@rynx-ai/runtime 0.1.11-beta.2 → 0.1.11-beta.20

package/dist/claude/models.d.ts

@@ -1,9 +1,4 @@
 import type { ModelInfo, ModelListResponse } from "../codex-app-server/protocol.js";
-/**
- * Default model for the claude runtime when `CLAUDE_MODEL` is unset. Kept in
- * sync with the `CLAUDE_MODEL` default in {@link import("../config.js")}.
- */
-export declare const CLAUDE_DEFAULT_MODEL = "claude-sonnet-4-6";
 /** Build the `ModelInfo[]` for the claude runtime. */
 export declare function claudeModelInfos(): ModelInfo[];
 /** {@link ModelListResponse} for the claude runtime (broker `listModels`). */

package/dist/claude/models.js

@@ -1,8 +1,3 @@
-/**
- * Default model for the claude runtime when `CLAUDE_MODEL` is unset. Kept in
- * sync with the `CLAUDE_MODEL` default in {@link import("../config.js")}.
- */
-export const CLAUDE_DEFAULT_MODEL = "claude-sonnet-4-6";
 /**
  * Static catalogue of Claude models the `/model` card and `/models` reply offer
  * for the claude runtime. Unlike codex/traex (which query a live app-server),
@@ -12,7 +7,7 @@ export const CLAUDE_DEFAULT_MODEL = "claude-sonnet-4-6";
  */
 const CLAUDE_MODEL_IDS = [
     { id: "claude-opus-4-8", displayName: "Claude Opus 4.8 · 最强" },
-    { id: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6 · 均衡（默认）" },
+    { id: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6 · 均衡" },
     { id: "claude-haiku-4-5", displayName: "Claude Haiku 4.5 · 最快" },
     { id: "claude-opus-4-7", displayName: "Claude Opus 4.7" },
     { id: "claude-opus-4-6", displayName: "Claude Opus 4.6" },
@@ -24,7 +19,6 @@ export function claudeModelInfos() {
         id,
         model: id,
         displayName,
-        isDefault: id === CLAUDE_DEFAULT_MODEL,
     }));
 }
 /** {@link ModelListResponse} for the claude runtime (broker `listModels`). */

package/dist/claude/native-integration.d.ts

@@ -283,6 +283,8 @@ export declare class ClaudeLiveSession {
      *  sent an Escape — an Escape into idle claude submits an empty turn, which
      *  claude answers with a stray "No response requested." bubble. */
     isTurnOpen(): boolean;
+    /** Fail an open turn exactly once when its native terminal/runner disappears. */
+    failOpenTurn(error: Error): boolean;
     private closeTurn;
     private closeTurnError;
     private resetMessageCorrelation;
@@ -303,12 +305,16 @@ export interface InjectViaTerminalOptions {
     promptGlyph?: string;
     promptTimeoutMs?: number;
     settleMs?: number;
+    /** Wait for the pasted draft to become visible before the first Enter. */
+    pasteCommitMs?: number;
     /** Transcript-backed proof that Claude accepted this exact input. When
-     * absent, injection keeps the legacy one-Enter best-effort contract. */
+     * present it takes precedence over pane heuristics. */
     submissionObserved?: () => boolean;
-    /** Per-attempt wait for a transcript acknowledgement. */
+    /** Total post-Enter verification budget. */
     submitConfirmMs?: number;
-    /** Total Enter attempts when transcript confirmation is available. */
+    /** Minimum delay between Enter retries while the draft remains visible. */
+    submitRetryMs?: number;
+    /** Optional safety cap for tests/callers; the time budget remains authoritative. */
     maxSubmitAttempts?: number;
     pollMs?: number;
     now?: () => number;
@@ -324,8 +330,8 @@ export interface InjectViaTerminalOptions {
  *
  * THROWS if the prompt never appears within the ready-gate window (reference implementation
  * `_wait_for_claude_prompt_ready` RAISE) — a not-ready pane is a hard error the
- * caller reports, NOT a signal to fall through to a second output path. With a
- * transcript observer, Enter is retried only when Claude has durably recorded
- * neither a direct user prompt nor a type-ahead enqueue.
+ * caller reports, NOT a signal to fall through to a second output path. Enter
+ * is retried only while the exact draft remains visible and Claude has durably
+ * recorded neither a direct user prompt nor a type-ahead enqueue.
  */
 export declare function injectViaTerminal(injector: TerminalInjector, text: string, opts?: InjectViaTerminalOptions): Promise<boolean>;

package/dist/claude/native-integration.js

@@ -844,6 +844,15 @@ export class ClaudeLiveSession {
             }
             // A real prompt (not an XML-marker bookkeeping record) opens a new turn.
             if (!content.startsWith("<")) {
+                const queuedIntoOpenTurn = this.turnOpen && (queuedPromotion || rec.promptSource === "queued" || rec.promptSource === "sdk");
+                if (queuedIntoOpenTurn) {
+                    // Claude type-ahead is one native busy interval: enqueue now, promote
+                    // later, and emit one final Stop. Do not close/re-open the canonical
+                    // response when the promoted user record arrives mid-turn.
+                    this.sink.onUserMessage(content);
+                    this.lastActivityAt = this.now();
+                    return;
+                }
                 const turnId = typeof rec.uuid === "string" ? rec.uuid : undefined;
                 if (this.turnOpen && this.syntheticTurn) {
                     // A hook can flush just before the transcript's user record. The
@@ -1077,6 +1086,13 @@ export class ClaudeLiveSession {
     isTurnOpen() {
         return this.turnOpen;
     }
+    /** Fail an open turn exactly once when its native terminal/runner disappears. */
+    failOpenTurn(error) {
+        if (!this.turnOpen)
+            return false;
+        this.closeTurnError(error);
+        return true;
+    }
     closeTurn() {
         if (!this.turnOpen)
             return;
@@ -1132,14 +1148,79 @@ export class ClaudeLiveSession {
 /** Claude Code renders this glyph once the input box is mounted (ready-gate). */
 const CLAUDE_PROMPT_GLYPH = "❯";
 const CLAUDE_PROMPT_SCAN_TAIL_LINES = 5;
+const CLAUDE_BOX_RULE_CHARS = new Set([..."─━╭╮╰╯│┃╌╍"]);
+const CLAUDE_PASTED_PLACEHOLDER_PREFIX = "[Pasted text";
+const CLAUDE_DRAFT_NEEDLE_MAX_CHARS = 24;
+/** Omnigent's Claude-native readiness window: tmux may exist well before the
+ * first interactive composer mounts on a cold start. */
+const CLAUDE_PROMPT_READY_TIMEOUT_MS = 30_000;
+const CLAUDE_PASTE_COMMIT_TIMEOUT_MS = 5_000;
+const CLAUDE_PASTE_SETTLE_MS = 100;
+const CLAUDE_SUBMIT_CONFIRM_TIMEOUT_MS = 10_000;
+const CLAUDE_SUBMIT_RETRY_MS = 1_000;
+function selectedMenuRow(line, glyph) {
+    const index = line.indexOf(glyph);
+    if (index < 0)
+        return false;
+    return /^\d+\.\s/.test(line.slice(index + glyph.length).trimStart());
+}
+function boxRule(line) {
+    const text = line.trim();
+    return text.length >= 3 && [...text].every((character) => CLAUDE_BOX_RULE_CHARS.has(character));
+}
 /** The live composer sits at the bottom of the pane. Restricting readiness to
  * its trailing non-empty lines prevents an old prompt glyph in scrollback from
  * accepting input while Claude is still booting or showing another screen. */
 function claudePromptRendered(pane, glyph) {
     const nonEmpty = pane.split(/\r?\n/).filter((line) => line.trim());
-    return nonEmpty
-        .slice(-CLAUDE_PROMPT_SCAN_TAIL_LINES)
-        .some((line) => line.includes(glyph));
+    const tailStart = Math.max(0, nonEmpty.length - CLAUDE_PROMPT_SCAN_TAIL_LINES);
+    for (let index = tailStart; index < nonEmpty.length; index += 1) {
+        const line = nonEmpty[index] ?? "";
+        if (!line.includes(glyph))
+            continue;
+        const framed = nonEmpty.slice(index + 1).some(boxRule);
+        if (framed)
+            return true;
+        if (!selectedMenuRow(line, glyph))
+            return true;
+    }
+    // A fan-out of subagents can make the running footer arbitrarily tall. Above
+    // the fixed tail, only a prompt framed by the composer's closing rule counts.
+    for (let index = 0; index < tailStart; index += 1) {
+        const line = nonEmpty[index] ?? "";
+        if (line.includes(glyph) && nonEmpty.slice(index + 1).some(boxRule))
+            return true;
+    }
+    return false;
+}
+function draftNeedle(content) {
+    const normalized = content.replace(/\r\n?/g, "\n");
+    for (const rawLine of normalized.split("\n")) {
+        const control = rawLine.search(/[\x00-\x1f]/);
+        const line = (control >= 0 ? rawLine.slice(0, control) : rawLine).trim();
+        if (line)
+            return line.slice(0, CLAUDE_DRAFT_NEEDLE_MAX_CHARS);
+    }
+    return "";
+}
+function draftInInputBox(pane, glyph, needle) {
+    const lines = pane.split(/\r?\n/).filter((line) => line.includes(glyph));
+    const line = lines.at(-1);
+    if (!line)
+        return false;
+    const tail = line.slice(line.lastIndexOf(glyph) + glyph.length);
+    if (tail.includes(CLAUDE_PASTED_PLACEHOLDER_PREFIX))
+        return true;
+    return Boolean(needle) && tail.includes(needle);
+}
+function terminalFailureTail(pane) {
+    const lines = pane.split(/\r?\n/).filter((line) => line.trim()).slice(-12);
+    if (lines.length === 0)
+        return "";
+    let tail = lines.join("\n");
+    if (tail.length > 800)
+        tail = `…${tail.slice(-800)}`;
+    return `\nlast terminal output:\n${tail}`;
 }
 async function pollUntil(pred, timeoutMs, pollMs, now, sleep, signal) {
     const deadline = now() + timeoutMs;
@@ -1159,9 +1240,9 @@ async function pollUntil(pred, timeoutMs, pollMs, now, sleep, signal) {
  *
  * THROWS if the prompt never appears within the ready-gate window (reference implementation
  * `_wait_for_claude_prompt_ready` RAISE) — a not-ready pane is a hard error the
- * caller reports, NOT a signal to fall through to a second output path. With a
- * transcript observer, Enter is retried only when Claude has durably recorded
- * neither a direct user prompt nor a type-ahead enqueue.
+ * caller reports, NOT a signal to fall through to a second output path. Enter
+ * is retried only while the exact draft remains visible and Claude has durably
+ * recorded neither a direct user prompt nor a type-ahead enqueue.
  */
 export async function injectViaTerminal(injector, text, opts = {}) {
     const glyph = opts.promptGlyph ?? CLAUDE_PROMPT_GLYPH;
@@ -1180,12 +1261,23 @@ export async function injectViaTerminal(injector, text, opts = {}) {
     };
     // 1. Ready-gate. No prompt within the window → THROW (reference implementation RAISE): a
     //    not-ready pane is a hard error, never a fall-through-to-run signal.
-    const ready = await pollUntil(() => claudePromptRendered(injector.capturePane(), glyph), opts.promptTimeoutMs ?? 20_000, pollMs, now, sleep, signal);
+    let promptPolls = 0;
+    let emptyPromptPolls = 0;
+    let lastPromptPane = "";
+    const ready = await pollUntil(() => {
+        const pane = injector.capturePane();
+        promptPolls += 1;
+        if (pane.trim())
+            lastPromptPane = pane;
+        else
+            emptyPromptPolls += 1;
+        return claudePromptRendered(pane, glyph);
+    }, opts.promptTimeoutMs ?? CLAUDE_PROMPT_READY_TIMEOUT_MS, pollMs, now, sleep, signal);
     if (cancelled())
         return false;
     if (!ready) {
-        const tail = injector.capturePane().split("\n").slice(-5).join("\n");
-        throw new Error(`claude prompt not ready (no "${glyph}" within timeout)\npane tail:\n${tail}`);
+        throw new Error(`claude prompt not ready (no input composer within timeout; ${promptPolls} polls, ` +
+            `${emptyPromptPolls} empty captures)${terminalFailureTail(lastPromptPane)}`);
     }
     // 2. Clear leftover, then bracketed-paste the draft. A final "\" is Claude's
     // documented soft-newline escape: a bare submit Enter would consume it and
@@ -1193,30 +1285,47 @@ export async function injectViaTerminal(injector, text, opts = {}) {
     // the bracketed paste; normal messages must not gain an empty input row.
     injector.clearInputLine();
     injector.paste(text.endsWith("\\") ? `${text}\n` : text);
-    // 3. `paste-buffer` returns after tmux wrote the bracketed-paste frame. Give
-    // Claude a short, fixed settle window before the separate submit key; screen
-    // text is not used as an acknowledgement because submitted prompts remain in
-    // scrollback and are indistinguishable from an editable draft.
-    await sleep(opts.settleMs ?? 500);
+    // 3. tmux accepting `paste-buffer` does not mean Claude consumed it. Wait for
+    // the draft (or its large-paste placeholder) to appear in the live composer;
+    // otherwise Enter can be coalesced into the paste as a newline.
+    const needle = draftNeedle(text);
+    const draftSeen = await pollUntil(() => draftInInputBox(injector.capturePane(), glyph, needle), opts.pasteCommitMs ?? CLAUDE_PASTE_COMMIT_TIMEOUT_MS, pollMs, now, sleep, signal);
+    await sleep(opts.settleMs ?? CLAUDE_PASTE_SETTLE_MS);
     if (cancelled())
         return false; // Stop pressed mid-paste → don't submit
-    // 4. Submit. Without a transcript observer this remains a one-Enter
-    // best-effort operation. With one, a bounded retry handles an Enter swallowed
-    // by the TUI without ever consulting stale pane text. A direct prompt or
-    // queue enqueue ends the loop immediately.
+    // 4. Submit and verify. Retry only while this exact draft is still visible;
+    // once it leaves the composer, another Enter could hit a permission dialog or
+    // an empty prompt. Transcript acknowledgement is the strongest success proof.
     const observed = opts.submissionObserved;
-    const attempts = observed
-        ? Math.max(1, Math.floor(opts.maxSubmitAttempts ?? 2))
-        : 1;
-    for (let attempt = 0; attempt < attempts; attempt += 1) {
-        injector.sendEnter();
-        if (!observed)
+    let attempts = 1;
+    const maxAttempts = Math.max(1, Math.floor(opts.maxSubmitAttempts ?? Number.MAX_SAFE_INTEGER));
+    injector.sendEnter();
+    // Omnigent preserves the old blind-submit fallback when capture-pane cannot
+    // identify the draft; its absence would otherwise "prove" success trivially.
+    if (!draftSeen)
+        return true;
+    const deadline = now() + (opts.submitConfirmMs ?? CLAUDE_SUBMIT_CONFIRM_TIMEOUT_MS);
+    const retryMs = opts.submitRetryMs ?? CLAUDE_SUBMIT_RETRY_MS;
+    let lastEnterAt = now();
+    while (now() < deadline) {
+        if (cancelled())
+            return false;
+        if (observed?.())
             return true;
-        if (await pollUntil(observed, opts.submitConfirmMs ?? 2_000, pollMs, now, sleep, signal)) {
+        if (!draftInInputBox(injector.capturePane(), glyph, needle))
             return true;
+        if (now() - lastEnterAt >= retryMs && attempts < maxAttempts) {
+            injector.sendEnter();
+            attempts += 1;
+            lastEnterAt = now();
         }
-        if (cancelled())
-            return false;
+        await sleep(pollMs);
     }
-    return false;
+    if (observed?.())
+        return true;
+    if (!draftInInputBox(injector.capturePane(), glyph, needle))
+        return true;
+    throw new Error(`Claude Code did not accept the submitted message within ` +
+        `${opts.submitConfirmMs ?? CLAUDE_SUBMIT_CONFIRM_TIMEOUT_MS}ms ` +
+        "(the draft is still in the input box). The message was not delivered.");
 }

package/dist/codex-app-server/forwarder.d.ts

@@ -23,6 +23,7 @@
  */
 import type { AgentEvent, UserContentPart } from "@rynx-ai/core";
 import type { CodexAppServerClient } from "./client.js";
+import type { McpStartupPlan } from "./mcp-startup.js";
 import type { ResumedTurn } from "./protocol.js";
 export interface CodexForwarderSink {
     /** A turn began. `turnId` is codex's turn id, used to derive a stable
@@ -30,6 +31,9 @@ export interface CodexForwarderSink {
     onTurnStart(turnId?: string): void;
     /** One mapped event within the current turn. */
     onEvent(event: AgentEvent): void;
+    /** Provider startup is session status, not a model item. Hosts that already
+     * published the response can forward it without synthesizing another start. */
+    onStatus?(note: string | undefined, statusKind?: "startup"): void;
     /** The current turn finished; `usage` is the runtime's raw snapshot if any. */
     onTurnEnd(usage?: Record<string, unknown>): void;
     /** A turn failed on the runtime. */
@@ -58,6 +62,9 @@ export interface CodexSessionForwarderOptions {
     assistantMessageGraceMs?: number;
     /** Surface Traex's provider-capacity queue as a canonical running status. */
     surfaceQueueStatus?: boolean;
+    /** Provider-configured MCP servers. Their startup round is synthesized because
+     * Codex currently sends per-server edges only to the thread-owning TUI. */
+    mcpStartup?: McpStartupPlan | null;
 }
 export declare class CodexSessionForwarder {
     private readonly client;
@@ -72,6 +79,10 @@ export declare class CodexSessionForwarder {
     private assistantMessageTimer;
     private deferredAssistantMessage;
     private pendingCompletion;
+    private readonly pendingMcpServers;
+    private readonly failedMcpServers;
+    private mcpStartupTimer;
+    private lastMcpStatusNote;
     /** Completed-item dedup keys already mirrored (live vs resume backfill). Key =
      *  `threadId:turnId:item.id`; anonymous items use a per-(thread,turn) position
      *  counter. Mirrors reference implementation `_completed_item_key` + `synced_item_keys`. */
@@ -87,6 +98,18 @@ export declare class CodexSessionForwarder {
     isTurnOpen(): boolean;
     /** The current turn's codex id (only meaningful while {@link isTurnOpen}). */
     currentTurnId(): string | null;
+    /**
+     * Record a turn accepted by the injection connection before the independent
+     * observer receives `turn/started`. This closes the read-decide-RPC-write race:
+     * another web message arriving in that window must steer this turn, not start
+     * a second one.
+     */
+    noteTurnAccepted(turnId: string): void;
+    hasPendingMcpStartup(): boolean;
+    /** Mark and return the startup servers cancelled by a web Stop. */
+    cancelMcpStartup(): string[];
+    /** Diagnostic suffix for an injection failure during Provider startup. */
+    mcpStartupDetail(): string | null;
     /** The bound codex thread id captured from `thread/started` (null until then). */
     threadId(): string | null;
     /**
@@ -97,11 +120,21 @@ export declare class CodexSessionForwarder {
      * not doubled.
      */
     replayBackfill(turns: ResumedTurn[]): void;
+    /** Reconcile only the exact active turn after an observer resume. Historical
+     * items are intentionally not replayed on an existing-thread reconnect. */
+    reconcileActiveTurn(turn: ResumedTurn | undefined): boolean;
+    /** Fail an open response exactly once when its observer or terminal exits. */
+    failOpenTurn(error: Error): boolean;
     private handle;
     private scheduleCompletion;
     private refreshCompletionGrace;
     private flushPendingCompletion;
     private settle;
+    private handleMcpStartupStatus;
+    private settleMcpStartup;
+    private clearMcpStartupTimer;
+    private emitMcpStartupStatus;
+    private emitMcpStatus;
     /** Map + emit one completed codex item, deduped by a TOTAL key and routing the
      *  user echo to {@link CodexForwarderSink.onUserMessage}. Shared by live + backfill. */
     private processCompletedItem;

package/dist/codex-app-server/forwarder.js

@@ -1,5 +1,7 @@
 import { codexUserContent } from "../input-resources.js";
 import { mapCodexItem, mapCodexNotification } from "./mapping.js";
+const MCP_STARTUP_STATUS_METHOD = "mcpServer/startupStatus/updated";
+const MCP_TERMINAL_STATES = new Set(["ready", "failed", "cancelled"]);
 function threadIdFrom(params) {
     const p = params;
     return p?.threadId ?? p?.thread?.id;
@@ -31,6 +33,18 @@ function indicatesActive(method, params) {
     }
     return false;
 }
+function isThreadIdle(method, params) {
+    if (method !== "thread/status/changed")
+        return false;
+    const status = params?.status;
+    return status === "idle" || (typeof status === "object" && status?.type === "idle");
+}
+function isModelOutput(method, params) {
+    if (method !== "item/started" && method !== "item/completed")
+        return false;
+    const item = params?.item;
+    return Boolean(item?.type && item.type !== "userMessage");
+}
 export class CodexSessionForwarder {
     client;
     sink;
@@ -44,6 +58,10 @@ export class CodexSessionForwarder {
     assistantMessageTimer = null;
     deferredAssistantMessage = null;
     pendingCompletion = null;
+    pendingMcpServers = new Set();
+    failedMcpServers = new Map();
+    mcpStartupTimer = null;
+    lastMcpStatusNote = null;
     /** Completed-item dedup keys already mirrored (live vs resume backfill). Key =
      *  `threadId:turnId:item.id`; anonymous items use a per-(thread,turn) position
      *  counter. Mirrors reference implementation `_completed_item_key` + `synced_item_keys`. */
@@ -63,10 +81,18 @@ export class CodexSessionForwarder {
         this.unsubscribe = this.client.onNotification((method, params) => {
             this.handle(method, params);
         });
+        const startup = this.options.mcpStartup;
+        if (startup?.servers.length) {
+            for (const server of startup.servers)
+                this.pendingMcpServers.add(server);
+            this.mcpStartupTimer = setTimeout(() => this.settleMcpStartup(), startup.settleTimeoutMs);
+            this.mcpStartupTimer.unref?.();
+        }
     }
     stop() {
         this.unsubscribe?.();
         this.unsubscribe = null;
+        this.clearMcpStartupTimer();
         this.flushPendingCompletion();
         this.flushDeferredAssistantMessage();
         if (this.turnOpen) {
@@ -82,6 +108,44 @@ export class CodexSessionForwarder {
     currentTurnId() {
         return this.currentTurnIdValue;
     }
+    /**
+     * Record a turn accepted by the injection connection before the independent
+     * observer receives `turn/started`. This closes the read-decide-RPC-write race:
+     * another web message arriving in that window must steer this turn, not start
+     * a second one.
+     */
+    noteTurnAccepted(turnId) {
+        if (!turnId)
+            return;
+        this.currentTurnIdValue = turnId;
+        this.ensureTurn();
+        this.emitMcpStartupStatus();
+    }
+    hasPendingMcpStartup() {
+        return this.pendingMcpServers.size > 0;
+    }
+    /** Mark and return the startup servers cancelled by a web Stop. */
+    cancelMcpStartup() {
+        const pending = [...this.pendingMcpServers].sort();
+        if (pending.length === 0)
+            return pending;
+        this.pendingMcpServers.clear();
+        this.clearMcpStartupTimer();
+        if (this.turnOpen) {
+            this.emitMcpStatus(`MCP startup cancelled: ${pending.join(", ")}`);
+        }
+        return pending;
+    }
+    /** Diagnostic suffix for an injection failure during Provider startup. */
+    mcpStartupDetail() {
+        const pending = [...this.pendingMcpServers].sort();
+        if (pending.length)
+            return `MCP startup still waiting on ${pending.join(", ")}`;
+        const failed = [...this.failedMcpServers.entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, error]) => error ? `${name}: ${error}` : name);
+        return failed.length ? `MCP startup failed for ${failed.join(", ")}` : null;
+    }
     /** The bound codex thread id captured from `thread/started` (null until then). */
     threadId() {
         return this.currentThreadIdValue;
@@ -111,6 +175,27 @@ export class CodexSessionForwarder {
                 this.sink.onTurnEnd(mapped.usage);
         }
     }
+    /** Reconcile only the exact active turn after an observer resume. Historical
+     * items are intentionally not replayed on an existing-thread reconnect. */
+    reconcileActiveTurn(turn) {
+        if (!this.turnOpen || !turn || turn.status === "inProgress")
+            return false;
+        const resumedTurnId = turn.id ?? turn.turnId;
+        if (!this.currentTurnIdValue || resumedTurnId !== this.currentTurnIdValue)
+            return false;
+        const mapped = mapCodexNotification("turn/completed", { turn });
+        this.settle(mapped.fatalError
+            ? { kind: "error", error: mapped.fatalError }
+            : { kind: "end", ...(mapped.usage ? { usage: mapped.usage } : {}) });
+        return true;
+    }
+    /** Fail an open response exactly once when its observer or terminal exits. */
+    failOpenTurn(error) {
+        if (!this.turnOpen)
+            return false;
+        this.settle({ kind: "error", error });
+        return true;
+    }
     handle(method, params) {
         if (method === "thread/started" || method === "thread.started") {
             const tid = threadIdFrom(params);
@@ -138,6 +223,13 @@ export class CodexSessionForwarder {
             notificationThreadId &&
             notificationThreadId !== this.currentThreadIdValue)
             return;
+        if (method === MCP_STARTUP_STATUS_METHOD) {
+            this.handleMcpStartupStatus(params);
+            return;
+        }
+        if (isThreadIdle(method, params) || isModelOutput(method, params)) {
+            this.settleMcpStartup();
+        }
         // Release a parked resume as soon as the thread shows activity (rollout now
         // exists). Fire once.
         if (!this.activeSignaled && indicatesActive(method, params)) {
@@ -243,6 +335,73 @@ export class CodexSessionForwarder {
         else
             this.sink.onTurnEnd(completion.usage);
     }
+    handleMcpStartupStatus(params) {
+        const update = params;
+        const name = typeof update?.name === "string" ? update.name : "";
+        const status = typeof update?.status === "string" ? update.status : "";
+        if (!name || (status !== "starting" && !MCP_TERMINAL_STATES.has(status)))
+            return;
+        if (status === "starting") {
+            this.pendingMcpServers.add(name);
+            this.failedMcpServers.delete(name);
+        }
+        else {
+            this.pendingMcpServers.delete(name);
+            if (status === "failed") {
+                this.failedMcpServers.set(name, typeof update?.error === "string" && update.error ? update.error : undefined);
+            }
+            else {
+                this.failedMcpServers.delete(name);
+            }
+            if (this.pendingMcpServers.size === 0)
+                this.clearMcpStartupTimer();
+        }
+        this.emitMcpStartupStatus();
+    }
+    settleMcpStartup() {
+        if (this.pendingMcpServers.size === 0) {
+            this.clearMcpStartupTimer();
+            return;
+        }
+        this.pendingMcpServers.clear();
+        this.clearMcpStartupTimer();
+        this.emitMcpStartupStatus();
+    }
+    clearMcpStartupTimer() {
+        if (this.mcpStartupTimer)
+            clearTimeout(this.mcpStartupTimer);
+        this.mcpStartupTimer = null;
+    }
+    emitMcpStartupStatus() {
+        if (!this.turnOpen)
+            return;
+        const pending = [...this.pendingMcpServers].sort();
+        if (pending.length) {
+            this.emitMcpStatus(`Starting MCP servers: ${pending.join(", ")}`);
+            return;
+        }
+        const failed = [...this.failedMcpServers.keys()].sort();
+        if (failed.length) {
+            this.emitMcpStatus(`MCP startup failed: ${failed.join(", ")}`);
+            return;
+        }
+        if (this.lastMcpStatusNote !== null) {
+            this.lastMcpStatusNote = null;
+            if (this.sink.onStatus)
+                this.sink.onStatus(undefined);
+            else
+                this.sink.onEvent({ type: "status" });
+        }
+    }
+    emitMcpStatus(note) {
+        if (this.lastMcpStatusNote === note)
+            return;
+        this.lastMcpStatusNote = note;
+        if (this.sink.onStatus)
+            this.sink.onStatus(note, "startup");
+        else
+            this.sink.onEvent({ type: "status", statusKind: "startup", note });
+    }
     /** Map + emit one completed codex item, deduped by a TOTAL key and routing the
      *  user echo to {@link CodexForwarderSink.onUserMessage}. Shared by live + backfill. */
     processCompletedItem(item) {

package/dist/codex-app-server/mcp-startup.d.ts

@@ -0,0 +1,13 @@
+import type { CodexLineageRuntime } from "../codex-home.js";
+export interface McpStartupPlan {
+    servers: string[];
+    settleTimeoutMs: number;
+}
+/**
+ * Read the MCP table fields needed for startup tracking. Provider config stays
+ * authoritative: malformed TOML disables the synthesized status rather than
+ * preventing the native CLI from reporting its own startup error.
+ */
+export declare function parseMcpStartupToml(input: string): McpStartupPlan | null;
+/** Enabled Provider-configured MCP servers and their synthesized settle window. */
+export declare function readMcpStartupPlan(runtimeHome: string, runtime: CodexLineageRuntime): McpStartupPlan | null;

package/dist/codex-app-server/mcp-startup.js

@@ -0,0 +1,63 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "smol-toml";
+const DEFAULT_SERVER_TIMEOUT_MS = 10_000;
+const SETTLE_GRACE_MS = 15_000;
+const MAX_SETTLE_TIMEOUT_MS = 240_000;
+function configNames(runtime) {
+    return runtime === "codex"
+        ? ["config.toml"]
+        : ["traecli.toml"];
+}
+function isTomlTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Read the MCP table fields needed for startup tracking. Provider config stays
+ * authoritative: malformed TOML disables the synthesized status rather than
+ * preventing the native CLI from reporting its own startup error.
+ */
+export function parseMcpStartupToml(input) {
+    let config;
+    try {
+        config = parse(input);
+    }
+    catch {
+        return null;
+    }
+    const servers = config.mcp_servers;
+    if (!isTomlTable(servers))
+        return null;
+    const enabled = Object.entries(servers)
+        .filter(([name, server]) => Boolean(name) && isTomlTable(server) && server.enabled !== false)
+        .sort(([left], [right]) => left.localeCompare(right));
+    if (enabled.length === 0)
+        return null;
+    const slowest = Math.max(DEFAULT_SERVER_TIMEOUT_MS, ...enabled.map(([, server]) => {
+        if (!isTomlTable(server))
+            return DEFAULT_SERVER_TIMEOUT_MS;
+        const seconds = server.startup_timeout_sec;
+        return typeof seconds === "number" && Number.isFinite(seconds) && seconds > 0
+            ? seconds * 1_000
+            : DEFAULT_SERVER_TIMEOUT_MS;
+    }));
+    return {
+        servers: enabled.map(([name]) => name),
+        settleTimeoutMs: Math.min(slowest + SETTLE_GRACE_MS, MAX_SETTLE_TIMEOUT_MS),
+    };
+}
+/** Enabled Provider-configured MCP servers and their synthesized settle window. */
+export function readMcpStartupPlan(runtimeHome, runtime) {
+    for (const name of configNames(runtime)) {
+        try {
+            const plan = parseMcpStartupToml(readFileSync(join(runtimeHome, name), "utf8"));
+            if (plan)
+                return plan;
+        }
+        catch {
+            // Missing/unreadable config: the Provider still owns startup; Rynx simply
+            // cannot synthesize per-server progress for this launch.
+        }
+    }
+    return null;
+}