-server emitted a response for an unknown request id.', {
-        retryable: true,
-    });
-    const buildStaleTurnEventError = (input) => new VaultCliError('ASSISTANT_CODEX_APP_SERVER_STALE_TURN_EVENT', 'Codex app-server emitted an event that does not match the active turn.', {
-        eventMethod: input.eventMethod,
-        eventTurnIdPresent: input.eventTurnId !== null,
-        expectedTurnIdPresent: expectedTurnId !== null,
-        retryable: true,
-    });
-    const buildMissingReusedTurnIdError = () => new VaultCliError('ASSISTANT_CODEX_APP_SERVER_TURN_ID_MISSING', 'Codex app-server turn/start response is missing a turn id on a reused warm process.', {
-        retryable: true,
-    });
-    const bindExpectedTurnId = (candidateTurnId, eventMethod) => {
-        if (!candidateTurnId) {
-            return null;
-        }
-        if (expectedTurnId === null) {
-            expectedTurnId = candidateTurnId;
-            return null;
-        }
-        if (candidateTurnId === expectedTurnId) {
-            return null;
-        }
-        return buildStaleTurnEventError({
-            eventMethod,
-            eventTurnId: candidateTurnId,
-        });
-    };
-    const validateWarmTurnEventCorrelation = (message, eventMethod) => {
-        const eventTurnId = extractCodexTurnIdFromMessage(message);
-        if (codexProcess.requiresCompleteTurnCorrelation &&
-            expectedTurnId === null &&
-            codexEventMethodRequiresTurnCorrelation(eventMethod)) {
-            if (eventTurnId) {
-                return null;
-            }
-            return buildStaleTurnEventError({
-                eventMethod,
-                eventTurnId,
-            });
-        }
-        if (eventTurnId) {
-            return bindExpectedTurnId(eventTurnId, eventMethod);
-        }
-        return codexProcess.requiresCompleteTurnCorrelation &&
-            codexEventMethodRequiresTurnCorrelation(eventMethod)
-            ? buildStaleTurnEventError({
-                eventMethod,
-                eventTurnId: null,
-            })
-            : null;
-    };
-    const shouldBufferPreStartWarmMessage = (message, eventMethod) => {
-        return (codexProcess.requiresCompleteTurnCorrelation &&
-            expectedTurnId === null &&
-            codexEventMethodRequiresTurnCorrelation(eventMethod) &&
-            extractCodexTurnIdFromMessage(message) !== null) || (codexProcess.requiresCompleteTurnCorrelation &&
-            expectedTurnId === null &&
-            readCodexRpcServerRequestId(message) !== null &&
-            extractCodexTurnIdFromMessage(message) !== null);
-    };
     const acceptJsonEvent = (message) => {
         jsonEvents.push(message);
     };
@@ -2097,6 +2265,38 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             });
             return;
         }
+        if (computerToolsLockedAfterUserPause &&
+            dynamicToolRequest.kind === 'finish-without-reply') {
+            void tryWriteRpcMessage({
+                id: requestId,
+                result: {
+                    success: false,
+                    contentItems: [
+                        {
+                            type: 'inputText',
+                            text: 'finish_without_reply is unavailable after pausing a computer run for the user',
+                        },
+                    ],
+                },
+            });
+            return;
+        }
+        if (requiredVaultFileApprovalUrls.length > 0 &&
+            dynamicToolRequest.kind === 'finish-without-reply') {
+            void tryWriteRpcMessage({
+                id: requestId,
+                result: {
+                    success: false,
+                    contentItems: [
+                        {
+                            type: 'inputText',
+                            text: 'finish_without_reply is unavailable while a vault-file approval link must be delivered',
+                        },
+                    ],
+                },
+            });
+            return;
+        }
         if (computerToolsLockedAfterUserPause &&
             isComputerDynamicToolRequest(dynamicToolRequest)) {
             void tryWriteRpcMessage({
@@ -2149,34 +2349,44 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             ? addPendingExternallyVisibleAssistantOutput(dynamicToolDeliveryContextOrdinal ?? 0)
             : null;
         if (dynamicToolRequest.kind === 'computer-pause-for-user') {
+            finalActionPatches = finalActionPatches.filter((entry) => entry.patch.kind !== 'none' ||
+                entry.deliveryContextOrdinal !==
+                    dynamicToolRequestDeliveryContextOrdinal);
+            reservedNoReplyDeliveryContextOrdinals.delete(dynamicToolRequestDeliveryContextOrdinal);
             computerToolsLockedAfterUserPause = true;
             closeLiveTurn();
         }
-        const runDynamicTool = () => executeMurphDynamicToolRequest({
-            abortSignal: input.abortSignal
-                ? AbortSignal.any([input.abortSignal, dynamicToolAbortController.signal])
-                : dynamicToolAbortController.signal,
-            loadAuthorizedReferenceImageRefs: input.loadAuthorizedReferenceImageRefs ?? null,
-            codexHome: input.codexHome ?? input.env.CODEX_HOME ?? null,
-            env: input.env,
-            fetchImpl: input.fetchImpl,
-            hostedGeneratedImageUploader: input.hostedGeneratedImageUploader,
-            hostedToolContext: resolveCodexAppServerHostedToolContext(input),
-            materializeWorkspaceArtifacts: input.materializeWorkspaceArtifacts ?? null,
-            currentResponseMedia: responseMedia,
-            nextUsageOrdinal: () => nextDynamicToolUsageOrdinal++,
-            productFeedbackRecorder: input.productFeedbackRecorder ?? null,
-            progressDelivery: dynamicToolRequest.kind === 'send-progress-update'
-                ? dynamicToolProgressDelivery
-                : null,
-            publicFetchImpl: input.publicInternetFetch ?? null,
-            request: dynamicToolRequest,
-            requireHostedGeneratedImageUploader: input.requireHostedGeneratedImageUploader ?? false,
-            vaultRoot: input.vaultRoot ?? null,
-            voiceMemoRuntime: dynamicToolRequest.kind === 'generate-voice-memo' ||
-                dynamicToolRequest.kind === 'generate-song'
-                ? input.voiceMemoRuntime ?? null
-                : null,
+        const runDynamicTool = () => withHostedCanonicalWritePort(hostedCanonicalWritePort, async () => {
+            const hostedToolContext = resolveCodexAppServerHostedToolContext(input);
+            await hostedToolContext?.beforeToolExecution?.();
+            return await executeMurphDynamicToolRequest({
+                assistantStyleSettingsOverlay,
+                assistantStyleSettingsAvailable: input.dynamicTools.some((tool) => tool.namespace === MURPH_ASSISTANT_STYLE_TOOL.namespace &&
+                    tool.name === MURPH_ASSISTANT_STYLE_TOOL.name),
+                abortSignal: input.abortSignal
+                    ? AbortSignal.any([input.abortSignal, dynamicToolAbortController.signal])
+                    : dynamicToolAbortController.signal,
+                codexHome: input.codexHome ?? input.env.CODEX_HOME ?? null,
+                env: input.env,
+                fetchImpl: input.fetchImpl,
+                hostedGeneratedImageUploader: input.hostedGeneratedImageUploader,
+                hostedToolContext,
+                materializeWorkspaceArtifacts: input.materializeWorkspaceArtifacts ?? null,
+                currentResponseMedia: responseMedia,
+                nextUsageOrdinal: () => nextDynamicToolUsageOrdinal++,
+                productFeedbackRecorder: input.productFeedbackRecorder ?? null,
+                progressDelivery: dynamicToolRequest.kind === 'send-progress-update'
+                    ? dynamicToolProgressDelivery
+                    : null,
+                publicFetchImpl: input.publicInternetFetch ?? null,
+                request: dynamicToolRequest,
+                requireHostedGeneratedImageUploader: input.requireHostedGeneratedImageUploader ?? false,
+                vaultRoot: input.vaultRoot ?? null,
+                voiceMemoRuntime: dynamicToolRequest.kind === 'generate-voice-memo' ||
+                    dynamicToolRequest.kind === 'generate-song'
+                    ? input.voiceMemoRuntime ?? null
+                    : null,
+            });
         }).then(async (result) => {
             if (dynamicToolRequest.kind === 'send-progress-update') {
                 releaseDynamicProgressPending?.();
@@ -2184,8 +2394,9 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             if (result.usageDraft) {
                 additionalUsages.push(result.usageDraft);
             }
-            if (result.computerRunPausedForUser) {
-                computerToolsLockedAfterUserPause = true;
+            if (result.requiredVaultFileApprovalUrl &&
+                !requiredVaultFileApprovalUrls.includes(result.requiredVaultFileApprovalUrl)) {
+                requiredVaultFileApprovalUrls.push(result.requiredVaultFileApprovalUrl);
             }
             if (result.responseMediaPatch) {
                 try {
@@ -2284,15 +2495,11 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     };
     const handleAcceptedEvent = (message, method) => {
         acceptJsonEvent(message);
-        codexThreadId = codexThreadId ?? extractCodexSessionId(message);
         for (const receiverThreadId of readCodexCollabReceiverThreadIds(message)) {
             collabReceiverThreadIds.add(receiverThreadId);
         }
         lastEventError = extractCodexErrorMessage(message) ?? lastEventError;
         lastEventErrorInfo = extractCodexErrorInfo(message) ?? lastEventErrorInfo;
-        if (isCodexTurnStartedMethod(method)) {
-            turnId = extractCodexTurnIdFromMessage(message) ?? turnId;
-        }
         const normalizedEvent = normalizeCodexEvent(message);
         const runtimeIssueInput = buildRuntimeIssueInputForFailedCodexAction({
             normalizedEvent,
@@ -2306,6 +2513,27 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             normalizedEvent,
             rawEvent: message,
         });
+        const transportDiagnosticsTraceEvent = input.onTraceEvent
+            ? buildCodexTransportDiagnosticsTraceEvent({
+                codexThreadId,
+                message,
+                method,
+                providerActionCount,
+                turnId,
+            })
+            : null;
+        if (transportDiagnosticsTraceEvent) {
+            try {
+                input.onTraceEvent?.({
+                    codexThreadId: null,
+                    rawEvent: transportDiagnosticsTraceEvent,
+                    updates: [],
+                });
+            }
+            catch {
+                // Transport diagnostics are metadata-only and must not block turns.
+            }
+        }
         const providerActionKey = extractCodexProviderActionKey(normalizedEvent);
         if (providerActionKey && !providerActionItemIds.has(providerActionKey)) {
             providerActionItemIds.add(providerActionKey);
@@ -2313,11 +2541,22 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         }
         const deliveryContextOrdinal = currentDeliveryContextOrdinal();
         const suppressDeliveryContext = shouldSuppressDeliveryContext(deliveryContextOrdinal);
-        const updates = extractCodexTraceUpdatesFromNormalized(normalizedEvent)
+        const isCommentaryAssistantMessage = normalizedEvent.kind === 'assistant_message' &&
+            normalizedEvent.messagePhase === 'commentary';
+        const rawUpdates = extractCodexTraceUpdatesFromNormalized(normalizedEvent);
+        const updates = rawUpdates
             .filter((update) => !(suppressDeliveryContext && update.kind === 'assistant'));
         for (const update of updates) {
             recordAssistantTraceUpdate(update, deliveryContextOrdinal);
         }
+        if (isCommentaryAssistantMessage) {
+            // Commentary is internal progress, not a member-facing message. Remove
+            // its stream, including any earlier deltas for the same item, so a
+            // media-only response cannot reuse it as final reply text.
+            for (const update of rawUpdates) {
+                removeAssistantTraceUpdateFromFinalFallback(update);
+            }
+        }
         if (normalizedEvent.kind !== 'status_item' ||
             normalizedEvent.itemType !== 'context.compaction') {
             input.onTraceEvent?.({
@@ -2330,23 +2569,14 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
                 markExternallyVisibleAssistantOutput(deliveryContextOrdinal);
             }
         }
-        const progressDeliveryText = extractCodexCurrentChannelProgressTextFromNormalized(normalizedEvent);
-        const progressDeliverySource = progressDeliveryText
-            ? resolveCodexCurrentChannelProgressSource(normalizedEvent)
-            : null;
-        if (progressDeliveryText &&
-            progressDeliverySource &&
+        const contextCompactionProgressText = extractCodexContextCompactionProgressTextFromNormalized(normalizedEvent);
+        if (contextCompactionProgressText &&
             !suppressDeliveryContext) {
-            notifyCurrentChannelProgress(deliveryContextOrdinal, progressDeliveryText, progressDeliverySource);
+            notifyContextCompactionProgress(deliveryContextOrdinal, contextCompactionProgressText);
         }
         const completedFinalAgentMessageText = extractCodexCompletedFinalAgentMessageTextFromNormalized(normalizedEvent);
         if (completedFinalAgentMessageText !== null && !suppressDeliveryContext) {
-            if (trailingSteerCandidate) {
-                precedingAgentMessageSegments.push(trailingSteerCandidate);
-                trailingSteerCandidate = null;
-                trailingSteerCandidateDeliveryContextOrdinal = null;
-                trailingSteerCandidateMedia = null;
-            }
+            promoteTrailingSteerCandidate();
             completedFinalAgentMessage = completedFinalAgentMessageText;
         }
         else if (isCodexCompletedUserMessageItemFromNormalized(normalizedEvent)) {
@@ -2356,10 +2586,9 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
                     response: completedFinalAgentMessage,
                     media: [...responseMedia],
                 };
-                trailingSteerCandidateDeliveryContextOrdinal =
-                    trailingSteerCandidate.deliveryContextOrdinal ?? 0;
-                trailingSteerCandidateMedia = trailingSteerCandidate.media;
                 completedFinalAgentMessage = null;
+                assistantStreams.clear();
+                assistantStreamOrder.length = 0;
                 responseMedia = [];
             }
             completedUserMessageOrdinal += 1;
@@ -2371,8 +2600,8 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             }
             else {
                 if (progressEvent.kind === 'message') {
-                    lastAgentMessage = progressEvent.text;
-                    if (input.onProgress && normalizeStreamingText(progressEvent.text)) {
+                    if (input.onProgress &&
+                        normalizeStreamingText(progressEvent.text)) {
                         markExternallyVisibleAssistantOutput(deliveryContextOrdinal);
                     }
                 }
@@ -2401,39 +2630,15 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         turnTerminal = true;
         completeTurn?.();
     };
-    const flushPendingPreStartMessages = () => {
-        while (pendingPreStartMessages.length > 0) {
-            const pending = pendingPreStartMessages.shift();
-            const correlationError = validateWarmTurnEventCorrelation(pending.message, pending.method);
-            if (correlationError) {
-                rejectOnce(correlationError);
-                return false;
-            }
-            if (pending.kind === 'server_request') {
-                const requestId = readCodexRpcServerRequestId(pending.message);
-                if (requestId === null) {
-                    rejectOnce(buildUnknownRpcResponseError());
-                    return false;
-                }
-                handleAcceptedServerRequest(pending.message, requestId);
-            }
-            else {
-                handleAcceptedEvent(pending.message, pending.method);
-            }
-        }
-        return true;
-    };
     const handleSubagentThreadMessage = (threadId, message) => {
         const requestId = readCodexRpcServerRequestId(message);
         if (requestId !== null) {
             // Dynamic tools and approvals stay parent-thread-scoped; answer the
             // child so it does not hang, without involving the parent turn.
-            void tryWriteRpcMessage({
-                id: requestId,
-                error: {
-                    code: -32000,
-                    message: 'Server requests from codex subagent threads are not supported.',
-                },
+            rejectCodexServerRequest({
+                message: 'Server requests from codex subagent threads are not supported.',
+                requestId,
+                writeRpcMessage: tryWriteRpcMessage,
             });
             return;
         }
@@ -2466,7 +2671,46 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             lastEvent: message,
         });
     };
-    const handleParsedMessage = (message) => {
+    const handleStaleParentTurnMessage = (message) => {
+        const requestId = readCodexRpcServerRequestId(message);
+        if (requestId === null) {
+            return;
+        }
+        rejectCodexServerRequest({
+            message: 'Codex message turn id does not match the active turn.',
+            requestId,
+            writeRpcMessage: tryWriteRpcMessage,
+        });
+    };
+    const rejectUnscopedParentTurnRequest = (requestId) => {
+        rejectCodexServerRequest({
+            message: 'Codex parent-thread request did not include the active turn id.',
+            requestId,
+            writeRpcMessage: tryWriteRpcMessage,
+        });
+    };
+    const rejectPreStartParentTurnRequest = (requestId) => {
+        rejectCodexServerRequest({
+            message: 'Codex parent-thread request arrived before the active turn id was known.',
+            requestId,
+            writeRpcMessage: tryWriteRpcMessage,
+        });
+    };
+    const acceptTurnStartResultTurnId = (resultTurnId) => {
+        if (resultTurnId === null) {
+            return;
+        }
+        if (turnId === null) {
+            turnId = resultTurnId;
+            return;
+        }
+        if (turnId !== resultTurnId) {
+            rejectOnce(new VaultCliError('ASSISTANT_CODEX_APP_SERVER_TURN_ID_MISMATCH', 'Codex app-server turn/start returned a different turn id than the active turn.', {
+                retryable: true,
+            }));
+        }
+    };
+    function handleParsedMessage(message) {
         const responseId = readCodexRpcResponseId(message);
         if (responseId !== null) {
             const pending = codexProcess.pendingRequests.get(responseId);
@@ -2475,91 +2719,69 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
                 pendingRequests: codexProcess.pendingRequests,
                 responseId,
             });
-            if (resolveResult === 'unknown_response_id' &&
-                !codexProcess.consumeIgnoredResponseId(responseId)) {
-                rejectOnce(buildUnknownRpcResponseError());
+            if (resolveResult === 'unknown_response_id') {
+                codexProcess.consumeIgnoredResponseId(responseId);
                 return;
             }
-            if (resolveResult !== 'unknown_response_id') {
-                acceptJsonEvent(message);
-                if (message.error) {
-                    return;
-                }
-                if (pending?.method === 'thread/start' || pending?.method === 'thread/resume') {
-                    codexThreadId = extractCodexThreadIdFromResult(message.result) ?? codexThreadId;
-                    codexProcess.noteBoundThreadId(codexThreadId);
-                }
-                if (pending?.method === 'turn/start') {
-                    const resultTurnId = extractCodexTurnIdFromResult(message.result);
-                    if (codexProcess.requiresCompleteTurnCorrelation && !resultTurnId) {
-                        rejectOnce(buildMissingReusedTurnIdError());
-                        return;
-                    }
-                    const correlationError = bindExpectedTurnId(resultTurnId, 'turn/start');
-                    if (correlationError) {
-                        rejectOnce(correlationError);
-                        return;
-                    }
-                    turnId = resultTurnId ?? turnId;
-                }
-                if (pending?.method === 'turn/start' && !flushPendingPreStartMessages()) {
-                    return;
-                }
+            acceptJsonEvent(message);
+            if (message.error) {
+                return;
+            }
+            if (pending?.method === 'turn/start') {
+                const resultTurnId = extractCodexTurnIdFromResult(message.result);
+                acceptTurnStartResultTurnId(resultTurnId);
             }
             return;
         }
-        // Codex app-server auto-attaches this connection to every thread it
-        // creates, including spawned subagent threads, and their notifications
-        // carry foreign thread/turn ids. Route them off the single-turn
-        // correlation path: token usage is buffered for billing, server requests
-        // are denied without failing the parent turn, everything else is dropped.
-        // Before a fresh thread/start response produces this turn's thread id,
-        // fall back to the process's last bound thread id so a late child event
-        // in that window is still routed instead of failing correlation; events
-        // for the last bound thread itself keep today's strict stale handling.
+        // Codex owns subagent/thread lifecycle. Murph only keeps foreign thread
+        // traffic away from the active parent turn: token usage is buffered for
+        // billing, server requests are denied, and other child events are dropped.
+        // Before a fresh thread/start response produces this turn's thread id, the
+        // previous bound thread id is enough to distinguish late child traffic.
         const messageThreadId = extractCodexThreadIdFromMessage(message);
-        const knownParentThreadId = codexThreadId ?? codexProcess.lastBoundThreadId;
+        const knownParentThreadId = codexThreadId ?? requestedResumeThreadId ?? codexProcess.lastBoundThreadId;
         if (messageThreadId !== null &&
             knownParentThreadId !== null &&
             messageThreadId !== knownParentThreadId) {
             handleSubagentThreadMessage(messageThreadId, message);
             return;
         }
+        const messageTurnId = extractCodexTurnIdFromMessage(message);
+        const method = readCodexEventMethod(message);
         const requestId = readCodexRpcServerRequestId(message);
-        if (requestId !== null) {
-            const requestMethod = typeof message.method === 'string' ? message.method : null;
-            if (shouldBufferPreStartWarmMessage(message, requestMethod)) {
-                pendingPreStartMessages.push({
-                    kind: 'server_request',
-                    message,
-                    method: requestMethod,
-                });
+        if (messageTurnId !== null) {
+            if (turnId === null) {
+                // A reused warm process adopts the turn id only from turn/started (or
+                // the turn/start response); a fresh process cannot carry stale turns,
+                // so any tagged message may bind it.
+                if (isCodexTurnStartedMethod(method) || !isReusedWarmProcess) {
+                    turnId = messageTurnId;
+                }
+                else {
+                    if (requestId !== null) {
+                        rejectPreStartParentTurnRequest(requestId);
+                    }
+                    return;
+                }
+            }
+            else if (messageTurnId !== turnId) {
+                handleStaleParentTurnMessage(message);
                 return;
             }
-            const correlationError = validateWarmTurnEventCorrelation(message, requestMethod);
-            if (correlationError) {
-                rejectOnce(correlationError);
+        }
+        if (requestId !== null) {
+            if (isReusedWarmProcess && messageTurnId === null) {
+                rejectUnscopedParentTurnRequest(requestId);
                 return;
             }
             handleAcceptedServerRequest(message, requestId);
             return;
         }
-        const method = readCodexEventMethod(message);
-        if (shouldBufferPreStartWarmMessage(message, method)) {
-            pendingPreStartMessages.push({
-                kind: 'event',
-                message,
-                method,
-            });
-            return;
-        }
-        const correlationError = validateWarmTurnEventCorrelation(message, method);
-        if (correlationError) {
-            rejectOnce(correlationError);
+        if (isReusedWarmProcess && messageTurnId === null) {
             return;
         }
         handleAcceptedEvent(message, method);
-    };
+    }
     const emitActionDiagnosticsTrace = () => {
         if (actionDiagnosticsTraceEmitted ||
             !input.onTraceEvent ||
@@ -2637,7 +2859,7 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
                 return;
             }
             rejectOnce(buildCodexProcessExitError({
-                abortRequested,
+                abortOwnsTermination: false,
                 code,
                 diagnostics: buildProcessExitDiagnostics(),
                 errorInfo: lastEventErrorInfo,
@@ -2689,7 +2911,7 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             lifecycleStage = 'initialized';
             emitAppServerTimingTrace('warm-reused');
         }
-        const resumeThreadId = codexThreadId;
+        const resumeThreadId = requestedResumeThreadId;
         const threadTimingStage = resumeThreadId ? 'thread-resumed' : 'thread-started';
         lifecycleStage = resumeThreadId ? 'thread_resume' : 'thread_start';
         const threadResult = await withCodexRpcTimeout(resumeThreadId
@@ -2705,6 +2927,12 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
                 threadResult,
             });
         }
+        else if (normalizeNullableString(input.permissions)) {
+            assertCodexThreadStartPermissionAttestation({
+                input,
+                threadResult,
+            });
+        }
         codexThreadId = extractCodexThreadIdFromResult(threadResult) ?? codexThreadId;
         codexProcess.noteBoundThreadId(codexThreadId);
         rolloutRelativePath = resolveCodexRolloutRelativePath({
@@ -2718,16 +2946,22 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             throw new VaultCliError('ASSISTANT_CODEX_APP_SERVER_FAILED', 'Codex app-server did not return a thread id.');
         }
         lifecycleStage = 'turn_start';
+        codexProcess.noteBoundThreadModel(input.model ?? null);
         codexProcess.noteBoundThreadServiceTier(input.serviceTier ?? null);
-        const turnResult = await withCodexRpcTimeout(sendRequest('turn/start', buildCodexTurnStartParams({
+        const turnStartRequest = sendRequest('turn/start', buildCodexTurnStartParams({
             input,
             imagePaths: input.imagePaths,
             codexThreadId,
-        })), CODEX_RPC_DEFAULT_TIMEOUT_MS, 'turn/start');
-        turnId = extractCodexTurnIdFromResult(turnResult) ?? turnId;
+        }));
+        // The child can begin executing (including side-effecting commands) as
+        // soon as the turn/start request is written, so the provider-start
+        // barrier arms here rather than at the acknowledgement. A death between
+        // write and response must never be classified as pre-provider work.
+        notifyProviderRequestStarted();
+        const turnResult = await withCodexRpcTimeout(turnStartRequest, CODEX_RPC_DEFAULT_TIMEOUT_MS, 'turn/start');
+        acceptTurnStartResultTurnId(extractCodexTurnIdFromResult(turnResult));
         lifecycleStage = 'turn_started';
         emitAppServerTimingTrace('turn-started');
-        notifyProviderRequestStarted();
         registerLiveTurn();
         lifecycleStage = 'turn_running';
         await turnCompleted;
@@ -2738,33 +2972,81 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         lifecycleStage = 'turn_completed';
         emitAppServerTimingTrace('turn-completed');
         closeLiveTurn();
+        if (stdinFailure) {
+            throw stdinFailure;
+        }
+        await settleNoReplyFinalActions();
         if (abortRequested || terminationSignalSent) {
             normalShutdown = true;
             lifecycleStage = 'abort_cleanup';
             await codexProcess.poison('turn-completed-after-abort');
             lifecycleStage = 'shutdown_complete';
-            emitAppServerTimingTrace('warm-abort-poisoned');
+            emitAppServerTimingTrace(input.processLifetime === 'one-shot'
+                ? 'one-shot-abort-stopped'
+                : 'warm-abort-poisoned');
         }
         else {
-            lifecycleStage = 'idle';
-            codexProcess.releaseTurn(activeTurnBinding);
-            emitAppServerTimingTrace('warm-idle');
-        }
-        if (stdinFailure) {
-            throw stdinFailure;
+            if (input.processLifetime !== 'one-shot' &&
+                codexThreadId &&
+                normalizeNullableString(input.env[HOSTED_CLI_BRIDGE_TOKEN_ENV])) {
+                lifecycleStage = 'background_terminal_cleanup';
+                const cleanup = codexProcess.beginHostedBackgroundTerminalCleanup({
+                    binding: activeTurnBinding,
+                    threadId: codexThreadId,
+                });
+                trackHostedCodexPostTurnCleanup(cleanup);
+                void cleanup.then(() => {
+                    emitAppServerTimingTrace(codexProcess.isReusableFor(input.launchKey)
+                        ? 'background-terminals-cleaned'
+                        : 'warm-background-terminal-cleanup-failed');
+                });
+            }
+            if (!normalShutdown && !codexProcess.pendingPostTurnCleanup) {
+                lifecycleStage = 'idle';
+                codexProcess.releaseTurn(activeTurnBinding);
+                emitAppServerTimingTrace(input.processLifetime === 'one-shot'
+                    ? 'one-shot-complete'
+                    : 'warm-idle');
+            }
         }
     }
     catch (error) {
+        const recordedEndReason = codexProcess.recordedEndReason;
+        const preserveInterruptCleanupTimeout = error instanceof VaultCliError &&
+            error.code === 'ASSISTANT_CODEX_APP_SERVER_INTERRUPT_TIMEOUT' &&
+            recordedEndReason !== 'previous-process-exit';
+        const preserveMissingCodexStartupFailure = error instanceof VaultCliError &&
+            error.code === 'ASSISTANT_CODEX_NOT_FOUND';
+        const failureMatchesRecordedOwner = error instanceof VaultCliError &&
+            ((recordedEndReason === 'previous-process-exit' &&
+                error.context?.codexFailureStage === 'process_exit') ||
+                (recordedEndReason === 'previous-turn-abort' &&
+                    error.code === 'ASSISTANT_CODEX_INTERRUPTED'));
+        const shouldApplyRecordedOwner = !preserveInterruptCleanupTimeout &&
+            !preserveMissingCodexStartupFailure &&
+            !failureMatchesRecordedOwner &&
+            (recordedEndReason === 'previous-turn-abort' ||
+                (recordedEndReason === 'previous-process-exit' &&
+                    providerRequestStartedNotified));
+        let turnFailure = shouldApplyRecordedOwner
+            ? (buildRecordedTerminationError(lastEventError) ?? error)
+            : error;
         emitActionDiagnosticsTrace();
         dynamicToolAbortController.abort();
         await drainPendingDynamicToolExecutions();
         await drainPendingProgressDeliveries();
-        annotateTurnFailureContext(error);
+        try {
+            await settleNoReplyFinalActions();
+        }
+        catch (settlementError) {
+            turnFailure = settlementError;
+        }
+        annotateTurnFailureContext(turnFailure);
         closeLiveTurn();
         normalShutdown = true;
         lifecycleStage = 'error_cleanup';
-        await codexProcess.poison('turn-failure').catch(() => undefined);
-        throw error;
+        await codexProcess.poison(abortRequested ? 'turn-completed-after-abort' : 'turn-failure').catch(() => undefined);
+        throw turnFailure;
     }
     finally {
         closeLiveTurn();
@@ -2777,39 +3059,48 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
     const extractedFinalMessage = extractAssistantMessageFallback({
         assistantStreams,
         assistantStreamOrder,
-    }) ??
-        lastAgentMessage ??
-        '';
+    }) ?? '';
     const latestDeliveryContextOrdinal = Math.max(0, completedUserMessageOrdinal);
     const latestFinalActionPatch = resolveFinalActionPatch(latestDeliveryContextOrdinal);
+    let finalTrailingSteerCandidate = readTrailingSteerCandidate();
+    const trailingSteerCandidateDeliveryContextOrdinal = finalTrailingSteerCandidate?.deliveryContextOrdinal ?? null;
     const trailingSteerCandidateFinalActionPatch = trailingSteerCandidateDeliveryContextOrdinal !== null
         ? resolveFinalActionPatch(trailingSteerCandidateDeliveryContextOrdinal)
         : null;
     const suppressTrailingSteerCandidateForEarlierNoReply = latestFinalActionPatch === null &&
-        trailingSteerCandidate !== null &&
+        finalTrailingSteerCandidate !== null &&
         trailingSteerCandidateFinalActionPatch?.kind === 'none';
-    const finalPrecedingAgentMessageSegments = latestFinalActionPatch?.kind === 'none' && trailingSteerCandidate
-        ? [...precedingAgentMessageSegments, trailingSteerCandidate]
-        : precedingAgentMessageSegments;
+    const shouldPromoteTrailingSteerCandidate = finalTrailingSteerCandidate !== null &&
+        (latestFinalActionPatch?.kind === 'none' ||
+            (!suppressTrailingSteerCandidateForEarlierNoReply &&
+                (normalizeNullableString(extractedFinalMessage) !== null ||
+                    responseMedia.length > 0)));
+    if (shouldPromoteTrailingSteerCandidate) {
+        promoteTrailingSteerCandidate();
+        finalTrailingSteerCandidate = null;
+    }
+    const selectedFinalMessage = finalTrailingSteerCandidate?.response ?? extractedFinalMessage;
     const finalResponseMedia = latestFinalActionPatch?.kind === 'none'
         ? responseMedia
         : suppressTrailingSteerCandidateForEarlierNoReply
             ? responseMedia
-            : trailingSteerCandidateMedia ?? responseMedia;
+            : finalTrailingSteerCandidate?.media ?? responseMedia;
     const finalDeliveryContextOrdinal = latestFinalActionPatch?.kind === 'none'
         ? latestDeliveryContextOrdinal
         : suppressTrailingSteerCandidateForEarlierNoReply
             ? latestDeliveryContextOrdinal
-            : trailingSteerCandidateDeliveryContextOrdinal ??
+            : finalTrailingSteerCandidate?.deliveryContextOrdinal ??
                 latestDeliveryContextOrdinal;
     const finalActionPatch = resolveFinalActionPatch(finalDeliveryContextOrdinal);
-    const noReplySelected = finalActionPatch?.kind === 'none';
+    const requiredUserVisibleOutput = hasRequiredUserVisibleOutput();
+    const noReplySelected = finalActionPatch?.kind === 'none' && !requiredUserVisibleOutput;
     const finalAction = noReplySelected
         ? { kind: 'none' }
         : null;
-    const finalMessage = noReplySelected || suppressTrailingSteerCandidateForEarlierNoReply
+    const modelFinalMessage = noReplySelected || suppressTrailingSteerCandidateForEarlierNoReply
         ? ''
-        : extractedFinalMessage;
+        : selectedFinalMessage;
+    const finalMessage = appendRequiredVaultFileApprovalUrls(modelFinalMessage, requiredVaultFileApprovalUrls);
     if (noReplySelected &&
         normalizeNullableString(extractedFinalMessage) !== null) {
         emitCodexSuppressedFinalMessageTrace({
@@ -2819,31 +3110,27 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
             suppressedTextLength: extractedFinalMessage.length,
         });
     }
-    const filteredPrecedingAgentMessageSegments = finalPrecedingAgentMessageSegments
+    const filteredPrecedingAgentMessageSegments = precedingAgentMessageSegments
         .filter((segment) => !shouldSuppressDeliveryContext(segment.deliveryContextOrdinal));
-    const codexThreadHistoryUnsafe = finalActionPatches.some((entry) => entry.patch.kind === 'none') ||
-        suppressTrailingSteerCandidateForEarlierNoReply ||
-        filteredPrecedingAgentMessageSegments.length !==
-            finalPrecedingAgentMessageSegments.length;
     const finalHasDeliverableOutput = normalizeNullableString(finalMessage) !== null ||
         (!noReplySelected && finalResponseMedia.length > 0);
     return {
-        acceptedNoReplyDeliveryContextOrdinals: listNoReplyFinalActionPatchOrdinals(),
-        codexThreadHistoryUnsafe,
+        acceptedNoReplyDeliveryContextOrdinals: acceptedNoReplyDeliveryContextOrdinals,
         finalAction,
-        finalActionExplicit: finalActionPatch !== null,
+        finalActionExplicit: finalActionPatch !== null && !requiredUserVisibleOutput,
         finalMessage,
+        transcriptMessage: normalizeNullableString(modelFinalMessage) ??
+            (finalResponseMedia.length > 0 ? '' : null),
         reactions: reactionPatches.map((entry) => ({
             deliveryContextOrdinal: entry.deliveryContextOrdinal,
             reaction: entry.patch.reaction,
         })),
         precedingAgentMessageSegments: filteredPrecedingAgentMessageSegments.map((segment) => ({
-            ...(typeof segment.deliveryContextOrdinal === 'number'
-                ? { deliveryContextOrdinal: segment.deliveryContextOrdinal }
-                : {}),
+            deliveryContextOrdinal: segment.deliveryContextOrdinal,
             response: segment.response,
             media: [...segment.media],
         })),
+        responseDeliveryContextOrdinal: finalDeliveryContextOrdinal,
         additionalUsages: [...additionalUsages, ...buildSubagentUsageDrafts()],
         responseMedia: finalHasDeliverableOutput ? [...finalResponseMedia] : [],
         jsonEvents,
@@ -2857,6 +3144,45 @@ async function runCodexAppServerTurnOnProcess(codexProcess, input) {
         turnId,
     };
 }
+function assertCodexThreadStartPermissionAttestation(input) {
+    const result = asCodexRecord(input.threadResult);
+    const activePermissionProfile = asCodexRecord(result?.activePermissionProfile);
+    const actualCwd = normalizeNullableString(asCodexString(result?.cwd));
+    const actualRoots = asCodexStringArray(result?.runtimeWorkspaceRoots);
+    const instructionSources = Array.isArray(result?.instructionSources)
+        ? result.instructionSources
+        : null;
+    const expectedRoots = input.input.runtimeWorkspaceRoots ?? [];
+    const mismatchedFields = [];
+    const permissionProfileMismatch = normalizeNullableString(asCodexString(activePermissionProfile?.id)) !==
+        normalizeNullableString(input.input.permissions) ||
+        normalizeNullableString(asCodexString(activePermissionProfile?.extends)) !== null;
+    if (permissionProfileMismatch) {
+        mismatchedFields.push('activePermissionProfile');
+    }
+    if (!actualRoots ||
+        actualRoots.length !== expectedRoots.length ||
+        actualRoots.some((root, index) => path.resolve(root) !== path.resolve(expectedRoots[index] ?? ''))) {
+        mismatchedFields.push('runtimeWorkspaceRoots');
+    }
+    if (!actualCwd || path.resolve(actualCwd) !== input.input.workingDirectory) {
+        mismatchedFields.push('cwd');
+    }
+    if (instructionSources === null || instructionSources.length !== 0) {
+        mismatchedFields.push('instructionSources');
+    }
+    if (asCodexString(result?.approvalPolicy) !==
+        mapCodexAppServerApprovalPolicy(input.input.approvalPolicy)) {
+        mismatchedFields.push('approvalPolicy');
+    }
+    if (mismatchedFields.length === 0) {
+        return;
+    }
+    throw new VaultCliError('ASSISTANT_CODEX_APP_SERVER_PERMISSION_ATTESTATION_FAILED', 'Codex app-server did not attest the requested read-only execution context.', {
+        mismatchedFields,
+        retryable: false,
+    });
+}
 function emitCodexSuppressedFinalMessageTrace(input) {
     if (!input.onTraceEvent) {
         return;
@@ -2882,7 +3208,10 @@ function notifyCodexAppServerProviderRequestStartedBestEffort(input) {
         return;
     }
     try {
-        void Promise.resolve(input.hook({ startedAt: input.startedAt })).catch(() => {
+        void Promise.resolve(input.hook({
+            ...(input.timing ?? {}),
+            startedAt: input.startedAt,
+        })).catch(() => {
             // Provider-start hooks are diagnostic-only and must not block turns.
         });
     }
@@ -2892,6 +3221,7 @@ function notifyCodexAppServerProviderRequestStartedBestEffort(input) {
 }
 function isInvalidDynamicToolRequest(request) {
     return (request.kind === 'invalid-generate-image-arguments' ||
+        request.kind === 'invalid-assistant-style-arguments' ||
         request.kind === 'invalid-computer-arguments' ||
         request.kind === 'invalid-generate-voice-memo-arguments' ||
         request.kind === 'invalid-finish-without-reply-arguments' ||
@@ -2905,6 +3235,9 @@ function isSerializedDynamicToolRequest(request) {
         request.kind === 'generate-voice-memo' ||
         request.kind === 'generate-song' ||
         request.kind === 'attach-response-media' ||
+        request.kind === 'assistant-configuration' ||
+        request.kind === 'assistant-style' ||
+        request.kind === 'personalization' ||
         request.kind === 'submit-product-feedback' ||
         isComputerDynamicToolRequest(request);
 }
@@ -2977,7 +3310,9 @@ function resolveCodexRolloutRelativePath(input) {
 // remain attached (codex-rs `thread_processor.rs` `resume_running_thread`).
 // The thread/resume response echoes the effective execution context, so this
 // echo check is the only client-visible stale-rejoin signal before turn/start.
-// Fields with no requested value are skipped; requested fields must echo back.
+// Fields with no requested value are skipped; requested immutable execution
+// fields must echo back. Model is intentionally excluded because turn/start
+// applies its sticky model override atomically with the next user input.
 function assertCodexResumeContextMatches(input) {
     const result = asCodexRecord(input.threadResult);
     const actualCwd = normalizeNullableString(asCodexString(result?.cwd));
@@ -2993,11 +3328,6 @@ function assertCodexResumeContextMatches(input) {
             asCodexString(result?.approvalPolicy),
         ],
         ['cwd', input.input.workingDirectory, actualCwd ? path.resolve(actualCwd) : null],
-        [
-            'model',
-            normalizeNullableString(input.input.model),
-            normalizeNullableString(asCodexString(result?.model)),
-        ],
         [
             'modelProvider',
             normalizeNullableString(input.input.modelProvider),
@@ -3045,6 +3375,11 @@ function asCodexRecord(value) {
 function asCodexString(value) {
     return typeof value === 'string' ? value : null;
 }
+function asCodexStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === 'string')
+        ? value
+        : null;
+}
 const codexRolloutRelativePathPattern = /^sessions\/(\d{4})\/(\d{2})\/(\d{2})\/rollout-(\d{4})-(\d{2})-(\d{2})T[^/]+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/u;
 function normalizeCodexRolloutRelativePath(value, codexThreadId) {
     if (value.length === 0 ||