@openscout/scout 0.2.63 → 0.2.65

package/dist/pair-supervisor.mjs

@@ -5930,8 +5930,8 @@ class CodexAdapter extends BaseAdapter {
         const resumed = await this.request("thread/resume", {
           threadId: storedThreadId,
           cwd: options.cwd,
-          approvalPolicy: "never",
-          sandbox: "danger-full-access",
+          approvalPolicy: options.approvalPolicy ?? "never",
+          sandbox: options.sandbox ?? "danger-full-access",
           baseInstructions: options.systemPrompt,
           persistExtendedHistory: true
         });
@@ -5961,8 +5961,8 @@ class CodexAdapter extends BaseAdapter {
     }
     const started = await this.request("thread/start", {
       cwd: options.cwd,
-      approvalPolicy: "never",
-      sandbox: "danger-full-access",
+      approvalPolicy: options.approvalPolicy ?? "never",
+      sandbox: options.sandbox ?? "danger-full-access",
       baseInstructions: options.systemPrompt,
       ephemeral: false,
       experimentalRawEvents: false,
@@ -8321,10 +8321,12 @@ function scopesMatch(left, right) {
   if (left.sessionId !== right.sessionId) {
     return false;
   }
-  if (left.kind === "session") {
-    return true;
+  switch (left.kind) {
+    case "session":
+      return true;
+    case "file_change":
+      return right.kind === "file_change" && left.turnId === right.turnId && left.blockId === right.blockId;
   }
-  return left.turnId === right.turnId && left.blockId === right.blockId;
 }
 function pathForWebHandoffScope(scope) {
   switch (scope.kind) {
@@ -9097,6 +9099,40 @@ var BUILT_IN_HARNESS_CATALOG = [
       cwdFlag: "--cwd"
     },
     capabilities: ["chat", "invoke", "deliver", "review", "execute"]
+  },
+  {
+    name: "cursor",
+    harness: "cursor",
+    label: "Cursor Agent SDK",
+    description: "Programmatic agent execution via the Cursor Agent SDK",
+    homepage: "https://cursor.com",
+    tags: ["coding", "sdk", "cursor"],
+    featured: true,
+    order: 3,
+    support: {
+      ...DEFAULT_SUPPORT,
+      workspace: true,
+      collaboration: true,
+      files: true
+    },
+    install: {
+      binary: "mw",
+      requires: ["bun"],
+      macos: "bun install -g missionwriter",
+      linux: "bun install -g missionwriter",
+      windows: "bun install -g missionwriter"
+    },
+    readiness: {
+      anyOf: [
+        { kind: "env", key: "CURSOR_API_KEY" }
+      ],
+      notReadyMessage: "Cursor Agent SDK is available but CURSOR_API_KEY is not set."
+    },
+    capabilities: ["invoke", "deliver", "execute"],
+    metadata: {
+      sdkType: "cursor",
+      invocationModel: "one_shot"
+    }
   }
 ];
 function expandHomePath(value) {
@@ -10671,6 +10707,22 @@ function diagnoseAgentIdentity(identity, candidates) {
 var parseAgentSelector = parseAgentIdentity;
 var formatAgentSelector = formatAgentIdentity;
 var resolveAgentSelector = resolveAgentIdentity;
+// ../protocol/src/permission-policy.ts
+var SCOUT_PERMISSION_PROFILES = [
+  "observe",
+  "review",
+  "workspace_write",
+  "sandboxed_write",
+  "trusted_local",
+  "external_sandbox"
+];
+function normalizeScoutPermissionProfile(value) {
+  const normalized = value?.trim().replaceAll("-", "_");
+  return SCOUT_PERMISSION_PROFILES.find((profile) => profile === normalized);
+}
+function formatScoutPermissionProfiles() {
+  return SCOUT_PERMISSION_PROFILES.join("|");
+}
 // ../runtime/src/user-project-hints.ts
 import { readdir, readFile as readFile3, stat } from "fs/promises";
 import { homedir as homedir11 } from "os";
@@ -10996,7 +11048,7 @@ async function collectUserLevelProjectRootHints(options = {}) {
 // ../runtime/src/setup.ts
 var SCOUT_AGENT_ID = "scout";
 var SCOUT_PRIMARY_CONVERSATION_ID = "dm.scout.primary";
-var MANAGED_AGENT_HARNESSES = ["claude", "codex"];
+var MANAGED_AGENT_HARNESSES = ["claude", "codex", "cursor"];
 function titleCaseWords(value) {
   return value.split(/[\s._-]+/).map((part) => part.trim()).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
@@ -11115,6 +11167,10 @@ var PROJECT_HARNESS_MARKERS = {
     "AGENTS.md",
     "CODEX.md",
     ".codex"
+  ],
+  cursor: [
+    ".cursor",
+    ".cursorrules"
   ]
 };
 function partitionFlatAndNestedMarkers(markers) {
@@ -11179,6 +11235,9 @@ function normalizeManagedHarness(value, fallback) {
   if (value === "claude") {
     return "claude";
   }
+  if (value === "cursor") {
+    return "cursor";
+  }
   return fallback;
 }
 function titleCase(value) {
@@ -11352,12 +11411,15 @@ function normalizeCapabilities(value) {
   return normalized.length > 0 ? normalized : [...DEFAULT_CAPABILITIES];
 }
 function normalizeHarness(value, fallback) {
-  return value === "codex" ? "codex" : value === "claude" ? "claude" : fallback;
+  return value === "codex" ? "codex" : value === "claude" ? "claude" : value === "cursor" ? "cursor" : fallback;
 }
 function normalizeTransport(value, harness, fallback) {
   if (harness === "codex") {
     return "codex_app_server";
   }
+  if (harness === "cursor") {
+    return "cursor_exec";
+  }
   if (value === "claude_stream_json") {
     return "claude_stream_json";
   }
@@ -11367,11 +11429,13 @@ function normalizeTransport(value, harness, fallback) {
   return fallback === "codex_app_server" ? "claude_stream_json" : fallback;
 }
 function normalizeHarnessProfile(profile, harness, options) {
+  const permissionProfile = normalizeScoutPermissionProfile(typeof profile?.permissionProfile === "string" ? profile.permissionProfile : options.fallbackPermissionProfile);
   return {
     cwd: profile?.cwd ? normalizeProjectRelativePath(options.projectRoot, profile.cwd) : options.projectRoot,
     transport: normalizeTransport(profile?.transport, harness, harness === "codex" ? "codex_app_server" : DEFAULT_TRANSPORT),
     sessionId: normalizeTmuxSessionName(profile?.sessionId, `${options.sessionKey}-${harness}`, options.sessionPrefix),
-    launchArgs: normalizeLaunchArgs(profile?.launchArgs ?? options.fallbackLaunchArgs)
+    launchArgs: normalizeLaunchArgs(profile?.launchArgs ?? options.fallbackLaunchArgs),
+    ...permissionProfile ? { permissionProfile } : {}
   };
 }
 function buildHarnessProfiles(input) {
@@ -11387,7 +11451,8 @@ function buildHarnessProfiles(input) {
       projectRoot: input.projectRoot,
       sessionKey: input.sessionKey,
       sessionPrefix: input.sessionPrefix,
-      fallbackLaunchArgs: input.launchArgs
+      fallbackLaunchArgs: input.launchArgs,
+      fallbackPermissionProfile: input.permissionProfile
     });
   }
   for (const harness of MANAGED_AGENT_HARNESSES) {
@@ -11400,7 +11465,8 @@ function buildHarnessProfiles(input) {
         projectRoot: input.projectRoot,
         sessionKey: input.sessionKey,
         sessionPrefix: input.sessionPrefix,
-        fallbackLaunchArgs: profiles[harness]?.launchArgs ?? input.launchArgs
+        fallbackLaunchArgs: profiles[harness]?.launchArgs ?? input.launchArgs,
+        fallbackPermissionProfile: profiles[harness]?.permissionProfile ?? input.permissionProfile
       });
     }
   }
@@ -11408,7 +11474,8 @@ function buildHarnessProfiles(input) {
     projectRoot: input.projectRoot,
     sessionKey: input.sessionKey,
     sessionPrefix: input.sessionPrefix,
-    fallbackLaunchArgs: input.launchArgs
+    fallbackLaunchArgs: input.launchArgs,
+    fallbackPermissionProfile: input.permissionProfile
   });
   profiles[input.defaultHarness] = ensuredHarness;
   return profiles;
@@ -11858,7 +11925,8 @@ async function readLegacyAgentRegistry() {
 async function detectHarnessMarkers(projectRoot) {
   const detected = {
     claude: [],
-    codex: []
+    codex: [],
+    cursor: []
   };
   for (const harness of MANAGED_AGENT_HARNESSES) {
     for (const marker of PROJECT_HARNESS_MARKERS[harness]) {
@@ -12440,7 +12508,8 @@ async function resolveManifestBackedAgent(projectRoot, config, settings, overrid
     defaultHarness,
     profiles: config.agent?.runtime?.profiles,
     runtime: runtimeDefaults,
-    launchArgs: normalizeLaunchArgs(runtimeDefaults?.launchArgs)
+    launchArgs: normalizeLaunchArgs(runtimeDefaults?.launchArgs),
+    permissionProfile: normalizeScoutPermissionProfile(runtimeDefaults?.permissionProfile)
   });
   const view = resolvedRuntimeView(defaultHarness, harnessProfiles);
   const base = {
@@ -12515,7 +12584,7 @@ async function buildProjectInventoryEntry(agent, sourceRoot) {
       });
     }
   }
-  if (manifestDefaultHarness === "claude" || manifestDefaultHarness === "codex") {
+  if (manifestDefaultHarness === "claude" || manifestDefaultHarness === "codex" || manifestDefaultHarness === "cursor") {
     harnesses.set(manifestDefaultHarness, {
       harness: manifestDefaultHarness,
       source: "manifest",
@@ -12800,6 +12869,29 @@ function buildManagedAgentShellExports(options) {
 }
 
 // ../runtime/src/claude-stream-json.ts
+function resolveRequesterTimeoutMs(timeoutMs) {
+  if (typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0) {
+    return timeoutMs;
+  }
+  return null;
+}
+function waitForRequesterResult(promise, timeoutMs, label) {
+  const effectiveTimeoutMs = resolveRequesterTimeoutMs(timeoutMs);
+  if (effectiveTimeoutMs === null) {
+    return promise;
+  }
+  let timer = null;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`Timed out after ${effectiveTimeoutMs}ms waiting for ${label}.`));
+    }, effectiveTimeoutMs);
+  });
+  return Promise.race([promise, timeout]).finally(() => {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  });
+}
 function resolveClaudeStreamJsonOutput(result, fallbackParts) {
   const trimmedResult = result?.trim();
   if (trimmedResult) {
@@ -12896,7 +12988,7 @@ class ClaudeStreamJsonSession {
       sessionId: this.claudeSessionId
     };
   }
-  async invoke(prompt, stallTimeoutMs = 10 * 60000) {
+  async invoke(prompt, timeoutMs) {
     await this.ensureStarted();
     if (!this.process?.stdin) {
       throw new Error(`Claude stream-json session for ${this.options.agentName} is not running.`);
@@ -12908,13 +13000,10 @@ class ClaudeStreamJsonSession {
       const turn = {
         id: randomUUID(),
         output: [],
-        timer: null,
-        stallMs: stallTimeoutMs,
         resolve: resolve4,
         reject
       };
       this.activeTurn = turn;
-      this.resetTurnWatchdog(turn);
     });
     const payload = JSON.stringify({
       type: "user",
@@ -12927,7 +13016,7 @@ class ClaudeStreamJsonSession {
     }) + `
 `;
     this.process.stdin.write(payload);
-    const output = await outputPromise;
+    const output = await waitForRequesterResult(outputPromise, timeoutMs, this.options.agentName);
     return {
       output,
       sessionId: this.claudeSessionId
@@ -12949,27 +13038,10 @@ class ClaudeStreamJsonSession {
     }) + `
 `);
   }
-  resetTurnWatchdog(turn) {
-    if (turn.timer) {
-      clearTimeout(turn.timer);
-    }
-    turn.timer = setTimeout(() => {
-      this.interrupt().catch(() => {
-        return;
-      });
-      if (this.activeTurn?.id === turn.id) {
-        this.activeTurn = null;
-      }
-      turn.reject(new Error(`${this.options.agentName} stalled \u2014 no stream event in ${turn.stallMs}ms`));
-    }, turn.stallMs);
-  }
   async shutdown(options = {}) {
     const turn = this.activeTurn;
     this.activeTurn = null;
     if (turn) {
-      if (turn.timer) {
-        clearTimeout(turn.timer);
-      }
       turn.reject(new Error(`Claude stream-json session for ${this.options.agentName} was shut down.`));
     }
     const child = this.process;
@@ -13047,9 +13119,6 @@ class ClaudeStreamJsonSession {
       if (this.activeTurn) {
         const turn = this.activeTurn;
         this.activeTurn = null;
-        if (turn.timer) {
-          clearTimeout(turn.timer);
-        }
         turn.reject(new Error(`Claude process error: ${error.message}`));
       }
     });
@@ -13080,9 +13149,6 @@ class ClaudeStreamJsonSession {
       if (code !== 0 && this.activeTurn) {
         const turn = this.activeTurn;
         this.activeTurn = null;
-        if (turn.timer) {
-          clearTimeout(turn.timer);
-        }
         turn.reject(new Error(`Claude exited with code ${code}`));
       }
     });
@@ -13104,7 +13170,6 @@ class ClaudeStreamJsonSession {
     if (!turn) {
       return;
     }
-    this.resetTurnWatchdog(turn);
     if (event.type === "assistant") {
       const content = event.message?.content ?? event.content ?? [];
       for (const part of content) {
@@ -13116,17 +13181,11 @@ class ClaudeStreamJsonSession {
     }
     if (event.type === "result") {
       this.activeTurn = null;
-      if (turn.timer) {
-        clearTimeout(turn.timer);
-      }
       turn.resolve(resolveClaudeStreamJsonOutput(event.result, turn.output));
       return;
     }
     if (event.type === "error") {
       this.activeTurn = null;
-      if (turn.timer) {
-        clearTimeout(turn.timer);
-      }
       turn.reject(new Error(event.error?.message ?? event.message ?? "Unknown Claude error"));
     }
   }
@@ -13179,10 +13238,17 @@ function normalizeCodexModelValue(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : null;
 }
+function normalizeCodexReasoningEffortValue(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
 function encodeCodexModelConfig(model) {
   return `model=${JSON.stringify(model)}`;
 }
-function parseCodexModelConfig(value) {
+function encodeCodexReasoningEffortConfig(reasoningEffort) {
+  return `model_reasoning_effort=${JSON.stringify(reasoningEffort)}`;
+}
+function parseCodexConfigValue(value, expectedKey) {
   const trimmed = value?.trim();
   if (!trimmed) {
     return null;
@@ -13192,7 +13258,7 @@ function parseCodexModelConfig(value) {
     return null;
   }
   const key = trimmed.slice(0, separatorIndex).trim();
-  if (key !== "model") {
+  if (key !== expectedKey) {
     return null;
   }
   const rawValue = trimmed.slice(separatorIndex + 1).trim();
@@ -13204,6 +13270,12 @@ function parseCodexModelConfig(value) {
   }
   return rawValue;
 }
+function parseCodexModelConfig(value) {
+  return parseCodexConfigValue(value, "model");
+}
+function parseCodexReasoningEffortConfig(value) {
+  return parseCodexConfigValue(value, "model_reasoning_effort");
+}
 function normalizeCodexAppServerLaunchArgs(launchArgs) {
   const args = Array.isArray(launchArgs) ? launchArgs.map((entry) => String(entry).trim()).filter(Boolean) : [];
   const normalized = [];
@@ -13233,11 +13305,36 @@ function normalizeCodexAppServerLaunchArgs(launchArgs) {
         continue;
       }
     }
+    if (current === "--reasoning-effort" || current === "--effort") {
+      const reasoningEffort = normalizeCodexReasoningEffortValue(args[index + 1]);
+      if (reasoningEffort) {
+        normalized.push("-c", encodeCodexReasoningEffortConfig(reasoningEffort));
+        index += 1;
+        continue;
+      }
+      normalized.push(current);
+      continue;
+    }
+    if (current.startsWith("--reasoning-effort=")) {
+      const reasoningEffort = normalizeCodexReasoningEffortValue(current.slice("--reasoning-effort=".length));
+      if (reasoningEffort) {
+        normalized.push("-c", encodeCodexReasoningEffortConfig(reasoningEffort));
+        continue;
+      }
+    }
+    if (current.startsWith("--effort=")) {
+      const reasoningEffort = normalizeCodexReasoningEffortValue(current.slice("--effort=".length));
+      if (reasoningEffort) {
+        normalized.push("-c", encodeCodexReasoningEffortConfig(reasoningEffort));
+        continue;
+      }
+    }
     if (current === "-c" || current === "--config") {
       const next = args[index + 1];
       if (typeof next === "string") {
         const model = parseCodexModelConfig(next);
-        normalized.push(current === "--config" ? "--config" : "-c", model ? encodeCodexModelConfig(model) : next);
+        const reasoningEffort = parseCodexReasoningEffortConfig(next);
+        normalized.push(current === "--config" ? "--config" : "-c", model ? encodeCodexModelConfig(model) : reasoningEffort ? encodeCodexReasoningEffortConfig(reasoningEffort) : next);
         index += 1;
         continue;
       }
@@ -13245,7 +13342,8 @@ function normalizeCodexAppServerLaunchArgs(launchArgs) {
     if (current.startsWith("--config=")) {
       const value = current.slice("--config=".length);
       const model = parseCodexModelConfig(value);
-      normalized.push(model ? `--config=${encodeCodexModelConfig(model)}` : current);
+      const reasoningEffort = parseCodexReasoningEffortConfig(value);
+      normalized.push(model ? `--config=${encodeCodexModelConfig(model)}` : reasoningEffort ? `--config=${encodeCodexReasoningEffortConfig(reasoningEffort)}` : current);
       continue;
     }
     normalized.push(current);
@@ -13273,6 +13371,50 @@ function readCodexAppServerModelFromLaunchArgs(launchArgs) {
   }
   return null;
 }
+function readCodexAppServerReasoningEffortFromLaunchArgs(launchArgs) {
+  const normalized = normalizeCodexAppServerLaunchArgs(launchArgs);
+  for (let index = 0;index < normalized.length; index += 1) {
+    const current = normalized[index] ?? "";
+    if (current === "-c" || current === "--config") {
+      const reasoningEffort = parseCodexReasoningEffortConfig(normalized[index + 1]);
+      if (reasoningEffort) {
+        return reasoningEffort;
+      }
+      index += 1;
+      continue;
+    }
+    if (current.startsWith("--config=")) {
+      const reasoningEffort = parseCodexReasoningEffortConfig(current.slice("--config=".length));
+      if (reasoningEffort) {
+        return reasoningEffort;
+      }
+    }
+  }
+  return null;
+}
+function resolveRequesterTimeoutMs2(timeoutMs) {
+  if (typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0) {
+    return timeoutMs;
+  }
+  return null;
+}
+function waitForRequesterResult2(promise, timeoutMs, label) {
+  const effectiveTimeoutMs = resolveRequesterTimeoutMs2(timeoutMs);
+  if (effectiveTimeoutMs === null) {
+    return promise;
+  }
+  let timer = null;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`Timed out after ${effectiveTimeoutMs}ms waiting for ${label}.`));
+    }, effectiveTimeoutMs);
+  });
+  return Promise.race([promise, timeout]).finally(() => {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  });
+}
 function sessionKey2(options) {
   return `${options.agentName}:${options.sessionId}`;
 }
@@ -13375,23 +13517,86 @@ async function readOptionalFile2(filePath) {
     return null;
   }
 }
+var SESSION_CATALOG_FILENAME2 = "session-catalog.json";
+var SESSION_CATALOG_MAX_ENTRIES2 = 64;
+async function readCodexSessionCatalog(runtimeDirectory) {
+  const raw = await readOptionalFile2(join13(runtimeDirectory, SESSION_CATALOG_FILENAME2));
+  if (!raw) {
+    return { activeSessionId: null, sessions: [] };
+  }
+  const parsed = parseCodexMaybeJson(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { activeSessionId: null, sessions: [] };
+  }
+  return {
+    activeSessionId: typeof parsed.activeSessionId === "string" ? parsed.activeSessionId : null,
+    sessions: Array.isArray(parsed.sessions) ? parsed.sessions.filter((entry) => Boolean(entry) && typeof entry === "object" && typeof entry.id === "string" && typeof entry.startedAt === "number" && typeof entry.cwd === "string") : []
+  };
+}
+async function writeCodexSessionCatalog(runtimeDirectory, catalog) {
+  await mkdir5(runtimeDirectory, { recursive: true });
+  await writeFile5(join13(runtimeDirectory, SESSION_CATALOG_FILENAME2), JSON.stringify(catalog, null, 2) + `
+`);
+}
+async function recordCodexSessionCatalog(runtimeDirectory, threadId, input) {
+  const catalog = await readCodexSessionCatalog(runtimeDirectory);
+  const now = Date.now();
+  const sessions2 = catalog.sessions.map((session) => session.id === catalog.activeSessionId && session.id !== threadId && !session.endedAt ? { ...session, endedAt: now } : session);
+  if (!sessions2.some((session) => session.id === threadId)) {
+    sessions2.push({
+      id: threadId,
+      startedAt: now,
+      cwd: input.cwd,
+      harness: input.harness,
+      transport: input.transport,
+      model: input.model,
+      approvalPolicy: input.approvalPolicy,
+      sandbox: input.sandbox
+    });
+  }
+  while (sessions2.length > SESSION_CATALOG_MAX_ENTRIES2) {
+    sessions2.shift();
+  }
+  await writeCodexSessionCatalog(runtimeDirectory, {
+    activeSessionId: threadId,
+    sessions: sessions2
+  });
+}
+async function closeCodexSessionCatalog(runtimeDirectory, threadId) {
+  const catalog = await readCodexSessionCatalog(runtimeDirectory);
+  const now = Date.now();
+  const activeSessionId = threadId ?? catalog.activeSessionId;
+  const sessions2 = catalog.sessions.map((session) => session.id === activeSessionId && !session.endedAt ? { ...session, endedAt: now } : session);
+  await writeCodexSessionCatalog(runtimeDirectory, {
+    activeSessionId: null,
+    sessions: sessions2
+  });
+}
+function parseCodexMaybeJson(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return value;
+  }
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return value;
+  }
+}
 function isMissingCodexRolloutError2(error) {
   const message = errorMessage3(error).toLowerCase();
   return message.includes("no rollout found for thread id");
 }
-function resolveCodexCompletionGraceMs() {
-  const parsed = Number.parseInt(process.env.OPENSCOUT_CODEX_COMPLETION_GRACE_MS ?? "", 10);
-  if (Number.isFinite(parsed) && parsed >= 0) {
-    return parsed;
-  }
-  return 60000;
-}
 
 class CodexAppServerSession {
   options;
   key;
   threadIdPath;
   statePath;
+  replyContextPath;
   stdoutLogPath;
   stderrLogPath;
   process = null;
@@ -13409,6 +13614,7 @@ class CodexAppServerSession {
     this.key = sessionKey2(options);
     this.threadIdPath = join13(options.runtimeDirectory, "codex-thread-id.txt");
     this.statePath = join13(options.runtimeDirectory, "state.json");
+    this.replyContextPath = join13(options.runtimeDirectory, "scout-reply-context.json");
     this.stdoutLogPath = join13(options.logsDirectory, "stdout.log");
     this.stderrLogPath = join13(options.logsDirectory, "stderr.log");
     this.lastConfigSignature = this.configSignature(options);
@@ -13432,15 +13638,16 @@ class CodexAppServerSession {
       threadId: this.threadId
     };
   }
-  async invoke(prompt, timeoutMs = 5 * 60000) {
+  async invoke(prompt, timeoutMs, replyContext) {
     return this.enqueue(async () => {
       await this.ensureStarted();
       if (!this.threadId) {
         throw new Error(`Codex app-server session for ${this.options.agentName} has no active thread.`);
       }
-      const output = await new Promise(async (resolve4, reject) => {
-        const turn = this.createActiveTurn(resolve4, reject, timeoutMs);
+      const outputPromise = new Promise(async (resolve4, reject) => {
+        const turn = this.createActiveTurn(resolve4, reject);
         try {
+          await this.writeReplyContext(replyContext ?? null);
           const response = await this.request("turn/start", {
             threadId: this.threadId,
             cwd: this.options.cwd,
@@ -13455,10 +13662,12 @@ class CodexAppServerSession {
           turn.turnId = response.turn.id;
           await this.persistState();
         } catch (error) {
+          await this.clearReplyContext();
           this.clearActiveTurn(turn);
           reject(error instanceof Error ? error : new Error(errorMessage3(error)));
         }
       });
+      const output = await waitForRequesterResult2(outputPromise, timeoutMs, this.options.agentName);
       return {
         output,
         threadId: this.threadId
@@ -13468,7 +13677,7 @@ class CodexAppServerSession {
   hasActiveTurn() {
     return Boolean(this.activeTurn);
   }
-  async steerAndWait(prompt, timeoutMs = 5 * 60000) {
+  async steerAndWait(prompt, timeoutMs) {
     await this.ensureStarted();
     if (!this.threadId) {
       throw new Error(`Codex app-server session for ${this.options.agentName} has no active thread.`);
@@ -13532,9 +13741,6 @@ class CodexAppServerSession {
     const activeTurn = this.activeTurn;
     this.activeTurn = null;
     if (activeTurn) {
-      if (activeTurn.timer) {
-        clearTimeout(activeTurn.timer);
-      }
       activeTurn.reject(new Error(`Codex app-server session for ${this.options.agentName} was shut down.`));
     }
     for (const pending of this.pendingRequests.values()) {
@@ -13553,6 +13759,7 @@ class CodexAppServerSession {
       }
     }
     if (options.resetThread) {
+      await closeCodexSessionCatalog(this.options.runtimeDirectory, this.threadId);
       this.threadId = null;
       this.threadPath = null;
       await rm4(this.threadIdPath, { force: true });
@@ -13573,6 +13780,8 @@ class CodexAppServerSession {
       cwd: options.cwd,
       sessionId: options.sessionId,
       systemPrompt: options.systemPrompt,
+      approvalPolicy: options.approvalPolicy ?? "never",
+      sandbox: options.sandbox ?? "danger-full-access",
       threadId: options.threadId ?? null,
       requireExistingThread: options.requireExistingThread === true,
       launchArgs: normalizeCodexAppServerLaunchArgs(options.launchArgs)
@@ -13603,6 +13812,7 @@ class CodexAppServerSession {
       currentDirectory: this.options.cwd,
       baseEnv: process.env
     });
+    env.OPENSCOUT_REPLY_CONTEXT_FILE = this.replyContextPath;
     const child = spawn3(codexExecutable, [
       "app-server",
       ...buildScoutMcpCodexLaunchArgs({
@@ -13658,14 +13868,15 @@ class CodexAppServerSession {
         const resumed = await this.request("thread/resume", {
           threadId: storedThreadId,
           cwd: this.options.cwd,
-          approvalPolicy: "never",
-          sandbox: "danger-full-access",
+          approvalPolicy: this.options.approvalPolicy ?? "never",
+          sandbox: this.options.sandbox ?? "danger-full-access",
           baseInstructions: this.options.systemPrompt,
           persistExtendedHistory: true
         });
         this.threadId = resumed.thread.id;
         this.threadPath = resumed.thread.path ?? null;
         await this.persistThreadId();
+        await recordCodexSessionCatalog(this.options.runtimeDirectory, this.threadId, this.catalogRuntimeMeta());
         return;
       } catch (error) {
         await appendFile3(this.stderrLogPath, `[openscout] failed to resume stored Codex thread ${storedThreadId}: ${errorMessage3(error)}
@@ -13688,8 +13899,8 @@ class CodexAppServerSession {
     }
     const started = await this.request("thread/start", {
       cwd: this.options.cwd,
-      approvalPolicy: "never",
-      sandbox: "danger-full-access",
+      approvalPolicy: this.options.approvalPolicy ?? "never",
+      sandbox: this.options.sandbox ?? "danger-full-access",
       baseInstructions: this.options.systemPrompt,
       ephemeral: false,
       experimentalRawEvents: false,
@@ -13698,71 +13909,47 @@ class CodexAppServerSession {
     this.threadId = started.thread.id;
     this.threadPath = started.thread.path ?? null;
     await this.persistThreadId();
+    await recordCodexSessionCatalog(this.options.runtimeDirectory, this.threadId, this.catalogRuntimeMeta());
   }
-  createActiveTurn(resolve4, reject, timeoutMs) {
+  catalogRuntimeMeta() {
+    return {
+      cwd: this.options.cwd,
+      harness: "codex",
+      transport: "codex_app_server",
+      model: readCodexAppServerModelFromLaunchArgs(this.options.launchArgs),
+      approvalPolicy: this.options.approvalPolicy ?? "never",
+      sandbox: this.options.sandbox ?? "danger-full-access"
+    };
+  }
+  createActiveTurn(resolve4, reject) {
     if (this.activeTurn) {
       throw new Error(`Codex app-server session for ${this.options.agentName} already has an active turn.`);
     }
     const turn = {
       turnId: "",
       startedAt: Date.now(),
-      timer: null,
-      graceTimer: null,
-      timedOutAt: null,
       messageOrder: [],
       messageByItemId: new Map,
       resolve: resolve4,
       reject,
       watchers: []
     };
-    turn.timer = setTimeout(() => {
-      this.scheduleTurnTimeout(turn, timeoutMs);
-    }, timeoutMs);
     this.activeTurn = turn;
     return turn;
   }
-  buildTurnTimeoutError(timeoutMs) {
-    return new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`);
-  }
-  scheduleTurnTimeout(turn, timeoutMs) {
-    if (turn.timedOutAt !== null) {
-      return;
-    }
-    turn.timedOutAt = Date.now();
-    this.interrupt().catch(() => {
-      return;
-    });
-    const graceMs = resolveCodexCompletionGraceMs();
-    if (graceMs <= 0) {
-      this.rejectTimedOutTurn(turn, timeoutMs);
-      return;
-    }
-    turn.graceTimer = setTimeout(() => {
-      this.rejectTimedOutTurn(turn, timeoutMs);
-    }, graceMs);
-  }
-  rejectTimedOutTurn(turn, timeoutMs) {
-    if (this.activeTurn !== turn) {
-      this.clearActiveTurn(turn);
-      return;
-    }
-    this.clearActiveTurn(turn);
-    const error = this.buildTurnTimeoutError(timeoutMs);
-    for (const watcher of this.drainTurnWatchers(turn)) {
-      watcher.reject(error);
-    }
-    turn.reject(error);
-  }
   addTurnWatcher(turn, resolve4, reject, timeoutMs) {
     const watcher = {
       resolve: resolve4,
       reject,
       timer: null
     };
-    watcher.timer = setTimeout(() => {
-      this.removeTurnWatcher(turn, watcher);
-      reject(new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`));
-    }, timeoutMs);
+    const effectiveTimeoutMs = resolveRequesterTimeoutMs2(timeoutMs);
+    if (effectiveTimeoutMs !== null) {
+      watcher.timer = setTimeout(() => {
+        this.removeTurnWatcher(turn, watcher);
+        reject(new Error(`Timed out after ${effectiveTimeoutMs}ms waiting for ${this.options.agentName}.`));
+      }, effectiveTimeoutMs);
+    }
     turn.watchers.push(watcher);
     return watcher;
   }
@@ -13783,12 +13970,6 @@ class CodexAppServerSession {
     return watchers;
   }
   clearActiveTurn(turn) {
-    if (turn.timer) {
-      clearTimeout(turn.timer);
-    }
-    if (turn.graceTimer) {
-      clearTimeout(turn.graceTimer);
-    }
     if (this.activeTurn === turn) {
       this.activeTurn = null;
     }
@@ -13845,6 +14026,20 @@ class CodexAppServerSession {
       error: buildUnsupportedServerRequestError2(message)
     });
   }
+  async writeReplyContext(context) {
+    if (!context) {
+      await this.clearReplyContext();
+      return;
+    }
+    await mkdir5(this.options.runtimeDirectory, { recursive: true });
+    await writeFile5(this.replyContextPath, `${JSON.stringify(context, null, 2)}
+`, "utf8");
+  }
+  async clearReplyContext() {
+    await rm4(this.replyContextPath, { force: true }).catch(() => {
+      return;
+    });
+  }
   handleNotification(message) {
     const method = message.method;
     const params = message.params ?? {};
@@ -13899,6 +14094,7 @@ class CodexAppServerSession {
       return;
     }
     if (method === "turn/completed") {
+      this.clearReplyContext();
       this.completeTurn(params);
       return;
     }
@@ -13970,9 +14166,6 @@ class CodexAppServerSession {
     const activeTurn = this.activeTurn;
     this.activeTurn = null;
     if (activeTurn) {
-      if (activeTurn.timer) {
-        clearTimeout(activeTurn.timer);
-      }
       for (const watcher of this.drainTurnWatchers(activeTurn)) {
         watcher.reject(error);
       }
@@ -14076,6 +14269,8 @@ async function shutdownCodexAppServerAgent(options, shutdownOptions = {}) {
   if (!session) {
     if (shutdownOptions.resetThread) {
       const runtimeDirectory = options.runtimeDirectory;
+      const threadId = await readOptionalFile2(join13(runtimeDirectory, "codex-thread-id.txt"));
+      await closeCodexSessionCatalog(runtimeDirectory, threadId);
       await rm4(join13(runtimeDirectory, "codex-thread-id.txt"), { force: true });
     }
     return;
@@ -14627,12 +14822,15 @@ function runtimePackageDir() {
   const explicit = process.env.OPENSCOUT_RUNTIME_PACKAGE_DIR?.trim();
   if (explicit)
     return explicit;
-  const fromGlobal = findGlobalRuntimeDir();
-  if (fromGlobal)
-    return fromGlobal;
+  const fromBundledPackage = findBundledRuntimeDir();
+  if (fromBundledPackage)
+    return fromBundledPackage;
   const fromCwd = findWorkspaceRuntimeDir(process.cwd());
   if (fromCwd)
     return fromCwd;
+  const fromGlobal = findGlobalRuntimeDir();
+  if (fromGlobal)
+    return fromGlobal;
   const moduleDir = dirname6(fileURLToPath4(import.meta.url));
   return resolve5(moduleDir, "..");
 }
@@ -14654,6 +14852,8 @@ function findGlobalRuntimeDir() {
     const scoutBin = result.stdout?.trim();
     if (scoutBin) {
       const scoutPkg = resolve5(scoutBin, "..", "..");
+      if (isInstalledRuntimePackageDir(scoutPkg))
+        return scoutPkg;
       const nested = join15(scoutPkg, "node_modules", "@openscout", "runtime");
       if (isInstalledRuntimePackageDir(nested))
         return nested;
@@ -14664,6 +14864,11 @@ function findGlobalRuntimeDir() {
   } catch {}
   return null;
 }
+function findBundledRuntimeDir() {
+  const moduleDir = dirname6(fileURLToPath4(import.meta.url));
+  const candidate = resolve5(moduleDir, "..");
+  return isInstalledRuntimePackageDir(candidate) ? candidate : null;
+}
 function findWorkspaceRuntimeDir(startDir) {
   let current = resolve5(startDir);
   while (true) {
@@ -14702,10 +14907,21 @@ function resolveBrokerStartTimeoutMs() {
   return DEFAULT_BROKER_START_TIMEOUT_MS;
 }
 function resolveBrokerServiceLabel(mode) {
-  const explicit = process.env.OPENSCOUT_BROKER_SERVICE_LABEL?.trim();
+  const explicit = process.env.OPENSCOUT_SERVICE_LABEL?.trim() || process.env.OPENSCOUT_BROKER_SERVICE_LABEL?.trim();
   if (explicit) {
     return explicit;
   }
+  switch (mode) {
+    case "prod":
+      return "com.openscout";
+    case "custom":
+      return "com.openscout.custom";
+    case "dev":
+    default:
+      return "dev.openscout";
+  }
+}
+function legacyBrokerServiceLabel(mode) {
   switch (mode) {
     case "prod":
       return "com.openscout.broker";
@@ -14764,6 +14980,7 @@ function renderLaunchAgentPlist(config) {
     OPENSCOUT_CONTROL_HOME: config.controlHome,
     OPENSCOUT_BROKER_SERVICE_MODE: config.mode,
     OPENSCOUT_BROKER_SERVICE_LABEL: config.label,
+    OPENSCOUT_SERVICE_LABEL: config.label,
     OPENSCOUT_ADVERTISE_SCOPE: config.advertiseScope,
     HOME: homedir14(),
     PATH: launchPath,
@@ -14792,7 +15009,7 @@ function renderLaunchAgentPlist(config) {
   <array>
     <string>${xmlEscape(config.bunExecutable)}</string>
     <string>${xmlEscape(join15(config.runtimePackageDir, "bin", "openscout-runtime.mjs"))}</string>
-    <string>broker</string>
+    <string>base</string>
   </array>
   <key>WorkingDirectory</key>
   <string>${xmlEscape(config.runtimePackageDir)}</string>
@@ -14856,6 +15073,22 @@ function writeLaunchAgentPlist(config) {
   ensureServiceDirectories(config);
   writeFileSync5(config.launchAgentPath, renderLaunchAgentPlist(config), "utf8");
 }
+function bootoutCommand(config) {
+  return `${launchctlPath()} bootout ${config.serviceTarget}`;
+}
+function legacyLaunchAgentPath(config) {
+  return join15(homedir14(), "Library", "LaunchAgents", `${legacyBrokerServiceLabel(config.mode)}.plist`);
+}
+function legacyServiceTarget(config) {
+  return `${config.domainTarget}/${legacyBrokerServiceLabel(config.mode)}`;
+}
+function bootoutLegacyBrokerService(config) {
+  const legacyTarget = legacyServiceTarget(config);
+  if (legacyTarget === config.serviceTarget) {
+    return;
+  }
+  runCommand(launchctlPath(), ["bootout", legacyTarget], { allowFailure: true });
+}
 function runCommand(command, args, options) {
   const result = spawnSync(command, args, {
     env: {
@@ -14974,6 +15207,7 @@ async function brokerServiceStatus(config = resolveBrokerServiceConfig()) {
     label: config.label,
     mode: config.mode,
     launchAgentPath: config.launchAgentPath,
+    bootoutCommand: bootoutCommand(config),
     brokerUrl: config.brokerUrl,
     brokerSocketPath: config.brokerSocketPath,
     supportDirectory: config.supportDirectory,
@@ -14993,10 +15227,12 @@ async function brokerServiceStatus(config = resolveBrokerServiceConfig()) {
   };
 }
 async function installBrokerService(config = resolveBrokerServiceConfig()) {
+  bootoutLegacyBrokerService(config);
   writeLaunchAgentPlist(config);
   return brokerServiceStatus(config);
 }
 async function startBrokerService(config = resolveBrokerServiceConfig()) {
+  bootoutLegacyBrokerService(config);
   writeLaunchAgentPlist(config);
   runCommand(launchctlPath(), ["bootout", config.serviceTarget], { allowFailure: true });
   runCommand(launchctlPath(), ["bootstrap", config.domainTarget, config.launchAgentPath], { allowFailure: true });
@@ -15035,6 +15271,11 @@ async function uninstallBrokerService(config = resolveBrokerServiceConfig()) {
   if (existsSync13(config.launchAgentPath)) {
     rmSync2(config.launchAgentPath, { force: true });
   }
+  const legacyPath = legacyLaunchAgentPath(config);
+  bootoutLegacyBrokerService(config);
+  if (existsSync13(legacyPath)) {
+    rmSync2(legacyPath, { force: true });
+  }
   return brokerServiceStatus(config);
 }
 async function main() {
@@ -15076,6 +15317,7 @@ function formatBrokerServiceStatus(status) {
     `label: ${status.label}`,
     `mode: ${status.mode}`,
     `launch agent: ${status.installed ? status.launchAgentPath : "not installed"}`,
+    `bootout: ${status.bootoutCommand}`,
     `loaded: ${status.loaded ? "yes" : "no"}`,
     `pid: ${status.pid ?? "\u2014"}`,
     `launchd state: ${status.launchdState ?? "\u2014"}`,
@@ -15105,6 +15347,58 @@ var LOCAL_AGENT_SYSTEM_PROMPT_TEMPLATE_HINT = [
   "{{relay_hub}}, {{broker_url}}, {{relay_command}}, {{openscout_root}}, {{relay_agent_comms_skill}}, and {{env.NAME}} variables."
 ].join("");
 
+// ../runtime/src/permission-policy.ts
+function parseScoutPermissionProfile(value) {
+  const profile = normalizeScoutPermissionProfile(value);
+  if (value && !profile) {
+    throw new Error(`Unknown permission profile "${value}". Expected one of: ${formatScoutPermissionProfiles()}.`);
+  }
+  return profile;
+}
+function compileCodexPermissionProfile(profileInput) {
+  const profile = profileInput ? parseScoutPermissionProfile(profileInput) ?? "trusted_local" : "trusted_local";
+  switch (profile) {
+    case "observe":
+    case "review":
+      return {
+        profile,
+        sandbox: "read-only",
+        approvalPolicy: "on-request",
+        enforcement: "native"
+      };
+    case "workspace_write":
+      return {
+        profile,
+        sandbox: "workspace-write",
+        approvalPolicy: "on-request",
+        enforcement: "native"
+      };
+    case "sandboxed_write":
+      return {
+        profile,
+        sandbox: "workspace-write",
+        approvalPolicy: "on-request",
+        enforcement: "advisory",
+        note: "External sandbox placement is not wired yet; Codex receives its native workspace-write sandbox."
+      };
+    case "external_sandbox":
+      return {
+        profile,
+        sandbox: "workspace-write",
+        approvalPolicy: "on-request",
+        enforcement: "advisory",
+        note: "External sandbox placement is not wired yet; Codex receives its native workspace-write sandbox."
+      };
+    case "trusted_local":
+      return {
+        profile,
+        sandbox: "danger-full-access",
+        approvalPolicy: "never",
+        enforcement: "native"
+      };
+  }
+}
+
 // ../runtime/src/local-agents.ts
 var MODULE_DIRECTORY = dirname7(fileURLToPath5(import.meta.url));
 var OPENSCOUT_REPO_ROOT = resolve6(MODULE_DIRECTORY, "..", "..", "..");
@@ -15554,6 +15848,46 @@ function buildLaunchArgsForRequestedModel(harness, model) {
   }
   return [];
 }
+function normalizeRequestedReasoningEffort(reasoningEffort) {
+  const trimmed = reasoningEffort?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function stripLaunchReasoningEffortForHarness(harness, launchArgs) {
+  if (harness !== "codex") {
+    return normalizeLaunchArgsForHarness(harness, launchArgs);
+  }
+  const next = [];
+  const normalized = normalizeCodexAppServerLaunchArgs(launchArgs);
+  for (let index = 0;index < normalized.length; index += 1) {
+    const current = normalized[index] ?? "";
+    if (current === "-c" || current === "--config") {
+      const value = normalized[index + 1];
+      if (readCodexAppServerReasoningEffortFromLaunchArgs(value ? [current, value] : [current])) {
+        index += 1;
+        continue;
+      }
+      next.push(current);
+      if (value) {
+        next.push(value);
+        index += 1;
+      }
+      continue;
+    }
+    if (current.startsWith("--config=")) {
+      if (readCodexAppServerReasoningEffortFromLaunchArgs([current])) {
+        continue;
+      }
+    }
+    next.push(current);
+  }
+  return next;
+}
+function buildLaunchArgsForRequestedReasoningEffort(harness, reasoningEffort) {
+  if (harness === "codex") {
+    return normalizeCodexAppServerLaunchArgs(["--reasoning-effort", reasoningEffort]);
+  }
+  return [];
+}
 function applyRequestedModelToLaunchArgs(harness, launchArgs, model) {
   const normalized = normalizeLaunchArgsForHarness(harness, launchArgs);
   const requestedModel = normalizeRequestedModel(model);
@@ -15565,6 +15899,17 @@ function applyRequestedModelToLaunchArgs(harness, launchArgs, model) {
     ...buildLaunchArgsForRequestedModel(harness, requestedModel)
   ];
 }
+function applyRequestedRuntimeOptionsToLaunchArgs(harness, launchArgs, options) {
+  const withModel = applyRequestedModelToLaunchArgs(harness, launchArgs, options.model);
+  const requestedReasoningEffort = normalizeRequestedReasoningEffort(options.reasoningEffort);
+  if (!requestedReasoningEffort) {
+    return withModel;
+  }
+  return [
+    ...stripLaunchReasoningEffortForHarness(harness, withModel),
+    ...buildLaunchArgsForRequestedReasoningEffort(harness, requestedReasoningEffort)
+  ];
+}
 function defaultHarnessForOverride(override, fallback = "claude") {
   return normalizeManagedHarness2(override.defaultHarness ?? override.runtime?.harness, fallback);
 }
@@ -15584,16 +15929,17 @@ function overrideHarnessProfile(override, harness) {
     cwd: normalizeProjectPath(profile?.cwd || override.runtime?.cwd || override.projectRoot || process.cwd()),
     transport: normalizeLocalAgentTransport(profile?.transport ?? override.runtime?.transport, harness),
     sessionId: normalizeTmuxSessionName2(profile?.sessionId, `${override.agentId}-${harness}`),
-    launchArgs: launchArgsForOverrideHarness(override, harness)
+    launchArgs: launchArgsForOverrideHarness(override, harness),
+    ...profile?.permissionProfile ? { permissionProfile: profile.permissionProfile } : {}
   };
 }
 function normalizeManagedHarness2(value, fallback) {
-  return value === "codex" ? "codex" : value === "claude" ? "claude" : fallback;
+  return value === "codex" ? "codex" : value === "claude" ? "claude" : value === "cursor" ? "cursor" : fallback;
 }
 function normalizeLocalHarnessProfiles(agentId, record) {
   const defaultHarness = normalizeManagedHarness2(typeof record.defaultHarness === "string" ? record.defaultHarness : record.harness, "claude");
   const nextProfiles = {};
-  for (const harness of ["claude", "codex"]) {
+  for (const harness of ["claude", "codex", "cursor"]) {
     const profile = record.harnessProfiles?.[harness];
     if (!profile) {
       continue;
@@ -15602,7 +15948,8 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(profile.cwd || record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(profile.transport, harness),
       sessionId: normalizeTmuxSessionName2(profile.sessionId, `${agentId}-${harness}`),
-      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs),
+      ...profile.permissionProfile ? { permissionProfile: profile.permissionProfile } : {}
     };
   }
   const runtimeHarness = normalizeManagedHarness2(record.harness, defaultHarness);
@@ -15611,7 +15958,8 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(record.transport, runtimeHarness),
       sessionId: normalizeTmuxSessionName2(record.tmuxSession, `${agentId}-${runtimeHarness}`),
-      launchArgs: normalizeLaunchArgsForHarness(runtimeHarness, record.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(runtimeHarness, record.launchArgs),
+      ...record.permissionProfile ? { permissionProfile: record.permissionProfile } : {}
     };
   }
   if (!nextProfiles[defaultHarness]) {
@@ -15619,10 +15967,11 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(record.transport, defaultHarness),
       sessionId: normalizeTmuxSessionName2(record.tmuxSession, `${agentId}-${defaultHarness}`),
-      launchArgs: normalizeLaunchArgsForHarness(defaultHarness, record.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(defaultHarness, record.launchArgs),
+      ...record.permissionProfile ? { permissionProfile: record.permissionProfile } : {}
     };
   }
-  for (const harness of ["claude", "codex"]) {
+  for (const harness of ["claude", "codex", "cursor"]) {
     const profile = nextProfiles[harness];
     if (!profile) {
       continue;
@@ -15631,7 +15980,8 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(profile.cwd || record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(profile.transport, harness),
       sessionId: normalizeTmuxSessionName2(profile.sessionId, `${agentId}-${harness}`),
-      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs),
+      ...profile.permissionProfile ? { permissionProfile: profile.permissionProfile } : {}
     };
   }
   return nextProfiles;
@@ -15656,13 +16006,15 @@ function recordForHarness(record, harnessOverride) {
       cwd: fallbackCwd,
       transport: fallbackTransport,
       launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs),
+      ...normalized.permissionProfile ? { permissionProfile: normalized.permissionProfile } : {},
       harnessProfiles: {
         ...normalized.harnessProfiles,
         [selectedHarness]: {
           cwd: fallbackCwd,
           transport: fallbackTransport,
           sessionId: fallbackSessionId,
-          launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs)
+          launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs),
+          ...normalized.permissionProfile ? { permissionProfile: normalized.permissionProfile } : {}
         }
       }
     };
@@ -15674,7 +16026,8 @@ function recordForHarness(record, harnessOverride) {
     tmuxSession: profile.sessionId,
     cwd: profile.cwd,
     transport: profile.transport,
-    launchArgs: profile.launchArgs
+    launchArgs: profile.launchArgs,
+    permissionProfile: profile.permissionProfile
   };
 }
 function normalizeLocalAgentRecord(agentId, record) {
@@ -15705,6 +16058,7 @@ function normalizeLocalAgentRecord(agentId, record) {
     transport: activeProfile?.transport ?? normalizeLocalAgentTransport(record.transport, harness),
     capabilities: normalizeLocalAgentCapabilities(record.capabilities),
     launchArgs: activeProfile?.launchArgs ?? normalizeLaunchArgsForHarness(harness, record.launchArgs),
+    permissionProfile: activeProfile?.permissionProfile ?? record.permissionProfile,
     registrationSource: record.registrationSource
   };
 }
@@ -15790,6 +16144,7 @@ function relayAgentOverrideFromLocalAgentRecord(agentId, record, existing) {
   };
 }
 function buildCodexAgentSessionOptions(agentName, record, systemPrompt) {
+  const permissionPosture = compileCodexPermissionProfile(record.permissionProfile);
   return {
     agentName,
     sessionId: record.tmuxSession,
@@ -15797,7 +16152,10 @@ function buildCodexAgentSessionOptions(agentName, record, systemPrompt) {
     systemPrompt: systemPrompt ?? buildLocalAgentSystemPrompt(agentName, record.project, record.cwd, { transport: "codex_app_server" }),
     runtimeDirectory: relayAgentRuntimeDirectory(agentName),
     logsDirectory: relayAgentLogsDirectory(agentName),
-    launchArgs: normalizeLaunchArgsForHarness("codex", record.launchArgs)
+    launchArgs: normalizeLaunchArgsForHarness("codex", record.launchArgs),
+    permissionProfile: permissionPosture.profile,
+    approvalPolicy: permissionPosture.approvalPolicy,
+    sandbox: permissionPosture.sandbox
   };
 }
 function buildClaudeAgentSessionOptions(agentName, record, systemPrompt) {
@@ -16054,6 +16412,7 @@ async function startLocalAgent(input) {
   const currentDirectory = input.currentDirectory ?? projectPath;
   const effectiveCwd = input.cwdOverride ? normalizeProjectPath(input.cwdOverride) : undefined;
   const shouldEnsureOnline = input.ensureOnline !== false;
+  const requestedPermissionProfile = parseScoutPermissionProfile(input.permissionProfile);
   const requestedDefinitionId = input.agentName?.trim() ? normalizeAgentSelectorSegment(input.agentName.trim()) : "";
   if (input.agentName?.trim() && !requestedDefinitionId) {
     throw new Error(`Invalid agent name "${input.agentName}".`);
@@ -16109,7 +16468,10 @@ async function startLocalAgent(input) {
     const effectiveHarness = normalizeManagedHarness2(preferredHarness ?? configDefaultHarness, "claude");
     const transport = normalizeLocalAgentTransport(undefined, effectiveHarness);
     const sessionId = normalizeTmuxSessionName2(undefined, `${instance.id}-${effectiveHarness}`);
-    const launchArgs = applyRequestedModelToLaunchArgs(effectiveHarness, [], input.model);
+    const launchArgs = applyRequestedRuntimeOptionsToLaunchArgs(effectiveHarness, [], {
+      model: input.model,
+      reasoningEffort: input.reasoningEffort
+    });
     const existingForInstance = overrides[instance.id];
     if (existingForInstance && normalizeProjectPath(existingForInstance.projectRoot) !== projectRoot) {
       throw new Error(`Another agent is already registered as ${instance.id} at ${existingForInstance.projectRoot}. ` + `Two clones of the same project on the same branch cannot both register here; ` + `rename one of the checkouts or switch its branch before running scout up.`);
@@ -16130,7 +16492,8 @@ async function startLocalAgent(input) {
           cwd: effectiveCwd ?? projectRoot,
           transport,
           sessionId,
-          launchArgs
+          launchArgs,
+          ...requestedPermissionProfile ? { permissionProfile: requestedPermissionProfile } : {}
         }
       },
       runtime: {
@@ -16154,7 +16517,10 @@ async function startLocalAgent(input) {
     const nextHarness = normalizeManagedHarness2(resolvedHarness, "claude");
     const nextDefaultHarness = preferredHarness ? normalizeManagedHarness2(preferredHarness, "claude") : defaultHarnessForOverride(matchingOverride, "claude");
     const nextSessionId = normalizeTmuxSessionName2(undefined, `${instance.id}-${nextHarness}`);
-    const nextLaunchArgs = applyRequestedModelToLaunchArgs(nextHarness, launchArgsForOverrideHarness(matchingOverride, nextHarness), input.model);
+    const nextLaunchArgs = applyRequestedRuntimeOptionsToLaunchArgs(nextHarness, launchArgsForOverrideHarness(matchingOverride, nextHarness), {
+      model: input.model,
+      reasoningEffort: input.reasoningEffort
+    });
     overrides[instance.id] = {
       agentId: instance.id,
       definitionId: requestedDefinitionId,
@@ -16172,7 +16538,8 @@ async function startLocalAgent(input) {
         [nextHarness]: {
           ...overrideHarnessProfile(matchingOverride, nextHarness),
           sessionId: nextSessionId,
-          launchArgs: nextLaunchArgs
+          launchArgs: nextLaunchArgs,
+          ...requestedPermissionProfile ? { permissionProfile: requestedPermissionProfile } : {}
         }
       },
       runtime: {
@@ -16186,9 +16553,12 @@ async function startLocalAgent(input) {
     await writeRelayAgentOverrides(overrides);
     targetAgentId = instance.id;
   } else {
-    if (input.model) {
+    if (input.model || input.reasoningEffort || requestedPermissionProfile) {
       const existingHarness = normalizeManagedHarness2(preferredHarness ?? matchingOverride.defaultHarness ?? matchingOverride.runtime?.harness, "claude");
-      const nextLaunchArgs = applyRequestedModelToLaunchArgs(existingHarness, launchArgsForOverrideHarness(matchingOverride, existingHarness), input.model);
+      const nextLaunchArgs = applyRequestedRuntimeOptionsToLaunchArgs(existingHarness, launchArgsForOverrideHarness(matchingOverride, existingHarness), {
+        model: input.model,
+        reasoningEffort: input.reasoningEffort
+      });
       overrides[matchingAgentId] = {
         ...matchingOverride,
         launchArgs: existingHarness === defaultHarnessForOverride(matchingOverride, existingHarness) ? nextLaunchArgs : matchingOverride.launchArgs,
@@ -16196,7 +16566,8 @@ async function startLocalAgent(input) {
           ...matchingOverride.harnessProfiles ?? {},
           [existingHarness]: {
             ...overrideHarnessProfile(matchingOverride, existingHarness),
-            launchArgs: nextLaunchArgs
+            launchArgs: nextLaunchArgs,
+            ...requestedPermissionProfile ? { permissionProfile: requestedPermissionProfile } : {}
           }
         }
       };
@@ -16300,6 +16671,7 @@ function readPersistedClaudeSessionId(agentName) {
 function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
   const normalizedRecord = normalizeLocalAgentRecord(agentId, record);
   const configuredModel = readLaunchModelForHarness(normalizeLocalAgentHarness(normalizedRecord.harness), normalizedRecord.launchArgs);
+  const codexPermissionPosture = normalizeLocalAgentHarness(normalizedRecord.harness) === "codex" ? compileCodexPermissionProfile(normalizedRecord.permissionProfile) : null;
   const definitionId = normalizedRecord.definitionId ?? agentId;
   const displayName = titleCaseLocalAgentName(definitionId);
   const projectRoot = normalizedRecord.projectRoot ?? normalizedRecord.cwd;
@@ -16326,7 +16698,13 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
         branch: instance.branch,
-        ...configuredModel ? { model: configuredModel } : {}
+        ...configuredModel ? { model: configuredModel } : {},
+        ...codexPermissionPosture ? {
+          permissionProfile: codexPermissionPosture.profile,
+          approvalPolicy: codexPermissionPosture.approvalPolicy,
+          sandbox: codexPermissionPosture.sandbox,
+          permissionEnforcement: codexPermissionPosture.enforcement
+        } : {}
       }
     },
     agent: {
@@ -16355,7 +16733,13 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
         branch: instance.branch,
-        ...configuredModel ? { model: configuredModel } : {}
+        ...configuredModel ? { model: configuredModel } : {},
+        ...codexPermissionPosture ? {
+          permissionProfile: codexPermissionPosture.profile,
+          approvalPolicy: codexPermissionPosture.approvalPolicy,
+          sandbox: codexPermissionPosture.sandbox,
+          permissionEnforcement: codexPermissionPosture.enforcement
+        } : {}
       },
       agentClass: "general",
       capabilities: normalizeLocalAgentCapabilities(normalizedRecord.capabilities),
@@ -16390,6 +16774,12 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         workspaceQualifier: instance.workspaceQualifier,
         branch: instance.branch,
         ...configuredModel ? { model: configuredModel } : {},
+        ...codexPermissionPosture ? {
+          permissionProfile: codexPermissionPosture.profile,
+          approvalPolicy: codexPermissionPosture.approvalPolicy,
+          sandbox: codexPermissionPosture.sandbox,
+          permissionEnforcement: codexPermissionPosture.enforcement
+        } : {},
         ...externalSessionId ? { externalSessionId } : {}
       }
     }
@@ -16488,7 +16878,11 @@ var scoutBrokerPaths = {
     deliver: "/v1/deliver",
     activity: "/v1/activity",
     collaborationRecords: "/v1/collaboration/records",
-    collaborationEvents: "/v1/collaboration/events"
+    collaborationEvents: "/v1/collaboration/events",
+    pairingAttach: "/v1/pairing/attach",
+    pairingDetach: "/v1/pairing/detach",
+    localSessionsAttach: "/v1/local-sessions/attach",
+    localSessionsDetach: "/v1/local-sessions/detach"
   }
 };
 
@@ -16845,7 +17239,10 @@ async function sendScoutDirectMessage(input) {
     body: input.body.trim(),
     intent: "consult",
     replyToMessageId: input.replyToMessageId ?? undefined,
-    execution: input.executionHarness ? { harness: input.executionHarness } : undefined,
+    execution: {
+      ...input.executionHarness ? { harness: input.executionHarness } : {},
+      session: "new"
+    },
     ensureAwake: true,
     messageMetadata: {
       source,
@@ -36238,7 +36635,7 @@ function deleteMobilePushRegistrationByToken(pushToken) {
   writeDb().query(`DELETE FROM mobile_push_registrations WHERE push_token = ?1`).run(token);
 }
 function base64UrlEncode(input) {
-  const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+  const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.from(Array.from(input));
   return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 function loadApnsCredentials() {
@@ -36283,7 +36680,7 @@ function apnsJwt(credentials) {
   }));
   const unsignedToken = `${header}.${claims}`;
   const privateKey = createPrivateKey(credentials.privateKeyPem);
-  const signature = signWithKey("sha256", Buffer.from(unsignedToken), privateKey);
+  const signature = signWithKey("sha256", new TextEncoder().encode(unsignedToken), privateKey);
   const token = `${unsignedToken}.${base64UrlEncode(signature)}`;
   cachedApnsJwt = {
     cacheKey,
@@ -36339,11 +36736,11 @@ async function sendApnsAlertToRegistration(registration, alert) {
       apnsId = typeof headers["apns-id"] === "string" ? headers["apns-id"] : null;
     });
     request.on("data", (chunk) => {
-      chunks.push(typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk);
+      chunks.push(chunk);
     });
     request.on("end", () => {
       client.close();
-      const rawBody = chunks.length > 0 ? Buffer.concat(chunks).toString("utf8") : "";
+      const rawBody = chunks.join("");
       let reason = null;
       if (rawBody.trim().length > 0) {
         try {
@@ -40062,6 +40459,7 @@ async function startSupervisorRuntime(state) {
       relay: activeRelayUrl,
       pairing: {
         relay: payload.relay,
+        ...payload.fallbackRelays?.length ? { fallbackRelays: payload.fallbackRelays } : {},
         room: payload.room,
         publicKey: payload.publicKey,
         expiresAt: payload.expiresAt,