@parall/daemon 1.44.0 → 1.45.0

package/bundle/parall-codex-agent.js

@@ -17718,9 +17718,9 @@ var require_getMachineId_linux = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     async function getMachineId() {
       const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-      for (const path11 of paths) {
+      for (const path12 of paths) {
         try {
-          const result = await fs_1.promises.readFile(path11, { encoding: "utf8" });
+          const result = await fs_1.promises.readFile(path12, { encoding: "utf8" });
           return result.trim();
         } catch (e) {
           api_1.diag.debug(`error reading machine id: ${e}`);
@@ -21123,7 +21123,7 @@ function appendRootPathToUrlIfNeeded(url) {
     return void 0;
   }
 }
-function appendResourcePathToUrl(url, path11) {
+function appendResourcePathToUrl(url, path12) {
   try {
     new URL(url);
   } catch (_a) {
@@ -21133,11 +21133,11 @@ function appendResourcePathToUrl(url, path11) {
   if (!url.endsWith("/")) {
     url = url + "/";
   }
-  url += path11;
+  url += path12;
   try {
     new URL(url);
   } catch (_b) {
-    diag2.warn("Configuration: Provided URL appended with '" + path11 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
+    diag2.warn("Configuration: Provided URL appended with '" + path12 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
     return void 0;
   }
   return url;
@@ -24050,7 +24050,7 @@ var require_parse = __commonJS({
   "ts/node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/parse.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse2 = (version, options, throwErrors = false) => {
+    var parse = (version, options, throwErrors = false) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -24063,7 +24063,7 @@ var require_parse = __commonJS({
         throw er;
       }
     };
-    module2.exports = parse2;
+    module2.exports = parse;
   }
 });
 
@@ -24071,9 +24071,9 @@ var require_parse = __commonJS({
 var require_valid = __commonJS({
   "ts/node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
-    var parse2 = require_parse();
+    var parse = require_parse();
     var valid = (version, options) => {
-      const v = parse2(version, options);
+      const v = parse(version, options);
       return v ? v.version : null;
     };
     module2.exports = valid;
@@ -24084,9 +24084,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "ts/node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/clean.js"(exports2, module2) {
     "use strict";
-    var parse2 = require_parse();
+    var parse = require_parse();
     var clean = (version, options) => {
-      const s = parse2(version.trim().replace(/^[=v]+/, ""), options);
+      const s = parse(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module2.exports = clean;
@@ -24121,10 +24121,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "ts/node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/diff.js"(exports2, module2) {
     "use strict";
-    var parse2 = require_parse();
+    var parse = require_parse();
     var diff = (version1, version2) => {
-      const v1 = parse2(version1, null, true);
-      const v2 = parse2(version2, null, true);
+      const v1 = parse(version1, null, true);
+      const v2 = parse(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -24195,9 +24195,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "ts/node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/prerelease.js"(exports2, module2) {
     "use strict";
-    var parse2 = require_parse();
+    var parse = require_parse();
     var prerelease = (version, options) => {
-      const parsed = parse2(version, options);
+      const parsed = parse(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module2.exports = prerelease;
@@ -24383,7 +24383,7 @@ var require_coerce = __commonJS({
   "ts/node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/coerce.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse2 = require_parse();
+    var parse = require_parse();
     var { safeRe: re2, t } = require_re();
     var coerce = (version, options) => {
       if (version instanceof SemVer) {
@@ -24418,7 +24418,7 @@ var require_coerce = __commonJS({
       const patch = match[4] || "0";
       const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
-      return parse2(`${major2}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse(`${major2}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module2.exports = coerce;
   }
@@ -25435,7 +25435,7 @@ var require_semver2 = __commonJS({
     var constants2 = require_constants3();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse2 = require_parse();
+    var parse = require_parse();
     var valid = require_valid();
     var clean = require_clean();
     var inc = require_inc();
@@ -25473,7 +25473,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module2.exports = {
-      parse: parse2,
+      parse,
       valid,
       clean,
       inc,
@@ -26487,9 +26487,6 @@ function laneContextFilePath(contextDir, targetUri, threadRootId) {
   return path.join(contextDir, `${laneKeyForTarget(targetUri, threadRootId)}.json`);
 }
 
-// ts/agent-core/dist/lane-ledger.js
-import * as fs from "node:fs";
-
 // ts/sdk/dist/types.js
 var MENTION_ALL_USER_ID = "all";
 
@@ -26965,7 +26962,7 @@ var ParallClient = class _ParallClient {
     return apiError;
   }
   /** Build headers common to all requests (auth, swimlane). */
-  buildHeaders(path11, extra) {
+  buildHeaders(path12, extra) {
     const headers = {
       "Content-Type": "application/json",
       ...extra
@@ -26976,7 +26973,7 @@ var ParallClient = class _ParallClient {
     if (this.swimlaneName) {
       headers["X-Prll-Swimlane"] = this.swimlaneName;
     }
-    if (path11.startsWith(API_BASE)) {
+    if (path12.startsWith(API_BASE)) {
       const overrides = this.getFeatureFlagOverrides?.();
       if (overrides)
         headers["X-Prll-FF-Override"] = overrides;
@@ -26999,8 +26996,8 @@ var ParallClient = class _ParallClient {
    * is authoritative, so wiki vs api routing can't drift from how a caller
    * happens to invoke the client.
    */
-  baseUrlFor(path11) {
-    return path11.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
+  baseUrlFor(path12) {
+    return path12.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
   }
   setToken(token) {
     this.token = token;
@@ -27027,10 +27024,10 @@ var ParallClient = class _ParallClient {
    * REFRESH_THRESHOLD_S, refresh it **before** sending the request.
    * No-op when the token is still fresh, missing, or un-parseable.
    */
-  async ensureFreshToken(path11) {
+  async ensureFreshToken(path12) {
     if (!this.token || !this.getRefreshToken)
       return;
-    const pathSuffix = path11.replace(/^\/api\/v1/, "");
+    const pathSuffix = path12.replace(/^\/api\/v1/, "");
     if (_ParallClient.AUTH_PATHS.has(pathSuffix))
       return;
     const exp = _ParallClient.decodeJwtExp(this.token);
@@ -27062,11 +27059,11 @@ var ParallClient = class _ParallClient {
       this.refreshPromise = null;
     }
   }
-  async request(method, path11, body, query, retried = false, opts) {
+  async request(method, path12, body, query, retried = false, opts) {
     if (!retried) {
-      await this.ensureFreshToken(path11);
+      await this.ensureFreshToken(path12);
     }
-    let url = `${this.baseUrlFor(path11)}${path11}`;
+    let url = `${this.baseUrlFor(path12)}${path12}`;
     if (query) {
       const params = new URLSearchParams();
       for (const [key, value] of Object.entries(query)) {
@@ -27078,7 +27075,7 @@ var ParallClient = class _ParallClient {
       if (qs)
         url += `?${qs}`;
     }
-    const headers = this.buildHeaders(path11);
+    const headers = this.buildHeaders(path12);
     const timeoutSignal = AbortSignal.timeout(opts?.timeoutMs ?? 15e3);
     const signal = opts?.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
     let res;
@@ -27096,12 +27093,12 @@ var ParallClient = class _ParallClient {
       throw _ParallClient.normalizeFetchError(err);
     }
     if (res.status === 401) {
-      const pathSuffix = path11.replace(/^\/api\/v1/, "");
+      const pathSuffix = path12.replace(/^\/api\/v1/, "");
       const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
       if (!retried && !isAuthPath && this.getRefreshToken) {
         const refreshed = await this.tryRefresh();
         if (refreshed) {
-          return this.request(method, path11, body, query, true, opts);
+          return this.request(method, path12, body, query, true, opts);
         }
       }
       if (this.onTokenExpired && !isAuthPath) {
@@ -27131,15 +27128,15 @@ var ParallClient = class _ParallClient {
    * hit the 100 MiB cap, so a longer 5-minute timeout is used so a
    * 50 MiB blob on a slow connection doesn't get chopped at 15 s.
    */
-  async multipartRequest(method, path11, body, retried = false) {
+  async multipartRequest(method, path12, body, retried = false) {
     if (!retried) {
-      await this.ensureFreshToken(path11);
+      await this.ensureFreshToken(path12);
     }
-    const { "Content-Type": _drop, ...headers } = this.buildHeaders(path11);
+    const { "Content-Type": _drop, ...headers } = this.buildHeaders(path12);
     void _drop;
     let res;
     try {
-      res = await fetch(`${this.baseUrlFor(path11)}${path11}`, {
+      res = await fetch(`${this.baseUrlFor(path12)}${path12}`, {
         method,
         headers,
         body,
@@ -27149,12 +27146,12 @@ var ParallClient = class _ParallClient {
       throw _ParallClient.normalizeFetchError(err);
     }
     if (res.status === 401) {
-      const pathSuffix = path11.replace(/^\/api\/v1/, "");
+      const pathSuffix = path12.replace(/^\/api\/v1/, "");
       const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
       if (!retried && !isAuthPath && this.getRefreshToken) {
         const refreshed = await this.tryRefresh();
         if (refreshed) {
-          return this.multipartRequest(method, path11, body, true);
+          return this.multipartRequest(method, path12, body, true);
         }
       }
       if (this.onTokenExpired && !isAuthPath) {
@@ -27858,8 +27855,8 @@ var ParallClient = class _ParallClient {
   async requestMachineUpdate(orgId, machineId, mandatory = false) {
     await this.request("POST", ENDPOINTS.MACHINE_REQUEST_UPDATE(orgId, machineId), { mandatory });
   }
-  async browseMachineFilesystem(orgId, machineId, path11) {
-    return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path11 }, void 0, false, { timeoutMs: 15e3 });
+  async browseMachineFilesystem(orgId, machineId, path12) {
+    return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path12 }, void 0, false, { timeoutMs: 15e3 });
   }
   /** Create a new machine key. Returns the raw key string (shown once) + metadata. */
   async createMachineKey(orgId, machineId, name) {
@@ -28431,8 +28428,8 @@ var ParallClient = class _ParallClient {
   async deleteWikiRestriction(orgId, wikiId, restrictionId) {
     await this.request("DELETE", ENDPOINTS.WIKI_RESTRICTION(orgId, wikiId, restrictionId));
   }
-  async getWikiAccessStatus(orgId, wikiId, path11) {
-    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path11 ? { path: path11 } : void 0);
+  async getWikiAccessStatus(orgId, wikiId, path12) {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path12 ? { path: path12 } : void 0);
   }
   async createWikiAccessRequest(orgId, wikiId, data) {
     await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
@@ -28441,14 +28438,14 @@ var ParallClient = class _ParallClient {
   async getWikiCommits(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_COMMITS(orgId, wikiId), void 0, params);
   }
-  async getWikiFileCommits(orgId, wikiId, path11, params) {
+  async getWikiFileCommits(orgId, wikiId, path12, params) {
     return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, {
-      path: path11,
+      path: path12,
       ...params
     });
   }
-  async getWikiBlame(orgId, wikiId, path11, ref) {
-    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path11, ref });
+  async getWikiBlame(orgId, wikiId, path12, ref) {
+    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path12, ref });
   }
   // ---- Wiki Operations (audit log) ----
   async getWikiOperations(orgId, wikiId, params) {
@@ -29101,6 +29098,7 @@ var ParallWs = class {
 };
 
 // ts/agent-core/dist/lane-ledger.js
+import * as fs from "node:fs";
 var LedgerUnsupportedError = class extends Error {
 };
 function isStaleLane(err) {
@@ -29384,6 +29382,20 @@ var LaneLedger = class {
     this.lanes.set(lane.laneKey, lane);
     return lane;
   }
+  /**
+   * Drop a lane's local record without any server call — for a typed lane
+   * whose member the by-id complete just resolved (the server dropped the
+   * vacated lane row in the same transaction). Calling completeIfIdle
+   * instead would fire a lane-form Complete at a lane that no longer exists
+   * and burn an RPC on the guaranteed STALE_LANE answer.
+   */
+  dropLocal(laneKey) {
+    const lane = this.lanes.get(laneKey);
+    if (!lane)
+      return;
+    this.lanes.delete(laneKey);
+    this.removeLaneContext(lane);
+  }
   /**
    * Remove the per-lane context file (and its CLI sidecar) when the lane
    * ends. A leftover file would make a later cross-context send to the same
@@ -29463,10 +29475,104 @@ async function dispatchLaneGroup(host, opts) {
   await ledger.completeIfIdle(lane.laneKey, pendingInjections || opts.hasMoreLocal());
   return "dispatched";
 }
+function typedLedgerEventIds(host, events) {
+  if (!host.laneLedger || host.ledgerDisabled)
+    return null;
+  const ids = [];
+  for (const ev of events) {
+    if (!ev.dispatchEventId || host.usesLaneLedger(ev))
+      return null;
+    ids.push(ev.dispatchEventId);
+  }
+  return ids.length > 0 ? ids : null;
+}
+function isByIDCompleteUnsupported(err) {
+  return err instanceof ApiError && err.status === 400;
+}
+async function resolveDispatchByID(host, dispatchEventId, lane) {
+  try {
+    await host.opts.client.completeDispatch(host.opts.config.org_id, {
+      dispatch_event_id: dispatchEventId,
+      ...lane ? { lane } : {},
+      turn_outcome: "ok"
+    });
+    return "ok";
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 409)
+      return "stale";
+    if (isByIDCompleteUnsupported(err))
+      return "unsupported";
+    host.opts.log?.warn(`by-id complete failed for ${dispatchEventId} \u2014 leaving for re-drive: ${String(err)}`);
+    return "failed";
+  }
+}
+function clearTypedDedupeForEvent(host, event) {
+  const sourceId = event.ackSourceId;
+  if (!sourceId)
+    return;
+  switch (event.ackSourceType) {
+    case "task_activity": {
+      const prefix = `${event.targetId}:`;
+      for (const key of host.dispatchedTasks) {
+        if (key.startsWith(prefix))
+          host.dispatchedTasks.delete(key);
+      }
+      break;
+    }
+    case "comment":
+      host.dispatchedTasks.delete(`comment:${sourceId}`);
+      break;
+    case "schedule_run":
+      host.dispatchedTasks.delete(`schedule_run:${sourceId}`);
+      break;
+    case "external_trigger_run":
+      host.dispatchedTasks.delete(`external_trigger_run:${sourceId}`);
+      break;
+    case "channel_message":
+      host.dispatchedMessages.delete(`channel_message:${sourceId}`);
+      break;
+    case "approval":
+      host.dispatchedTasks.delete(`approval:${sourceId}`);
+      break;
+  }
+}
+async function settleDrainedTypedGroup(host, events, ids, turnErrored) {
+  if (turnErrored) {
+    host.opts.log?.info(`buffered typed turn for ${events[events.length - 1]?.messageId} surfaced a runtime error \u2014 leaving for re-drive`);
+    for (const event of events)
+      clearTypedDedupeForEvent(host, event);
+    return;
+  }
+  const legacyAckFrom = async (start) => {
+    for (const [j, id] of ids.slice(start).entries()) {
+      try {
+        await host.opts.client.ackDispatchByID(host.opts.config.org_id, id);
+      } catch {
+        clearTypedDedupeForEvent(host, events[start + j]);
+      }
+    }
+  };
+  if (host.typedByIdCompleteUnsupported) {
+    await legacyAckFrom(0);
+    return;
+  }
+  for (const [i, id] of ids.entries()) {
+    const outcome = await resolveDispatchByID(host, id);
+    if (outcome === "unsupported") {
+      host.typedByIdCompleteUnsupported = true;
+      host.opts.log?.warn("server predates the by-id dispatch complete \u2014 falling back to legacy typed acks");
+      await legacyAckFrom(i);
+      return;
+    }
+    if (outcome !== "ok") {
+      clearTypedDedupeForEvent(host, events[i]);
+    }
+  }
+}
 var TYPED_BACKOFF_BASE_MS = 2e3;
 var TYPED_BACKOFF_CAP_MS = 5 * 6e4;
 var TYPED_BACKOFF_MAP_CAP = 512;
-async function consumeTypedDispatch(host, ref, run, ack) {
+async function consumeTypedDispatch(host, ref, run, hooks) {
   const backoffKey = ref.dispatchEventId ?? `${ref.sourceType}:${ref.sourceId}`;
   const armed = host.typedRedriveBackoff.get(backoffKey);
   if (armed) {
@@ -29482,8 +29588,8 @@ async function consumeTypedDispatch(host, ref, run, ack) {
       return;
   }
   const settleAck = (ackResult) => ackResult !== false;
-  const settle = (acked2) => {
-    if (acked2) {
+  const settle = (resolved2) => {
+    if (resolved2) {
       host.typedRedriveBackoff.delete(backoffKey);
       return;
     }
@@ -29497,13 +29603,13 @@ async function consumeTypedDispatch(host, ref, run, ack) {
     host.typedRedriveBackoff.set(backoffKey, { failures, until: Date.now() + backoffMs });
   };
   const runLegacy = async () => {
-    let acked2 = false;
+    let acked = false;
     try {
       if (await run(ref.dispatchEventId)) {
-        acked2 = settleAck(await ack(ref.dispatchEventId));
+        acked = settleAck(await hooks.legacyAck(ref.dispatchEventId));
       }
     } finally {
-      settle(acked2);
+      settle(acked);
     }
   };
   if (!host.laneLedger || host.ledgerDisabled) {
@@ -29525,15 +29631,39 @@ async function consumeTypedDispatch(host, ref, run, ack) {
     host.opts.log?.info(`typed dispatch ${ref.dispatchEventId ?? `${ref.sourceType}:${ref.sourceId}`} not claimable (held elsewhere or already resolved) \u2014 skipping`);
     return;
   }
-  let acked = false;
+  let resolved = false;
+  let viaLegacyAck = false;
   try {
     if (await run(lane.typedDispatchEventId)) {
-      acked = settleAck(await ack(lane.typedDispatchEventId));
+      if (host.typedByIdCompleteUnsupported || !lane.typedDispatchEventId) {
+        viaLegacyAck = true;
+        resolved = settleAck(await hooks.legacyAck(lane.typedDispatchEventId));
+      } else {
+        const outcome = await resolveDispatchByID(host, lane.typedDispatchEventId, lane.lane);
+        if (outcome === "unsupported") {
+          host.typedByIdCompleteUnsupported = true;
+          host.opts.log?.warn("server predates the by-id dispatch complete \u2014 falling back to the legacy typed ack");
+          viaLegacyAck = true;
+          resolved = settleAck(await hooks.legacyAck(lane.typedDispatchEventId));
+        } else if (outcome === "stale") {
+          hooks.clearDedupe?.();
+          resolved = true;
+        } else {
+          resolved = outcome === "ok";
+          if (!resolved) {
+            hooks.clearDedupe?.();
+          }
+        }
+      }
     }
   } finally {
-    settle(acked);
-    await host.laneLedger.completeIfIdle(lane.laneKey, false).catch(() => {
-    });
+    settle(resolved);
+    if (resolved && !viaLegacyAck) {
+      host.laneLedger.dropLocal(lane.laneKey);
+    } else {
+      await host.laneLedger.completeIfIdle(lane.laneKey, false).catch(() => {
+      });
+    }
   }
 }
 async function consumeMessageWorkItem(host, item) {
@@ -29542,6 +29672,16 @@ async function consumeMessageWorkItem(host, item) {
   if (!host.tryClaimMessage(item.source_id))
     return;
   const ackItem = () => {
+    if (host.laneLedger && !host.ledgerDisabled && !host.typedByIdCompleteUnsupported) {
+      void resolveDispatchByID(host, item.id).then((outcome) => {
+        if (outcome === "unsupported") {
+          host.typedByIdCompleteUnsupported = true;
+          host.opts.client.ackDispatchByID(host.opts.config.org_id, item.id).catch(() => {
+          });
+        }
+      });
+      return;
+    }
     host.opts.client.ackDispatchByID(host.opts.config.org_id, item.id).catch(() => {
     });
   };
@@ -30721,20 +30861,23 @@ var ParallAgentGateway = class {
       if (data.status !== "todo" && data.status !== "in_progress")
         return;
       try {
-        await this.consumeTypedDispatch(data.dispatch_event_id ? { dispatchEventId: data.dispatch_event_id } : { sourceType: "task_activity", sourceId: data.id }, (dispatchEventId) => this.handleTaskAssignment(data, data.id, dispatchEventId), (dispatchEventId) => {
-          if (dispatchEventId) {
-            return this.ackDispatchEvent(dispatchEventId, () => {
+        await this.consumeTypedDispatch(data.dispatch_event_id ? { dispatchEventId: data.dispatch_event_id } : { sourceType: "task_activity", sourceId: data.id }, (dispatchEventId) => this.handleTaskAssignment(data, data.id, dispatchEventId), {
+          legacyAck: (dispatchEventId) => {
+            if (dispatchEventId) {
+              return this.ackDispatchEvent(dispatchEventId, () => {
+                this.dispatchedTasks.delete(`${data.id}:${data.updated_at}`);
+              });
+            }
+            return this.opts.client.ackDispatch(this.opts.config.org_id, {
+              source_type: "task_activity",
+              source_id: data.id
+            }).then(() => true, (err) => {
               this.dispatchedTasks.delete(`${data.id}:${data.updated_at}`);
+              this.opts.log?.warn(`dispatch ack failed for task ${data.id}, releasing for re-drive: ${String(err)}`);
+              return false;
             });
-          }
-          return this.opts.client.ackDispatch(this.opts.config.org_id, {
-            source_type: "task_activity",
-            source_id: data.id
-          }).then(() => true, (err) => {
-            this.dispatchedTasks.delete(`${data.id}:${data.updated_at}`);
-            this.opts.log?.warn(`dispatch ack failed for task ${data.id}, releasing for re-drive: ${String(err)}`);
-            return false;
-          });
+          },
+          clearDedupe: () => this.dispatchedTasks.delete(`${data.id}:${data.updated_at}`)
         });
       } catch (err) {
         this.opts.log?.error(`task dispatch failed for ${data.id}: ${String(err)}`);
@@ -30753,7 +30896,10 @@ var ParallAgentGateway = class {
         if (!data.source_id || !data.task_id)
           return;
         try {
-          await this.consumeTypedDispatch({ dispatchEventId: data.id }, () => this.handleTaskComment(data.source_id, data.task_id ?? "", data.actor_id, data.delivery_reason), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.handleTaskComment(data.source_id, data.task_id ?? "", data.actor_id, data.delivery_reason, dispatchEventId), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`task comment dispatch failed for ${data.source_id}: ${String(err)}`);
         }
@@ -30761,7 +30907,10 @@ var ParallAgentGateway = class {
         if (!data.source_id)
           return;
         try {
-          await this.consumeTypedDispatch({ dispatchEventId: data.id }, () => this.handleWikiComment(data.source_id, data.actor_id, data.delivery_reason), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.handleWikiComment(data.source_id, data.actor_id, data.delivery_reason, dispatchEventId), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`wiki comment dispatch failed for ${data.source_id}: ${String(err)}`);
         }
@@ -30772,7 +30921,10 @@ var ParallAgentGateway = class {
           await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.handleTaskDispatch(data.task_id ?? "", data.source_id ?? data.task_id ?? "", {
             allowCreator: true,
             dispatchEventId
-          }), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          }), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`task update dispatch failed for ${data.task_id}: ${String(err)}`);
         }
@@ -30780,7 +30932,10 @@ var ParallAgentGateway = class {
         if (!data.source_id)
           return;
         try {
-          await this.consumeTypedDispatch({ dispatchEventId: data.id }, () => this.fetchAndHandleScheduleFire(data.source_id, data.actor_id), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.fetchAndHandleScheduleFire(data.source_id, data.actor_id, dispatchEventId), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`schedule fire dispatch failed for ${data.source_id}: ${String(err)}`);
         }
@@ -30788,7 +30943,10 @@ var ParallAgentGateway = class {
         if (!data.source_id)
           return;
         try {
-          await this.consumeTypedDispatch({ dispatchEventId: data.id }, () => this.fetchAndHandleExternalTriggerRun(data.source_id), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.fetchAndHandleExternalTriggerRun(data.source_id, dispatchEventId), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`external trigger dispatch failed for ${data.source_id}: ${String(err)}`);
         }
@@ -30796,7 +30954,10 @@ var ParallAgentGateway = class {
         if (!data.source_id)
           return;
         try {
-          await this.consumeTypedDispatch({ dispatchEventId: data.id }, () => this.fetchAndHandleChannelMessage(data.source_id), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.fetchAndHandleChannelMessage(data.source_id, dispatchEventId), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`channel message dispatch failed for ${data.source_id}: ${String(err)}`);
         }
@@ -30804,7 +30965,10 @@ var ParallAgentGateway = class {
         if (!data.source_id)
           return;
         try {
-          await this.consumeTypedDispatch({ dispatchEventId: data.id }, () => this.fetchAndHandleApprovalDecided(data.source_id, data.actor_id, data.chat_id ?? null), () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)));
+          await this.consumeTypedDispatch({ dispatchEventId: data.id }, (dispatchEventId) => this.fetchAndHandleApprovalDecided(data.source_id, data.actor_id, data.chat_id ?? null, dispatchEventId), {
+            legacyAck: () => this.ackDispatchEvent(data.id, () => this.clearTypedDispatchDedupe(data)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(data)
+          });
         } catch (err) {
           this.opts.log?.error(`approval decided dispatch failed for ${data.source_id}: ${String(err)}`);
         }
@@ -30887,6 +31051,20 @@ var ParallAgentGateway = class {
       source_id: sourceId
     });
   }
+  /**
+   * Sticky: the server answered a by-id complete with 400 (predates the
+   * form). Typed resolution falls back to the legacy ack for the rest of
+   * the process lifetime.
+   */
+  typedByIdCompleteUnsupported = false;
+  // Typed-face ledger helpers live in gateway-lane-flow.ts; thin delegates
+  // keep the site code and tests on the class surface.
+  typedLedgerEventIds(events) {
+    return typedLedgerEventIds(this.laneFlowHost(), events);
+  }
+  resolveDispatchByID(dispatchEventId, lane) {
+    return resolveDispatchByID(this.laneFlowHost(), dispatchEventId, lane);
+  }
   /** True when this event's lifecycle is owned by the dispatch lane ledger. */
   usesLaneLedger(event) {
     return this.laneLedger != null && !this.ledgerDisabled && this.laneLedger.handles(event);
@@ -30917,15 +31095,16 @@ var ParallAgentGateway = class {
   dispatchLaneGroup(opts) {
     return dispatchLaneGroup(this.laneFlowHost(), opts);
   }
-  consumeTypedDispatch(ref, run, ack) {
-    return consumeTypedDispatch(this.laneFlowHost(), ref, run, ack);
+  consumeTypedDispatch(ref, run, hooks) {
+    return consumeTypedDispatch(this.laneFlowHost(), ref, run, hooks);
   }
-  // Typed completion must wait until the administrative ack has either
-  // committed or failed. Errors stay best-effort: a failed ack leaves the row
-  // received, so Complete releases and re-drives it safely. The boolean
-  // outcome feeds the typed-consume backoff — an ack that failed must count
-  // as a failed consume, or an ack outage would clear the backoff entry and
-  // let the release re-drive spin at wire speed.
+  // Legacy administrative ack (ledger-disabled fallback only). Typed
+  // completion must wait until the ack has either committed or failed.
+  // Errors stay best-effort: a failed ack leaves the row received, so
+  // Complete releases and re-drives it safely. The boolean outcome feeds the
+  // typed-consume backoff — an ack that failed must count as a failed
+  // consume, or an ack outage would clear the backoff entry and let the
+  // release re-drive spin at wire speed.
   ackDispatchEvent(dispatchEventId, onFailure) {
     return this.opts.client.ackDispatchByID(this.opts.config.org_id, dispatchEventId).then(() => true, (err) => {
       onFailure?.();
@@ -30933,6 +31112,9 @@ var ParallAgentGateway = class {
       return false;
     });
   }
+  // PARITY: this switch and gateway-lane-flow's clearTypedDedupeForEvent must
+  // handle the same typed source families — extend BOTH when adding a typed
+  // event type (same dedupe entries, keyed from different event shapes).
   clearTypedDispatchDedupe(item) {
     switch (item.event_type) {
       case "task_assign":
@@ -31506,6 +31688,12 @@ var ParallAgentGateway = class {
             dispatched = outcome === "dispatched";
           } else {
             dispatched = await this.runDispatch(last, fork.fork.sessionKey, buildForkScopePrefix(last) + buildEventBody(last), earlier, batchText);
+            if (dispatched && this.typedLedgerEventIds(events) && this.consumeTurnError(fork.fork.sessionKey)) {
+              this.opts.log?.info(`typed fork turn for ${last.messageId} surfaced a runtime error \u2014 releasing for retry`);
+              for (const item of items)
+                item.resolve(false);
+              continue;
+            }
           }
           if (!dispatched) {
             for (const item of items) {
@@ -31655,13 +31843,16 @@ var ParallAgentGateway = class {
           }
           continue;
         }
-        try {
-          await this.emitDispatchReceived(event);
-        } catch (err) {
-          this.opts.log?.warn?.(`mark-received failed for buffered dispatch, leaving unacked for retry: ${String(err)}`);
-          this.dispatchState.mainBuffer.unshift(...events);
-          this.dispatchState.pendingForkResults.unshift(...pendingFork);
-          break;
+        const typedRefs = this.typedLedgerEventIds(events);
+        if (!typedRefs) {
+          try {
+            await this.emitDispatchReceived(event);
+          } catch (err) {
+            this.opts.log?.warn?.(`mark-received failed for buffered dispatch, leaving unacked for retry: ${String(err)}`);
+            this.dispatchState.mainBuffer.unshift(...events);
+            this.dispatchState.pendingForkResults.unshift(...pendingFork);
+            break;
+          }
         }
         const dispatched = await this.runDispatch(event, this.opts.runtimeKey, forkPrefix + buildEventBody(event), earlier);
         if (!dispatched) {
@@ -31669,6 +31860,10 @@ var ParallAgentGateway = class {
           this.dispatchState.pendingForkResults.unshift(...pendingFork);
           break;
         }
+        if (typedRefs) {
+          await settleDrainedTypedGroup(this.laneFlowHost(), events, typedRefs, this.consumeTurnError(this.opts.runtimeKey));
+          continue;
+        }
         for (const bufferedEvent of events) {
           const sourceType = bufferedEvent.ackSourceType ?? (bufferedEvent.type === "task" ? "task_activity" : "message");
           const sourceId = bufferedEvent.ackSourceId ?? bufferedEvent.messageId;
@@ -31728,20 +31923,27 @@ var ParallAgentGateway = class {
           }
           return outcome === "dispatched";
         }
-        try {
-          await this.emitDispatchReceived(event);
-        } catch (err) {
-          this.opts.log?.warn?.(`mark-received failed, leaving unacked for retry: ${String(err)}`);
-          this.dispatchState.mainDispatching = false;
-          this.dispatchState.mainCurrentTargetId = void 0;
-          this.mainCurrentGroupKey = void 0;
-          this.dispatchState.mainPreDispatchBranchPoint = void 0;
-          this.dispatchState.pendingForkResults.unshift(...pendingFork);
-          return false;
+        const typedRefs = this.typedLedgerEventIds([event]);
+        if (!typedRefs) {
+          try {
+            await this.emitDispatchReceived(event);
+          } catch (err) {
+            this.opts.log?.warn?.(`mark-received failed, leaving unacked for retry: ${String(err)}`);
+            this.dispatchState.mainDispatching = false;
+            this.dispatchState.mainCurrentTargetId = void 0;
+            this.mainCurrentGroupKey = void 0;
+            this.dispatchState.mainPreDispatchBranchPoint = void 0;
+            this.dispatchState.pendingForkResults.unshift(...pendingFork);
+            return false;
+          }
         }
         let dispatched = false;
         try {
           dispatched = await this.runDispatch(event, this.opts.runtimeKey, forkPrefix + buildEventBody(event));
+          if (dispatched && typedRefs && this.consumeTurnError(this.opts.runtimeKey)) {
+            this.opts.log?.info(`typed dispatch turn for ${event.messageId} surfaced a runtime error \u2014 releasing for retry`);
+            dispatched = false;
+          }
           if (!dispatched) {
             this.dispatchState.pendingForkResults.unshift(...pendingFork);
           }
@@ -31783,7 +31985,7 @@ var ParallAgentGateway = class {
           this.dispatchState.mainBuffer.push(event);
           return false;
         }
-        if (!this.usesLaneLedger(event)) {
+        if (!this.usesLaneLedger(event) && !this.typedLedgerEventIds([event])) {
           try {
             await this.emitDispatchReceived(event);
           } catch (err) {
@@ -31964,7 +32166,10 @@ var ParallAgentGateway = class {
       return;
     await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.handleTaskDispatch(item.task_id ?? "", item.source_id ?? item.task_id ?? "", {
       dispatchEventId
-    }), (dispatchEventId) => this.ackDispatchEvent(dispatchEventId ?? item.id, () => this.clearTypedDispatchDedupe(item)));
+    }), {
+      legacyAck: (dispatchEventId) => this.ackDispatchEvent(dispatchEventId ?? item.id, () => this.clearTypedDispatchDedupe(item)),
+      clearDedupe: () => this.clearTypedDispatchDedupe(item)
+    });
   }
   consumeMessageWorkItem(item) {
     return consumeMessageWorkItem(this.laneFlowHost(), item);
@@ -32025,7 +32230,7 @@ var ParallAgentGateway = class {
     }
     return this.handleTaskAssignment(task, ackSourceId, opts.dispatchEventId);
   }
-  async handleTaskComment(commentId, taskId, actorId, deliveryReason) {
+  async handleTaskComment(commentId, taskId, actorId, deliveryReason, dispatchEventId) {
     if (this.shuttingDown)
       return false;
     const dedupeKey = `comment:${commentId}`;
@@ -32081,7 +32286,8 @@ var ParallAgentGateway = class {
       body: parts.join("\n"),
       deliveryReason: deliveryReason ?? void 0,
       ackSourceType: "comment",
-      ackSourceId: commentId
+      ackSourceId: commentId,
+      dispatchEventId
     };
     let dispatched;
     try {
@@ -32095,7 +32301,7 @@ var ParallAgentGateway = class {
     }
     return dispatched;
   }
-  async handleWikiComment(commentId, actorId, deliveryReason) {
+  async handleWikiComment(commentId, actorId, deliveryReason, dispatchEventId) {
     if (this.shuttingDown)
       return false;
     const dedupeKey = `comment:${commentId}`;
@@ -32141,7 +32347,8 @@ var ParallAgentGateway = class {
       deliveryReason: deliveryReason ?? void 0,
       replyTargetUri: comment.target_uri,
       ackSourceType: "comment",
-      ackSourceId: commentId
+      ackSourceId: commentId,
+      dispatchEventId
     };
     let dispatched;
     try {
@@ -32163,7 +32370,7 @@ var ParallAgentGateway = class {
    * access to already-delivered run snapshots, and the runtime must not crash
    * or retry forever in that case.
    */
-  async fetchAndHandleScheduleFire(runId, actorId) {
+  async fetchAndHandleScheduleFire(runId, actorId, dispatchEventId) {
     let run = null;
     try {
       run = await this.opts.client.getScheduleRun(this.opts.config.org_id, runId);
@@ -32178,9 +32385,9 @@ var ParallAgentGateway = class {
     }
     if (!run)
       return true;
-    return this.handleScheduleFire(run, actorId);
+    return this.handleScheduleFire(run, actorId, dispatchEventId);
   }
-  async handleScheduleFire(run, actorId) {
+  async handleScheduleFire(run, actorId, dispatchEventId) {
     if (this.shuttingDown)
       return false;
     const dedupeKey = `schedule_run:${run.id}`;
@@ -32203,7 +32410,8 @@ var ParallAgentGateway = class {
       scheduledFireAt: run.scheduled_fire_at,
       attachedUri: run.fired_attached_uri ?? void 0,
       ackSourceType: "schedule_run",
-      ackSourceId: run.id
+      ackSourceId: run.id,
+      dispatchEventId
     };
     let dispatched;
     try {
@@ -32217,7 +32425,7 @@ var ParallAgentGateway = class {
     }
     return dispatched;
   }
-  async fetchAndHandleExternalTriggerRun(runId) {
+  async fetchAndHandleExternalTriggerRun(runId, dispatchEventId) {
     let run = null;
     try {
       run = await this.opts.client.getExternalTriggerRun(this.opts.config.org_id, runId);
@@ -32232,14 +32440,14 @@ var ParallAgentGateway = class {
     }
     if (!run)
       return true;
-    return this.handleExternalTriggerRun(run);
+    return this.handleExternalTriggerRun(run, dispatchEventId);
   }
   // fetchAndHandleChannelMessage resolves a channel_message dispatch to its
   // durable ChannelMessage + conversation and hands it to the inbound
   // pipeline. targetId = the ChannelConversation id, so per-conversation
   // multi-turn continuity rides the same per-target session mechanics as
   // chats. Design: docs/engineering-design/external-im-channel-design.md.
-  async fetchAndHandleChannelMessage(messageId) {
+  async fetchAndHandleChannelMessage(messageId, dispatchEventId) {
     if (this.shuttingDown)
       return false;
     const claimKey = `channel_message:${messageId}`;
@@ -32292,7 +32500,8 @@ var ParallAgentGateway = class {
       channelExternalMessageId: msg.external_message_id,
       channelCliCapable: cliCapable,
       ackSourceType: "channel_message",
-      ackSourceId: msg.id
+      ackSourceId: msg.id,
+      dispatchEventId
     };
     let dispatched;
     try {
@@ -32306,7 +32515,7 @@ var ParallAgentGateway = class {
     }
     return dispatched;
   }
-  async handleExternalTriggerRun(run) {
+  async handleExternalTriggerRun(run, dispatchEventId) {
     if (this.shuttingDown)
       return false;
     const dedupeKey = `external_trigger_run:${run.id}`;
@@ -32331,7 +32540,8 @@ var ParallAgentGateway = class {
       externalIngressEventType: run.ingress_event_type || void 0,
       attachedUri,
       ackSourceType: "external_trigger_run",
-      ackSourceId: run.id
+      ackSourceId: run.id,
+      dispatchEventId
     };
     let dispatched;
     try {
@@ -32345,7 +32555,7 @@ var ParallAgentGateway = class {
     }
     return dispatched;
   }
-  async fetchAndHandleApprovalDecided(approvalId, actorId, chatId) {
+  async fetchAndHandleApprovalDecided(approvalId, actorId, chatId, dispatchEventId) {
     let approval = null;
     try {
       approval = await this.opts.client.getApproval(approvalId);
@@ -32376,7 +32586,12 @@ var ParallAgentGateway = class {
       senderId: actorId ?? approval.decided_by ?? "system",
       senderName: "approver",
       messageId: approval.id,
-      body
+      body,
+      // The WorkItem's real source pair. Without it the legacy fallback
+      // guessed ('message', approval_id) — a pair no row matches.
+      ackSourceType: "approval",
+      ackSourceId: approval.id,
+      dispatchEventId
     };
     let dispatched;
     try {
@@ -32423,7 +32638,17 @@ var ParallAgentGateway = class {
           break;
         if (overflowMode && processed >= CATCHUP_MAX) {
           try {
-            await this.opts.client.ackDispatchByID(this.opts.config.org_id, item.id);
+            if (this.laneLedger && !this.ledgerDisabled && !this.typedByIdCompleteUnsupported) {
+              const outcome = await this.resolveDispatchByID(item.id);
+              if (outcome === "unsupported") {
+                this.typedByIdCompleteUnsupported = true;
+                await this.opts.client.ackDispatchByID(this.opts.config.org_id, item.id);
+              } else if (outcome === "failed") {
+                throw new Error("by-id complete failed");
+              }
+            } else {
+              await this.opts.client.ackDispatchByID(this.opts.config.org_id, item.id);
+            }
             skipped++;
             const key = item.event_type;
             skippedByType.set(key, (skippedByType.get(key) ?? 0) + 1);
@@ -32434,12 +32659,15 @@ var ParallAgentGateway = class {
         }
         processed++;
         try {
-          const ackItem = () => this.ackDispatchEvent(item.id, () => this.clearTypedDispatchDedupe(item));
+          const typedHooks = {
+            legacyAck: () => this.ackDispatchEvent(item.id, () => this.clearTypedDispatchDedupe(item)),
+            clearDedupe: () => this.clearTypedDispatchDedupe(item)
+          };
           if (item.event_type === "task_assign" && item.task_id) {
             try {
               await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.handleTaskDispatch(item.task_id ?? "", item.source_id ?? item.task_id ?? "", {
                 dispatchEventId
-              }), ackItem);
+              }), typedHooks);
             } catch (err) {
               this.opts.log?.warn(`catch-up task fetch failed for ${item.task_id}, leaving pending: ${String(err)}`);
               continue;
@@ -32449,23 +32677,23 @@ var ParallAgentGateway = class {
               await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.handleTaskDispatch(item.task_id ?? "", item.source_id ?? item.task_id ?? "", {
                 allowCreator: true,
                 dispatchEventId
-              }), ackItem);
+              }), typedHooks);
             } catch (err) {
               this.opts.log?.warn(`catch-up task fetch failed for ${item.task_id}, leaving pending: ${String(err)}`);
               continue;
             }
           } else if (item.event_type === "task_comment" && item.source_id && item.task_id) {
-            await this.consumeTypedDispatch({ dispatchEventId: item.id }, () => this.handleTaskComment(item.source_id, item.task_id ?? "", item.actor_id, item.delivery_reason), ackItem);
+            await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.handleTaskComment(item.source_id, item.task_id ?? "", item.actor_id, item.delivery_reason, dispatchEventId), typedHooks);
           } else if (item.event_type === "wiki_comment" && item.source_id) {
-            await this.consumeTypedDispatch({ dispatchEventId: item.id }, () => this.handleWikiComment(item.source_id, item.actor_id, item.delivery_reason), ackItem);
+            await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.handleWikiComment(item.source_id, item.actor_id, item.delivery_reason, dispatchEventId), typedHooks);
           } else if (item.event_type === "schedule.fire" && item.source_id) {
-            await this.consumeTypedDispatch({ dispatchEventId: item.id }, () => this.fetchAndHandleScheduleFire(item.source_id, item.actor_id), ackItem);
+            await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.fetchAndHandleScheduleFire(item.source_id, item.actor_id, dispatchEventId), typedHooks);
           } else if (item.event_type === "external_trigger" && item.source_id) {
-            await this.consumeTypedDispatch({ dispatchEventId: item.id }, () => this.fetchAndHandleExternalTriggerRun(item.source_id), ackItem);
+            await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.fetchAndHandleExternalTriggerRun(item.source_id, dispatchEventId), typedHooks);
           } else if (item.event_type === "channel_message" && item.source_id) {
-            await this.consumeTypedDispatch({ dispatchEventId: item.id }, () => this.fetchAndHandleChannelMessage(item.source_id), ackItem);
+            await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.fetchAndHandleChannelMessage(item.source_id, dispatchEventId), typedHooks);
           } else if (item.event_type === "approval_decided" && item.source_id) {
-            await this.consumeTypedDispatch({ dispatchEventId: item.id }, () => this.fetchAndHandleApprovalDecided(item.source_id, item.actor_id, item.chat_id ?? null), ackItem);
+            await this.consumeTypedDispatch({ dispatchEventId: item.id }, (dispatchEventId) => this.fetchAndHandleApprovalDecided(item.source_id, item.actor_id, item.chat_id ?? null, dispatchEventId), typedHooks);
           } else if (item.event_type === "message" && item.source_id && item.chat_id) {
             await this.consumeMessageWorkItem({
               id: item.id,
@@ -33163,16 +33391,32 @@ parall tasks list --assignee-id prll://usr_xxx   # first page only (default 20)
 parall tasks subtasks prll://tsk_xxx             # children of a single parent task
 
 # Create a task (add --parent-id to make it a SUBTASK of another task)
-parall tasks create --title "Task title" [--assignee-id prll://usr_xxx] [--parent-id prll://tsk_xxx] [--project-id prll://prj_xxx]
+parall tasks create --title "Task title" [--assignee-id prll://usr_xxx] [--parent-id prll://tsk_xxx] [--project-id prll://prj_xxx] [--due-date 2026-08-01]
+
+# Update task status \u2014 add --placement end so the task lands at the end of
+# its NEW status column (a bare --status keeps the old column's sort_order)
+parall tasks update prll://tsk_xxx --status in_progress --placement end
+parall tasks update prll://tsk_xxx --status done --placement end
 
-# Update task status
-parall tasks update prll://tsk_xxx --status in_progress
-parall tasks update prll://tsk_xxx --status done
+# Due date \u2014 a plain YYYY-MM-DD date (no timestamps); "none" clears it
+parall tasks update prll://tsk_xxx --due-date 2026-08-01
+parall tasks update prll://tsk_xxx --due-date none
+
+# Move a task to the end of its status column
+parall tasks update prll://tsk_xxx --placement end
 
 # Add a comment
 parall tasks comments add prll://tsk_xxx --body "Progress update..."
 \`\`\`
 
+Ordering: to append a task to the end of a status column, always use
+\`--placement end\` \u2014 the server resolves the position atomically. This
+includes status changes: a bare \`--status\` keeps the task's old
+\`sort_order\`, which may collide inside the new column. Do NOT compute a
+\`sort_order\` value yourself from listed tasks (your view may be stale or
+partial). \`--sort-order\` is only for pinpoint insertion between two cards
+you just listed, and it cannot be combined with \`--placement\`.
+
 Subtasks are just tasks with a parent: create one with \`tasks create --parent-id\`,
 re-parent with \`tasks update --parent-id\`, list a parent's children with
 \`tasks subtasks\`. \`tasks list\` without \`--parent-id\` already returns both
@@ -33207,7 +33451,7 @@ watcher.
 When you receive \`[Event: task.assigned]\`:
 
 1. Acknowledge with a comment: \`tasks comments add prll://tsk_xxx --body "On it"\`
-2. Update status: \`tasks update prll://tsk_xxx --status in_progress\`
+2. Update status: \`tasks update prll://tsk_xxx --status in_progress --placement end\`
 3. Do the work
 4. Report results in a comment. If a gate remains \u2014 review, merge, deploy,
    requester acceptance \u2014 set \`in_review\` and name the gate; set \`done\`
@@ -33453,7 +33697,7 @@ parall schedules create \\
   --run-at <FUTURE_RFC3339_TIME>
 \`\`\`
 
-\`--target-ids\` is who receives the fire (usually yourself when you're self-scheduling; another agent or human when delegating). \`--attached-to-uri\` optionally anchors the schedule to a task / chat / project / wiki page \u2014 when that resource is archived or deleted, the schedule auto-cancels (\`cancel_reason=attached_gone\`).
+\`--target-ids\` is who receives the fire (usually yourself when you're self-scheduling; another agent or human when delegating). \`--attached-to-uri\` optionally anchors the schedule to a task / chat / project / wiki page \u2014 when that resource is archived or deleted, the schedule auto-cancels (\`status_reason=attached_gone\`). A schedule whose agent targets all sit on a terminated machine is auto-paused by the platform (\`status_reason=attendee_unreachable\`) instead of firing into a void; resuming a recurring schedule while the machine is still terminated just pauses it again on the next slot (a one-shot resumed past its catch-up window instead follows the normal missed semantics and completes).
 
 ### Reminders for someone else
 
@@ -33769,9 +34013,8 @@ function stepIdFilePathForSession(stateDir, sessionKey) {
 }
 
 // ts/codex-agent/dist/dispatch.js
-import { execSync as execSync2, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import * as fs7 from "node:fs";
 import * as path8 from "node:path";
 
 // ts/agent-core/dist/internal/attachment-input.js
@@ -34346,125 +34589,333 @@ function parseContentLength(value) {
   return n;
 }
 
-// ts/codex-agent/dist/event-mapping.js
-var EventMapper = class {
-  toolCallStart = /* @__PURE__ */ new Map();
-  /**
-   * Map a single server notification to zero or more RuntimeEvents.
-   * Return `null` for notifications that have no chat surface.
-   */
-  map(method, params) {
-    const events = [];
-    const p = params ?? {};
-    switch (method) {
-      // Streaming deltas are intentionally dropped — see the class comment.
-      case "item/agentMessage/delta":
-      case "item/reasoning/textDelta":
-      case "item/reasoning/summaryTextDelta":
-        break;
-      case "item/started": {
-        const item = p.item;
-        if (!item || typeof item.type !== "string")
-          break;
-        events.push(...this.mapItem(item, "started"));
-        break;
-      }
-      case "item/completed": {
-        const item = p.item;
-        if (!item || typeof item.type !== "string")
-          break;
-        events.push(...this.mapItem(item, "completed"));
-        break;
-      }
-      case "turn/completed": {
-        const turn = p.turn;
-        const status = turn ? asString(turn.status) : void 0;
-        const error = turn?.error;
-        if (status === "failed") {
-          const message = asString(error?.message) ?? "Codex turn failed";
-          events.push({ type: "error", message });
-        }
-        break;
-      }
-      case "error": {
-        const message = asString(p.message) ?? "Codex error";
-        events.push({ type: "error", message });
-        break;
-      }
-    }
-    return events;
+// ts/codex-agent/dist/app-server-process.js
+import { execSync as execSync2 } from "node:child_process";
+import * as fs7 from "node:fs";
+var IS_WIN32 = process.platform === "win32";
+function quoteWin32Arg(arg) {
+  if (!/[\s"&|^<>()]/.test(arg))
+    return arg;
+  return `"${arg.replace(/"/g, '""')}"`;
+}
+function killWin32Tree(pid) {
+  try {
+    execSync2(`taskkill /T /F /PID ${pid}`, { windowsHide: true, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
   }
-  mapItem(item, phase) {
-    const type = asString(item.type);
-    const id = asString(item.id);
-    const now = Date.now();
-    if (type === "agentMessage") {
-      if (phase !== "completed")
-        return [];
-      const text = asString(item.text);
-      if (!text)
-        return [];
-      return [{ type: "text", text, project: false }];
-    }
-    if (type === "reasoning") {
-      if (phase !== "completed")
-        return [];
-      const text = joinReasoningText(item);
-      if (!text)
-        return [];
-      return [{ type: "thinking", text }];
-    }
-    if (type === "commandExecution") {
-      const command = formatCommand(item.command);
-      const callId = id ?? `shell-${now}`;
-      if (phase === "started") {
-        this.toolCallStart.set(callId, now);
-        return [
-          {
-            type: "tool_call",
-            callId,
-            toolName: "shell",
-            input: { command, cwd: asString(item.cwd) },
-            startedAt: new Date(now).toISOString()
-          }
-        ];
-      }
-      const durationMs = this.resolveDuration(callId, now, item.durationMs);
-      const output = asString(item.aggregatedOutput) ?? joinStreams(item.stdout, item.stderr);
-      const exitCode = typeof item.exitCode === "number" ? item.exitCode : void 0;
-      const status = asString(item.status);
-      const failed = exitCode !== void 0 && exitCode !== 0 || status === "failed" || status === "declined";
-      return [
-        {
-          type: "tool_result",
-          callId,
-          toolName: "shell",
-          output,
-          ...failed ? { error: output || `shell ${status ?? "exited"} (code=${exitCode ?? "?"})` } : {},
-          ...durationMs !== void 0 ? { durationMs } : {}
-        }
-      ];
-    }
-    if (type === "mcpToolCall") {
-      const server = asString(item.server);
-      const tool = asString(item.tool);
-      const toolName = server && tool ? `${server}:${tool}` : tool ?? server ?? "mcp";
-      const callId = id ?? `mcp-${now}`;
-      if (phase === "started") {
-        this.toolCallStart.set(callId, now);
-        return [
-          {
-            type: "tool_call",
-            callId,
-            toolName,
-            input: item.arguments ?? {},
-            startedAt: new Date(now).toISOString()
-          }
-        ];
-      }
-      const durationMs = this.resolveDuration(callId, now, item.durationMs);
-      const result = item.result;
-      const output = result == null ? "" : typeof result === "string" ? result : JSON.stringify(result);
+}
+function ensureGitRepo(workingDirectory) {
+  fs7.mkdirSync(workingDirectory, { recursive: true });
+  try {
+    execSync2("git rev-parse --is-inside-work-tree", { cwd: workingDirectory, stdio: "pipe" });
+    ensureLocalAttachmentGitExclude(workingDirectory);
+    return;
+  } catch {
+  }
+  const env = {
+    ...process.env,
+    GIT_AUTHOR_NAME: "parall-codex-agent",
+    GIT_AUTHOR_EMAIL: "agent@parall.local",
+    GIT_COMMITTER_NAME: "parall-codex-agent",
+    GIT_COMMITTER_EMAIL: "agent@parall.local"
+  };
+  try {
+    execSync2("git init", { cwd: workingDirectory, stdio: "pipe", env });
+    execSync2("git commit --allow-empty -m init", { cwd: workingDirectory, stdio: "pipe", env });
+    ensureLocalAttachmentGitExclude(workingDirectory);
+  } catch {
+  }
+}
+
+// ts/codex-agent/dist/app-server-protocol.js
+function buildTurnInput(body, images) {
+  return [
+    { type: "text", text: body },
+    ...images.map((image) => ({ type: "localImage", path: image.localPath }))
+  ];
+}
+function extractThreadId(result) {
+  if (!result || typeof result !== "object")
+    return void 0;
+  const r = result;
+  if (typeof r.threadId === "string")
+    return r.threadId;
+  const thread = r.thread;
+  if (thread && typeof thread.id === "string")
+    return thread.id;
+  return void 0;
+}
+function extractTurnId(result) {
+  if (!result || typeof result !== "object")
+    return void 0;
+  const r = result;
+  if (typeof r.turnId === "string")
+    return r.turnId;
+  const turn = r.turn;
+  if (turn && typeof turn.id === "string")
+    return turn.id;
+  return void 0;
+}
+function extractThreadIdFromNotification(params) {
+  if (!params || typeof params !== "object")
+    return void 0;
+  const p = params;
+  if (typeof p.threadId === "string")
+    return p.threadId;
+  const thread = p.thread;
+  if (thread && typeof thread.id === "string")
+    return thread.id;
+  const meta = p._meta ?? p.meta;
+  if (meta && typeof meta.threadId === "string")
+    return meta.threadId;
+  return void 0;
+}
+
+// ts/codex-agent/dist/jsonrpc-client.js
+var DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+var JsonRpcStdioClient = class {
+  proc;
+  requestTimeoutMs;
+  killProcess;
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  buffer = "";
+  onNotification = null;
+  disposed = false;
+  constructor(proc, requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, killProcess) {
+    this.proc = proc;
+    this.requestTimeoutMs = requestTimeoutMs;
+    this.killProcess = killProcess;
+    proc.stdout.setEncoding("utf8");
+    proc.stdout.on("data", (chunk) => this.ingest(chunk));
+    proc.once("close", () => this.dispose(new Error("app-server subprocess closed")));
+    proc.once("error", (err) => this.dispose(err));
+    proc.stdin.on("error", (err) => this.killUnhealthy(err));
+  }
+  setNotificationHandler(handler) {
+    this.onNotification = handler;
+  }
+  sendRequest(method, params) {
+    if (this.disposed) {
+      return Promise.reject(new Error("JSON-RPC client disposed"));
+    }
+    const id = this.nextId++;
+    const request3 = { jsonrpc: "2.0", id, method, params };
+    const promise = new Promise((resolve4, reject) => {
+      const timer = setTimeout(() => {
+        const pending = this.pending.get(id);
+        if (!pending)
+          return;
+        this.pending.delete(id);
+        reject(new Error(`JSON-RPC request "${method}" timed out after ${this.requestTimeoutMs}ms`));
+        this.killUnhealthy(new Error(`request "${method}" timed out; subprocess assumed hung`));
+      }, this.requestTimeoutMs);
+      this.pending.set(id, { resolve: resolve4, reject, timer });
+    });
+    this.writeFrame(request3);
+    return promise;
+  }
+  sendNotification(method, params) {
+    if (this.disposed)
+      return;
+    const notification = { jsonrpc: "2.0", method, params };
+    this.writeFrame(notification);
+  }
+  isDisposed() {
+    return this.disposed;
+  }
+  dispose(err) {
+    if (this.disposed)
+      return;
+    this.disposed = true;
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(err);
+    }
+    this.pending.clear();
+  }
+  writeFrame(message) {
+    try {
+      this.proc.stdin.write(`${JSON.stringify(message)}
+`);
+    } catch (err) {
+      this.killUnhealthy(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+  killUnhealthy(err) {
+    this.dispose(err);
+    if (this.proc.exitCode === null && this.proc.signalCode === null) {
+      if (this.killProcess) {
+        this.killProcess(this.proc);
+      } else {
+        this.proc.kill("SIGTERM");
+      }
+    }
+  }
+  ingest(chunk) {
+    this.buffer += chunk;
+    let newlineIndex = this.buffer.indexOf("\n");
+    while (newlineIndex >= 0) {
+      const line = this.buffer.slice(0, newlineIndex).trim();
+      this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (line)
+        this.handleLine(line);
+      newlineIndex = this.buffer.indexOf("\n");
+    }
+  }
+  handleLine(line) {
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (isResponse(message)) {
+      const pending = this.pending.get(message.id);
+      if (!pending)
+        return;
+      this.pending.delete(message.id);
+      clearTimeout(pending.timer);
+      if (message.error) {
+        pending.reject(new Error(message.error.message || "JSON-RPC error"));
+      } else {
+        pending.resolve(message.result);
+      }
+      return;
+    }
+    if (isNotification(message)) {
+      this.onNotification?.(message.method, message.params);
+    }
+  }
+};
+function isResponse(m) {
+  return !!m && typeof m === "object" && "id" in m && ("result" in m || "error" in m);
+}
+function isNotification(m) {
+  return !!m && typeof m === "object" && "method" in m && !("id" in m);
+}
+
+// ts/codex-agent/dist/event-mapping.js
+var EventMapper = class {
+  toolCallStart = /* @__PURE__ */ new Map();
+  /**
+   * Map a single server notification to zero or more RuntimeEvents.
+   * Return `null` for notifications that have no chat surface.
+   */
+  map(method, params) {
+    const events = [];
+    const p = params ?? {};
+    switch (method) {
+      // Streaming deltas are intentionally dropped — see the class comment.
+      case "item/agentMessage/delta":
+      case "item/reasoning/textDelta":
+      case "item/reasoning/summaryTextDelta":
+        break;
+      case "item/started": {
+        const item = p.item;
+        if (!item || typeof item.type !== "string")
+          break;
+        events.push(...this.mapItem(item, "started"));
+        break;
+      }
+      case "item/completed": {
+        const item = p.item;
+        if (!item || typeof item.type !== "string")
+          break;
+        events.push(...this.mapItem(item, "completed"));
+        break;
+      }
+      case "turn/completed": {
+        const turn = p.turn;
+        const status = turn ? asString(turn.status) : void 0;
+        const error = turn?.error;
+        if (status === "failed") {
+          const message = asString(error?.message) ?? "Codex turn failed";
+          events.push({ type: "error", message });
+        }
+        break;
+      }
+      case "error": {
+        const message = asString(p.message) ?? "Codex error";
+        events.push({ type: "error", message });
+        break;
+      }
+    }
+    return events;
+  }
+  mapItem(item, phase) {
+    const type = asString(item.type);
+    const id = asString(item.id);
+    const now = Date.now();
+    if (type === "agentMessage") {
+      if (phase !== "completed")
+        return [];
+      const text = asString(item.text);
+      if (!text)
+        return [];
+      return [{ type: "text", text, project: false }];
+    }
+    if (type === "reasoning") {
+      if (phase !== "completed")
+        return [];
+      const text = joinReasoningText(item);
+      if (!text)
+        return [];
+      return [{ type: "thinking", text }];
+    }
+    if (type === "commandExecution") {
+      const command = formatCommand(item.command);
+      const callId = id ?? `shell-${now}`;
+      if (phase === "started") {
+        this.toolCallStart.set(callId, now);
+        return [
+          {
+            type: "tool_call",
+            callId,
+            toolName: "shell",
+            input: { command, cwd: asString(item.cwd) },
+            startedAt: new Date(now).toISOString()
+          }
+        ];
+      }
+      const durationMs = this.resolveDuration(callId, now, item.durationMs);
+      const output = asString(item.aggregatedOutput) ?? joinStreams(item.stdout, item.stderr);
+      const exitCode = typeof item.exitCode === "number" ? item.exitCode : void 0;
+      const status = asString(item.status);
+      const failed = exitCode !== void 0 && exitCode !== 0 || status === "failed" || status === "declined";
+      return [
+        {
+          type: "tool_result",
+          callId,
+          toolName: "shell",
+          output,
+          ...failed ? { error: output || `shell ${status ?? "exited"} (code=${exitCode ?? "?"})` } : {},
+          ...durationMs !== void 0 ? { durationMs } : {}
+        }
+      ];
+    }
+    if (type === "mcpToolCall") {
+      const server = asString(item.server);
+      const tool = asString(item.tool);
+      const toolName = server && tool ? `${server}:${tool}` : tool ?? server ?? "mcp";
+      const callId = id ?? `mcp-${now}`;
+      if (phase === "started") {
+        this.toolCallStart.set(callId, now);
+        return [
+          {
+            type: "tool_call",
+            callId,
+            toolName,
+            input: item.arguments ?? {},
+            startedAt: new Date(now).toISOString()
+          }
+        ];
+      }
+      const durationMs = this.resolveDuration(callId, now, item.durationMs);
+      const result = item.result;
+      const output = result == null ? "" : typeof result === "string" ? result : JSON.stringify(result);
       const success = item.isSuccess !== false;
       return [
         {
@@ -34577,145 +35028,43 @@ function formatCommand(command) {
   return "";
 }
 
-// ts/codex-agent/dist/jsonrpc-client.js
-var DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
-var JsonRpcStdioClient = class {
-  proc;
-  requestTimeoutMs;
-  killProcess;
-  nextId = 1;
-  pending = /* @__PURE__ */ new Map();
-  buffer = "";
-  onNotification = null;
-  disposed = false;
-  constructor(proc, requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, killProcess) {
-    this.proc = proc;
-    this.requestTimeoutMs = requestTimeoutMs;
-    this.killProcess = killProcess;
-    proc.stdout.setEncoding("utf8");
-    proc.stdout.on("data", (chunk) => this.ingest(chunk));
-    proc.once("close", () => this.dispose(new Error("app-server subprocess closed")));
-    proc.once("error", (err) => this.dispose(err));
-    proc.stdin.on("error", (err) => this.killUnhealthy(err));
-  }
-  setNotificationHandler(handler) {
-    this.onNotification = handler;
-  }
-  sendRequest(method, params) {
-    if (this.disposed) {
-      return Promise.reject(new Error("JSON-RPC client disposed"));
-    }
-    const id = this.nextId++;
-    const request3 = { jsonrpc: "2.0", id, method, params };
-    const promise = new Promise((resolve4, reject) => {
-      const timer = setTimeout(() => {
-        const pending = this.pending.get(id);
-        if (!pending)
-          return;
-        this.pending.delete(id);
-        reject(new Error(`JSON-RPC request "${method}" timed out after ${this.requestTimeoutMs}ms`));
-        this.killUnhealthy(new Error(`request "${method}" timed out; subprocess assumed hung`));
-      }, this.requestTimeoutMs);
-      this.pending.set(id, { resolve: resolve4, reject, timer });
-    });
-    this.writeFrame(request3);
-    return promise;
-  }
-  sendNotification(method, params) {
-    if (this.disposed)
+// ts/codex-agent/dist/turn-sink.js
+var TurnSink = class {
+  mapper = new EventMapper();
+  queue = [];
+  resolver = null;
+  closed = false;
+  push(envelope) {
+    if (this.closed)
       return;
-    const notification = { jsonrpc: "2.0", method, params };
-    this.writeFrame(notification);
-  }
-  isDisposed() {
-    return this.disposed;
-  }
-  dispose(err) {
-    if (this.disposed)
+    if (this.resolver) {
+      const r = this.resolver;
+      this.resolver = null;
+      r(envelope);
       return;
-    this.disposed = true;
-    for (const pending of this.pending.values()) {
-      clearTimeout(pending.timer);
-      pending.reject(err);
-    }
-    this.pending.clear();
-  }
-  writeFrame(message) {
-    try {
-      this.proc.stdin.write(`${JSON.stringify(message)}
-`);
-    } catch (err) {
-      this.killUnhealthy(err instanceof Error ? err : new Error(String(err)));
-    }
-  }
-  killUnhealthy(err) {
-    this.dispose(err);
-    if (this.proc.exitCode === null && this.proc.signalCode === null) {
-      if (this.killProcess) {
-        this.killProcess(this.proc);
-      } else {
-        this.proc.kill("SIGTERM");
-      }
     }
+    this.queue.push(envelope);
   }
-  ingest(chunk) {
-    this.buffer += chunk;
-    let newlineIndex = this.buffer.indexOf("\n");
-    while (newlineIndex >= 0) {
-      const line = this.buffer.slice(0, newlineIndex).trim();
-      this.buffer = this.buffer.slice(newlineIndex + 1);
-      if (line)
-        this.handleLine(line);
-      newlineIndex = this.buffer.indexOf("\n");
+  next() {
+    const pending = this.queue.shift();
+    if (pending)
+      return Promise.resolve(pending);
+    if (this.closed) {
+      return Promise.resolve({ kind: "turn_end" });
     }
+    return new Promise((resolve4) => {
+      this.resolver = resolve4;
+    });
   }
-  handleLine(line) {
-    let message;
-    try {
-      message = JSON.parse(line);
-    } catch {
-      return;
-    }
-    if (isResponse(message)) {
-      const pending = this.pending.get(message.id);
-      if (!pending)
-        return;
-      this.pending.delete(message.id);
-      clearTimeout(pending.timer);
-      if (message.error) {
-        pending.reject(new Error(message.error.message || "JSON-RPC error"));
-      } else {
-        pending.resolve(message.result);
-      }
-      return;
-    }
-    if (isNotification(message)) {
-      this.onNotification?.(message.method, message.params);
-    }
+  close() {
+    this.closed = true;
+    const r = this.resolver;
+    this.resolver = null;
+    r?.({ kind: "turn_end" });
   }
 };
-function isResponse(m) {
-  return !!m && typeof m === "object" && "id" in m && ("result" in m || "error" in m);
-}
-function isNotification(m) {
-  return !!m && typeof m === "object" && "method" in m && !("id" in m);
-}
 
 // ts/codex-agent/dist/dispatch.js
-var IS_WIN32 = process.platform === "win32";
-function quoteWin32Arg(arg) {
-  if (!/[\s"&|^<>()]/.test(arg))
-    return arg;
-  return `"${arg.replace(/"/g, '""')}"`;
-}
-function killWin32Tree(pid) {
-  try {
-    execSync2(`taskkill /T /F /PID ${pid}`, { windowsHide: true, stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
 var CodexAppServerAdapter = class {
   opts;
   client = null;
@@ -34752,6 +35101,8 @@ var CodexAppServerAdapter = class {
       this.opts.model = config.model ?? void 0;
     if (config.reasoningEffort !== void 0)
       this.opts.reasoningEffort = config.reasoningEffort ?? void 0;
+    if (config.developerInstructions !== void 0)
+      this.opts.developerInstructions = config.developerInstructions ?? void 0;
   }
   async enqueueDuringDispatch(sessionKey, body) {
     const client = this.client;
@@ -34996,6 +35347,9 @@ var CodexAppServerAdapter = class {
       if (this.opts.useParallProvider) {
         forkParams.modelProvider = "parall";
       }
+      if (this.opts.developerInstructions) {
+        forkParams.developerInstructions = this.opts.developerInstructions;
+      }
       if (this.opts.model)
         forkParams.model = this.opts.model;
       if (this.opts.reasoningEffort) {
@@ -35021,11 +35375,14 @@ var CodexAppServerAdapter = class {
     return null;
   }
   /**
-   * Lazily restart the app-server before the NEXT turn: the workspace
-   * config.toml (developer_instructions, carrying capability fragments) is
-   * loaded at process start, so a changed fragment set needs a respawn to
-   * reach the prompt. Deferred to the next dispatch with no active turns —
-   * never kills an in-flight turn; thread state survives via thread/resume.
+   * Lazily restart the app-server before the NEXT turn, so a subprocess that
+   * has been running since before a capability change starts clean. Deferred
+   * to the next dispatch with no active turns — never kills an in-flight turn;
+   * thread state survives via thread/resume.
+   *
+   * A restart does NOT re-instruct an already-persisted thread — see the
+   * `developerInstructions` option doc. The capability shim dir on PATH is what
+   * makes a grant/revocation effective immediately.
    */
   requestProcessRestart() {
     this.restartRequested = true;
@@ -35035,7 +35392,7 @@ var CodexAppServerAdapter = class {
     if (!this.restartRequested || this.activeTurns.size > 0)
       return;
     this.restartRequested = false;
-    (log2 ?? this.opts.log)?.info?.("restarting codex app-server to pick up updated developer_instructions");
+    (log2 ?? this.opts.log)?.info?.("restarting codex app-server after a capability change (new threads pick up the refreshed developerInstructions; an already-persisted thread keeps its own)");
     await this.stop();
   }
   async stop() {
@@ -35174,6 +35531,9 @@ var CodexAppServerAdapter = class {
       commonParams.modelProvider = "parall";
     }
     commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
+    if (this.opts.developerInstructions) {
+      commonParams.developerInstructions = this.opts.developerInstructions;
+    }
     if (this.opts.model)
       commonParams.model = this.opts.model;
     if (this.opts.reasoningEffort) {
@@ -35196,119 +35556,21 @@ var CodexAppServerAdapter = class {
         for (const sink2 of this.activeTurns.values()) {
           sink2.push({ kind: "error", message: String(msg) });
         }
-      }
-      return;
-    }
-    const sink = this.activeTurns.get(threadId);
-    if (!sink)
-      return;
-    for (const event of sink.mapper.map(method, params)) {
-      sink.push({ kind: "runtime", event });
-    }
-    if (method === "turn/completed") {
-      this.activeTurnIds.delete(threadId);
-      sink.push({ kind: "turn_end", threadId });
-    }
-  }
-};
-var TurnSink = class {
-  mapper = new EventMapper();
-  queue = [];
-  resolver = null;
-  closed = false;
-  push(envelope) {
-    if (this.closed)
-      return;
-    if (this.resolver) {
-      const r = this.resolver;
-      this.resolver = null;
-      r(envelope);
-      return;
-    }
-    this.queue.push(envelope);
-  }
-  next() {
-    const pending = this.queue.shift();
-    if (pending)
-      return Promise.resolve(pending);
-    if (this.closed) {
-      return Promise.resolve({ kind: "turn_end" });
-    }
-    return new Promise((resolve4) => {
-      this.resolver = resolve4;
-    });
-  }
-  close() {
-    this.closed = true;
-    const r = this.resolver;
-    this.resolver = null;
-    r?.({ kind: "turn_end" });
-  }
-};
-function ensureGitRepo(workingDirectory) {
-  fs7.mkdirSync(workingDirectory, { recursive: true });
-  try {
-    execSync2("git rev-parse --is-inside-work-tree", { cwd: workingDirectory, stdio: "pipe" });
-    ensureLocalAttachmentGitExclude(workingDirectory);
-    return;
-  } catch {
-  }
-  const env = {
-    ...process.env,
-    GIT_AUTHOR_NAME: "parall-codex-agent",
-    GIT_AUTHOR_EMAIL: "agent@parall.local",
-    GIT_COMMITTER_NAME: "parall-codex-agent",
-    GIT_COMMITTER_EMAIL: "agent@parall.local"
-  };
-  try {
-    execSync2("git init", { cwd: workingDirectory, stdio: "pipe", env });
-    execSync2("git commit --allow-empty -m init", { cwd: workingDirectory, stdio: "pipe", env });
-    ensureLocalAttachmentGitExclude(workingDirectory);
-  } catch {
+      }
+      return;
+    }
+    const sink = this.activeTurns.get(threadId);
+    if (!sink)
+      return;
+    for (const event of sink.mapper.map(method, params)) {
+      sink.push({ kind: "runtime", event });
+    }
+    if (method === "turn/completed") {
+      this.activeTurnIds.delete(threadId);
+      sink.push({ kind: "turn_end", threadId });
+    }
   }
-}
-function buildTurnInput(body, images) {
-  return [
-    { type: "text", text: body },
-    ...images.map((image) => ({ type: "localImage", path: image.localPath }))
-  ];
-}
-function extractThreadId(result) {
-  if (!result || typeof result !== "object")
-    return void 0;
-  const r = result;
-  if (typeof r.threadId === "string")
-    return r.threadId;
-  const thread = r.thread;
-  if (thread && typeof thread.id === "string")
-    return thread.id;
-  return void 0;
-}
-function extractTurnId(result) {
-  if (!result || typeof result !== "object")
-    return void 0;
-  const r = result;
-  if (typeof r.turnId === "string")
-    return r.turnId;
-  const turn = r.turn;
-  if (turn && typeof turn.id === "string")
-    return turn.id;
-  return void 0;
-}
-function extractThreadIdFromNotification(params) {
-  if (!params || typeof params !== "object")
-    return void 0;
-  const p = params;
-  if (typeof p.threadId === "string")
-    return p.threadId;
-  const thread = p.thread;
-  if (thread && typeof thread.id === "string")
-    return thread.id;
-  const meta = p._meta ?? p.meta;
-  if (meta && typeof meta.threadId === "string")
-    return meta.threadId;
-  return void 0;
-}
+};
 function errToString(err) {
   if (err instanceof Error)
     return err.message;
@@ -35385,697 +35647,123 @@ var CodexSessionManager = class {
 };
 
 // ts/codex-agent/dist/workspace.js
+import * as fs10 from "node:fs";
+import * as path11 from "node:path";
+
+// ts/codex-agent/dist/legacy-workspace-config-migration.js
 import * as fs9 from "node:fs";
 import * as path10 from "node:path";
-
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/error.js
-function getLineColFromPtr(string, ptr) {
-  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
-  return [lines.length, lines.pop().length + 1];
-}
-function makeCodeBlock(string, line, column) {
-  let lines = string.split(/\r\n|\n|\r/g);
-  let codeblock = "";
-  let numberLen = (Math.log10(line + 1) | 0) + 1;
-  for (let i = line - 1; i <= line + 1; i++) {
-    let l = lines[i - 1];
-    if (!l)
-      continue;
-    codeblock += i.toString().padEnd(numberLen, " ");
-    codeblock += ":  ";
-    codeblock += l;
-    codeblock += "\n";
-    if (i === line) {
-      codeblock += " ".repeat(numberLen + column + 2);
-      codeblock += "^\n";
-    }
-  }
-  return codeblock;
-}
-var TomlError = class extends Error {
-  line;
-  column;
-  codeblock;
-  constructor(message, options) {
-    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
-    const codeblock = makeCodeBlock(options.toml, line, column);
-    super(`Invalid TOML document: ${message}
-
-${codeblock}`, options);
-    this.line = line;
-    this.column = column;
-    this.codeblock = codeblock;
-  }
-};
-
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/util.js
-function isEscaped(str, ptr) {
-  let i = 0;
-  while (str[ptr - ++i] === "\\")
-    ;
-  return --i && i % 2;
-}
-function indexOfNewline(str, start = 0, end = str.length) {
-  let idx = str.indexOf("\n", start);
-  if (str[idx - 1] === "\r")
-    idx--;
-  return idx <= end ? idx : -1;
-}
-function skipComment(str, ptr) {
-  for (let i = ptr; i < str.length; i++) {
-    let c = str[i];
-    if (c === "\n")
-      return i;
-    if (c === "\r" && str[i + 1] === "\n")
-      return i + 1;
-    if (c < " " && c !== "	" || c === "\x7F") {
-      throw new TomlError("control characters are not allowed in comments", {
-        toml: str,
-        ptr
-      });
-    }
-  }
-  return str.length;
+var LEGACY_CONFIG_RELPATH = [".codex", "config.toml"];
+var MIGRATION_SENTINEL_RELPATH = [".parall", "legacy-workspace-config-migration.v1"];
+function legacyWorkspaceConfigPath(workspaceDir) {
+  return path10.join(workspaceDir, ...LEGACY_CONFIG_RELPATH);
 }
-function skipVoid(str, ptr, banNewLines, banComments) {
-  let c;
-  while (1) {
-    while ((c = str[ptr]) === " " || c === "	" || !banNewLines && (c === "\n" || c === "\r" && str[ptr + 1] === "\n"))
-      ptr++;
-    if (banComments || c !== "#")
-      break;
-    ptr = skipComment(str, ptr);
-  }
-  return ptr;
+function migrationSentinelPath(workspaceDir) {
+  return path10.join(workspaceDir, ...MIGRATION_SENTINEL_RELPATH);
 }
-function skipUntil(str, ptr, sep2, end, banNewLines = false) {
-  if (!end) {
-    ptr = indexOfNewline(str, ptr);
-    return ptr < 0 ? str.length : ptr;
-  }
-  for (let i = ptr; i < str.length; i++) {
-    let c = str[i];
-    if (c === "#") {
-      i = indexOfNewline(str, i);
-    } else if (c === sep2) {
-      return i + 1;
-    } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i + 1] === "\n")) {
-      return i;
-    }
-  }
-  throw new TomlError("cannot find end of structure", {
-    toml: str,
-    ptr
-  });
+function legacyWorkspaceConfigToml(prompt) {
+  return `developer_instructions = """
+${prompt.replace(/\\/g, "\\\\").replace(/"""/g, '\\"""')}
+"""
+`;
 }
-function getStringEnd(str, seek) {
-  let first = str[seek];
-  let target = first === str[seek + 1] && str[seek + 1] === str[seek + 2] ? str.slice(seek, seek + 3) : first;
-  seek += target.length - 1;
-  do
-    seek = str.indexOf(target, ++seek);
-  while (seek > -1 && first !== "'" && isEscaped(str, seek));
-  if (seek > -1) {
-    seek += target.length;
-    if (target.length > 1) {
-      if (str[seek] === first)
-        seek++;
-      if (str[seek] === first)
-        seek++;
-    }
-  }
-  return seek;
+function classifyLegacyWorkspaceConfig(facts) {
+  const { entry, rawContent, proof } = facts;
+  if (!entry)
+    return { action: "none" };
+  if (!entry.isPlainFile)
+    return { action: "preserve", reason: "not-a-plain-file" };
+  if (entry.hardLinks !== 1)
+    return { action: "preserve", reason: "extra-hard-links" };
+  if (proof.kind === "absent")
+    return { action: "preserve", reason: "no-authorship-proof" };
+  if (proof.kind === "unreadable") {
+    return { action: "preserve", reason: "authorship-proof-unreadable" };
+  }
+  if (rawContent === null)
+    return { action: "preserve", reason: "config-unreadable" };
+  if (rawContent !== legacyWorkspaceConfigToml(proof.prompt)) {
+    return { action: "preserve", reason: "content-mismatch" };
+  }
+  return { action: "remove" };
 }
-
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/date.js
-var DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
-var TomlDate = class _TomlDate extends Date {
-  #hasDate = false;
-  #hasTime = false;
-  #offset = null;
-  constructor(date) {
-    let hasDate = true;
-    let hasTime = true;
-    let offset = "Z";
-    if (typeof date === "string") {
-      let match = date.match(DATE_TIME_RE);
-      if (match) {
-        if (!match[1]) {
-          hasDate = false;
-          date = `0000-01-01T${date}`;
-        }
-        hasTime = !!match[2];
-        hasTime && date[10] === " " && (date = date.replace(" ", "T"));
-        if (match[2] && +match[2] > 23) {
-          date = "";
-        } else {
-          offset = match[3] || null;
-          date = date.toUpperCase();
-          if (!offset && hasTime)
-            date += "Z";
-        }
-      } else {
-        date = "";
-      }
-    }
-    super(date);
-    if (!isNaN(this.getTime())) {
-      this.#hasDate = hasDate;
-      this.#hasTime = hasTime;
-      this.#offset = offset;
-    }
-  }
-  isDateTime() {
-    return this.#hasDate && this.#hasTime;
-  }
-  isLocal() {
-    return !this.#hasDate || !this.#hasTime || !this.#offset;
-  }
-  isDate() {
-    return this.#hasDate && !this.#hasTime;
-  }
-  isTime() {
-    return this.#hasTime && !this.#hasDate;
-  }
-  isValid() {
-    return this.#hasDate || this.#hasTime;
-  }
-  toISOString() {
-    let iso = super.toISOString();
-    if (this.isDate())
-      return iso.slice(0, 10);
-    if (this.isTime())
-      return iso.slice(11, 23);
-    if (this.#offset === null)
-      return iso.slice(0, -1);
-    if (this.#offset === "Z")
-      return iso;
-    let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
-    offset = this.#offset[0] === "-" ? offset : -offset;
-    let offsetDate = new Date(this.getTime() - offset * 6e4);
-    return offsetDate.toISOString().slice(0, -1) + this.#offset;
-  }
-  static wrapAsOffsetDateTime(jsDate, offset = "Z") {
-    let date = new _TomlDate(jsDate);
-    date.#offset = offset;
-    return date;
-  }
-  static wrapAsLocalDateTime(jsDate) {
-    let date = new _TomlDate(jsDate);
-    date.#offset = null;
-    return date;
-  }
-  static wrapAsLocalDate(jsDate) {
-    let date = new _TomlDate(jsDate);
-    date.#hasTime = false;
-    date.#offset = null;
-    return date;
-  }
-  static wrapAsLocalTime(jsDate) {
-    let date = new _TomlDate(jsDate);
-    date.#hasDate = false;
-    date.#offset = null;
-    return date;
-  }
+var PRESERVE_DETAIL = {
+  "not-a-plain-file": "it is a symlink or directory, not a plain file the bridge could have written",
+  "extra-hard-links": "the file has more than one hard link, so another path shares this inode",
+  "no-authorship-proof": "this workspace has no .parall/system-prompt.md from a previous boot, so nothing here can be proven ours",
+  "authorship-proof-unreadable": "the .parall/system-prompt.md authorship proof exists but could not be read, so ownership cannot be evaluated",
+  "config-unreadable": "its own bytes could not be read, so authorship cannot be proven",
+  "content-mismatch": "its bytes are not what the retired bridge would have written"
 };
+var SENTINEL_BODY = `Parall codex bridge \u2014 one-shot workspace migration record (v1)
 
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/primitive.js
-var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
-var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
-var LEADING_ZERO = /^[+-]?0[0-9_]/;
-var ESCAPE_REGEX = /^[0-9a-f]{2,8}$/i;
-var ESC_MAP = {
-  b: "\b",
-  t: "	",
-  n: "\n",
-  f: "\f",
-  r: "\r",
-  e: "\x1B",
-  '"': '"',
-  "\\": "\\"
-};
-function parseString(str, ptr = 0, endPtr = str.length) {
-  let isLiteral = str[ptr] === "'";
-  let isMultiline = str[ptr++] === str[ptr] && str[ptr] === str[ptr + 1];
-  if (isMultiline) {
-    endPtr -= 2;
-    if (str[ptr += 2] === "\r")
-      ptr++;
-    if (str[ptr] === "\n")
-      ptr++;
-  }
-  let tmp = 0;
-  let isEscape;
-  let parsed = "";
-  let sliceStart = ptr;
-  while (ptr < endPtr - 1) {
-    let c = str[ptr++];
-    if (c === "\n" || c === "\r" && str[ptr] === "\n") {
-      if (!isMultiline) {
-        throw new TomlError("newlines are not allowed in strings", {
-          toml: str,
-          ptr: ptr - 1
-        });
-      }
-    } else if (c < " " && c !== "	" || c === "\x7F") {
-      throw new TomlError("control characters are not allowed in strings", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    }
-    if (isEscape) {
-      isEscape = false;
-      if (c === "x" || c === "u" || c === "U") {
-        let code = str.slice(ptr, ptr += c === "x" ? 2 : c === "u" ? 4 : 8);
-        if (!ESCAPE_REGEX.test(code)) {
-          throw new TomlError("invalid unicode escape", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-        try {
-          parsed += String.fromCodePoint(parseInt(code, 16));
-        } catch {
-          throw new TomlError("invalid unicode escape", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-      } else if (isMultiline && (c === "\n" || c === " " || c === "	" || c === "\r")) {
-        ptr = skipVoid(str, ptr - 1, true);
-        if (str[ptr] !== "\n" && str[ptr] !== "\r") {
-          throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-        ptr = skipVoid(str, ptr);
-      } else if (c in ESC_MAP) {
-        parsed += ESC_MAP[c];
-      } else {
-        throw new TomlError("unrecognized escape sequence", {
-          toml: str,
-          ptr: tmp
-        });
-      }
-      sliceStart = ptr;
-    } else if (!isLiteral && c === "\\") {
-      tmp = ptr - 1;
-      isEscape = true;
-      parsed += str.slice(sliceStart, tmp);
-    }
-  }
-  return parsed + str.slice(sliceStart, endPtr - 1);
-}
-function parseValue(value, toml, ptr, integersAsBigInt) {
-  if (value === "true")
-    return true;
-  if (value === "false")
-    return false;
-  if (value === "-inf")
-    return -Infinity;
-  if (value === "inf" || value === "+inf")
-    return Infinity;
-  if (value === "nan" || value === "+nan" || value === "-nan")
-    return NaN;
-  if (value === "-0")
-    return integersAsBigInt ? 0n : 0;
-  let isInt = INT_REGEX.test(value);
-  if (isInt || FLOAT_REGEX.test(value)) {
-    if (LEADING_ZERO.test(value)) {
-      throw new TomlError("leading zeroes are not allowed", {
-        toml,
-        ptr
-      });
-    }
-    value = value.replace(/_/g, "");
-    let numeric = +value;
-    if (isNaN(numeric)) {
-      throw new TomlError("invalid number", {
-        toml,
-        ptr
-      });
-    }
-    if (isInt) {
-      if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
-        throw new TomlError("integer value cannot be represented losslessly", {
-          toml,
-          ptr
-        });
-      }
-      if (isInt || integersAsBigInt === true)
-        numeric = BigInt(value);
-    }
-    return numeric;
-  }
-  const date = new TomlDate(value);
-  if (!date.isValid()) {
-    throw new TomlError("invalid value", {
-      toml,
-      ptr
-    });
-  }
-  return date;
-}
+The legacy workspace-config cleanup has been CLAIMED for this workspace. Only the
+boot that created this file was allowed to remove a bridge-authored
+.codex/config.toml, and only under a byte-exact authorship proof.
 
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/extract.js
-function sliceAndTrimEndOf(str, startPtr, endPtr) {
-  let value = str.slice(startPtr, endPtr);
-  let commentIdx = value.indexOf("#");
-  if (commentIdx > -1) {
-    skipComment(str, commentIdx);
-    value = value.slice(0, commentIdx);
-  }
-  return [value.trimEnd(), commentIdx];
-}
-function extractValue(str, ptr, end, depth, integersAsBigInt) {
-  if (depth === 0) {
-    throw new TomlError("document contains excessively nested structures. aborting.", {
-      toml: str,
-      ptr
-    });
-  }
-  let c = str[ptr];
-  if (c === "[" || c === "{") {
-    let [value, endPtr2] = c === "[" ? parseArray(str, ptr, depth, integersAsBigInt) : parseInlineTable(str, ptr, depth, integersAsBigInt);
-    if (end) {
-      endPtr2 = skipVoid(str, endPtr2);
-      if (str[endPtr2] === ",")
-        endPtr2++;
-      else if (str[endPtr2] !== end) {
-        throw new TomlError("expected comma or end of structure", {
-          toml: str,
-          ptr: endPtr2
-        });
-      }
-    }
-    return [value, endPtr2];
-  }
-  let endPtr;
-  if (c === '"' || c === "'") {
-    endPtr = getStringEnd(str, ptr);
-    let parsed = parseString(str, ptr, endPtr);
-    if (end) {
-      endPtr = skipVoid(str, endPtr);
-      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== "\n" && str[endPtr] !== "\r") {
-        throw new TomlError("unexpected character encountered", {
-          toml: str,
-          ptr: endPtr
-        });
-      }
-      endPtr += +(str[endPtr] === ",");
-    }
-    return [parsed, endPtr];
-  }
-  endPtr = skipUntil(str, ptr, ",", end);
-  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","));
-  if (!slice[0]) {
-    throw new TomlError("incomplete key-value declaration: no value specified", {
-      toml: str,
-      ptr
-    });
-  }
-  if (end && slice[1] > -1) {
-    endPtr = skipVoid(str, ptr + slice[1]);
-    endPtr += +(str[endPtr] === ",");
-  }
-  return [
-    parseValue(slice[0], str, ptr, integersAsBigInt),
-    endPtr
-  ];
-}
+While this file exists the bridge will NEVER auto-remove .codex/config.toml again.
+Deleting this file does not safely re-arm the migration: the evidence it relied on
+(.parall/system-prompt.md as written by a pre-protocol-delivery bridge) has since
+been overwritten by this bridge, so a re-run could mistake a prompt it wrote itself
+for legacy evidence and delete a file that is not ours.
 
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/struct.js
-var KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
-function parseKey(str, ptr, end = "=") {
-  let dot = ptr - 1;
-  let parsed = [];
-  let endPtr = str.indexOf(end, ptr);
-  if (endPtr < 0) {
-    throw new TomlError("incomplete key-value: cannot find end of key", {
-      toml: str,
-      ptr
-    });
-  }
-  do {
-    let c = str[ptr = ++dot];
-    if (c !== " " && c !== "	") {
-      if (c === '"' || c === "'") {
-        if (c === str[ptr + 1] && c === str[ptr + 2]) {
-          throw new TomlError("multiline strings are not allowed in keys", {
-            toml: str,
-            ptr
-          });
-        }
-        let eos = getStringEnd(str, ptr);
-        if (eos < 0) {
-          throw new TomlError("unfinished string encountered", {
-            toml: str,
-            ptr
-          });
-        }
-        dot = str.indexOf(".", eos);
-        let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
-        let newLine = indexOfNewline(strEnd);
-        if (newLine > -1) {
-          throw new TomlError("newlines are not allowed in keys", {
-            toml: str,
-            ptr: ptr + dot + newLine
-          });
-        }
-        if (strEnd.trimStart()) {
-          throw new TomlError("found extra tokens after the string part", {
-            toml: str,
-            ptr: eos
-          });
-        }
-        if (endPtr < eos) {
-          endPtr = str.indexOf(end, eos);
-          if (endPtr < 0) {
-            throw new TomlError("incomplete key-value: cannot find end of key", {
-              toml: str,
-              ptr
-            });
-          }
-        }
-        parsed.push(parseString(str, ptr, eos));
-      } else {
-        dot = str.indexOf(".", ptr);
-        let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
-        if (!KEY_PART_RE.test(part)) {
-          throw new TomlError("only letter, numbers, dashes and underscores are allowed in keys", {
-            toml: str,
-            ptr
-          });
-        }
-        parsed.push(part.trimEnd());
-      }
-    }
-  } while (dot + 1 && dot < endPtr);
-  return [parsed, skipVoid(str, endPtr + 1, true, true)];
-}
-function parseInlineTable(str, ptr, depth, integersAsBigInt) {
-  let res = {};
-  let seen = /* @__PURE__ */ new Set();
-  let c;
-  ptr++;
-  while ((c = str[ptr++]) !== "}" && c) {
-    if (c === ",") {
-      throw new TomlError("expected value, found comma", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    } else if (c === "#")
-      ptr = skipComment(str, ptr);
-    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
-      let k;
-      let t = res;
-      let hasOwn = false;
-      let [key, keyEndPtr] = parseKey(str, ptr - 1);
-      for (let i = 0; i < key.length; i++) {
-        if (i)
-          t = hasOwn ? t[k] : t[k] = {};
-        k = key[i];
-        if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) {
-          throw new TomlError("trying to redefine an already defined value", {
-            toml: str,
-            ptr
-          });
-        }
-        if (!hasOwn && k === "__proto__") {
-          Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
-        }
-      }
-      if (hasOwn) {
-        throw new TomlError("trying to redefine an already defined value", {
-          toml: str,
-          ptr
-        });
-      }
-      let [value, valueEndPtr] = extractValue(str, keyEndPtr, "}", depth - 1, integersAsBigInt);
-      seen.add(value);
-      t[k] = value;
-      ptr = valueEndPtr;
-    }
-  }
-  if (!c) {
-    throw new TomlError("unfinished table encountered", {
-      toml: str,
-      ptr
-    });
+If a stale .codex/config.toml is still present, remove it by hand.
+`;
+function claimLegacyWorkspaceConfigMigration(workspaceDir) {
+  const sentinel = migrationSentinelPath(workspaceDir);
+  fs9.mkdirSync(path10.dirname(sentinel), { recursive: true });
+  try {
+    fs9.writeFileSync(sentinel, SENTINEL_BODY, { flag: "wx" });
+    return "claimed";
+  } catch (err) {
+    if (err.code === "EEXIST")
+      return "already-claimed";
+    throw err;
   }
-  return [res, ptr];
 }
-function parseArray(str, ptr, depth, integersAsBigInt) {
-  let res = [];
-  let c;
-  ptr++;
-  while ((c = str[ptr++]) !== "]" && c) {
-    if (c === ",") {
-      throw new TomlError("expected value, found comma", {
-        toml: str,
-        ptr: ptr - 1
-      });
-    } else if (c === "#")
-      ptr = skipComment(str, ptr);
-    else if (c !== " " && c !== "	" && c !== "\n" && c !== "\r") {
-      let e = extractValue(str, ptr - 1, "]", depth - 1, integersAsBigInt);
-      res.push(e[0]);
-      ptr = e[1];
-    }
-  }
-  if (!c) {
-    throw new TomlError("unfinished array encountered", {
-      toml: str,
-      ptr
-    });
-  }
-  return [res, ptr];
+function runLegacyWorkspaceConfigMigration(workspaceDir, readProof, log2) {
+  if (claimLegacyWorkspaceConfigMigration(workspaceDir) === "already-claimed")
+    return;
+  cleanupLegacyWorkspaceConfig(workspaceDir, readProof(), log2);
 }
-
-// ts/node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/parse.js
-function peekTable(key, table, meta, type) {
-  let t = table;
-  let m = meta;
-  let k;
-  let hasOwn = false;
-  let state;
-  for (let i = 0; i < key.length; i++) {
-    if (i) {
-      t = hasOwn ? t[k] : t[k] = {};
-      m = (state = m[k]).c;
-      if (type === 0 && (state.t === 1 || state.t === 2)) {
-        return null;
-      }
-      if (state.t === 2) {
-        let l = t.length - 1;
-        t = t[l];
-        m = m[l].c;
-      }
-    }
-    k = key[i];
-    if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) {
-      return null;
-    }
-    if (!hasOwn) {
-      if (k === "__proto__") {
-        Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
-        Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
-      }
-      m[k] = {
-        t: i < key.length - 1 && type === 2 ? 3 : type,
-        d: false,
-        i: 0,
-        c: {}
-      };
+function cleanupLegacyWorkspaceConfig(workspaceDir, proof, log2) {
+  const configPath = legacyWorkspaceConfigPath(workspaceDir);
+  let entry;
+  try {
+    entry = fs9.lstatSync(configPath);
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      log2?.warn(`could not inspect legacy workspace codex config ${configPath}: ${String(err)}`);
     }
+    return;
   }
-  state = m[k];
-  if (state.t !== type && !(type === 1 && state.t === 3)) {
-    return null;
-  }
-  if (type === 2) {
-    if (!state.d) {
-      state.d = true;
-      t[k] = [];
+  const isPlainFile = entry.isFile();
+  let rawContent = null;
+  if (isPlainFile) {
+    try {
+      rawContent = fs9.readFileSync(configPath, "utf8");
+    } catch (err) {
+      log2?.warn(`could not read legacy workspace codex config ${configPath}: ${String(err)}`);
     }
-    t[k].push(t = {});
-    state.c[state.i++] = state = { t: 1, d: false, i: 0, c: {} };
-  }
-  if (state.d) {
-    return null;
-  }
-  state.d = true;
-  if (type === 1) {
-    t = hasOwn ? t[k] : t[k] = {};
-  } else if (type === 0 && hasOwn) {
-    return null;
   }
-  return [k, t, state.c];
-}
-function parse(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
-  let res = {};
-  let meta = {};
-  let tbl = res;
-  let m = meta;
-  for (let ptr = skipVoid(toml, 0); ptr < toml.length; ) {
-    if (toml[ptr] === "[") {
-      let isTableArray = toml[++ptr] === "[";
-      let k = parseKey(toml, ptr += +isTableArray, "]");
-      if (isTableArray) {
-        if (toml[k[1] - 1] !== "]") {
-          throw new TomlError("expected end of table declaration", {
-            toml,
-            ptr: k[1] - 1
-          });
-        }
-        k[1]++;
-      }
-      let p = peekTable(
-        k[0],
-        res,
-        meta,
-        isTableArray ? 2 : 1
-        /* Type.EXPLICIT */
-      );
-      if (!p) {
-        throw new TomlError("trying to redefine an already defined table or value", {
-          toml,
-          ptr
-        });
-      }
-      m = p[2];
-      tbl = p[1];
-      ptr = k[1];
-    } else {
-      let k = parseKey(toml, ptr);
-      let p = peekTable(
-        k[0],
-        tbl,
-        m,
-        0
-        /* Type.DOTTED */
-      );
-      if (!p) {
-        throw new TomlError("trying to redefine an already defined table or value", {
-          toml,
-          ptr
-        });
-      }
-      let v = extractValue(toml, k[1], void 0, maxDepth, integersAsBigInt);
-      p[1][p[0]] = v[0];
-      ptr = v[1];
-    }
-    ptr = skipVoid(toml, ptr, true);
-    if (toml[ptr] && toml[ptr] !== "\n" && toml[ptr] !== "\r") {
-      throw new TomlError("each key-value declaration must be followed by an end-of-line", {
-        toml,
-        ptr
-      });
+  const verdict = classifyLegacyWorkspaceConfig({
+    entry: { isPlainFile, hardLinks: entry.nlink },
+    rawContent,
+    proof
+  });
+  if (verdict.action === "none")
+    return;
+  if (verdict.action === "remove") {
+    try {
+      fs9.unlinkSync(configPath);
+    } catch (err) {
+      if (err.code === "ENOENT")
+        return;
+      log2?.warn(`could not remove legacy workspace codex config ${configPath}: ${String(err)}`);
     }
-    ptr = skipVoid(toml, ptr);
+    return;
   }
-  return res;
+  log2?.warn(`leaving ${configPath} in place \u2014 ${PRESERVE_DETAIL[verdict.reason]}, so it is not provably the retired bridge's own artifact. Codex loads it for trusted workspaces IN ADDITION to the platform instructions; remove it manually if it is a stale artifact.`);
 }
 
 // ts/codex-agent/dist/workspace.js
@@ -36089,16 +35777,16 @@ function sleepSync(ms) {
   Atomics.wait(SLEEP_SIGNAL, 0, 0, ms);
 }
 function withConfigLock(codexHome, log2, fn) {
-  const queueDir = path10.join(codexHome, "config.toml.lock.d");
+  const queueDir = path11.join(codexHome, "config.toml.lock.d");
   let ticketName = bakeryEnqueue(queueDir);
-  let ticketPath = ticketName ? path10.join(queueDir, ticketName) : "";
+  let ticketPath = ticketName ? path11.join(queueDir, ticketName) : "";
   let acquired = false;
   let heldPath = "";
   const deadline = Date.now() + CONFIG_LOCK_TIMINGS.waitMs;
   while (ticketName && Date.now() < deadline) {
     let names;
     try {
-      names = fs9.readdirSync(queueDir).sort();
+      names = fs10.readdirSync(queueDir).sort();
     } catch {
       break;
     }
@@ -36106,7 +35794,7 @@ function withConfigLock(codexHome, log2, fn) {
       ticketName = bakeryEnqueue(queueDir);
       if (!ticketName)
         break;
-      ticketPath = path10.join(queueDir, ticketName);
+      ticketPath = path11.join(queueDir, ticketName);
       continue;
     }
     const now = Date.now();
@@ -36114,12 +35802,12 @@ function withConfigLock(codexHome, log2, fn) {
     let blocked = false;
     let head;
     for (const name of names) {
-      const entryPath = path10.join(queueDir, name);
+      const entryPath = path11.join(queueDir, name);
       if (name.startsWith("held-")) {
         const enteredAt = Number.parseInt(name.slice(5, 20), 10);
         if (Number.isFinite(enteredAt) && now - enteredAt > CONFIG_LOCK_TIMINGS.staleMs) {
           try {
-            fs9.unlinkSync(entryPath);
+            fs10.unlinkSync(entryPath);
           } catch {
           }
           rescan = true;
@@ -36130,14 +35818,14 @@ function withConfigLock(codexHome, log2, fn) {
       }
       let mtimeMs;
       try {
-        mtimeMs = fs9.statSync(entryPath).mtimeMs;
+        mtimeMs = fs10.statSync(entryPath).mtimeMs;
       } catch {
         rescan = true;
         break;
       }
       if (now - mtimeMs > CONFIG_LOCK_TIMINGS.staleMs) {
         try {
-          fs9.unlinkSync(entryPath);
+          fs10.unlinkSync(entryPath);
         } catch {
         }
         rescan = true;
@@ -36157,9 +35845,9 @@ function withConfigLock(codexHome, log2, fn) {
     if (!blocked && head === ticketName) {
       CONFIG_LOCK_TEST_HOOKS.beforeTicketEntry?.();
       const heldName = `held-${String(Date.now()).padStart(15, "0")}-${ticketName.slice(2)}`;
-      const candidateHeldPath = path10.join(queueDir, heldName);
+      const candidateHeldPath = path11.join(queueDir, heldName);
       try {
-        fs9.renameSync(ticketPath, candidateHeldPath);
+        fs10.renameSync(ticketPath, candidateHeldPath);
       } catch {
         continue;
       }
@@ -36169,7 +35857,7 @@ function withConfigLock(codexHome, log2, fn) {
     }
     try {
       const t = /* @__PURE__ */ new Date();
-      fs9.utimesSync(ticketPath, t, t);
+      fs10.utimesSync(ticketPath, t, t);
     } catch {
     }
     sleepSync(CONFIG_LOCK_TIMINGS.retryMs);
@@ -36178,7 +35866,7 @@ function withConfigLock(codexHome, log2, fn) {
     log2?.warn(`could not acquire ${queueDir}; writing config.toml without lock`);
     if (ticketName) {
       try {
-        fs9.unlinkSync(ticketPath);
+        fs10.unlinkSync(ticketPath);
       } catch {
       }
     }
@@ -36188,7 +35876,7 @@ function withConfigLock(codexHome, log2, fn) {
   } finally {
     if (acquired) {
       try {
-        fs9.unlinkSync(heldPath);
+        fs10.unlinkSync(heldPath);
       } catch {
       }
     }
@@ -36198,17 +35886,17 @@ var CONFIG_LOCK_TEST_HOOKS = {};
 function bakeryEnqueue(queueDir) {
   for (let attempt = 0; attempt < 3; attempt++) {
     const token = `${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
-    const markerPath = path10.join(queueDir, `choosing-${token}`);
+    const markerPath = path11.join(queueDir, `choosing-${token}`);
     try {
-      fs9.mkdirSync(queueDir, { recursive: true });
+      fs10.mkdirSync(queueDir, { recursive: true });
       CONFIG_LOCK_TEST_HOOKS.beforeChoosingMarker?.();
-      fs9.writeFileSync(markerPath, "", { flag: "wx" });
+      fs10.writeFileSync(markerPath, "", { flag: "wx" });
     } catch {
       return null;
     }
     try {
       let maxSeq = 0;
-      for (const name of fs9.readdirSync(queueDir)) {
+      for (const name of fs10.readdirSync(queueDir)) {
         if (!name.startsWith("t-"))
           continue;
         const seq = Number.parseInt(name.slice(2, 12), 10);
@@ -36216,18 +35904,18 @@ function bakeryEnqueue(queueDir) {
           maxSeq = seq;
       }
       const ticketName = `t-${String(maxSeq + 1).padStart(10, "0")}-${token}`;
-      const ticketPath = path10.join(queueDir, ticketName);
+      const ticketPath = path11.join(queueDir, ticketName);
       CONFIG_LOCK_TEST_HOOKS.beforeTicketPublish?.();
-      fs9.renameSync(markerPath, ticketPath);
+      fs10.renameSync(markerPath, ticketPath);
       try {
         const t = /* @__PURE__ */ new Date();
-        fs9.utimesSync(ticketPath, t, t);
+        fs10.utimesSync(ticketPath, t, t);
       } catch {
       }
       return ticketName;
     } catch (err) {
       try {
-        fs9.unlinkSync(markerPath);
+        fs10.unlinkSync(markerPath);
       } catch {
       }
       if (err.code === "ENOENT")
@@ -36241,21 +35929,21 @@ function writeConfigAtomic(filePath, content) {
   const realPath = resolveWriteTarget(filePath);
   let mode;
   try {
-    mode = fs9.statSync(realPath).mode & 511;
+    mode = fs10.statSync(realPath).mode & 511;
   } catch {
   }
   const tmpPath = `${realPath}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
   let tmpCreated = false;
   try {
-    fs9.writeFileSync(tmpPath, content, { encoding: "utf8", mode: 384, flag: "wx" });
+    fs10.writeFileSync(tmpPath, content, { encoding: "utf8", mode: 384, flag: "wx" });
     tmpCreated = true;
     if (mode !== void 0)
-      fs9.chmodSync(tmpPath, mode);
-    fs9.renameSync(tmpPath, realPath);
+      fs10.chmodSync(tmpPath, mode);
+    fs10.renameSync(tmpPath, realPath);
   } catch (err) {
     if (tmpCreated || err.code !== "EEXIST") {
       try {
-        fs9.unlinkSync(tmpPath);
+        fs10.unlinkSync(tmpPath);
       } catch {
       }
     }
@@ -36264,13 +35952,13 @@ function writeConfigAtomic(filePath, content) {
 }
 function resolveWriteTarget(filePath) {
   try {
-    return fs9.realpathSync(filePath);
+    return fs10.realpathSync(filePath);
   } catch (err) {
     if (err.code !== "ENOENT")
       throw err;
   }
   const seen = /* @__PURE__ */ new Set();
-  let p = path10.resolve(filePath);
+  let p = path11.resolve(filePath);
   for (let depth = 0; depth < 40; depth++) {
     if (seen.has(p)) {
       throw new Error(`symlink cycle at ${p} while resolving ${filePath}`);
@@ -36278,87 +35966,17 @@ function resolveWriteTarget(filePath) {
     seen.add(p);
     let link;
     try {
-      link = fs9.readlinkSync(p);
+      link = fs10.readlinkSync(p);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT" || code === "EINVAL")
         return p;
       throw err;
     }
-    p = path10.resolve(path10.dirname(p), link);
+    p = path11.resolve(path11.dirname(p), link);
   }
   throw new Error(`symlink chain deeper than 40 while resolving ${filePath}`);
 }
-function ensureWorkspaceTrusted(codexHome, workspaceDir, log2) {
-  withConfigLock(codexHome, log2, () => ensureWorkspaceTrustedLocked(codexHome, workspaceDir, log2));
-}
-function ensureWorkspaceTrustedLocked(codexHome, workspaceDir, log2) {
-  const configPath = path10.join(codexHome, "config.toml");
-  const normalizedPath = path10.resolve(workspaceDir);
-  try {
-    let content = "";
-    try {
-      content = fs9.readFileSync(configPath, "utf8");
-    } catch (err) {
-      if (err.code !== "ENOENT")
-        throw err;
-    }
-    let parsed;
-    if (content) {
-      try {
-        parsed = parse(content);
-      } catch {
-        log2?.warn(`Codex config.toml is not valid TOML; skipping trust write for ${normalizedPath}`);
-        return;
-      }
-    }
-    const projects = parsed?.projects;
-    const existingTrust = projects?.[normalizedPath]?.trust_level;
-    if (existingTrust === "trusted")
-      return;
-    if (existingTrust !== void 0) {
-      log2?.warn(`Codex config marks ${normalizedPath} as trust_level=${JSON.stringify(existingTrust)}; respecting the explicit decision \u2014 project-level developer_instructions will not load for this workspace`);
-      return;
-    }
-    const escapedPath = normalizedPath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-    const sectionHeader = `[projects."${escapedPath}"]`;
-    const trustLine = 'trust_level = "trusted"';
-    const headerIdx = content.indexOf(sectionHeader);
-    if (headerIdx !== -1) {
-      const headerLineEnd = content.indexOf("\n", headerIdx);
-      if (headerLineEnd === -1) {
-        content = `${content}
-${trustLine}
-`;
-      } else {
-        const afterHeader = headerLineEnd + 1;
-        const sectionEnd = findSectionEnd(content, afterHeader);
-        const sectionBody = content.substring(afterHeader, sectionEnd);
-        const trustMatch = sectionBody.match(/^[ \t]*trust_level[ \t]*=.*$/m);
-        if (trustMatch) {
-          const matchStart = afterHeader + trustMatch.index;
-          const matchEnd = matchStart + trustMatch[0].length;
-          content = content.substring(0, matchStart) + trustLine + content.substring(matchEnd);
-        } else {
-          content = content.substring(0, afterHeader) + trustLine + "\n" + content.substring(afterHeader);
-        }
-      }
-      writeConfigAtomic(configPath, content);
-    } else if (projects?.[normalizedPath] !== void 0) {
-      log2?.warn(`Codex config.toml has non-canonical header for ${normalizedPath}; skipping trust write`);
-    } else if (projects && !content.includes("[projects.")) {
-      log2?.warn(`Codex config.toml uses inline table for projects; skipping trust write for ${normalizedPath}`);
-    } else {
-      fs9.mkdirSync(codexHome, { recursive: true });
-      fs9.appendFileSync(configPath, `
-${sectionHeader}
-${trustLine}
-`, "utf8");
-    }
-  } catch (err) {
-    log2?.warn(`failed to write Codex project trust for ${normalizedPath}: ${String(err)}`);
-  }
-}
 function isParallProxyMode(env = process.env) {
   const baseUrl = env.OPENAI_BASE_URL?.trim()?.replace(/\/+$/, "");
   const apiUrl = env.PRLL_API_URL?.trim()?.replace(/\/+$/, "");
@@ -36366,16 +35984,50 @@ function isParallProxyMode(env = process.env) {
     return false;
   return baseUrl === apiUrl || baseUrl.startsWith(`${apiUrl}/`);
 }
-function ensureParallProvider(codexHome, apiUrl, log2) {
-  withConfigLock(codexHome, log2, () => ensureParallProviderLocked(codexHome, apiUrl));
+function tomlBasicString(value) {
+  let out = "";
+  for (const ch of value) {
+    const code = ch.codePointAt(0) ?? 0;
+    if (ch === "\\")
+      out += "\\\\";
+    else if (ch === '"')
+      out += '\\"';
+    else if (ch === "\b")
+      out += "\\b";
+    else if (ch === "	")
+      out += "\\t";
+    else if (ch === "\n")
+      out += "\\n";
+    else if (ch === "\f")
+      out += "\\f";
+    else if (ch === "\r")
+      out += "\\r";
+    else if (code < 32 || code === 127)
+      out += `\\u${code.toString(16).padStart(4, "0")}`;
+    else
+      out += ch;
+  }
+  return `"${out}"`;
+}
+function parallAuthLines(opts) {
+  const platform = opts?.platform ?? process.platform;
+  if (platform !== "win32") {
+    return ['command = "printenv"', 'args = ["OPENAI_API_KEY"]'];
+  }
+  const nodeBin = opts?.nodeBin ?? process.execPath;
+  const script = "const v=process.env.OPENAI_API_KEY;if(v===undefined)process.exit(1);process.stdout.write(v)";
+  return [`command = ${tomlBasicString(nodeBin)}`, `args = ["-e", ${tomlBasicString(script)}]`];
+}
+function ensureParallProvider(codexHome, apiUrl, log2, opts) {
+  withConfigLock(codexHome, log2, () => ensureParallProviderLocked(codexHome, apiUrl, opts));
 }
-function ensureParallProviderLocked(codexHome, apiUrl) {
-  const configPath = path10.join(codexHome, "config.toml");
+function ensureParallProviderLocked(codexHome, apiUrl, opts) {
+  const configPath = path11.join(codexHome, "config.toml");
   const baseUrl = apiUrl.replace(/\/$/, "") + "/api/llm/v1";
   try {
     let content = "";
     try {
-      content = fs9.readFileSync(configPath, "utf8");
+      content = fs10.readFileSync(configPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -36385,14 +36037,13 @@ function ensureParallProviderLocked(codexHome, apiUrl) {
     const providerBlock = [
       sectionHeader,
       'name = "Parall Proxy"',
-      `base_url = "${baseUrl}"`,
+      `base_url = ${tomlBasicString(baseUrl)}`,
       'wire_api = "responses"',
       "supports_websockets = false",
       "requires_openai_auth = false",
       "",
       authHeader,
-      'command = "printenv"',
-      'args = ["OPENAI_API_KEY"]'
+      ...parallAuthLines(opts)
     ].join("\n");
     const headerIdx = content.indexOf(sectionHeader);
     if (headerIdx !== -1) {
@@ -36406,7 +36057,7 @@ function ensureParallProviderLocked(codexHome, apiUrl) {
     } else {
       content = content.trimEnd() + "\n\n" + providerBlock + "\n";
     }
-    fs9.mkdirSync(codexHome, { recursive: true });
+    fs10.mkdirSync(codexHome, { recursive: true });
     writeConfigAtomic(configPath, content);
   } catch (err) {
     throw new Error(`failed to write Parall provider config: ${String(err)}`);
@@ -36416,6 +36067,9 @@ function findSectionEnd(content, fromIndex) {
   const nextHeader = content.indexOf("\n[", fromIndex);
   return nextHeader === -1 ? content.length : nextHeader;
 }
+function systemPromptCopyPath(workspaceDir) {
+  return path11.join(workspaceDir, ".parall", "system-prompt.md");
+}
 function writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments) {
   const parts = [
     buildIdentity(agentIdentity),
@@ -36428,21 +36082,27 @@ function writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments
   }
   parts.push(buildSkillReferences(workspaceDir));
   const systemPrompt = parts.join("\n\n");
-  const parallDir = path10.join(workspaceDir, ".parall");
-  fs9.mkdirSync(parallDir, { recursive: true });
-  fs9.writeFileSync(path10.join(parallDir, "system-prompt.md"), systemPrompt, "utf8");
-  const codexConfigDir = path10.join(workspaceDir, ".codex");
-  fs9.mkdirSync(codexConfigDir, { recursive: true });
-  const toml = `developer_instructions = """
-${systemPrompt.replace(/\\/g, "\\\\").replace(/"""/g, '\\"""')}
-"""
-`;
-  fs9.writeFileSync(path10.join(codexConfigDir, "config.toml"), toml, "utf8");
+  fs10.mkdirSync(path11.join(workspaceDir, ".parall"), { recursive: true });
+  fs10.writeFileSync(systemPromptCopyPath(workspaceDir), systemPrompt, "utf8");
+  return systemPrompt;
 }
 function ensureCodexWorkspace(workspaceDir, log2, agentIdentity, capabilityFragments) {
-  fs9.mkdirSync(workspaceDir, { recursive: true });
-  writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments);
-  writeSkillFiles(path10.join(workspaceDir, ".parall", "skills"));
+  fs10.mkdirSync(workspaceDir, { recursive: true });
+  runLegacyWorkspaceConfigMigration(workspaceDir, () => readAuthorshipProof(workspaceDir, log2), log2);
+  const systemPrompt = writeCodexSystemPrompt(workspaceDir, agentIdentity, capabilityFragments);
+  writeSkillFiles(path11.join(workspaceDir, ".parall", "skills"));
+  return systemPrompt;
+}
+function readAuthorshipProof(workspaceDir, log2) {
+  const proofPath = systemPromptCopyPath(workspaceDir);
+  try {
+    return { kind: "present", prompt: fs10.readFileSync(proofPath, "utf8") };
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return { kind: "absent" };
+    log2?.warn(`could not read the authorship proof ${proofPath}: ${String(err)}`);
+    return { kind: "unreadable" };
+  }
 }
 
 // ts/codex-agent/dist/index.js
@@ -36490,7 +36150,6 @@ async function main() {
     const agentUserId = me.id;
     const agentLog = childLogger(activeLog, agentUserId);
     activeLog = agentLog;
-    ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, agentLog);
     const useParallProvider = isParallProxyMode();
     if (useParallProvider) {
       ensureParallProvider(config.codexHome, config.apiUrl, agentLog);
@@ -36524,7 +36183,7 @@ async function main() {
     };
     const bootCapabilityFragments = applyChannelCapabilities();
     let lastCapabilityFragments = bootCapabilityFragments.join("\n\n");
-    ensureCodexWorkspace(config.workspaceDir, agentLog, agentIdentity, bootCapabilityFragments);
+    const developerInstructions = ensureCodexWorkspace(config.workspaceDir, agentLog, agentIdentity, bootCapabilityFragments);
     const platformModelOverride = deriveModelIsPin(platformDefaults, me.agent_profile);
     const resolvedModel = resolveRuntimeModel(platformModelOverride, platformDefaults.model, config.model);
     const resolvedEffort = platformDefaults.thinkingEffort ?? config.reasoningEffort;
@@ -36545,7 +36204,8 @@ async function main() {
       contextFilePath: mainContextFilePath,
       contextDirPath: dispatchContextDirPath(config.stateDir),
       useParallProvider,
-      capabilityBinDir: capabilityBinDir(config.stateDir)
+      capabilityBinDir: capabilityBinDir(config.stateDir),
+      developerInstructions
     });
     const refreshPlatformConfig = async () => {
       const updated = await configMgr.fetch();
@@ -36566,7 +36226,8 @@ async function main() {
       const joinedFragments = fragments.join("\n\n");
       let promptWritten = true;
       try {
-        writeCodexSystemPrompt(config.workspaceDir, agentIdentity, fragments);
+        const refreshedPrompt = writeCodexSystemPrompt(config.workspaceDir, agentIdentity, fragments);
+        adapter.updateConfig({ developerInstructions: refreshedPrompt });
       } catch (err) {
         promptWritten = false;
         agentLog.warn(`system prompt refresh write failed (retrying next refresh): ${String(err)}`);
@@ -36636,42 +36297,3 @@ main().catch((err) => {
   activeLog.error(`fatal: ${String(err)}`);
   process.exitCode = 1;
 });
-/*! Bundled license information:
-
-smol-toml/dist/error.js:
-smol-toml/dist/util.js:
-smol-toml/dist/date.js:
-smol-toml/dist/primitive.js:
-smol-toml/dist/extract.js:
-smol-toml/dist/struct.js:
-smol-toml/dist/parse.js:
-smol-toml/dist/stringify.js:
-smol-toml/dist/index.js:
-  (*!
-   * Copyright (c) Squirrel Chat et al., All rights reserved.
-   * SPDX-License-Identifier: BSD-3-Clause
-   *
-   * Redistribution and use in source and binary forms, with or without
-   * modification, are permitted provided that the following conditions are met:
-   *
-   * 1. Redistributions of source code must retain the above copyright notice, this
-   *    list of conditions and the following disclaimer.
-   * 2. Redistributions in binary form must reproduce the above copyright notice,
-   *    this list of conditions and the following disclaimer in the
-   *    documentation and/or other materials provided with the distribution.
-   * 3. Neither the name of the copyright holder nor the names of its contributors
-   *    may be used to endorse or promote products derived from this software without
-   *    specific prior written permission.
-   *
-   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-   * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-   * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-   * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-   *)
-*/