@seawork/server 1.0.22-rc.3 → 2.0.2-rc.6

package/dist/server/server/agent/providers/codex-app-server-agent.js

@@ -1,24 +1,55 @@
-import { execSync } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { z } from "zod";
-import { loadCodexPersistedTimeline } from "./codex-rollout-timeline.js";
-import { mapCodexRolloutToolCall, mapCodexToolCallFromThreadItem, } from "./codex/tool-call-mapper.js";
-import { applyProviderEnv, resolveProviderCommandPrefix, } from "../provider-launch-config.js";
 import { resolveElectronNodeRuntime } from "../../../utils/electron-helper.js";
+import { spawnProcess } from "../../../utils/spawn.js";
 import { getLatencyProxyUrlSync } from "../../latency-proxy.js";
+import { resolveCodexSkillDiscoveryDirs } from "../../library/codex-skill-discovery.js";
+import { applyProviderEnv, clearInheritedProxyEnv, mergeLocalhostProxyBypass, resolveProviderCommandPrefix, } from "../provider-launch-config.js";
+import { mapCodexRolloutToolCall, mapCodexToolCallFromThreadItem, } from "./codex/tool-call-mapper.js";
 import { selectCodexBinary, selectEffectiveCodexBinary, verifyCommandAvailable, } from "./codex-binary-resolver.js";
-import { getSeaworkModels } from "./seawork-models.js";
-import { spawnProcess } from "../../../utils/spawn.js";
-import { extractCodexTerminalSessionId, nonEmptyString } from "./tool-call-mapper-utils.js";
 import { buildCodexFeatures, codexModelSupportsFastMode } from "./codex-feature-definitions.js";
+import { loadCodexPersistedTimeline } from "./codex-rollout-timeline.js";
 import { collectStdout, formatDiagnosticStatus, formatProviderDiagnostic, formatProviderDiagnosticError, resolveBinaryVersion, toDiagnosticErrorMessage, } from "./diagnostic-utils.js";
+import { buildSeaworkGatewayHeaders, SEAWORK_AGENT_PROVIDER_HEADER_NAME, SEAWORK_SOURCE_HEADER_NAME, SEAWORK_SOURCE_HEADER_VALUE, } from "./gateway-telemetry.js";
+import { getSeaworkModels } from "./seawork-models.js";
+import { extractCodexTerminalSessionId, nonEmptyString } from "./tool-call-mapper-utils.js";
 const DEFAULT_TIMEOUT_MS = 14 * 24 * 60 * 60 * 1000;
 const TURN_START_TIMEOUT_MS = 90 * 1000;
+// issue #505: if a turn produces no notifications for this long, treat it as
+// stalled and force-complete it. Codex normally streams item/reasoning/output
+// events continuously, so a healthy long-running turn re-arms the watchdog far
+// more often than this; only a turn whose `turn/completed` is lost goes silent.
+const TURN_WATCHDOG_IDLE_MS = 5 * 60 * 1000;
+// issue #1427: when the watchdog decides a turn is stalled, do NOT force-fail
+// immediately. A successful turn's `turn/completed` can arrive tens of ms after
+// the watchdog fires — codex emits it only after a serial flush_rollout +
+// on_task_finished (token/metric/proxy work) + a second persist, a structural,
+// load/disk-dependent gap measured at ~55-71ms in #1416. Wait this grace window
+// for that completion before committing the failure: if it arrives the turn
+// finalizes normally and we never emit a spurious turn_failed. Far larger than
+// the observed gap, far smaller than the 5min idle window, so it cannot mask a
+// genuine stall.
+const WATCHDOG_LATE_COMPLETION_GRACE_MS = 2500;
+// issue #505: a tool execution still in flight (slow build, network fetch) can
+// be legitimately output-silent, so an in-flight tool grants extra idle cycles
+// before the turn is force-failed. Bounded so a *lost tool completion* still
+// recovers instead of re-arming forever. The watchdog fails on the cycle AFTER
+// the count reaches this max, so total silence tolerated with a tool in flight
+// is the initial idle cycle plus this many deferred cycles:
+// (1 + 3) * 5min = 20min.
+const TURN_WATCHDOG_MAX_INFLIGHT_CYCLES = 3;
+// issue #999: auto-compaction packs the whole (~240K-token) context and makes
+// an extra LLM summarization call, so it can stay turn-event-silent for well
+// over the idle window — a legitimate long operation, not a lost turn. Grant
+// it more deferred cycles than a tool (compaction is slower) but stay bounded
+// so a lost compaction-completion still recovers: (1 + 6) * 5min = 35min.
+const TURN_WATCHDOG_MAX_COMPACTION_CYCLES = 6;
+const COMPACTION_ITEM_WATCHDOG_MS = TURN_WATCHDOG_IDLE_MS * (1 + TURN_WATCHDOG_MAX_COMPACTION_CYCLES);
 // issue #259: window after turn/interrupt during which the next turn/start
 // gets a sentinel reminder prepended to its input.
 const CANCEL_REMINDER_WINDOW_MS = 60 * 1000;
@@ -26,10 +57,103 @@ const CANCEL_REMINDER_TEXT = "[seawork system note] The user canceled the previo
     "Ignore any prior user message that did not receive a complete answer. " +
     "Only respond to the message below.";
 const CODEX_EXTERNAL_MIGRATION_MIN_VERSION = "0.128.0";
+// Cap for the per-agent terminal-session maps. They are keyed by codex
+// terminal processId (and, for the dedup set, by stdin payload), which can
+// legitimately persist across turns — so we cannot sweep them per-turn and
+// only clear them on close(). To stop them from growing unbounded over a
+// long-lived agent (they would otherwise retain raw stdin for the whole
+// session — same OOM family as #1058), bound them: evicting the oldest entry
+// past the cap only risks a stale command label / a re-emitted interaction
+// for a terminal untouched across thousands of newer ones, which is benign.
+const TERMINAL_SESSION_MAP_MAX = 512;
+// Insert into an insertion-ordered Map/Set, evicting oldest entries first
+// once the size cap is exceeded. (Map and Set both iterate in insertion
+// order, so the first key is the oldest.)
+function setBounded(map, key, value, max) {
+    map.set(key, value);
+    while (map.size > max) {
+        const oldest = map.keys().next().value;
+        if (oldest === undefined)
+            break;
+        map.delete(oldest);
+    }
+}
+function addBounded(set, value, max) {
+    set.add(value);
+    while (set.size > max) {
+        const oldest = set.values().next().value;
+        if (oldest === undefined)
+            break;
+        set.delete(oldest);
+    }
+}
+// issue #1012: manual context compaction. `thread/compact/start` is a dedicated
+// RPC (not a turn), present from this codex version on. Mirrors claude's native
+// `/compact`. Gated so old codex doesn't surface a command its app-server lacks.
+const COMPACT_COMMAND_NAME = "compact";
+const COMPACT_COMMAND = {
+    name: COMPACT_COMMAND_NAME,
+    description: "压缩当前会话上下文",
+    argumentHint: "",
+};
+const CODEX_MANUAL_COMPACT_MIN_VERSION = "0.137.0";
+// issue #973: codex's own auto-compaction threshold is derived from the
+// gateway-reported context_window (limit = context_window * 90%). Some gateway
+// models report an inflated window (e.g. gpt-5.4-ops reports 950K), so the
+// derived threshold (855K) is never reached and a thread keeps growing until it
+// slams into max_output_tokens — the model's real budget is exhausted long
+// before codex's window-relative limit. Pin a conservative absolute limit well
+// below the smallest real context window so compaction fires on token count,
+// not on the (untrustworthy) reported window. Users can override via extra.codex.
+const CODEX_AUTO_COMPACT_TOKEN_LIMIT = 180000;
 const CODEX_PROVIDER = "codex";
 const CODEX_SEAWORK_PROVIDER_ID = "seawork";
+// MCP server key for the daemon-owned builtin (see agent-manager.applySeaworkMcp).
+const SEAWORK_BUILTIN_MCP_NAME = "seawork";
+// codex MCP tools/call timeout for the seawork builtin (default is 120s, too
+// short for SeaArt video/3d generation that generation_task waits on).
+const SEAWORK_MCP_TOOL_TIMEOUT_SEC = 660;
+// Only these seawork builtin tools are safe to auto-approve (no side effects
+// beyond a paid SeaArt generation the user already asked for). The builtin also
+// exposes high-impact agent/terminal/schedule/permission tools that MUST keep
+// their normal approval gate — so we set approval per-tool, never server-wide.
+const SEAWORK_AUTO_APPROVE_TOOLS = [
+    "generate_image",
+    "generate_video",
+    "generate_audio",
+    "generate_3d",
+    "generation_models",
+    "generation_task",
+];
 const CODEX_IMAGE_ATTACHMENT_DIR = "seawork-attachments";
 const CODEX_PLAN_IMPLEMENTATION_PROMPT_PREFIX = "The user approved the plan. Implement it now. Do not restate or revise the plan unless blocked.";
+// codex's experimental `goals` feature ships in 0.128.0+. Older binaries reject
+// `--enable goals`, so we version-gate both the launch flag and the /goal
+// command. /goal is out-of-band (no turn) so it works mid-turn against the same
+// thread without canceling a running turn.
+const CODEX_GOALS_MIN_VERSION = "0.128.0";
+const GOAL_COMMAND_NAME = "goal";
+const GOAL_COMMAND = {
+    name: GOAL_COMMAND_NAME,
+    description: "设置、暂停、恢复或清除当前会话目标",
+    argumentHint: "[<objective>|pause|resume|clear]",
+};
+function parseGoalSubcommand(args) {
+    const trimmed = (args ?? "").trim();
+    if (!trimmed)
+        return { kind: "usage" };
+    const lower = trimmed.toLowerCase();
+    if (lower === "pause")
+        return { kind: "pause" };
+    if (lower === "resume")
+        return { kind: "resume" };
+    if (lower === "clear")
+        return { kind: "clear" };
+    return { kind: "set", objective: trimmed };
+}
+function formatOutOfBandStatusMessage(text) {
+    return `${text.replace(/\n+$/u, "")}\n\n`;
+}
 const CODEX_APP_SERVER_CAPABILITIES = {
     supportsStreaming: true,
     supportsSessionPersistence: true,
@@ -66,6 +190,15 @@ const MODE_PRESETS = {
         networkAccess: true,
     },
 };
+// plan 模式语义=只产出计划、不写盘:物理收紧 sandbox 到 read-only,approval 不得为 never
+function applyPlanModeConstraints(approvalPolicy, sandboxPolicyType, planModeEnabled) {
+    if (!planModeEnabled)
+        return { approvalPolicy, sandboxPolicyType };
+    return {
+        approvalPolicy: approvalPolicy === "never" ? "on-request" : approvalPolicy,
+        sandboxPolicyType: "read-only",
+    };
+}
 function validateCodexMode(modeId) {
     if (!(modeId in MODE_PRESETS)) {
         const validModes = Object.keys(MODE_PRESETS).join(", ");
@@ -184,6 +317,13 @@ function isVersionAtLeast(raw, minimum) {
     }
     return true;
 }
+// issue #1012: the app-server `initialize` response carries a required
+// `userAgent` like "codex/0.137.0 (Mac OS ...)". parseVersionTriplet picks the
+// first x.y.z, so returning the raw userAgent is enough for version gating.
+function parseCodexUserAgentVersion(initializeResponse) {
+    const parsed = z.object({ userAgent: z.string() }).safeParse(initializeResponse);
+    return parsed.success ? parsed.data.userAgent : null;
+}
 function readStringMetadata(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
@@ -339,40 +479,14 @@ async function listCodexCustomPrompts() {
     }
     return commands.sort((a, b) => a.name.localeCompare(b.name));
 }
-async function listCodexSkillEntries(cwd) {
-    const candidates = [];
-    candidates.push(path.join(cwd, ".codex", "skills"));
-    candidates.push(path.join(cwd, ".agents", "skills"));
-    candidates.push(path.join(cwd, ".claude", "skills"));
-    candidates.push(path.join(cwd, "skills"));
-    const repoRoot = (() => {
-        try {
-            const output = execSync("git rev-parse --show-toplevel", {
-                cwd,
-                encoding: "utf8",
-                stdio: ["ignore", "pipe", "ignore"],
-            });
-            const trimmed = output.trim();
-            return trimmed ? trimmed : null;
-        }
-        catch {
-            return null;
-        }
-    })();
-    if (repoRoot) {
-        candidates.push(path.join(path.dirname(cwd), ".codex", "skills"));
-        candidates.push(path.join(path.dirname(cwd), ".agents", "skills"));
-        candidates.push(path.join(path.dirname(cwd), ".claude", "skills"));
-        candidates.push(path.join(path.dirname(cwd), "skills"));
-        candidates.push(path.join(repoRoot, ".codex", "skills"));
-        candidates.push(path.join(repoRoot, ".agents", "skills"));
-        candidates.push(path.join(repoRoot, ".claude", "skills"));
-        candidates.push(path.join(repoRoot, "skills"));
-    }
-    candidates.push(path.join(resolveCodexHomeDir(), "skills"));
-    candidates.push(path.join(os.homedir(), ".agents", "skills"));
+async function listCodexSkillEntries(cwd, logger) {
+    const candidates = resolveCodexSkillDiscoveryDirs({
+        cwd,
+        codexHomeDir: resolveCodexHomeDir(),
+        includeSeaworkCache: true,
+    });
     const skillsByName = new Map();
-    for (const dir of Array.from(new Set(candidates))) {
+    for (const dir of candidates) {
         let entries;
         try {
             entries = await fs.readdir(dir, { withFileTypes: true });
@@ -397,6 +511,19 @@ async function listCodexSkillEntries(cwd) {
             const name = frontMatter["name"];
             const description = frontMatter["description"];
             if (!name || !description) {
+                if (logger) {
+                    const reasons = [];
+                    if (Object.keys(frontMatter).length === 0) {
+                        reasons.push("missing YAML frontmatter delimited by ---");
+                    }
+                    else {
+                        if (!name)
+                            reasons.push("missing 'name' field in frontmatter");
+                        if (!description)
+                            reasons.push("missing 'description' field in frontmatter");
+                    }
+                    logger.warn({ path: skillPath, reasons }, "Codex skill skipped: invalid SKILL.md");
+                }
                 continue;
             }
             if (!skillsByName.has(name)) {
@@ -466,6 +593,33 @@ function toCodexMcpConfig(config) {
             };
     }
 }
+function summarizeJsonRpcParamsForLog(params) {
+    if (params && typeof params === "object" && !Array.isArray(params)) {
+        return { paramKeys: Object.keys(params).sort() };
+    }
+    if (params === null) {
+        return { paramType: "null" };
+    }
+    if (Array.isArray(params)) {
+        return { paramType: "array" };
+    }
+    return { paramType: typeof params };
+}
+// Pull the gateway `x-request-id` out of codex's `codex_client::default_client:
+// Request completed ... url=.../responses ... headers={... "x-request-id": "..." ...}`
+// debug line. Only `/responses` (model turn) requests are matched so a `/models`
+// request id never masquerades as the turn's. Exported for regression coverage
+// because this scrapes codex's log format, which can drift across versions.
+export function extractResponsesRequestId(logLine) {
+    // codex colorizes app-server tracing with ANSI escapes even when stderr is a
+    // pipe, which would otherwise break the substring/regex match below.
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping ANSI SGR codes
+    const line = logLine.replace(/\u001b\[[0-9;]*m/g, "");
+    if (!line.includes("Request completed") || !line.includes("/responses")) {
+        return null;
+    }
+    return line.match(/"x-request-id":\s*"([0-9a-fA-F-]+)"/)?.[1] ?? null;
+}
 class CodexAppServerClient {
     constructor(child, logger) {
         this.child = child;
@@ -473,9 +627,13 @@ class CodexAppServerClient {
         this.pending = new Map();
         this.requestHandlers = new Map();
         this.notificationHandler = null;
+        this.exitHandler = null;
+        this.upstreamLivenessHandler = null;
         this.nextId = 1;
         this.disposed = false;
         this.stderrBuffer = "";
+        this.stderrLineBuf = "";
+        this.lastResponsesRequestId = null;
         this.resolveExitPromise = null;
         this.rl = readline.createInterface({ input: child.stdout });
         this.exitPromise = new Promise((resolve) => {
@@ -483,10 +641,12 @@ class CodexAppServerClient {
         });
         this.rl.on("line", (line) => this.handleLine(line));
         child.stderr.on("data", (chunk) => {
-            this.stderrBuffer += chunk.toString();
+            const text = chunk.toString();
+            this.stderrBuffer += text;
             if (this.stderrBuffer.length > 8192) {
                 this.stderrBuffer = this.stderrBuffer.slice(-8192);
             }
+            this.captureResponsesRequestId(text);
         });
         child.on("error", (err) => {
             this.logger.error({ err }, "Codex app-server child process error");
@@ -498,6 +658,7 @@ class CodexAppServerClient {
             this.disposed = true;
             this.resolveExitPromise?.();
             this.resolveExitPromise = null;
+            this.exitHandler?.(err instanceof Error ? err.message : String(err));
         });
         child.on("exit", (code, signal) => {
             const message = code === 0 && !signal
@@ -512,11 +673,56 @@ class CodexAppServerClient {
             this.disposed = true;
             this.resolveExitPromise?.();
             this.resolveExitPromise = null;
+            this.exitHandler?.(message);
         });
     }
+    // Scrape codex's `codex_client::default_client: Request completed ... url=.../responses
+    // ... "x-request-id": "..."` debug line so a turn failure can be tagged with the
+    // gateway request id (codex omits it from the error message for stream
+    // disconnects). Newline-buffered so an id split across stderr chunks still
+    // parses; only `/responses` requests are tracked, latest wins.
+    captureResponsesRequestId(text) {
+        this.stderrLineBuf += text;
+        let nl = this.stderrLineBuf.indexOf("\n");
+        while (nl >= 0) {
+            const line = this.stderrLineBuf.slice(0, nl);
+            this.stderrLineBuf = this.stderrLineBuf.slice(nl + 1);
+            const requestId = extractResponsesRequestId(line);
+            if (requestId) {
+                this.lastResponsesRequestId = requestId;
+                this.upstreamLivenessHandler?.();
+            }
+            nl = this.stderrLineBuf.indexOf("\n");
+        }
+        if (this.stderrLineBuf.length > 16384) {
+            this.stderrLineBuf = this.stderrLineBuf.slice(-16384);
+        }
+    }
+    getLastResponsesRequestId() {
+        return this.lastResponsesRequestId;
+    }
+    resetLastResponsesRequestId() {
+        this.lastResponsesRequestId = null;
+    }
+    resetRecentStderrTail() {
+        this.stderrBuffer = "";
+        this.stderrLineBuf = "";
+    }
     setNotificationHandler(handler) {
         this.notificationHandler = handler;
     }
+    // Invoked once when the child process exits or errors. The session uses this
+    // to fail any foreground turn whose `turn/completed` notification will never
+    // arrive (codex process crashed mid-turn).
+    setExitHandler(handler) {
+        this.exitHandler = handler;
+    }
+    // Invoked whenever a `/responses` request completes (HTTP round-trip to the
+    // gateway), proving codex is alive and talking upstream even when the turn
+    // emits no protocol notification (e.g. a multi-minute large-payload upload).
+    setUpstreamLivenessHandler(handler) {
+        this.upstreamLivenessHandler = handler;
+    }
     setRequestHandler(method, handler) {
         this.requestHandlers.set(method, handler);
     }
@@ -602,6 +808,9 @@ class CodexAppServerClient {
             if (typeof msg.method === "string") {
                 const request = msg;
                 const handler = this.requestHandlers.get(request.method);
+                if (!handler) {
+                    this.logger.warn({ method: request.method, ...summarizeJsonRpcParamsForLog(request.params) }, "Unhandled Codex app-server request method");
+                }
                 try {
                     const result = handler ? await handler(request.params) : {};
                     this.writeJsonRpcResponse({ id: request.id, result });
@@ -685,8 +894,10 @@ function extractUserText(content) {
     }
     return parts.length > 0 ? parts.join("\n") : null;
 }
+const MAX_PLAN_TEXT_LENGTH = 50000;
 function normalizePlanMarkdown(text) {
     return text
+        .slice(0, MAX_PLAN_TEXT_LENGTH)
         .split("\n")
         .map((line) => line.replace(/\s+$/, ""))
         .join("\n")
@@ -948,6 +1159,8 @@ function normalizeCodexThreadItemType(rawType) {
             return "webSearch";
         case "ImageGeneration":
             return "imageGeneration";
+        case "ContextCompaction":
+            return "contextCompaction";
         default:
             return rawType;
     }
@@ -958,7 +1171,9 @@ function normalizeCodexCommandValue(value) {
         if (!trimmed.length) {
             return null;
         }
-        const wrapperMatch = trimmed.match(/^(?:\/bin\/)?(?:zsh|bash|sh)\s+-(?:lc|c)\s+([\s\S]+)$/);
+        const wrapperMatch = trimmed.match(/^(?:\/bin\/)?(?:zsh|bash|sh)\s+-(?:lc|c)\s+([\s\S]+)$/) ||
+            trimmed.match(/^(?:[^\s]*[/\\])?(?:powershell(?:\.exe)?|pwsh(?:\.exe)?)\s+-Command\s+([\s\S]+)$/i) ||
+            trimmed.match(/^(?:[^\s]*[/\\])?cmd(?:\.exe)?\s+\/(?:c|k)\s+([\s\S]+)$/i);
         if (!wrapperMatch) {
             return trimmed;
         }
@@ -985,8 +1200,38 @@ function normalizeCodexCommandValue(value) {
     if (parts.length >= 3 && (parts[1] === "-lc" || parts[1] === "-c")) {
         return parts[2] ?? parts;
     }
+    if (parts.length >= 3) {
+        const exe = parts[0]
+            .replace(/^.*[/\\]/, "")
+            .replace(/\.exe$/i, "")
+            .toLowerCase();
+        const flag = parts[1].toLowerCase();
+        if (((exe === "powershell" || exe === "pwsh") && flag === "-command") ||
+            (exe === "cmd" && (flag === "/c" || flag === "/k"))) {
+            return parts.slice(2).join(" ").trim() || parts;
+        }
+    }
     return parts;
 }
+function buildExecFallbackDetail(command, cwd) {
+    const normalized = normalizeCodexCommandValue(command);
+    const display = Array.isArray(normalized) ? normalized.join(" ") : (normalized ?? "");
+    if (display.trim().length > 0) {
+        return {
+            type: "shell",
+            command: display,
+            ...(cwd ? { cwd } : {}),
+        };
+    }
+    return {
+        type: "unknown",
+        input: {
+            command: Array.isArray(command) ? command : (command ?? null),
+            cwd: cwd ?? null,
+        },
+        output: null,
+    };
+}
 function parseCodexPatchChanges(changes) {
     const resolvePathFromRecord = (record) => {
         const directPath = (typeof record.path === "string" && record.path.trim().length > 0
@@ -1302,6 +1547,10 @@ function threadItemToTimeline(item, options) {
             return mapCodexToolCallFromThreadItem(normalizedItem, { cwd });
         case "imageGeneration":
             return mapCodexImageGenerationToTimeline(normalizedItem);
+        case "contextCompaction":
+            // issue #973: surface codex's auto-compaction as a timeline marker so the
+            // user sees why the context shrank. The thread item carries no preTokens.
+            return { type: "compaction", status: "completed", trigger: "auto" };
         default:
             return null;
     }
@@ -1388,17 +1637,20 @@ const TurnDiffUpdatedNotificationSchema = z
     .passthrough();
 const ThreadTokenUsageUpdatedNotificationSchema = z
     .object({
+    turnId: z.string().optional(),
     tokenUsage: z.unknown(),
 })
     .passthrough();
 const ItemTextDeltaNotificationSchema = z
     .object({
+    turnId: z.string().optional(),
     itemId: z.string(),
     delta: z.string(),
 })
     .passthrough();
 const ItemLifecycleNotificationSchema = z
     .object({
+    turnId: z.string().optional(),
     item: z
         .object({
         id: z.string().optional(),
@@ -1409,6 +1661,7 @@ const ItemLifecycleNotificationSchema = z
     .passthrough();
 const RawResponseItemCompletedNotificationSchema = z
     .object({
+    turnId: z.string().optional(),
     item: z
         .object({
         id: z.string().optional(),
@@ -1510,6 +1763,7 @@ const CodexEventTerminalInteractionNotificationSchema = z
     .passthrough();
 const ItemCommandExecutionTerminalInteractionNotificationSchema = z
     .object({
+    turnId: z.string().optional(),
     itemId: z.string().optional(),
     processId: z.union([z.string(), z.number()]).optional(),
     stdin: z.string().optional(),
@@ -1542,11 +1796,19 @@ const CodexEventPatchApplyEndNotificationSchema = z
     .passthrough();
 const ItemFileChangeOutputDeltaNotificationSchema = z
     .object({
+    turnId: z.string().optional(),
     itemId: z.string(),
     delta: z.string().optional(),
     chunk: z.string().optional(),
 })
     .passthrough();
+const ItemCommandExecutionOutputDeltaNotificationSchema = z
+    .object({
+    turnId: z.string().optional(),
+    itemId: z.string(),
+    delta: z.string().optional(),
+})
+    .passthrough();
 const CodexEventTurnDiffNotificationSchema = z
     .object({
     msg: z
@@ -1619,6 +1881,7 @@ const CodexNotificationSchema = z.union([
     })
         .transform(({ params }) => ({
         kind: "token_usage_updated",
+        turnId: params.turnId ?? null,
         tokenUsage: params.tokenUsage,
     })),
     z.object({ method: z.literal("thread/tokenUsage/updated"), params: z.unknown() }).transform(({ method, params }) => ({
@@ -1626,6 +1889,50 @@ const CodexNotificationSchema = z.union([
         method,
         params,
     })),
+    // codex announces an in-flight response-stream reconnect via `warning`
+    // (message "Reconnecting... n/5") and a paired `error(willRetry:true)`. Both
+    // are non-terminal — surface them as a reconnect notice so a slow turn does
+    // not look frozen. `warning` carries the human-readable attempt counter.
+    z
+        .object({
+        method: z.literal("warning"),
+        params: z.object({ threadId: z.string().optional(), message: z.string() }),
+    })
+        .transform(({ params }) => {
+        const counts = parseReconnectAttemptCounts(params.message);
+        return {
+            kind: "stream_retrying",
+            turnId: null,
+            message: params.message,
+            attempt: counts.attempt,
+            maxAttempts: counts.maxAttempts,
+        };
+    }),
+    z
+        .object({
+        method: z.literal("error"),
+        params: z.object({
+            willRetry: z.boolean().optional(),
+            turnId: z.string().optional(),
+            error: z.object({ message: z.string() }).partial().optional(),
+        }),
+    })
+        .transform(({ method, params }) => {
+        // Only a will_retry error is a non-terminal reconnect. A terminal error
+        // (willRetry false/absent) is delivered to clients via turn/completed
+        // (status Failed); let it fall through as an unknown method (logged, no
+        // UI) rather than misrender it as a reconnect.
+        if (params.willRetry !== true) {
+            return { kind: "unknown_method", method, params };
+        }
+        return {
+            kind: "stream_retrying",
+            turnId: params.turnId ?? null,
+            message: params.error?.message ?? null,
+            attempt: null,
+            maxAttempts: null,
+        };
+    }),
     z
         .object({
         method: z.literal("item/agentMessage/delta"),
@@ -1633,6 +1940,7 @@ const CodexNotificationSchema = z.union([
     })
         .transform(({ params }) => ({
         kind: "agent_message_delta",
+        turnId: params.turnId ?? null,
         itemId: params.itemId,
         delta: params.delta,
     })),
@@ -1648,6 +1956,7 @@ const CodexNotificationSchema = z.union([
     })
         .transform(({ params }) => ({
         kind: "reasoning_delta",
+        turnId: params.turnId ?? null,
         itemId: params.itemId,
         delta: params.delta,
     })),
@@ -1661,6 +1970,7 @@ const CodexNotificationSchema = z.union([
         .transform(({ params }) => ({
         kind: "item_completed",
         source: "item",
+        turnId: params.turnId ?? null,
         item: params.item,
     })),
     z.object({ method: z.literal("item/completed"), params: z.unknown() }).transform(({ method, params }) => ({
@@ -1675,6 +1985,7 @@ const CodexNotificationSchema = z.union([
     })
         .transform(({ params }) => ({
         kind: "raw_response_item_completed",
+        turnId: params.turnId ?? null,
         item: params.item,
     })),
     z.object({ method: z.literal("rawResponseItem/completed"), params: z.unknown() }).transform(({ method, params }) => ({
@@ -1687,6 +1998,7 @@ const CodexNotificationSchema = z.union([
         .transform(({ params }) => ({
         kind: "item_started",
         source: "item",
+        turnId: params.turnId ?? null,
         item: params.item,
     })),
     z.object({ method: z.literal("item/started"), params: z.unknown() }).transform(({ method, params }) => ({
@@ -1702,6 +2014,7 @@ const CodexNotificationSchema = z.union([
         .transform(({ params }) => ({
         kind: "item_started",
         source: "codex_event",
+        turnId: null,
         item: params.msg.item,
     })),
     z.object({ method: z.literal("codex/event/item_started"), params: z.unknown() }).transform(({ method, params }) => ({
@@ -1717,6 +2030,7 @@ const CodexNotificationSchema = z.union([
         .transform(({ params }) => ({
         kind: "item_completed",
         source: "codex_event",
+        turnId: null,
         item: params.msg.item,
     })),
     z.object({ method: z.literal("codex/event/item_completed"), params: z.unknown() }).transform(({ method, params }) => ({
@@ -1771,6 +2085,7 @@ const CodexNotificationSchema = z.union([
     })
         .transform(({ params }) => ({
         kind: "exec_command_output_delta",
+        turnId: null,
         callId: params.msg.call_id ?? null,
         stream: params.msg.stream ?? null,
         chunk: params.msg.chunk ?? params.msg.delta ?? null,
@@ -1785,6 +2100,27 @@ const CodexNotificationSchema = z.union([
         method,
         params,
     })),
+    z
+        .object({
+        method: z.literal("item/commandExecution/outputDelta"),
+        params: ItemCommandExecutionOutputDeltaNotificationSchema,
+    })
+        .transform(({ params }) => ({
+        kind: "command_execution_output_delta",
+        turnId: params.turnId ?? null,
+        itemId: params.itemId,
+        delta: params.delta ?? null,
+    })),
+    z
+        .object({
+        method: z.literal("item/commandExecution/outputDelta"),
+        params: z.unknown(),
+    })
+        .transform(({ method, params }) => ({
+        kind: "invalid_payload",
+        method,
+        params,
+    })),
     z
         .object({
         method: z.literal("codex/event/terminal_interaction"),
@@ -1793,6 +2129,7 @@ const CodexNotificationSchema = z.union([
         .transform(({ params }) => ({
         kind: "terminal_interaction",
         source: "codex_event",
+        turnId: null,
         callId: params.msg.call_id ?? null,
         processId: typeof params.msg.process_id === "number"
             ? String(params.msg.process_id)
@@ -1814,6 +2151,7 @@ const CodexNotificationSchema = z.union([
         .transform(({ params }) => ({
         kind: "terminal_interaction",
         source: "item",
+        turnId: params.turnId ?? null,
         callId: params.itemId ?? null,
         processId: typeof params.processId === "number"
             ? String(params.processId)
@@ -1870,6 +2208,7 @@ const CodexNotificationSchema = z.union([
     })
         .transform(({ params }) => ({
         kind: "file_change_output_delta",
+        turnId: params.turnId ?? null,
         itemId: params.itemId,
         delta: params.delta ?? params.chunk ?? null,
     })),
@@ -1926,6 +2265,15 @@ const CodexNotificationSchema = z.union([
         .object({ method: z.string(), params: z.unknown() })
         .transform(({ method, params }) => ({ kind: "unknown_method", method, params })),
 ]);
+// Pull "n/5" out of codex's "Reconnecting... 2/5" warning message. Best-effort:
+// returns nulls when the message has no counter (e.g. a transport-fallback warning).
+function parseReconnectAttemptCounts(message) {
+    const match = message.match(/(\d+)\s*\/\s*(\d+)/);
+    if (!match) {
+        return { attempt: null, maxAttempts: null };
+    }
+    return { attempt: Number(match[1]), maxAttempts: Number(match[2]) };
+}
 async function writeImageAttachment(mimeType, data) {
     const attachmentsDir = path.join(os.tmpdir(), CODEX_IMAGE_ATTACHMENT_DIR);
     await fs.mkdir(attachmentsDir, { recursive: true });
@@ -2013,10 +2361,7 @@ function buildCodexAppServerEnv(runtimeSettings, launchEnv) {
         env.HTTPS_PROXY = latencyProxyUrl;
     }
     else {
-        env.http_proxy = "";
-        env.https_proxy = "";
-        env.HTTP_PROXY = "";
-        env.HTTPS_PROXY = "";
+        clearInheritedProxyEnv(env, runtimeSettings);
     }
     const merged = launchEnv
         ? {
@@ -2024,8 +2369,25 @@ function buildCodexAppServerEnv(runtimeSettings, launchEnv) {
             ...launchEnv,
         }
         : env;
-    if (readStringMetadata(merged.OPENAI_BASE_URL)) {
-        merged.SEAWORK_API_KEY = merged.OPENAI_API_KEY ?? "";
+    // Merge the localhost bypass AFTER launchEnv is spread: a launch context that
+    // carries its own NO_PROXY would otherwise overwrite the bypass and send local
+    // daemon MCP traffic back through the CONNECT-only latency proxy.
+    if (latencyProxyUrl) {
+        mergeLocalhostProxyBypass(merged);
+    }
+    // LLM endpoint comes ONLY from SEAWORK_LLM_BASE_URL (auth.json base_url).
+    // OPENAI_BASE_URL is the desktop's image/SAC gateway, not the LLM gateway.
+    const llmBaseUrl = readStringMetadata(merged.SEAWORK_LLM_BASE_URL);
+    if (llmBaseUrl) {
+        merged.SEAWORK_API_KEY = merged.OPENAI_API_KEY ?? merged.SEAWORK_API_KEY ?? "";
+    }
+    // Enable codex's HTTP request-completion debug line (one per request, which
+    // carries the gateway `x-request-id` response header) so turn failures can be
+    // tagged with a request id — including stream disconnects, where codex omits
+    // the id from the error message. Scoped to a single module plus a global
+    // `error` level so stderr stays lean. A user-set RUST_LOG always wins.
+    if (!readStringMetadata(merged.RUST_LOG)) {
+        merged.RUST_LOG = "error,codex_client::default_client=debug";
     }
     return merged;
 }
@@ -2034,7 +2396,8 @@ function codexProviderBaseUrl(baseUrl) {
     return normalized.endsWith("/v1") ? normalized : `${normalized}/v1`;
 }
 function buildCodexSeaworkProviderConfig(env) {
-    const baseUrl = readStringMetadata(env.OPENAI_BASE_URL);
+    // LLM endpoint comes ONLY from SEAWORK_LLM_BASE_URL (auth.json base_url).
+    const baseUrl = readStringMetadata(env.SEAWORK_LLM_BASE_URL);
     if (!baseUrl) {
         return null;
     }
@@ -2045,6 +2408,7 @@ function buildCodexSeaworkProviderConfig(env) {
                 name: "Seawork",
                 base_url: codexProviderBaseUrl(baseUrl),
                 env_key: "SEAWORK_API_KEY",
+                http_headers: buildSeaworkGatewayHeaders(CODEX_PROVIDER),
             },
         },
     };
@@ -2064,6 +2428,322 @@ function mergeCodexConfig(base, override) {
         },
     };
 }
+function formatCodexTomlString(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function buildManagedCodexConfigToml(config, logger) {
+    if (!config) {
+        return null;
+    }
+    const providerId = readStringMetadata(config.model_provider);
+    const providerConfigs = readStringRecord(config.model_providers);
+    const provider = providerId ? readStringRecord(providerConfigs[providerId]) : {};
+    const providerName = readStringMetadata(provider.name);
+    const providerBaseUrl = readStringMetadata(provider.base_url);
+    const providerEnvKey = readStringMetadata(provider.env_key);
+    const providerHeaders = readStringRecord(provider.http_headers);
+    if (!providerId || !providerName || !providerBaseUrl || !providerEnvKey) {
+        logger?.warn({
+            providerId,
+            hasProviderName: Boolean(providerName),
+            hasProviderBaseUrl: Boolean(providerBaseUrl),
+            hasProviderEnvKey: Boolean(providerEnvKey),
+        }, "Skipping managed Codex config overlay because provider config is incomplete");
+        return null;
+    }
+    const lines = [
+        `model_provider = ${formatCodexTomlString(providerId)}`,
+        "",
+        `[model_providers.${providerId}]`,
+        `name = ${formatCodexTomlString(providerName)}`,
+        `base_url = ${formatCodexTomlString(providerBaseUrl)}`,
+        `env_key = ${formatCodexTomlString(providerEnvKey)}`,
+    ];
+    const headerEntries = Object.entries(providerHeaders)
+        .filter((entry) => typeof entry[1] === "string")
+        .sort(([a], [b]) => a.localeCompare(b));
+    if (headerEntries.length > 0) {
+        lines.push("", `[model_providers.${providerId}.http_headers]`);
+        for (const [name, value] of headerEntries) {
+            lines.push(`${formatCodexTomlString(name)} = ${formatCodexTomlString(value)}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+function managedCodexHomeRoot() {
+    return path.join(os.tmpdir(), "seawork-managed-codex-home");
+}
+function managedCodexHomePath(originalHome, configToml) {
+    const digest = createHash("sha1")
+        .update(originalHome)
+        .update("\0")
+        .update(configToml)
+        .digest("hex");
+    return path.join(managedCodexHomeRoot(), digest);
+}
+const MANAGED_CODEX_HOME_PRESERVED_ROOT_NAMES = ["AGENTS.md", "plugins"];
+const MANAGED_CODEX_ROOT_ENTRY_LEDGER = ".seawork-managed-root-entries.json";
+const MANAGED_CODEX_HOME_PRESERVED_ROOT_NAME_SET = new Set(MANAGED_CODEX_HOME_PRESERVED_ROOT_NAMES);
+const MANAGED_CODEX_HOME_BUSY_REMOVE_CODES = new Set(["EBUSY", "EPERM", "EACCES"]);
+async function ensureManagedCodexLink(source, dest) {
+    let sourceLstat;
+    try {
+        sourceLstat = await fs.lstat(source);
+    }
+    catch {
+        return;
+    }
+    try {
+        const existing = await fs.lstat(dest);
+        if (existing.isSymbolicLink()) {
+            const existingTarget = await fs.readlink(dest);
+            const resolvedExisting = path.resolve(path.dirname(dest), existingTarget);
+            if (resolvedExisting === source) {
+                return;
+            }
+        }
+        await fs.rm(dest, { recursive: true, force: true });
+    }
+    catch {
+        // Destination does not exist.
+    }
+    let symlinkType;
+    if (process.platform === "win32") {
+        if (sourceLstat.isSymbolicLink()) {
+            try {
+                const sourceStat = await fs.stat(source);
+                symlinkType = sourceStat.isDirectory() ? "junction" : "file";
+            }
+            catch {
+                return;
+            }
+        }
+        else {
+            symlinkType = sourceLstat.isDirectory() ? "junction" : "file";
+        }
+    }
+    await fs.symlink(source, dest, symlinkType);
+}
+function areSameFilesystemEntry(sourceStat, destStat) {
+    return sourceStat.dev === destStat.dev && sourceStat.ino === destStat.ino;
+}
+async function ensureManagedCodexFileAlias(source, dest, logger) {
+    const sourceStat = await fs.stat(source);
+    let existing;
+    try {
+        existing = await fs.lstat(dest);
+    }
+    catch {
+        // Destination does not exist.
+    }
+    if (existing) {
+        let shouldPreserveDestFile = false;
+        if (existing.isSymbolicLink()) {
+            const existingTarget = await fs.readlink(dest);
+            const resolvedExisting = path.resolve(path.dirname(dest), existingTarget);
+            if (resolvedExisting === source) {
+                return;
+            }
+        }
+        else if (existing.isFile()) {
+            const destStat = await fs.stat(dest);
+            if (areSameFilesystemEntry(sourceStat, destStat)) {
+                return;
+            }
+            shouldPreserveDestFile =
+                process.platform === "win32" && destStat.mtimeMs > sourceStat.mtimeMs;
+        }
+        if (shouldPreserveDestFile) {
+            await fs.copyFile(dest, source);
+        }
+        await fs.rm(dest, { recursive: true, force: true });
+    }
+    if (process.platform !== "win32") {
+        await fs.symlink(source, dest);
+        return;
+    }
+    try {
+        await fs.link(source, dest);
+        return;
+    }
+    catch (error) {
+        logger.warn({ error, source, dest }, "Failed to hard-link managed Codex file alias; falling back to copy");
+    }
+    await fs.copyFile(source, dest);
+}
+async function ensureManagedCodexPathAlias(params) {
+    if (params.kind === "directory") {
+        await fs.mkdir(params.source, { recursive: true });
+        await ensureManagedCodexLink(params.source, params.dest);
+        return;
+    }
+    await fs.mkdir(path.dirname(params.source), { recursive: true });
+    try {
+        await fs.access(params.source);
+    }
+    catch {
+        try {
+            await fs.copyFile(params.dest, params.source);
+        }
+        catch {
+            await fs.writeFile(params.source, "", "utf8");
+        }
+    }
+    await ensureManagedCodexFileAlias(params.source, params.dest, params.logger);
+}
+async function resolveManagedCodexRootEntryKind(sourcePath, entry) {
+    if (entry.isSymbolicLink()) {
+        try {
+            const stat = await fs.stat(sourcePath);
+            if (stat.isDirectory())
+                return "directory";
+            if (stat.isFile())
+                return "file";
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (entry.isDirectory())
+        return "directory";
+    if (entry.isFile())
+        return "file";
+    return null;
+}
+async function isManagedCodexRootAlias(params) {
+    const destPath = path.join(params.managedHome, params.entryName);
+    try {
+        const existing = await fs.lstat(destPath);
+        if (existing.isSymbolicLink()) {
+            const existingTarget = await fs.readlink(destPath);
+            const resolvedExisting = path.resolve(path.dirname(destPath), existingTarget);
+            return resolvedExisting === path.join(params.originalHome, params.entryName);
+        }
+        if (process.platform === "win32" && params.entryName === "AGENTS.md" && existing.isFile()) {
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+async function removeManagedCodexHomeEntry(targetPath, logger) {
+    try {
+        await fs.rm(targetPath, { recursive: true, force: true });
+    }
+    catch (error) {
+        const code = error.code;
+        if (process.platform === "win32" && code && MANAGED_CODEX_HOME_BUSY_REMOVE_CODES.has(code)) {
+            logger.warn({ error, path: targetPath }, "Skipping locked managed Codex home entry during cleanup");
+            return;
+        }
+        throw error;
+    }
+}
+function isManagedCodexHomePreservedRootName(value) {
+    return (typeof value === "string" &&
+        MANAGED_CODEX_HOME_PRESERVED_ROOT_NAME_SET.has(value));
+}
+async function readManagedCodexRootEntryLedger(managedHome) {
+    try {
+        const raw = await fs.readFile(path.join(managedHome, MANAGED_CODEX_ROOT_ENTRY_LEDGER), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed)) {
+            return new Set();
+        }
+        return new Set(parsed.filter(isManagedCodexHomePreservedRootName));
+    }
+    catch {
+        return new Set();
+    }
+}
+async function preserveManagedCodexHomeRootEntries(params) {
+    let entries;
+    try {
+        entries = await fs.readdir(params.originalHome, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    const entriesByName = new Map(entries.map((entry) => [entry.name, entry]));
+    const previouslyManagedNames = await readManagedCodexRootEntryLedger(params.managedHome);
+    const nextManagedNames = new Set();
+    for (const entryName of MANAGED_CODEX_HOME_PRESERVED_ROOT_NAMES) {
+        const entry = entriesByName.get(entryName);
+        const sourcePath = path.join(params.originalHome, entryName);
+        const destPath = path.join(params.managedHome, entryName);
+        if (!entry) {
+            if (previouslyManagedNames.has(entryName) ||
+                (previouslyManagedNames.size === 0 &&
+                    (await isManagedCodexRootAlias({
+                        managedHome: params.managedHome,
+                        originalHome: params.originalHome,
+                        entryName,
+                    })))) {
+                await removeManagedCodexHomeEntry(destPath, params.logger);
+            }
+            continue;
+        }
+        const kind = await resolveManagedCodexRootEntryKind(sourcePath, entry);
+        if (!kind) {
+            if (previouslyManagedNames.has(entryName)) {
+                await removeManagedCodexHomeEntry(destPath, params.logger);
+            }
+            continue;
+        }
+        await ensureManagedCodexPathAlias({
+            source: sourcePath,
+            dest: destPath,
+            kind,
+            logger: params.logger,
+        });
+        nextManagedNames.add(entryName);
+    }
+    await fs.writeFile(path.join(params.managedHome, MANAGED_CODEX_ROOT_ENTRY_LEDGER), `${JSON.stringify([...nextManagedNames].sort())}\n`, "utf8");
+}
+async function prepareManagedCodexHome(params) {
+    const managedConfig = buildCodexSeaworkProviderConfig(params.env);
+    const configToml = buildManagedCodexConfigToml(managedConfig, params.logger);
+    if (!configToml) {
+        return null;
+    }
+    const originalHome = readStringMetadata(params.env.CODEX_HOME) ?? path.join(os.homedir(), ".codex");
+    const managedHome = managedCodexHomePath(originalHome, configToml);
+    await fs.mkdir(managedHome, { recursive: true });
+    await fs.writeFile(path.join(managedHome, "config.toml"), configToml, "utf8");
+    await ensureManagedCodexPathAlias({
+        source: path.join(originalHome, "sessions"),
+        dest: path.join(managedHome, "sessions"),
+        kind: "directory",
+        logger: params.logger,
+    });
+    await ensureManagedCodexPathAlias({
+        source: path.join(originalHome, "prompts"),
+        dest: path.join(managedHome, "prompts"),
+        kind: "directory",
+        logger: params.logger,
+    });
+    await ensureManagedCodexPathAlias({
+        source: path.join(originalHome, "skills"),
+        dest: path.join(managedHome, "skills"),
+        kind: "directory",
+        logger: params.logger,
+    });
+    await ensureManagedCodexPathAlias({
+        source: path.join(originalHome, "external_agent_session_imports.json"),
+        dest: path.join(managedHome, "external_agent_session_imports.json"),
+        kind: "file",
+        logger: params.logger,
+    });
+    await preserveManagedCodexHomeRootEntries({
+        originalHome,
+        managedHome,
+        logger: params.logger,
+    });
+    return managedHome;
+}
 function withManagedCodexConfig(config, runtimeSettings, launchEnv) {
     const env = buildCodexAppServerEnv(runtimeSettings, launchEnv);
     const managedConfig = buildCodexSeaworkProviderConfig(env);
@@ -2091,9 +2771,10 @@ function buildCodexAppServerInitializeParams() {
     };
 }
 class CodexAppServerAgentSession {
-    constructor(config, resumeHandle, logger, spawnAppServer) {
+    constructor(config, resumeHandle, logger, spawnAppServer, goalsEnabled = false) {
         this.resumeHandle = resumeHandle;
         this.spawnAppServer = spawnAppServer;
+        this.goalsEnabled = goalsEnabled;
         this.provider = CODEX_PROVIDER;
         this.capabilities = CODEX_APP_SERVER_CAPABILITIES;
         this.currentThreadId = null;
@@ -2106,6 +2787,62 @@ class CodexAppServerAgentSession {
         this.subscribers = new Set();
         this.nextTurnOrdinal = 0;
         this.activeForegroundTurnId = null;
+        // issue #505: fires if the active turn goes silent (lost `turn/completed`).
+        this.turnWatchdogTimer = null;
+        // issue #1427: grace timer armed when the watchdog decides a turn is stalled.
+        // Commits forceFailActiveTurn only if no turn/completed arrives within
+        // WATCHDOG_LATE_COMPLETION_GRACE_MS, so a late-but-successful completion is
+        // not mis-killed. Cleared by any notification (the watchdog re-arm path) and
+        // by turn teardown.
+        this.pendingForceFailTimer = null;
+        // issue #505: consecutive watchdog cycles that have elapsed in silence while
+        // a tool was in flight. Reset by any real notification; bounded so a lost
+        // tool completion still recovers instead of deferring the watchdog forever.
+        this.turnWatchdogInflightCycles = 0;
+        // issue #505: set when a turn is force-failed (watchdog / process exit /
+        // interrupt). Late notifications for that fenced turn are dropped until the
+        // next `turn/started` arrives, so a stale `turn/completed` or terminal item
+        // cannot resurface a turn the UI already saw fail.
+        this.fencedAfterForcedFailure = false;
+        // issue #505: codex's `turn/start` RPC response carries `turn.id`, which the
+        // subsequent `turn/started` notification echoes verbatim. Saving it here lets
+        // the fence reject a late `turn/started` belonging to a force-failed turn
+        // even after a retry has set a fresh `activeForegroundTurnId` — we accept
+        // only the `turn/started` whose id matches the most recent turn/start ack.
+        this.expectedCodexTurnId = null;
+        // issue #505: between the moment startTurn() sets activeForegroundTurnId and
+        // the moment turn/start RPC ack returns and we know codex's turn.id, we
+        // cannot distinguish a dead turn's late turn/started from the new turn's
+        // own. This flag marks that "in-flight ack" window — while true the fence
+        // unconditionally drops every turn/started, so a stale notification cannot
+        // race the ack and pollute the new turn.
+        this.turnStartAckPending = false;
+        // issue #664 review #3 (gpt-5.5): codex can emit a new turn's
+        // `turn/started` BEFORE the `turn/start` RPC ack returns. The ack-pending
+        // fence drops it (since we don't yet know codex's turn.id to verify
+        // ownership). Cache the most recent fence-dropped turn/started here so
+        // the ack handler can replay it after `expectedCodexTurnId` is set —
+        // otherwise the fence stays closed and the new turn looks silent until
+        // the watchdog fires. Cleared on startTurn() entry, startTurn() failure,
+        // and after a successful replay.
+        this.pendingFencedTurnStarted = null;
+        // issue #1235 review #3 (geli-bot): keep the most recently force-failed
+        // codex turn id separate from `currentTurnId`. Older codex can omit
+        // `turn.id` from turn/start ack, leaving item.turnId as the only ownership
+        // signal for the retry turn. This lets the fallback fence reject the dead
+        // turn specifically without hard-locking the retry.
+        this.fencedTurnId = null;
+        // issue #1836: the local foreground turn id of the most recent force-fail.
+        // The fence self-heal reuses it when resuming the old codex turn so the
+        // recovered turn's start/completed accounting (pushTurnEvent durationMs,
+        // bug-report ring, latency) keys off the original id instead of a fresh one.
+        this.lastForcedFailForegroundTurnId = null;
+        // issue #1836: whether the current fence came from a watchdog force-fail (the
+        // only case self-heal should resurrect). `resetForegroundTurnState` is also
+        // called by the user interrupt/cancel paths, which fence the turn too —
+        // self-heal must NOT revive a turn the user deliberately canceled, so it gates
+        // on this flag rather than the fence merely existing.
+        this.fencedByForceFail = false;
         this.cachedRuntimeInfo = null;
         this.serviceTier = null;
         this.planModeEnabled = false;
@@ -2115,6 +2852,17 @@ class CodexAppServerAgentSession {
         this.pendingPermissionHandlers = new Map();
         this.resolvedPermissionRequests = new Set();
         this.pendingAgentMessages = new Map();
+        /**
+         * Per-itemId count of assistant-message characters already emitted as
+         * streaming `assistant_message` timeline deltas. `item_completed` uses this
+         * to emit only the un-streamed tail (and skip entirely if all streamed),
+         * avoiding a duplicate full-text emit at the end of a streamed message.
+         */
+        this.emittedAgentMessageLength = new Map();
+        /** Pending throttle timer for streaming agent-message deltas. */
+        this.agentMessageFlushTimer = null;
+        /** itemId awaiting a throttled streaming flush. */
+        this.agentMessageFlushPendingItemId = null;
         this.pendingReasoning = new Map();
         this.pendingCommandOutputDeltas = new Map();
         this.pendingFileChangeOutputDeltas = new Map();
@@ -2125,6 +2873,35 @@ class CodexAppServerAgentSession {
         this.emittedExecCommandCompletedCallIds = new Set();
         this.emittedItemStartedIds = new Set();
         this.emittedItemCompletedIds = new Set();
+        // issue #505: callIds of tool executions that have started but not completed.
+        // A long, output-silent command (build, network fetch) keeps this non-empty,
+        // so the stall watchdog can tell "genuinely working" from "lost turn".
+        this.inFlightToolCalls = new Set();
+        // issue #999: itemIds of context-compaction items currently in flight. Like
+        // inFlightToolCalls, it tells the watchdog "genuinely working" (packing the
+        // context + summarizing) from "lost turn", so a long compaction is deferred
+        // instead of force-failed.
+        this.compactionInFlight = new Set();
+        this.compactionItemTimers = new Map();
+        // issue #999: consecutive watchdog cycles elapsed in silence while a
+        // compaction was in flight. Reset by any real notification; bounded so a lost
+        // compaction completion still recovers.
+        this.turnWatchdogCompactionCycles = 0;
+        // issue #1181: wall-clock time of the most recent codex notification accepted
+        // by the active turn. The watchdog compares this to Date.now() so event-loop
+        // starvation from other agents cannot cause a false stall.
+        this.lastTurnNotificationTime = null;
+        // issue #1427: last reconnect-attempt key for which a "reconnecting" loading
+        // marker was emitted, so the paired warning+error(willRetry) for one attempt
+        // collapse into a single marker. Reset to null when a marker is resolved
+        // (real turn progress) or on turn teardown so the next stall re-announces.
+        this.lastReconnectMarkerKey = null;
+        // issue #1012: codex version parsed from the app-server `initialize`
+        // response's `userAgent` (e.g. "codex/0.137.0 (...)"). Gates the manual
+        // `/compact` command — `thread/compact/start` only exists on newer codex.
+        this.codexVersion = null;
+        this.manualCompactTurnId = null;
+        this.manualCompactCanceledTurnIds = new Set();
         this.warnedUnknownNotificationMethods = new Set();
         this.warnedInvalidNotificationPayloads = new Set();
         this.warnedIncompleteEditToolCallIds = new Set();
@@ -2150,6 +2927,12 @@ class CodexAppServerAgentSession {
         if (this.resumeHandle?.sessionId) {
             this.currentThreadId = this.resumeHandle.sessionId;
             this.historyPending = true;
+            // issue #277: restore the cancel sentinel persisted by describePersistence
+            // so a turn/interrupt issued before resume is honored on the next turn.
+            const persistedCanceledAt = this.resumeHandle.metadata?.lastCanceledAt;
+            if (typeof persistedCanceledAt === "number" && Number.isFinite(persistedCanceledAt)) {
+                this.lastCanceledAt = persistedCanceledAt;
+            }
         }
     }
     get id() {
@@ -2169,17 +2952,41 @@ class CodexAppServerAgentSession {
         const child = await this.spawnAppServer();
         this.client = new CodexAppServerClient(child, this.logger);
         this.client.setNotificationHandler((method, params) => this.handleNotification(method, params));
+        // issue #505: a mid-turn process crash never produces a `turn/completed`
+        // notification, so fail the foreground turn explicitly instead of leaving
+        // the UI stuck "thinking".
+        this.client.setExitHandler((reason) => {
+            this.handleClientExit(reason);
+        });
+        // issue #1824: a `/responses` round-trip completing proves the turn is alive
+        // even with no protocol notification (multi-minute large-payload uploads),
+        // so feed it into the stall watchdog as a liveness signal.
+        this.client.setUpstreamLivenessHandler(() => this.markUpstreamLiveness());
         this.registerRequestHandlers();
-        await this.client.request("initialize", buildCodexAppServerInitializeParams());
+        const initializeResponse = await this.client.request("initialize", buildCodexAppServerInitializeParams());
+        this.codexVersion = parseCodexUserAgentVersion(initializeResponse);
         this.client.notify("initialized", {});
         await this.loadCollaborationModes();
         await this.loadSkills();
         if (this.currentThreadId) {
-            await this.loadPersistedHistory();
-            await this.ensureThreadLoaded();
+            await this.restorePersistedHistoryForResume();
         }
         this.connected = true;
     }
+    async restorePersistedHistoryForResume() {
+        if (!this.currentThreadId) {
+            return;
+        }
+        const resumedThreadId = this.currentThreadId;
+        const restored = await this.loadPersistedHistory();
+        await this.ensureThreadLoaded();
+        // Some Codex builds only allow thread/read after thread/resume has loaded
+        // the thread into the app-server process. Retry once so reconnect/login
+        // flows don't lose visible history just because the first read raced.
+        if (!restored && this.currentThreadId === resumedThreadId) {
+            await this.loadPersistedHistory();
+        }
+    }
     async loadCollaborationModes() {
         if (!this.client)
             return;
@@ -2202,7 +3009,7 @@ class CodexAppServerAgentSession {
     }
     async loadSkills() {
         const skillsByName = new Map();
-        const projectSkills = await listCodexSkillEntries(this.config.cwd);
+        const projectSkills = await listCodexSkillEntries(this.config.cwd, this.logger);
         for (const skill of projectSkills) {
             skillsByName.set(skill.name, skill);
         }
@@ -2231,7 +3038,10 @@ class CodexAppServerAgentSession {
         catch (error) {
             this.logger.trace({ error }, "Failed to load skills list");
         }
-        this.cachedSkills = Array.from(skillsByName.values()).sort((a, b) => a.name.localeCompare(b.name));
+        const denied = new Set(this.config.librarySkillDenylist ?? []);
+        this.cachedSkills = Array.from(skillsByName.values())
+            .filter((skill) => !denied.has(skill.name))
+            .sort((a, b) => a.name.localeCompare(b.name));
     }
     findCollaborationMode(target) {
         if (this.collaborationModes.length === 0)
@@ -2343,10 +3153,66 @@ class CodexAppServerAgentSession {
         this.pendingPermissionHandlers.set(requestId, {
             resolve: () => undefined,
             kind: "plan",
+            foregroundTurnId: this.activeForegroundTurnId,
             planText,
+            // Capture the plan timeline item's callId now (while latestPlanResult is
+            // populated) so an edited-plan approval can re-emit/replace that exact card
+            // even after a daemon restart cleared latestPlanResult.
+            planCallId: this.latestPlanResult?.callId,
         });
         this.emitEvent({ type: "permission_requested", provider: CODEX_PROVIDER, request });
     }
+    foregroundTurnIdForLegacyPermission() {
+        if (this.turnStartAckPending) {
+            return null;
+        }
+        return this.activeForegroundTurnId;
+    }
+    isActiveForegroundCodexTurnId(codexTurnId) {
+        if (!codexTurnId || this.activeForegroundTurnId === null || this.turnStartAckPending) {
+            return false;
+        }
+        if (this.expectedCodexTurnId) {
+            return codexTurnId === this.expectedCodexTurnId;
+        }
+        if (this.currentTurnId) {
+            return codexTurnId === this.currentTurnId;
+        }
+        if (this.fencedAfterForcedFailure) {
+            return this.fencedTurnId === null || codexTurnId !== this.fencedTurnId;
+        }
+        return false;
+    }
+    foregroundTurnIdForCodexPermission(codexTurnId) {
+        const foregroundTurnId = this.activeForegroundTurnId;
+        if (!foregroundTurnId) {
+            return null;
+        }
+        return this.isActiveForegroundCodexTurnId(codexTurnId) ? foregroundTurnId : null;
+    }
+    parsedNotificationTurnId(parsed) {
+        switch (parsed.kind) {
+            case "turn_started":
+                return parsed.turnId;
+            case "token_usage_updated":
+            case "agent_message_delta":
+            case "reasoning_delta":
+            case "raw_response_item_completed":
+            case "command_execution_output_delta":
+            case "file_change_output_delta":
+                return parsed.turnId;
+            case "item_started":
+            case "item_completed":
+            case "terminal_interaction":
+                return parsed.turnId;
+            default:
+                return null;
+        }
+    }
+    isCurrentRetryTurnNotification(parsed) {
+        const turnId = this.parsedNotificationTurnId(parsed);
+        return this.isActiveForegroundCodexTurnId(turnId);
+    }
     /**
      * Prepare the session for plan implementation by disabling plan mode (so the
      * next turn runs in `code` collaboration mode instead of generating another
@@ -2365,27 +3231,29 @@ class CodexAppServerAgentSession {
             return;
         this.client.setRequestHandler("item/commandExecution/requestApproval", (params) => this.handleCommandApprovalRequest(params));
         this.client.setRequestHandler("item/fileChange/requestApproval", (params) => this.handleFileChangeApprovalRequest(params));
+        this.client.setRequestHandler("execCommandApproval", (params) => this.handleLegacyExecCommandApprovalRequest(params));
+        this.client.setRequestHandler("applyPatchApproval", (params) => this.handleLegacyApplyPatchApprovalRequest(params));
         this.client.setRequestHandler("item/tool/requestUserInput", (params) => this.handleToolApprovalRequest(params));
         // Keep the legacy method name for older Codex builds.
         this.client.setRequestHandler("tool/requestUserInput", (params) => this.handleToolApprovalRequest(params));
     }
     async loadPersistedHistory() {
         if (!this.client || !this.currentThreadId)
-            return;
+            return false;
+        let rolloutTimeline = [];
+        try {
+            rolloutTimeline = await loadCodexPersistedTimeline(this.currentThreadId, undefined, this.logger);
+        }
+        catch {
+            rolloutTimeline = [];
+        }
+        let threadTimeline = [];
         try {
-            let rolloutTimeline = [];
-            try {
-                rolloutTimeline = await loadCodexPersistedTimeline(this.currentThreadId, undefined, this.logger);
-            }
-            catch {
-                rolloutTimeline = [];
-            }
             const response = (await this.client.request("thread/read", {
                 threadId: this.currentThreadId,
                 includeTurns: true,
             }));
             const thread = response?.thread;
-            const threadTimeline = [];
             if (thread && Array.isArray(thread.turns)) {
                 for (const turn of thread.turns) {
                     const items = Array.isArray(turn.items) ? turn.items : [];
@@ -2402,17 +3270,19 @@ class CodexAppServerAgentSession {
                     }
                 }
             }
-            const timeline = rolloutTimeline.length > 0 ? rolloutTimeline : threadTimeline;
-            if (timeline.length > 0) {
-                this.persistedHistory = timeline;
-                this.historyPending = true;
-            }
         }
         catch (error) {
-            this.logger.warn({ error }, "Failed to load Codex thread history");
+            this.logger.warn({ error }, "Failed to read Codex thread history");
         }
-    }
-    async ensureThreadLoaded() {
+        const timeline = rolloutTimeline.length > 0 ? rolloutTimeline : threadTimeline;
+        if (timeline.length === 0) {
+            return false;
+        }
+        this.persistedHistory = timeline;
+        this.historyPending = true;
+        return true;
+    }
+    async ensureThreadLoaded() {
         if (!this.client || !this.currentThreadId)
             return;
         try {
@@ -2501,6 +3371,9 @@ class CodexAppServerAgentSession {
     async run(prompt, options) {
         const timeline = [];
         let finalText = "";
+        // Whether the previous timeline item was an assistant_message, so
+        // consecutive streaming deltas accumulate into finalText.
+        let prevTimelineWasAssistant = false;
         let usage;
         let turnId = null;
         const bufferedEvents = [];
@@ -2517,11 +3390,26 @@ class CodexAppServerAgentSession {
             }
             if (event.type === "timeline") {
                 timeline.push(event.item);
+                // assistant_message is now emitted as a stream of deltas (one per
+                // ~60ms throttle window), not a single full-text item. Mirror the
+                // UI's `appendAssistantMessage` coalescing: consecutive
+                // assistant_message items concatenate; a non-assistant item resets
+                // the run, so the last assistant message wins as finalText.
                 if (event.item.type === "assistant_message") {
-                    finalText = event.item.text;
+                    if (prevTimelineWasAssistant) {
+                        finalText += event.item.text;
+                    }
+                    else {
+                        finalText = event.item.text;
+                        prevTimelineWasAssistant = true;
+                    }
                 }
                 else if (event.item.type === "tool_call" && event.item.detail.type === "plan") {
                     finalText = event.item.detail.text;
+                    prevTimelineWasAssistant = false;
+                }
+                else {
+                    prevTimelineWasAssistant = false;
                 }
                 return;
             }
@@ -2581,6 +3469,17 @@ class CodexAppServerAgentSession {
         if (!this.client) {
             throw new Error("Codex client not initialized");
         }
+        // issue #1012: intercept `/compact` and route to the dedicated
+        // `thread/compact/start` RPC instead of starting a turn. Mirrors claude's
+        // rewind interception — fire-and-forget so we return the turnId immediately
+        // and the synthesized turn events finalize the foreground turn.
+        const compactInvocation = typeof prompt === "string" ? this.parseSlashCommandInput(prompt) : null;
+        if (compactInvocation?.commandName === COMPACT_COMMAND_NAME) {
+            const turnId = this.createTurnId();
+            this.activeForegroundTurnId = turnId;
+            void this.executeManualCompact(turnId);
+            return { turnId };
+        }
         const slashCommand = await this.resolveSlashCommandInvocation(prompt);
         const effectivePrompt = slashCommand
             ? await this.buildCommandPromptInput(slashCommand.commandName, slashCommand.args)
@@ -2593,8 +3492,9 @@ class CodexAppServerAgentSession {
         }
         const input = this.maybePrependCancelReminder(await this.buildUserInput(effectivePrompt));
         const preset = MODE_PRESETS[this.currentMode] ?? MODE_PRESETS[DEFAULT_CODEX_MODE_ID];
-        const approvalPolicy = this.config.approvalPolicy ?? preset.approvalPolicy;
-        const sandboxPolicyType = this.config.sandboxMode ?? preset.sandbox;
+        let approvalPolicy = this.config.approvalPolicy ?? preset.approvalPolicy;
+        let sandboxPolicyType = this.config.sandboxMode ?? preset.sandbox;
+        ({ approvalPolicy, sandboxPolicyType } = applyPlanModeConstraints(approvalPolicy, sandboxPolicyType, this.planModeEnabled));
         const params = {
             threadId: this.currentThreadId,
             input,
@@ -2634,22 +3534,72 @@ class CodexAppServerAgentSession {
         }
         const turnId = this.createTurnId();
         this.activeForegroundTurnId = turnId;
+        // issue #664 review #3 (gpt-5.5): start with a clean cache. A previous
+        // turn's leftover entry must not be replayed against this new turn.
+        this.pendingFencedTurnStarted = null;
+        // NOTE: the fence is intentionally NOT lifted here. `turn/start` is only a
+        // request; the new turn has not begun until codex starts producing
+        // notifications that we can safely attribute to it. Lifting the fence now
+        // would let a dead turn's late notification, arriving in the gap before
+        // the new turn is identified, be processed against the retry.
+        this.armTurnWatchdog();
         const turnStartT0 = Date.now();
         this.logger.info({ turnId }, "[timing] codex turn/start request sending");
+        // issue #505: from this point until the ack returns, we don't know codex's
+        // turn.id for the new turn, so the fence must drop every turn/started
+        // unconditionally — otherwise a dead turn's late turn/started could race
+        // the ack and be treated as the new turn.
+        this.turnStartAckPending = true;
+        let turnStartResponse;
         try {
-            await this.client.request("turn/start", params, TURN_START_TIMEOUT_MS);
+            turnStartResponse = await this.client.request("turn/start", params, TURN_START_TIMEOUT_MS);
         }
         catch (error) {
             this.logger.info({ turnId, elapsedMs: Date.now() - turnStartT0 }, "[timing] codex turn/start FAILED");
             this.activeForegroundTurnId = null;
+            this.clearTurnWatchdog();
+            this.turnStartAckPending = false;
+            // issue #664 review #3 (gpt-5.5): the RPC threw, so no ack will
+            // arrive to replay a cached turn/started. Drop the cache so a later
+            // unrelated startTurn() can't pick it up.
+            this.pendingFencedTurnStarted = null;
             throw error;
         }
         this.logger.info({ turnId, elapsedMs: Date.now() - turnStartT0 }, "[timing] codex turn/start acknowledged");
+        // issue #505: capture codex's turn.id from the start ack so the fence can
+        // reject a late `turn/started` belonging to a force-failed turn. If the
+        // ack omits `turn.id` (older codex or future schema change), leave this
+        // as null and the fence falls back to the weaker "any turn/started after
+        // a retry lifts the fence" rule — no event flow is hard-locked.
+        const parsedStartId = z
+            .object({ turn: z.object({ id: z.string() }).passthrough() })
+            .passthrough()
+            .safeParse(turnStartResponse);
+        this.expectedCodexTurnId = parsedStartId.success ? parsedStartId.data.turn.id : null;
+        this.turnStartAckPending = false;
         // issue #259: do NOT consume `lastCanceledAt` here. The sentinel is only
         // cleared once we see turn/completed with status "completed" — a
         // turn/start ack can still race with turn/completed: failed, in which
         // case the orphaned prompt is still in the thread and the next retry
         // must carry the reminder (PR #273 review #3).
+        // issue #664 review #3 (gpt-5.5): if codex emitted this turn's
+        // `turn/started` while the ack was still pending, the fence dropped it
+        // and cached it. Now that we know the expected codex turn.id, replay
+        // it through handleNotification — the fence will see
+        // `!turnStartAckPending` and a matching id, lift, and process the
+        // turn_started normally. Without this replay, the new turn would have
+        // no visible turn_started and stall until watchdog. Match by codex
+        // turn.id when we have one; fall back to "any cached turn/started"
+        // when the ack omitted turn.id (matches the looser fence rule above).
+        const cached = this.pendingFencedTurnStarted;
+        this.pendingFencedTurnStarted = null;
+        if (cached) {
+            const idMatches = this.expectedCodexTurnId === null || cached.codexTurnId === this.expectedCodexTurnId;
+            if (idMatches) {
+                this.logger.info({ turnId, codexTurnId: cached.codexTurnId }, "[timing] replaying turn/started that arrived during ack-pending window");
+                this.handleNotification("turn/started", cached.rawParams);
+            }
+        }
         return { turnId };
     }
     subscribe(callback) {
@@ -2732,14 +3682,42 @@ class CodexAppServerAgentSession {
     async respondToPermission(requestId, response) {
         const pending = this.pendingPermissionHandlers.get(requestId);
         if (!pending) {
+            if (this.resolvedPermissionRequests.has(requestId)) {
+                this.emitEvent({
+                    type: "permission_resolved",
+                    provider: CODEX_PROVIDER,
+                    requestId,
+                    resolution: response,
+                });
+                return;
+            }
             throw new Error(`No pending Codex app-server permission request with id '${requestId}'`);
         }
         const pendingRequest = this.pendingPermissions.get(requestId) ?? null;
         if (pending.kind === "plan") {
             let followUpPrompt;
             if (response.behavior === "allow") {
+                const rawEditedPlan = response.updatedInput?.["plan"];
+                const editedPlan = typeof rawEditedPlan === "string" ? rawEditedPlan : undefined;
+                const originalPlan = pending.planText ?? pendingRequest?.metadata?.planText;
+                // When the user edited the plan, re-emit the plan timeline item with the
+                // same callId so the conversation reflects the approved (edited) version
+                // instead of the original proposal. The callId is captured on the pending
+                // handler at request time so this survives a daemon restart (which clears
+                // the in-memory latestPlanResult).
+                const planCallId = pending.planCallId ?? this.latestPlanResult?.callId;
+                if (editedPlan != null && editedPlan !== originalPlan && planCallId) {
+                    const updatedItem = mapCodexPlanToToolCall({
+                        callId: planCallId,
+                        text: editedPlan,
+                    });
+                    if (updatedItem) {
+                        this.rememberPlanResult(updatedItem);
+                        this.emitEvent({ type: "timeline", provider: CODEX_PROVIDER, item: updatedItem });
+                    }
+                }
                 followUpPrompt = this.preparePlanImplementation({
-                    planText: pending.planText ?? pendingRequest?.metadata?.planText,
+                    planText: editedPlan ?? originalPlan,
                 });
             }
             this.pendingPermissionHandlers.delete(requestId);
@@ -2793,12 +3771,32 @@ class CodexAppServerAgentSession {
             resolution: response,
         });
         if (pending.kind === "command") {
-            const decision = response.behavior === "allow" ? "accept" : response.interrupt ? "cancel" : "decline";
+            const decision = pending.protocol === "legacy-review"
+                ? response.behavior === "allow"
+                    ? "approved"
+                    : response.interrupt
+                        ? "abort"
+                        : "denied"
+                : response.behavior === "allow"
+                    ? "accept"
+                    : response.interrupt
+                        ? "cancel"
+                        : "decline";
             pending.resolve({ decision });
             return;
         }
         if (pending.kind === "file") {
-            const decision = response.behavior === "allow" ? "accept" : response.interrupt ? "cancel" : "decline";
+            const decision = pending.protocol === "legacy-review"
+                ? response.behavior === "allow"
+                    ? "approved"
+                    : response.interrupt
+                        ? "abort"
+                        : "denied"
+                : response.behavior === "allow"
+                    ? "accept"
+                    : response.interrupt
+                        ? "cancel"
+                        : "decline";
             pending.resolve({ decision });
             return;
         }
@@ -2860,44 +3858,156 @@ class CodexAppServerAgentSession {
                 model: this.config.model ?? null,
                 thinkingOptionId,
                 extra: this.config.extra,
-                systemPrompt: this.config.systemPrompt,
+                // Persist the pre-injection base so resume re-injects once, not twice.
+                // `systemPromptBase` may be "" (no user base) — coalesce to undefined so we
+                // never persist the daemon-injected value back as the base.
+                systemPrompt: ("systemPromptBase" in this.config
+                    ? this.config.systemPromptBase || undefined
+                    : this.config.systemPrompt) ?? null,
                 mcpServers: this.config.mcpServers,
+                // issue #277: persist the cancel sentinel so a turn/interrupt issued
+                // before resume is still honored after — resume re-reads this into
+                // `lastCanceledAt` so the next turn/start prepends the ignore reminder.
+                // Only emitted when set, keeping the metadata backward-compatible.
+                ...(this.lastCanceledAt !== null ? { lastCanceledAt: this.lastCanceledAt } : {}),
             },
         };
     }
     async interrupt() {
-        if (!this.client || !this.currentThreadId || !this.currentTurnId)
+        if (this.client && this.manualCompactTurnId) {
+            const foregroundTurnId = this.activeForegroundTurnId;
+            if (foregroundTurnId === this.manualCompactTurnId) {
+                this.manualCompactCanceledTurnIds.add(foregroundTurnId);
+                this.emitEvent({ type: "turn_canceled", provider: CODEX_PROVIDER, reason: "interrupted" });
+                this.activeForegroundTurnId = null;
+                this.manualCompactTurnId = null;
+                this.clearTurnWatchdog();
+            }
             return;
-        try {
-            await this.client.request("turn/interrupt", {
-                threadId: this.currentThreadId,
-                turnId: this.currentTurnId,
-            });
-            // issue #259: codex protocol has no thread-truncate RPC, so a canceled
-            // user prompt stays in the thread. The sentinel timestamp is set on the
-            // turn/completed `interrupted` event below (not here), because a
-            // successful turn/interrupt RPC can race with normal completion — if
-            // the model already finished, the prompt has a paired assistant reply
-            // and the next turn must NOT prepend the sentinel.
         }
-        catch (error) {
-            this.logger.warn({ error }, "Failed to interrupt Codex turn");
+        // issue #1418: turn/start ack succeeded but turn/started not yet received
+        // (currentTurnId === null). No codex turnId → skip turn/interrupt RPC and
+        // tear down locally so activeForegroundTurnId is cleared; otherwise it
+        // never clears and every later startTurn() throws "already active".
+        // `!turnStartAckPending` excludes the in-flight ack window: during that
+        // window currentTurnId is also null, but tearing down here would orphan a
+        // real codex turn (the awaited turn/start RPC still resolves and codex runs
+        // it to completion silently). The guard at line below then makes interrupt()
+        // a no-op while the ack is pending, matching isActiveForegroundCodexTurnId
+        // and the fence-lift semantics.
+        if (this.activeForegroundTurnId && !this.currentTurnId && !this.turnStartAckPending) {
+            this.lastCanceledAt = Date.now();
+            this.emitEvent({ type: "turn_canceled", provider: CODEX_PROVIDER, reason: "interrupted" });
+            this.activeForegroundTurnId = null;
+            this.resetForegroundTurnState();
+            return;
+        }
+        if (!this.client || !this.currentThreadId || !this.currentTurnId)
+            return;
+        const threadId = this.currentThreadId;
+        const codexTurnId = this.currentTurnId;
+        const foregroundTurnId = this.activeForegroundTurnId;
+        // issue #664 review (gpt-5.5): send `turn/interrupt` BEFORE tearing
+        // down local state. If the RPC fails or is rejected (transport drop,
+        // codex rejects the cancel, no client connected), codex's old turn is
+        // still running — we must NOT optimistically clear
+        // `activeForegroundTurnId`, open the fence, or set the sentinel,
+        // because doing so would let a new turn start while the old one keeps
+        // streaming and would also fence-drop the old turn's eventual terminal
+        // notification, leaving UI + provider state desynced from codex's
+        // real state. The throw propagates to agent-manager, whose existing
+        // 2s wait + synthetic `turn_canceled` + watchdog handle the failure
+        // path, matching pre-#664 behavior for the RPC-failed case.
+        await this.client.request("turn/interrupt", {
+            threadId,
+            turnId: codexTurnId,
+        });
+        // issue #664: RPC accepted. Now clear provider-side turn state
+        // synchronously instead of waiting for codex to send
+        // `turn/completed (interrupted)` — codex can fail to send it (upstream
+        // cancel-token guard race in codex-rs `tasks/mod.rs:430`), and that's
+        // the specific case this PR is fixing. agent-manager's 2s
+        // force-dispatch synthetic `turn_canceled` only clears agent-manager's
+        // own state, leaving provider's `activeForegroundTurnId` set, so the
+        // next `startTurn()` would throw "A foreground turn is already
+        // active". Aligns with claude provider's `interrupt()`, which also
+        // drops state synchronously (via `requestCancel`) once the cancel
+        // request has been issued.
+        //
+        // Guard against the RPC await racing a real `turn/completed` (the
+        // happy path where codex DID emit a terminal notification): if
+        // `handleNotification` already cleared `activeForegroundTurnId` or
+        // moved on to a new turn while we awaited, don't double-teardown.
+        if (foregroundTurnId && this.activeForegroundTurnId === foregroundTurnId) {
+            // issue #259 + #664: optimistically set the sentinel. PR #664's
+            // whole point is that codex can fail to send `turn/completed
+            // (interrupted)`. If we waited for that notification, the
+            // lost-notification path would leave the orphaned user prompt in
+            // the thread without the next turn warning the model to ignore it.
+            // The race-aware override stays in `handleNotification`: if codex
+            // actually won the race and reports `turn/completed
+            // status=completed`, the fenced branch clears this back to null so
+            // the next turn does NOT carry a stale sentinel.
+            //
+            // issue #277: set this BEFORE the synchronous `emitEvent` below so the
+            // `turn_canceled`-driven `finalizeForegroundTurn` snapshot persists the
+            // sentinel; otherwise describePersistence would capture the stale null.
+            this.lastCanceledAt = Date.now();
+            // Emit `turn_canceled` BEFORE clearing `activeForegroundTurnId`:
+            // `notifySubscribers` reads `activeForegroundTurnId` to tag the event
+            // with `turnId`, so consumers can correlate the cancel back to the
+            // foreground turn it terminates. Mirrors `forceFailActiveTurn`'s
+            // ordering for the same reason.
+            this.emitEvent({ type: "turn_canceled", provider: CODEX_PROVIDER, reason: "interrupted" });
+            this.activeForegroundTurnId = null;
+            // Fence drops any late `turn/completed` / trailing items for this
+            // turn so we don't emit a second terminal event (which would be
+            // tagged with the *new* foreground turn's id and incorrectly
+            // finalize it). Lifted by the next `turn/started`. The fence still
+            // allows the issue #259 sentinel bookkeeping inside
+            // `handleNotification`, so codex's turn/completed status
+            // (interrupted vs completed — the race winner) can still override
+            // the optimistic sentinel set above if codex won the race.
+            this.resetForegroundTurnState();
         }
     }
     async close() {
         for (const pending of this.pendingPermissionHandlers.values()) {
-            pending.resolve({ decision: "cancel" });
+            pending.resolve({ decision: pending.protocol === "legacy-review" ? "abort" : "cancel" });
         }
         this.pendingPermissionHandlers.clear();
         this.pendingPermissions.clear();
         this.resolvedPermissionRequests.clear();
         this.subscribers.clear();
         this.activeForegroundTurnId = null;
+        this.clearTurnWatchdog();
+        this.turnWatchdogInflightCycles = 0;
+        this.turnWatchdogCompactionCycles = 0;
+        this.lastTurnNotificationTime = null;
+        this.lastReconnectMarkerKey = null;
+        this.fencedAfterForcedFailure = false;
+        this.fencedTurnId = null;
+        this.expectedCodexTurnId = null;
+        this.turnStartAckPending = false;
+        this.pendingFencedTurnStarted = null;
+        this.inFlightToolCalls.clear();
+        this.compactionInFlight.clear();
+        this.clearCompactionItemWatchdogs();
+        this.cancelAgentMessageFlush();
+        this.pendingAgentMessages.clear();
+        this.emittedAgentMessageLength.clear();
+        this.pendingReasoning.clear();
+        this.terminalCommandByProcessId.clear();
+        this.emittedTerminalInteractionKeys.clear();
+        this.pendingUnlabeledTerminalInteractions.clear();
         if (this.client) {
             await this.client.dispose();
         }
         this.client = null;
         this.connected = false;
+        this.codexVersion = null;
+        this.manualCompactTurnId = null;
+        this.manualCompactCanceledTurnIds.clear();
         this.currentThreadId = null;
         this.currentTurnId = null;
     }
@@ -2914,7 +4024,128 @@ class CodexAppServerAgentSession {
             description: skill.description,
             argumentHint: "",
         }));
-        return [...appServerSkills, ...prompts].sort((a, b) => a.name.localeCompare(b.name));
+        const builtins = [
+            ...(this.supportsManualCompact() ? [COMPACT_COMMAND] : []),
+            ...(this.goalsEnabled ? [GOAL_COMMAND] : []),
+        ];
+        return [...builtins, ...appServerSkills, ...prompts].sort((a, b) => a.name.localeCompare(b.name));
+    }
+    // issue #1012: whether codex's `thread/compact/start` RPC is available, based
+    // on the version captured from the `initialize` handshake. Unknown version
+    // (older codex / handshake without userAgent) → don't expose `/compact`.
+    supportsManualCompact() {
+        return (this.codexVersion !== null &&
+            isVersionAtLeast(this.codexVersion, CODEX_MANUAL_COMPACT_MIN_VERSION));
+    }
+    async tryHandleOutOfBand(prompt) {
+        if (!this.goalsEnabled || typeof prompt !== "string") {
+            return null;
+        }
+        const parsed = this.parseSlashCommandInput(prompt);
+        if (!parsed || parsed.commandName !== GOAL_COMMAND_NAME) {
+            return null;
+        }
+        const subcommand = parseGoalSubcommand(parsed.args);
+        const text = formatOutOfBandStatusMessage(await this.executeGoalSubcommand(subcommand));
+        return { handled: true, response: text };
+    }
+    async executeGoalSubcommand(subcommand) {
+        if (subcommand.kind === "usage") {
+            return "用法：/goal <objective>|pause|resume|clear";
+        }
+        try {
+            await this.connect();
+            if (this.currentThreadId) {
+                await this.ensureThreadLoaded();
+            }
+            else if (subcommand.kind === "set") {
+                await this.ensureThread();
+            }
+            else {
+                return "没有活动目标可操作。";
+            }
+            if (!this.client || !this.currentThreadId) {
+                throw new Error("Codex 会话不可用");
+            }
+            switch (subcommand.kind) {
+                case "set":
+                    await this.client.request("thread/goal/set", {
+                        threadId: this.currentThreadId,
+                        objective: subcommand.objective,
+                        status: "active",
+                    });
+                    return `已设置目标：${subcommand.objective}`;
+                case "pause":
+                    await this.client.request("thread/goal/set", {
+                        threadId: this.currentThreadId,
+                        status: "paused",
+                    });
+                    return "目标已暂停。";
+                case "resume":
+                    await this.client.request("thread/goal/set", {
+                        threadId: this.currentThreadId,
+                        status: "active",
+                    });
+                    return "目标已恢复。";
+                case "clear":
+                    await this.client.request("thread/goal/clear", {
+                        threadId: this.currentThreadId,
+                    });
+                    return "目标已清除。";
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "未知错误";
+            return `更新目标失败：${message}`;
+        }
+    }
+    // issue #1012: run a manual context compaction. `thread/compact/start` is a
+    // standalone RPC, not a turn, so codex emits no `turn/started` / `turn/completed`
+    // for it — we synthesize those here (mirrors claude's `executeRewindTurn`) so the
+    // UI leaves the "thinking" state. The `contextCompaction` thread item streams in
+    // independently and renders the compaction marker (#999 watchdog defer applies).
+    async executeManualCompact(turnId) {
+        this.manualCompactTurnId = turnId;
+        this.emitEvent({ type: "turn_started", provider: CODEX_PROVIDER });
+        try {
+            if (!this.client) {
+                throw new Error("Codex client not initialized");
+            }
+            if (this.currentThreadId) {
+                await this.ensureThreadLoaded();
+            }
+            else {
+                await this.ensureThread();
+            }
+            if (!this.currentThreadId) {
+                throw new Error("没有可压缩的会话上下文");
+            }
+            await this.client.request("thread/compact/start", { threadId: this.currentThreadId });
+            if (this.manualCompactCanceledTurnIds.has(turnId)) {
+                return;
+            }
+            this.emitEvent({ type: "turn_completed", provider: CODEX_PROVIDER });
+        }
+        catch (error) {
+            if (this.manualCompactCanceledTurnIds.has(turnId)) {
+                return;
+            }
+            this.emitEvent({
+                type: "turn_failed",
+                provider: CODEX_PROVIDER,
+                error: error instanceof Error ? error.message : "手动压缩失败",
+            });
+        }
+        finally {
+            this.manualCompactCanceledTurnIds.delete(turnId);
+            if (this.manualCompactTurnId === turnId) {
+                this.manualCompactTurnId = null;
+            }
+            if (this.activeForegroundTurnId === turnId) {
+                this.activeForegroundTurnId = null;
+                this.clearTurnWatchdog();
+            }
+        }
     }
     async ensureThread() {
         if (!this.client)
@@ -2952,8 +4183,9 @@ class CodexAppServerAgentSession {
         this.config.model = model;
         this.config.thinkingOptionId = thinkingOptionId;
         const preset = MODE_PRESETS[this.currentMode] ?? MODE_PRESETS[DEFAULT_CODEX_MODE_ID];
-        const approvalPolicy = this.config.approvalPolicy ?? preset.approvalPolicy;
-        const sandbox = this.config.sandboxMode ?? preset.sandbox;
+        let approvalPolicy = this.config.approvalPolicy ?? preset.approvalPolicy;
+        let sandbox = this.config.sandboxMode ?? preset.sandbox;
+        ({ approvalPolicy, sandboxPolicyType: sandbox } = applyPlanModeConstraints(approvalPolicy, sandbox, this.planModeEnabled));
         const innerConfig = this.buildCodexInnerConfig();
         const response = (await this.client.request("thread/start", {
             model,
@@ -2973,16 +4205,66 @@ class CodexAppServerAgentSession {
     }
     buildCodexInnerConfig() {
         const innerConfig = {};
+        // The daemon-owned seawork builtin (if present) is auto-approved + given a
+        // long tool timeout. We build it separately and re-assert it AFTER the
+        // extra.codex merge below, so a raw `extra.codex.mcp_servers.seawork`
+        // override can never replace the trusted builtin with an auto-approved
+        // attacker-controlled MCP. The `seawork` key itself is already reserved for
+        // the builtin upstream (agent-manager.applySeaworkMcp).
+        let seaworkBuiltin;
         if (this.config.mcpServers) {
             const mcpServers = {};
             for (const [name, serverConfig] of Object.entries(this.config.mcpServers)) {
-                mcpServers[name] = toCodexMcpConfig(serverConfig);
+                const mapped = toCodexMcpConfig(serverConfig);
+                if (name === SEAWORK_BUILTIN_MCP_NAME) {
+                    // generation_task blocks while a video/3d task renders; codex aborts
+                    // MCP tools/call after DEFAULT_TOOL_TIMEOUT (120s), so raise the limit.
+                    mapped.tool_timeout_sec = SEAWORK_MCP_TOOL_TIMEOUT_SEC;
+                    // Auto-approve ONLY the safe SeaArt generation tools (per-tool, never
+                    // server-wide). Under the default "auto" mode + "on-request" policy
+                    // codex routes each call to an approval prompt with no interactive
+                    // approver, which resolves to "user rejected MCP tool call". The same
+                    // builtin server also exposes high-impact agent/terminal/schedule/
+                    // permission tools that MUST keep their approval gate, so a blanket
+                    // default_tools_approval_mode would be an over-broad bypass.
+                    mapped.tools = Object.fromEntries(SEAWORK_AUTO_APPROVE_TOOLS.map((tool) => [tool, { approval_mode: "approve" }]));
+                    seaworkBuiltin = mapped;
+                }
+                mcpServers[name] = mapped;
             }
             innerConfig.mcp_servers = mcpServers;
         }
+        // issue #973: tighten codex's auto-compaction threshold. Scope MUST stay
+        // "body_after_prefix" (codex's default) — that is the only branch that reads
+        // our injected `model_auto_compact_token_limit`. The "total" scope ignores
+        // the config value entirely and only consults the per-model window-derived
+        // limit (codex-rs/core/src/session/turn.rs:664-684), so setting it would
+        // silently disable this fix. Set the defaults before the extra.codex merge so
+        // an explicit override still wins.
+        innerConfig.model_auto_compact_token_limit = CODEX_AUTO_COMPACT_TOKEN_LIMIT;
+        innerConfig.model_auto_compact_token_limit_scope = "body_after_prefix";
         if (this.config.extra?.codex) {
             Object.assign(innerConfig, this.config.extra.codex);
         }
+        // Enforce the reserved-name invariant after the extra.codex merge (a shallow
+        // Object.assign that could replace the whole mcp_servers map). The `seawork`
+        // key must ALWAYS be the daemon-owned builtin or absent — never an
+        // extra.codex-supplied entry, which could carry default_tools_approval_mode
+        // "approve". When a builtin exists, force it back; when none exists
+        // (no mcpBaseUrl / injection disabled), drop any `seawork` extra.codex set.
+        if (seaworkBuiltin) {
+            // Builtin exists → always restore it, even if extra.codex set
+            // mcp_servers to null/garbage (which would otherwise drop it).
+            const mergedMcp = readStringRecord(innerConfig.mcp_servers);
+            mergedMcp[SEAWORK_BUILTIN_MCP_NAME] = seaworkBuiltin;
+            innerConfig.mcp_servers = mergedMcp;
+        }
+        else if (innerConfig.mcp_servers) {
+            // No builtin → strip any `seawork` an extra.codex override smuggled in.
+            const mergedMcp = readStringRecord(innerConfig.mcp_servers);
+            delete mergedMcp[SEAWORK_BUILTIN_MCP_NAME];
+            innerConfig.mcp_servers = mergedMcp;
+        }
         return Object.keys(innerConfig).length > 0 ? innerConfig : null;
     }
     async buildUserInput(prompt) {
@@ -3013,13 +4295,358 @@ class CodexAppServerAgentSession {
         }
         return [{ type: "text", text: CANCEL_REMINDER_TEXT }, ...input];
     }
+    // Tag a turn failure with the gateway request id captured from codex's
+    // stderr when the message doesn't already carry one (status errors include
+    // `request id:` themselves; stream disconnects do not). The app's
+    // system-error parser reads this `request id: <id>` token.
+    //
+    // `lastResponsesRequestId` is scraped from codex's `Request completed` debug
+    // line, which codex only logs once a response HEADER has arrived. A
+    // mid-stream disconnect therefore has the failing request's own id (correct
+    // to append). But an `error sending request` failure happens in the SEND
+    // phase — no response header, no `Request completed` line — so the scraped id
+    // still points at the PREVIOUS, successful request. Appending it there
+    // mislabels the error with an unrelated id that looks failed but resolves to
+    // a 200 in gateway logs (issues #914/#862: one successful id `de0a34fc…`
+    // surfaced in unrelated disconnect reports). Don't append in that case.
+    appendRequestId(error) {
+        if (/request id:/i.test(error))
+            return error;
+        if (/error sending request/i.test(error))
+            return error;
+        const requestId = typeof this.client?.getLastResponsesRequestId === "function"
+            ? this.client.getLastResponsesRequestId()
+            : null;
+        return requestId ? `${error} (request id: ${requestId})` : error;
+    }
+    buildTurnFailedDiagnostic(error) {
+        const stderrTail = typeof this.client?.getRecentStderrTail === "function"
+            ? this.client.getRecentStderrTail()?.trim()
+            : undefined;
+        if (!stderrTail) {
+            return undefined;
+        }
+        const normalizedError = error
+            .trim()
+            .replace(/^\d{4}-\d{2}-\d{2}T\S+\s+/gm, "")
+            .replace(/^[A-Z]+\s+/gm, "")
+            .trim();
+        const normalizedStderr = stderrTail
+            .replace(/^\d{4}-\d{2}-\d{2}T\S+\s+/gm, "")
+            .replace(/^[A-Z]+\s+/gm, "")
+            .trim();
+        if (normalizedStderr === normalizedError || normalizedStderr.endsWith(normalizedError)) {
+            return undefined;
+        }
+        return stderrTail;
+    }
     emitEvent(event) {
-        if (event.type === "timeline") {
-            if (event.item.type === "assistant_message") {
-                this.pendingAgentMessages.clear();
+        // Note: assistant-message buffers (`pendingAgentMessages`) are NOT cleared
+        // here. Streaming now emits multiple `assistant_message` timeline items
+        // per message, so an emit-driven clear would wipe the buffer mid-stream.
+        // Buffers are instead cleared per-itemId at `item_completed` and fully on
+        // turn teardown.
+        this.notifySubscribers(event);
+    }
+    clearCompactionItemWatchdogs() {
+        for (const timer of this.compactionItemTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.compactionItemTimers.clear();
+    }
+    clearCompactionItemWatchdog(itemId) {
+        const timer = this.compactionItemTimers.get(itemId);
+        if (timer) {
+            clearTimeout(timer);
+            this.compactionItemTimers.delete(itemId);
+        }
+    }
+    armCompactionItemWatchdog(itemId) {
+        this.clearCompactionItemWatchdog(itemId);
+        const timer = setTimeout(() => {
+            this.compactionItemTimers.delete(itemId);
+            if (!this.compactionInFlight.delete(itemId)) {
+                return;
+            }
+            this.logger.warn({ itemId, timeoutMs: COMPACTION_ITEM_WATCHDOG_MS }, "Codex context compaction completion missing; closing timeline marker");
+            this.emitEvent({
+                type: "timeline",
+                provider: CODEX_PROVIDER,
+                item: { type: "compaction", status: "completed", trigger: "auto" },
+            });
+        }, COMPACTION_ITEM_WATCHDOG_MS);
+        timer.unref?.();
+        this.compactionItemTimers.set(itemId, timer);
+    }
+    // issue #1824: a completed `/responses` HTTP round-trip is upstream activity
+    // that emits no protocol notification, so the watchdog would otherwise force-
+    // fail a turn that is genuinely uploading/streaming. Treat it exactly like a
+    // notification: re-arm and cancel any pending late-completion force-fail.
+    markUpstreamLiveness() {
+        if (!this.activeForegroundTurnId)
+            return;
+        this.clearPendingForceFail();
+        this.lastTurnNotificationTime = Date.now();
+        this.armTurnWatchdog();
+    }
+    // issue #505: the turn lifecycle relies entirely on codex sending a
+    // `turn/completed` notification. If that notification is lost, the turn
+    // never finalizes and the UI stays "thinking" forever. The watchdog is
+    // re-armed on every notification for the active turn, so a healthy turn
+    // never trips it; a turn that goes fully silent is force-completed.
+    //
+    // `deferred` distinguishes a re-arm by the watchdog itself (silence
+    // continuing) from a reset by a genuine notification — only the latter
+    // clears the in-flight grace counter.
+    armTurnWatchdog(deferred = false) {
+        this.clearTurnWatchdog();
+        if (!deferred) {
+            this.turnWatchdogInflightCycles = 0;
+            this.turnWatchdogCompactionCycles = 0;
+        }
+        this.turnWatchdogTimer = setTimeout(() => {
+            this.turnWatchdogTimer = null;
+            const pendingPermissionsForActiveTurn = this.countPendingPermissionsForActiveTurn();
+            if (pendingPermissionsForActiveTurn > 0) {
+                this.logger.debug({
+                    pendingPermissions: pendingPermissionsForActiveTurn,
+                    totalPendingPermissions: this.pendingPermissionHandlers.size,
+                }, "Codex turn watchdog deferred: waiting for permission response");
+                this.armTurnWatchdog(true);
+                return;
+            }
+            // A long, output-silent tool (build, slow network call) is NOT a lost
+            // turn — codex will still send its completion. Grant it a bounded number
+            // of extra idle cycles. The bound matters: if the tool's *completion*
+            // notification is itself lost, an unbounded re-arm would recreate the
+            // exact "stuck thinking forever" bug, just keyed on a lost tool event.
+            if (this.inFlightToolCalls.size > 0 &&
+                this.turnWatchdogInflightCycles < TURN_WATCHDOG_MAX_INFLIGHT_CYCLES) {
+                this.turnWatchdogInflightCycles += 1;
+                this.logger.debug({ inFlight: this.inFlightToolCalls.size, cycle: this.turnWatchdogInflightCycles }, "Codex turn watchdog deferred: tool execution still in flight");
+                this.armTurnWatchdog(true);
+                return;
+            }
+            // issue #999: auto-compaction (pack ~240K-token context + an LLM
+            // summarization call) is a legitimate long, turn-event-silent operation,
+            // not a lost turn. Defer like an in-flight tool, with a wider but still
+            // bounded budget so a lost compaction completion still recovers.
+            if (this.compactionInFlight.size > 0 &&
+                this.turnWatchdogCompactionCycles < TURN_WATCHDOG_MAX_COMPACTION_CYCLES) {
+                this.turnWatchdogCompactionCycles += 1;
+                this.logger.debug({
+                    compactionInFlight: this.compactionInFlight.size,
+                    cycle: this.turnWatchdogCompactionCycles,
+                }, "Codex turn watchdog deferred: context compaction in flight");
+                this.armTurnWatchdog(true);
+                return;
             }
+            // issue #1181: the timer may fire long after the last notification arrived
+            // because other agents starved the event loop. Re-check the real idle gap;
+            // if a notification arrived < IDLE_MS ago, re-arm instead of false-failing.
+            if (this.lastTurnNotificationTime !== null) {
+                const idleSinceMs = Date.now() - this.lastTurnNotificationTime;
+                if (idleSinceMs < TURN_WATCHDOG_IDLE_MS) {
+                    this.armTurnWatchdog(true);
+                    return;
+                }
+            }
+            const stallError = "Codex turn stalled (no events received); recovered by watchdog";
+            const context = [
+                `pendingPermissions=${pendingPermissionsForActiveTurn}`,
+                `watchdogCycles inflight=${this.turnWatchdogInflightCycles} compaction=${this.turnWatchdogCompactionCycles}`,
+                `sinceLastNotification=${this.lastTurnNotificationTime !== null ? Date.now() - this.lastTurnNotificationTime : "unknown"}ms`,
+            ].join("\n");
+            // issue #1427: do not force-fail yet. Give a late-but-successful
+            // turn/completed a short grace window to land — committing now is what
+            // mis-kills it. armPendingForceFail commits only if the turn is still the
+            // active foreground turn (i.e. no completion arrived) when the window
+            // elapses; any notification in between clears the pending timer.
+            this.armPendingForceFail(stallError, context);
+        }, TURN_WATCHDOG_IDLE_MS);
+        this.turnWatchdogTimer.unref?.();
+    }
+    // issue #1427: arm the grace timer that decides whether a stalled turn is
+    // really dead or just slow to deliver its completion. Snapshots the turn id at
+    // schedule time; on fire, only commits the force-fail if that same turn is
+    // still active (a completion that arrived during the window finalizes the turn
+    // and clears activeForegroundTurnId, so the snapshot no longer matches).
+    armPendingForceFail(stallError, context) {
+        this.clearPendingForceFail();
+        const turnIdAtSchedule = this.activeForegroundTurnId;
+        if (!turnIdAtSchedule) {
+            return;
         }
-        this.notifySubscribers(event);
+        this.pendingForceFailTimer = setTimeout(() => {
+            this.pendingForceFailTimer = null;
+            if (this.activeForegroundTurnId !== turnIdAtSchedule) {
+                // A turn/completed (or interrupt/new turn) landed during the grace
+                // window and already finalized this turn — the watchdog mis-fired. Do
+                // not emit turn_failed.
+                this.logger.debug({ turnId: turnIdAtSchedule, graceMs: WATCHDOG_LATE_COMPLETION_GRACE_MS }, "Codex watchdog stand-down: turn completed within late-completion grace window");
+                return;
+            }
+            const stderrTail = this.buildTurnFailedDiagnostic(stallError);
+            const graceNote = `lateCompletionGraceMs=${WATCHDOG_LATE_COMPLETION_GRACE_MS}`;
+            const diagnostic = `${context}\n${graceNote}`;
+            this.forceFailActiveTurn(stallError, stderrTail ? `${diagnostic}\n${stderrTail}` : diagnostic);
+        }, WATCHDOG_LATE_COMPLETION_GRACE_MS);
+        this.pendingForceFailTimer.unref?.();
+    }
+    clearPendingForceFail() {
+        if (this.pendingForceFailTimer) {
+            clearTimeout(this.pendingForceFailTimer);
+            this.pendingForceFailTimer = null;
+        }
+    }
+    // Stops the timers only. The in-flight grace counter is reset by a
+    // non-deferred armTurnWatchdog() (a real notification) and by turn teardown,
+    // so a deferred re-arm — which calls this first — keeps its accumulated count.
+    // issue #1427: also drops a pending late-completion force-fail. Safe across a
+    // deferred re-arm: those paths return before arming a pending force-fail, and
+    // the force-fail-committing path arms its grace timer *after* the last
+    // clearTurnWatchdog() in the same tick, so this never kills the timer it set.
+    clearTurnWatchdog() {
+        if (this.turnWatchdogTimer) {
+            clearTimeout(this.turnWatchdogTimer);
+            this.turnWatchdogTimer = null;
+        }
+        this.clearPendingForceFail();
+    }
+    countPendingPermissionsForActiveTurn() {
+        const foregroundTurnId = this.activeForegroundTurnId;
+        if (!foregroundTurnId) {
+            return 0;
+        }
+        let count = 0;
+        for (const pending of this.pendingPermissionHandlers.values()) {
+            if (pending.foregroundTurnId !== foregroundTurnId) {
+                continue;
+            }
+            if (pending.codexTurnId && !this.isActiveForegroundCodexTurnId(pending.codexTurnId)) {
+                continue;
+            }
+            count += 1;
+        }
+        return count;
+    }
+    // Tear down provider-side foreground turn state after a cancel/fail. Fences
+    // any late notification for the (now cleared) turn. Does not emit, set
+    // `lastCanceledAt`, clear pending permissions, or touch
+    // `activeForegroundTurnId` — callers own those.
+    resetForegroundTurnState() {
+        this.fencedAfterForcedFailure = true;
+        // issue #1836: headline case — the turn/start ack returned codex's turn.id
+        // (expectedCodexTurnId) but turn/started never arrived, so currentTurnId is
+        // still null. Fall back to expectedCodexTurnId so the fenced id is non-null
+        // and the self-heal guard (fencedTurnId !== null) can fire.
+        this.fencedTurnId = this.currentTurnId ?? this.expectedCodexTurnId;
+        this.currentTurnId = null;
+        this.expectedCodexTurnId = null;
+        this.turnStartAckPending = false;
+        this.pendingFencedTurnStarted = null;
+        this.clearTurnWatchdog();
+        this.turnWatchdogInflightCycles = 0;
+        this.turnWatchdogCompactionCycles = 0;
+        this.lastTurnNotificationTime = null;
+        // issue #1836: default the fence to "not from force-fail" so the interrupt
+        // callers leave self-heal disabled; `forceFailActiveTurn` re-sets these two
+        // right after calling this. Clearing the stored id here also stops a prior
+        // force-fail's id leaking into a later interrupt fence.
+        this.fencedByForceFail = false;
+        this.lastForcedFailForegroundTurnId = null;
+        // issue #1427: drop the reconnect-marker dedup key on turn teardown so the
+        // next stall re-announces.
+        this.lastReconnectMarkerKey = null;
+        this.inFlightToolCalls.clear();
+        this.compactionInFlight.clear();
+        this.clearCompactionItemWatchdogs();
+        this.cancelAgentMessageFlush();
+        this.pendingAgentMessages.clear();
+        this.emittedAgentMessageLength.clear();
+    }
+    // issue #505: force-fail the active foreground turn (watchdog stall or
+    // process exit). Emits `turn_failed`, then fences the turn so any late
+    // notification — a delayed `turn/completed`, a trailing terminal item — is
+    // dropped instead of resurfacing a turn the UI already saw fail. The fence
+    // is lifted once we see a safely attributable retry-turn notification.
+    forceFailActiveTurn(error, diagnostic) {
+        if (!this.activeForegroundTurnId)
+            return;
+        const turnId = this.activeForegroundTurnId;
+        this.logger.warn({ turnId, error }, "Codex force-failing turn");
+        this.clearTurnWatchdog();
+        // emitEvent tags the event with activeForegroundTurnId, so emit before clearing.
+        this.emitEvent({ type: "turn_failed", provider: CODEX_PROVIDER, error, diagnostic });
+        this.clearPendingPermissionsForTurn(turnId);
+        this.activeForegroundTurnId = null;
+        this.resetForegroundTurnState();
+        // issue #1836: mark this fence as force-fail (so self-heal may resurrect it)
+        // and remember the local turn id so a self-heal resumes under the same id
+        // (preserving turn-event accounting). Set AFTER resetForegroundTurnState,
+        // which clears both for the interrupt callers that share it.
+        this.fencedByForceFail = true;
+        this.lastForcedFailForegroundTurnId = turnId;
+    }
+    handleClientExit(reason) {
+        this.client = null;
+        this.connected = false;
+        this.clearTurnWatchdog();
+        this.forceFailActiveTurn(`Codex process exited: ${reason}`);
+        this.currentTurnId = null;
+    }
+    clearPendingPermissionsForTurn(turnId) {
+        for (const [requestId, pending] of this.pendingPermissionHandlers.entries()) {
+            if (pending.foregroundTurnId !== turnId) {
+                continue;
+            }
+            this.pendingPermissionHandlers.delete(requestId);
+            this.pendingPermissions.delete(requestId);
+            this.resolvedPermissionRequests.add(requestId);
+            if (pending.kind === "question") {
+                pending.resolve({ answers: {} });
+                continue;
+            }
+            pending.resolve({ decision: pending.protocol === "legacy-review" ? "abort" : "cancel" });
+        }
+    }
+    /**
+     * Emit any not-yet-streamed tail of an in-flight agent message as an
+     * `assistant_message` timeline delta. Throttled (~60ms) so a fast token
+     * stream does not produce one timeline event — and one client setState —
+     * per token. The UI coalesces consecutive `assistant_message` items into a
+     * single growing bubble (see app `appendAssistantMessage`).
+     */
+    flushAgentMessageDelta(itemId) {
+        this.agentMessageFlushPendingItemId = itemId;
+        if (this.agentMessageFlushTimer)
+            return;
+        this.agentMessageFlushTimer = setTimeout(() => {
+            this.agentMessageFlushTimer = null;
+            const id = this.agentMessageFlushPendingItemId;
+            this.agentMessageFlushPendingItemId = null;
+            if (!id)
+                return;
+            const full = this.pendingAgentMessages.get(id) ?? "";
+            const emitted = this.emittedAgentMessageLength.get(id) ?? 0;
+            const chunk = full.slice(emitted);
+            if (chunk.length === 0)
+                return;
+            this.emittedAgentMessageLength.set(id, full.length);
+            this.emitEvent({
+                type: "timeline",
+                provider: CODEX_PROVIDER,
+                item: { type: "assistant_message", text: chunk },
+            });
+        }, 60);
+    }
+    /** Cancel a pending streaming flush (turn teardown / cancel / close). */
+    cancelAgentMessageFlush() {
+        if (this.agentMessageFlushTimer) {
+            clearTimeout(this.agentMessageFlushTimer);
+            this.agentMessageFlushTimer = null;
+        }
+        this.agentMessageFlushPendingItemId = null;
     }
     notifySubscribers(event) {
         const turnId = this.activeForegroundTurnId;
@@ -3038,6 +4665,130 @@ class CodexAppServerAgentSession {
     }
     handleNotification(method, params) {
         const parsed = CodexNotificationSchema.parse({ method, params });
+        // issue #505: after a turn was force-failed, drop every late notification
+        // for that turn — a delayed `turn/completed`, a trailing terminal item —
+        // so it cannot resurface a turn the UI already saw fail.
+        //
+        // `turn/started` lifts the fence only when it belongs to the post-retry
+        // turn. Three states for the new turn's `turn/start` ack:
+        //   * pending (`turnStartAckPending=true`): activeForegroundTurnId is set
+        //     but the ack has not returned, so we do NOT yet know codex's turn.id
+        //     for the new turn. Drop unconditionally — a turn/started arriving in
+        //     this window belongs to a dead turn racing the ack.
+        //   * returned with `turn.id` captured: require the incoming id to match
+        //     `expectedCodexTurnId`. Mismatched ids stay fenced.
+        //   * returned without `turn.id` (older codex / schema drift): fall back
+        //     to the weaker "any turn/started after retry lifts the fence" rule.
+        //     Strictly worse than the matched-id path, but does NOT hard-lock the
+        //     retry forever.
+        if (this.fencedAfterForcedFailure) {
+            const isFreshTurnStarted = parsed.kind === "turn_started" &&
+                this.activeForegroundTurnId !== null &&
+                !this.turnStartAckPending &&
+                (this.expectedCodexTurnId === null || parsed.turnId === this.expectedCodexTurnId);
+            const isFreshTurnContinuation = this.isCurrentRetryTurnNotification(parsed);
+            if (isFreshTurnStarted || isFreshTurnContinuation) {
+                this.fencedAfterForcedFailure = false;
+                this.fencedTurnId = null;
+            }
+            else {
+                // issue #259 + #664: even though we drop the notification (no emit,
+                // no state mutation), codex's `turn/completed` for the fenced turn
+                // still carries the authoritative interrupted-vs-completed race
+                // outcome. Update only `lastCanceledAt` so the next `turn/start`
+                // either prepends the ignore-sentinel (codex confirmed the cancel)
+                // or starts clean (codex won the race and naturally completed).
+                if (parsed.kind === "turn_completed") {
+                    const before = this.lastCanceledAt;
+                    if (parsed.status === "interrupted") {
+                        this.lastCanceledAt = Date.now();
+                    }
+                    else if (parsed.status === "completed") {
+                        this.lastCanceledAt = null;
+                    }
+                    // issue #277 (gpt-5.5 review): this fenced path emits no terminal
+                    // event, so `finalizeForegroundTurn` never re-snapshots persistence.
+                    // Without this, a race the codex side won (sentinel cleared to null)
+                    // would leave the optimistic non-null `lastCanceledAt` in the
+                    // persisted handle, and a resume within CANCEL_REMINDER_WINDOW_MS
+                    // would wrongly prepend the ignore reminder for a turn that actually
+                    // completed. Re-emit `thread_started` (same threadId, no UI side
+                    // effect — manager only re-reads describePersistence) to persist the
+                    // authoritative sentinel state.
+                    if (this.lastCanceledAt !== before && this.currentThreadId) {
+                        this.emitEvent({
+                            type: "thread_started",
+                            provider: CODEX_PROVIDER,
+                            sessionId: this.currentThreadId,
+                        });
+                    }
+                }
+                // issue #664 review #3 (gpt-5.5): if this is a `turn/started`
+                // arriving inside the `turn/start` ack-pending window for a
+                // post-interrupt retry, cache it. We don't yet know the new turn's
+                // codex turn.id (the ack hasn't returned), so we can't safely lift
+                // the fence here. startTurn()'s ack handler will replay this
+                // notification once `expectedCodexTurnId` is set, so the new turn
+                // doesn't lose its only `turn/started` and stall until watchdog.
+                if (parsed.kind === "turn_started" &&
+                    this.activeForegroundTurnId !== null &&
+                    this.turnStartAckPending) {
+                    this.pendingFencedTurnStarted = {
+                        codexTurnId: parsed.turnId,
+                        rawParams: params,
+                    };
+                }
+                // issue #1836: a force-fail is a purely local action — codex was not
+                // told to abort, so it keeps emitting for the old turn. If that turn is
+                // demonstrably still making progress (an item started or assistant text
+                // streaming) and no retry has begun, the force-fail was a misfire (e.g.
+                // watchdog mis-killed a live turn). Self-heal by un-fencing and resuming
+                // the old turn instead of dropping its events forever, which would leave
+                // the UI permanently blank. `fencedByForceFail` gates this to watchdog
+                // force-fails only — a user interrupt/cancel also fences and must never
+                // be resurrected.
+                const isProgress = parsed.kind === "item_started" || parsed.kind === "agent_message_delta";
+                const notifTurnId = this.parsedNotificationTurnId(parsed);
+                if (this.fencedByForceFail &&
+                    isProgress &&
+                    this.activeForegroundTurnId === null &&
+                    !this.turnStartAckPending &&
+                    this.fencedTurnId !== null &&
+                    notifTurnId === this.fencedTurnId) {
+                    this.logger.warn({ fencedTurnId: this.fencedTurnId }, "Codex fence self-heal: progress after force-fail; resuming turn");
+                    this.activeForegroundTurnId = this.lastForcedFailForegroundTurnId ?? this.createTurnId();
+                    this.lastForcedFailForegroundTurnId = null;
+                    this.fencedByForceFail = false;
+                    this.currentTurnId = this.fencedTurnId;
+                    this.fencedAfterForcedFailure = false;
+                    this.fencedTurnId = null;
+                    this.lastTurnNotificationTime = Date.now();
+                    this.armTurnWatchdog();
+                    this.handleNotification(method, params);
+                    return;
+                }
+                this.logger.debug({ method }, "Dropping late Codex notification for force-failed turn");
+                return;
+            }
+        }
+        // issue #505: any notification proves the turn is still alive; re-arm the
+        // stall watchdog so only a genuinely silent turn ever trips it.
+        // issue #1427: it also cancels a pending late-completion force-fail — the
+        // turn is demonstrably alive, so the grace window's verdict is moot. A
+        // turn/completed during the window finalizes the turn below (clearing
+        // activeForegroundTurnId); any other notification just proves liveness and
+        // re-arms the normal 5min watchdog.
+        if (this.activeForegroundTurnId) {
+            this.clearPendingForceFail();
+            this.lastTurnNotificationTime = Date.now();
+            this.armTurnWatchdog();
+        }
+        // issue #1427: a real (non-reconnect) notification after a reconnect marker
+        // means the stream is flowing again — close the loading marker so the UI
+        // stops showing "Reconnecting…".
+        if (parsed.kind !== "stream_retrying") {
+            this.resolveReconnectMarker();
+        }
         if (parsed.kind === "thread_started") {
             this.currentThreadId = parsed.threadId;
             this.emitEvent({
@@ -3048,24 +4799,49 @@ class CodexAppServerAgentSession {
             return;
         }
         if (parsed.kind === "turn_started") {
+            this.fencedTurnId = null;
             this.currentTurnId = parsed.turnId;
+            if (typeof this.client?.resetLastResponsesRequestId === "function") {
+                this.client.resetLastResponsesRequestId();
+            }
+            if (typeof this.client?.resetRecentStderrTail === "function") {
+                this.client.resetRecentStderrTail();
+            }
             this.latestPlanResult = null;
             this.emittedItemStartedIds.clear();
             this.emittedItemCompletedIds.clear();
             this.emittedExecCommandStartedCallIds.clear();
             this.emittedExecCommandCompletedCallIds.clear();
+            this.inFlightToolCalls.clear();
+            this.compactionInFlight.clear();
+            this.clearCompactionItemWatchdogs();
             this.pendingCommandOutputDeltas.clear();
             this.pendingFileChangeOutputDeltas.clear();
             this.warnedIncompleteEditToolCallIds.clear();
+            this.lastTurnNotificationTime = null;
+            this.cancelAgentMessageFlush();
+            this.pendingAgentMessages.clear();
+            this.emittedAgentMessageLength.clear();
+            // Reasoning buffers are per-itemId and already consumed at
+            // item_completed, so a per-turn sweep is safe and catches items that
+            // never reach item_completed (interrupted/failed turns). We do NOT
+            // clear terminalCommandByProcessId / emittedTerminalInteractionKeys
+            // here: codex terminal sessions (and their stdin-dedup keys) can span
+            // turns, so those are only cleared on close() to avoid losing
+            // cross-turn command labels / re-emitting deduped interactions.
+            this.pendingReasoning.clear();
             this.emitEvent({ type: "turn_started", provider: CODEX_PROVIDER });
             return;
         }
         if (parsed.kind === "turn_completed") {
+            this.fencedTurnId = null;
             if (parsed.status === "failed") {
+                const error = this.appendRequestId(parsed.errorMessage ?? "Codex turn failed");
                 this.emitEvent({
                     type: "turn_failed",
                     provider: CODEX_PROVIDER,
-                    error: parsed.errorMessage ?? "Codex turn failed",
+                    error,
+                    diagnostic: this.buildTurnFailedDiagnostic(error),
                 });
             }
             else if (parsed.status === "interrupted") {
@@ -3095,14 +4871,24 @@ class CodexAppServerAgentSession {
                 });
             }
             this.activeForegroundTurnId = null;
+            this.clearTurnWatchdog();
             this.latestPlanResult = null;
             this.emittedItemStartedIds.clear();
             this.emittedItemCompletedIds.clear();
             this.emittedExecCommandStartedCallIds.clear();
             this.emittedExecCommandCompletedCallIds.clear();
+            this.inFlightToolCalls.clear();
+            this.compactionInFlight.clear();
+            this.clearCompactionItemWatchdogs();
             this.pendingCommandOutputDeltas.clear();
             this.pendingFileChangeOutputDeltas.clear();
             this.warnedIncompleteEditToolCallIds.clear();
+            this.cancelAgentMessageFlush();
+            this.pendingAgentMessages.clear();
+            this.emittedAgentMessageLength.clear();
+            // See turn_started: only the per-item reasoning buffers are safe to
+            // sweep per-turn; terminal session maps persist until close().
+            this.pendingReasoning.clear();
             return;
         }
         if (parsed.kind === "plan_updated") {
@@ -3141,9 +4927,32 @@ class CodexAppServerAgentSession {
             }
             return;
         }
+        if (parsed.kind === "stream_retrying") {
+            // Non-terminal: codex is auto-retrying a dropped response stream. The
+            // shared "any notification re-arms the watchdog" path above already kept
+            // the turn alive; here we only surface a UI notice so a slow reconnect
+            // does not look frozen. Dedupe to one marker per (attempt) so the paired
+            // warning + error(willRetry) for the same attempt collapse into one.
+            const attemptKey = `${parsed.attempt ?? ""}/${parsed.maxAttempts ?? ""}`;
+            if (this.lastReconnectMarkerKey !== attemptKey) {
+                this.lastReconnectMarkerKey = attemptKey;
+                this.emitEvent({
+                    type: "timeline",
+                    provider: CODEX_PROVIDER,
+                    item: {
+                        type: "reconnecting",
+                        status: "loading",
+                        attempt: parsed.attempt ?? undefined,
+                        maxAttempts: parsed.maxAttempts ?? undefined,
+                    },
+                });
+            }
+            return;
+        }
         if (parsed.kind === "agent_message_delta") {
             const prev = this.pendingAgentMessages.get(parsed.itemId) ?? "";
             this.pendingAgentMessages.set(parsed.itemId, prev + parsed.delta);
+            this.flushAgentMessageDelta(parsed.itemId);
             return;
         }
         if (parsed.kind === "reasoning_delta") {
@@ -3158,6 +4967,10 @@ class CodexAppServerAgentSession {
             });
             return;
         }
+        if (parsed.kind === "command_execution_output_delta") {
+            this.appendOutputDeltaChunk(this.pendingCommandOutputDeltas, parsed.itemId, parsed.delta);
+            return;
+        }
         if (parsed.kind === "file_change_output_delta") {
             this.appendOutputDeltaChunk(this.pendingFileChangeOutputDeltas, parsed.itemId, parsed.delta);
             return;
@@ -3165,6 +4978,7 @@ class CodexAppServerAgentSession {
         if (parsed.kind === "exec_command_started") {
             if (parsed.callId) {
                 this.emittedExecCommandStartedCallIds.add(parsed.callId);
+                this.inFlightToolCalls.add(parsed.callId);
                 this.pendingCommandOutputDeltas.delete(parsed.callId);
             }
             const timelineItem = mapCodexExecNotificationToToolCall({
@@ -3179,6 +4993,9 @@ class CodexAppServerAgentSession {
             return;
         }
         if (parsed.kind === "exec_command_completed") {
+            if (parsed.callId) {
+                this.inFlightToolCalls.delete(parsed.callId);
+            }
             const bufferedOutput = this.consumeOutputDelta(this.pendingCommandOutputDeltas, parsed.callId);
             const resolvedOutput = parsed.output ?? bufferedOutput;
             this.rememberTerminalProcessForCommand(parsed.command, resolvedOutput);
@@ -3206,7 +5023,7 @@ class CodexAppServerAgentSession {
             const command = (parsed.processId ? this.terminalCommandByProcessId.get(parsed.processId) : undefined) ??
                 null;
             if (!command && parsed.processId) {
-                this.pendingUnlabeledTerminalInteractions.add(parsed.processId);
+                addBounded(this.pendingUnlabeledTerminalInteractions, parsed.processId, TERMINAL_SESSION_MAP_MAX);
             }
             const timelineItem = mapCodexTerminalInteractionToToolCall({
                 processId: parsed.processId,
@@ -3218,6 +5035,7 @@ class CodexAppServerAgentSession {
         }
         if (parsed.kind === "patch_apply_started") {
             if (parsed.callId) {
+                this.inFlightToolCalls.add(parsed.callId);
                 this.pendingFileChangeOutputDeltas.delete(parsed.callId);
             }
             const timelineItem = mapCodexPatchNotificationToToolCall({
@@ -3236,6 +5054,9 @@ class CodexAppServerAgentSession {
             return;
         }
         if (parsed.kind === "patch_apply_completed") {
+            if (parsed.callId) {
+                this.inFlightToolCalls.delete(parsed.callId);
+            }
             const bufferedOutput = this.consumeOutputDelta(this.pendingFileChangeOutputDeltas, parsed.callId);
             const timelineItem = mapCodexPatchNotificationToToolCall({
                 callId: parsed.callId,
@@ -3273,6 +5094,10 @@ class CodexAppServerAgentSession {
                 this.emitEvent({ type: "timeline", provider: CODEX_PROVIDER, item: timelineItem });
                 if (itemId) {
                     this.emittedItemCompletedIds.add(itemId);
+                    if (timelineItem.type === "compaction") {
+                        this.compactionInFlight.delete(itemId);
+                        this.clearCompactionItemWatchdog(itemId);
+                    }
                 }
             }
             return;
@@ -3298,14 +5123,38 @@ class CodexAppServerAgentSession {
                     if (callId && this.emittedExecCommandCompletedCallIds.has(callId)) {
                         return;
                     }
+                    if (callId) {
+                        const bufferedOutput = this.consumeOutputDelta(this.pendingCommandOutputDeltas, callId);
+                        if (bufferedOutput &&
+                            timelineItem.detail.type === "shell" &&
+                            (timelineItem.detail.output == null ||
+                                bufferedOutput.length > timelineItem.detail.output.length)) {
+                            timelineItem.detail.output = bufferedOutput;
+                        }
+                    }
                 }
                 if (itemId && this.emittedItemCompletedIds.has(itemId)) {
                     return;
                 }
+                // True once a streamed message has been fully emitted via deltas, so
+                // the final `item_completed` emit would only duplicate it.
+                let assistantFullyStreamed = false;
                 if (timelineItem.type === "assistant_message" && itemId) {
-                    const buffered = this.pendingAgentMessages.get(itemId);
-                    if (buffered && buffered.length > 0) {
-                        timelineItem.text = buffered;
+                    const buffered = this.pendingAgentMessages.get(itemId) ?? "";
+                    // `item_completed`'s text is codex's authoritative final text.
+                    // Take whichever of (final text, accumulated deltas) is longer:
+                    // they should match, but a dropped delta leaves `buffered` short,
+                    // and the final item then backfills the missing tail.
+                    const fullText = timelineItem.text.length >= buffered.length ? timelineItem.text : buffered;
+                    const emitted = this.emittedAgentMessageLength.get(itemId) ?? 0;
+                    if (emitted > 0) {
+                        // Streamed already: emit only the un-streamed tail.
+                        timelineItem.text = fullText.slice(emitted);
+                        assistantFullyStreamed = timelineItem.text.length === 0;
+                    }
+                    else {
+                        // Never streamed (no deltas seen): emit the full text.
+                        timelineItem.text = fullText;
                     }
                 }
                 if (timelineItem.type === "reasoning" && itemId) {
@@ -3320,12 +5169,33 @@ class CodexAppServerAgentSession {
                     }
                     this.warnOnIncompleteEditToolCall(timelineItem, "item_completed", parsed.item);
                 }
-                this.emitEvent({ type: "timeline", provider: CODEX_PROVIDER, item: timelineItem });
+                // Skip the emit when the assistant message was fully delivered via
+                // streaming deltas (avoids a duplicate / empty bubble), but still run
+                // the bookkeeping below so completion state stays consistent.
+                if (!assistantFullyStreamed) {
+                    this.emitEvent({ type: "timeline", provider: CODEX_PROVIDER, item: timelineItem });
+                }
                 if (itemId) {
                     this.emittedItemCompletedIds.add(itemId);
                     this.emittedItemStartedIds.delete(itemId);
+                    this.inFlightToolCalls.delete(itemId);
+                    // issue #999: compaction finished — let the watchdog resume normal
+                    // silence monitoring.
+                    this.compactionInFlight.delete(itemId);
+                    this.clearCompactionItemWatchdog(itemId);
                     this.pendingCommandOutputDeltas.delete(itemId);
                     this.pendingFileChangeOutputDeltas.delete(itemId);
+                    // Per-itemId buffer cleanup — replaces the old emit-driven full
+                    // `pendingAgentMessages.clear()` that streaming made unsafe.
+                    this.pendingAgentMessages.delete(itemId);
+                    this.emittedAgentMessageLength.delete(itemId);
+                    // The buffered reasoning deltas were already consumed at line ~5289
+                    // above. Drop them here too, mirroring the sibling per-item buffers:
+                    // gpt-5.x reasoning is voluminous, and without this the array of
+                    // every reasoning delta leaks for the whole agent lifetime, slowly
+                    // driving the worker to a V8 heap OOM on long multi-agent sessions
+                    // (#1058, #1298, #1188, #1124, #1082).
+                    this.pendingReasoning.delete(itemId);
                 }
             }
             return;
@@ -3354,10 +5224,31 @@ class CodexAppServerAgentSession {
                 this.emitEvent({ type: "timeline", provider: CODEX_PROVIDER, item: timelineItem });
                 if (itemId) {
                     this.emittedItemStartedIds.add(itemId);
+                    this.inFlightToolCalls.add(itemId);
                     this.pendingCommandOutputDeltas.delete(itemId);
                     this.pendingFileChangeOutputDeltas.delete(itemId);
                 }
             }
+            else if (timelineItem && timelineItem.type === "compaction") {
+                // issue #999: codex's auto-compaction starts a turn-event-silent
+                // operation. Track it so the watchdog defers instead of force-failing,
+                // and surface a "loading" marker (the app reducer pairs it with the
+                // later `item_completed` "completed", so it stays a single row).
+                const itemId = parsed.item.id;
+                if (itemId && this.emittedItemStartedIds.has(itemId)) {
+                    return;
+                }
+                this.compactionInFlight.add(itemId ?? "<no-id>");
+                this.armCompactionItemWatchdog(itemId ?? "<no-id>");
+                this.emitEvent({
+                    type: "timeline",
+                    provider: CODEX_PROVIDER,
+                    item: { ...timelineItem, status: "loading" },
+                });
+                if (itemId) {
+                    this.emittedItemStartedIds.add(itemId);
+                }
+            }
             return;
         }
         if (parsed.kind === "invalid_payload") {
@@ -3366,6 +5257,20 @@ class CodexAppServerAgentSession {
         }
         this.warnUnknownNotificationMethod(parsed.method, parsed.params);
     }
+    // issue #1427: close an open "reconnecting" loading marker by emitting its
+    // completed counterpart, then clear the dedup key. No-op when no marker is
+    // open. Used when real turn progress resumes after a reconnect.
+    resolveReconnectMarker() {
+        if (this.lastReconnectMarkerKey === null) {
+            return;
+        }
+        this.lastReconnectMarkerKey = null;
+        this.emitEvent({
+            type: "timeline",
+            provider: CODEX_PROVIDER,
+            item: { type: "reconnecting", status: "completed" },
+        });
+    }
     warnUnknownNotificationMethod(method, params) {
         if (this.warnedUnknownNotificationMethods.has(method)) {
             return;
@@ -3419,7 +5324,7 @@ class CodexAppServerAgentSession {
         if (!processId) {
             return;
         }
-        this.terminalCommandByProcessId.set(processId, displayCommand);
+        setBounded(this.terminalCommandByProcessId, processId, displayCommand, TERMINAL_SESSION_MAP_MAX);
         if (!this.pendingUnlabeledTerminalInteractions.has(processId)) {
             return;
         }
@@ -3437,7 +5342,7 @@ class CodexAppServerAgentSession {
         if (this.emittedTerminalInteractionKeys.has(key)) {
             return false;
         }
-        this.emittedTerminalInteractionKeys.add(key);
+        addBounded(this.emittedTerminalInteractionKeys, key, TERMINAL_SESSION_MAP_MAX);
         return true;
     }
     warnOnIncompleteEditToolCall(item, source, payload) {
@@ -3460,7 +5365,7 @@ class CodexAppServerAgentSession {
     }
     shouldAutoAcceptToolApprovals() {
         const preset = MODE_PRESETS[this.currentMode] ?? MODE_PRESETS[DEFAULT_CODEX_MODE_ID];
-        const approvalPolicy = this.config.approvalPolicy ?? preset.approvalPolicy;
+        const { approvalPolicy } = applyPlanModeConstraints(this.config.approvalPolicy ?? preset.approvalPolicy, this.config.sandboxMode ?? preset.sandbox, this.planModeEnabled);
         return approvalPolicy === "never";
     }
     handleCommandApprovalRequest(params) {
@@ -3487,14 +5392,8 @@ class CodexAppServerAgentSession {
                 command: parsed.command ?? undefined,
                 cwd: parsed.cwd ?? undefined,
             },
-            detail: commandPreview?.detail ?? {
-                type: "unknown",
-                input: {
-                    command: parsed.command ?? null,
-                    cwd: parsed.cwd ?? null,
-                },
-                output: null,
-            },
+            detail: commandPreview?.detail ??
+                buildExecFallbackDetail(parsed.command ?? null, parsed.cwd ?? this.config.cwd ?? null),
             metadata: {
                 itemId: parsed.itemId,
                 threadId: parsed.threadId,
@@ -3504,7 +5403,65 @@ class CodexAppServerAgentSession {
         this.pendingPermissions.set(requestId, request);
         this.emitEvent({ type: "permission_requested", provider: CODEX_PROVIDER, request });
         return new Promise((resolve) => {
-            this.pendingPermissionHandlers.set(requestId, { resolve, kind: "command" });
+            this.pendingPermissionHandlers.set(requestId, {
+                resolve,
+                kind: "command",
+                foregroundTurnId: this.foregroundTurnIdForCodexPermission(parsed.turnId),
+                codexTurnId: parsed.turnId,
+            });
+        });
+    }
+    handleLegacyExecCommandApprovalRequest(params) {
+        const parsed = params;
+        if (this.shouldAutoAcceptToolApprovals()) {
+            return Promise.resolve({ decision: "approved" });
+        }
+        const requestKey = parsed.approvalId ?? parsed.callId;
+        const requestId = `permission-${requestKey}`;
+        const commandValue = Array.isArray(parsed.command) && parsed.command.length > 0
+            ? parsed.command
+            : parsed.command == null
+                ? null
+                : String(parsed.command);
+        const commandPreview = mapCodexExecNotificationToToolCall({
+            callId: parsed.callId,
+            command: commandValue,
+            cwd: parsed.cwd ?? this.config.cwd ?? null,
+            running: true,
+        });
+        const commandText = Array.isArray(commandValue)
+            ? commandValue.join(" ")
+            : typeof commandValue === "string"
+                ? commandValue
+                : null;
+        const request = {
+            id: requestId,
+            provider: CODEX_PROVIDER,
+            name: "CodexBash",
+            kind: "tool",
+            title: commandText ? `Run command: ${commandText}` : "Run command",
+            description: parsed.reason ?? undefined,
+            input: {
+                command: commandValue ?? undefined,
+                cwd: parsed.cwd ?? undefined,
+            },
+            detail: commandPreview?.detail ??
+                buildExecFallbackDetail(commandValue ?? null, parsed.cwd ?? this.config.cwd ?? null),
+            metadata: {
+                itemId: parsed.callId,
+                approvalId: parsed.approvalId ?? null,
+                threadId: parsed.conversationId ?? null,
+            },
+        };
+        this.pendingPermissions.set(requestId, request);
+        this.emitEvent({ type: "permission_requested", provider: CODEX_PROVIDER, request });
+        return new Promise((resolve) => {
+            this.pendingPermissionHandlers.set(requestId, {
+                resolve,
+                kind: "command",
+                foregroundTurnId: this.foregroundTurnIdForLegacyPermission(),
+                protocol: "legacy-review",
+            });
         });
     }
     handleFileChangeApprovalRequest(params) {
@@ -3536,7 +5493,59 @@ class CodexAppServerAgentSession {
         this.pendingPermissions.set(requestId, request);
         this.emitEvent({ type: "permission_requested", provider: CODEX_PROVIDER, request });
         return new Promise((resolve) => {
-            this.pendingPermissionHandlers.set(requestId, { resolve, kind: "file" });
+            this.pendingPermissionHandlers.set(requestId, {
+                resolve,
+                kind: "file",
+                foregroundTurnId: this.foregroundTurnIdForCodexPermission(parsed.turnId),
+                codexTurnId: parsed.turnId,
+            });
+        });
+    }
+    handleLegacyApplyPatchApprovalRequest(params) {
+        const parsed = params;
+        if (this.shouldAutoAcceptToolApprovals()) {
+            return Promise.resolve({ decision: "approved" });
+        }
+        const requestId = `permission-${parsed.callId}`;
+        const patchPreview = mapCodexPatchNotificationToToolCall({
+            callId: parsed.callId,
+            changes: parsed.fileChanges,
+            cwd: this.config.cwd ?? null,
+            running: true,
+        });
+        const request = {
+            id: requestId,
+            provider: CODEX_PROVIDER,
+            name: "CodexFileChange",
+            kind: "tool",
+            title: "Apply file changes",
+            description: parsed.reason ?? undefined,
+            input: {
+                fileChanges: parsed.fileChanges ?? undefined,
+                grantRoot: parsed.grantRoot ?? undefined,
+            },
+            detail: patchPreview?.detail ?? {
+                type: "unknown",
+                input: {
+                    fileChanges: parsed.fileChanges ?? null,
+                    grantRoot: parsed.grantRoot ?? null,
+                },
+                output: null,
+            },
+            metadata: {
+                itemId: parsed.callId,
+                threadId: parsed.conversationId ?? null,
+            },
+        };
+        this.pendingPermissions.set(requestId, request);
+        this.emitEvent({ type: "permission_requested", provider: CODEX_PROVIDER, request });
+        return new Promise((resolve) => {
+            this.pendingPermissionHandlers.set(requestId, {
+                resolve,
+                kind: "file",
+                foregroundTurnId: this.foregroundTurnIdForLegacyPermission(),
+                protocol: "legacy-review",
+            });
         });
     }
     handleToolApprovalRequest(params) {
@@ -3578,6 +5587,8 @@ class CodexAppServerAgentSession {
             this.pendingPermissionHandlers.set(requestId, {
                 resolve,
                 kind: "question",
+                foregroundTurnId: this.foregroundTurnIdForCodexPermission(parsed.turnId),
+                codexTurnId: parsed.turnId,
                 questions,
             });
         });
@@ -3592,6 +5603,24 @@ export class CodexAppServerAgentClient {
         this.runtimeSettings = runtimeSettings;
         this.provider = CODEX_PROVIDER;
         this.capabilities = CODEX_APP_SERVER_CAPABILITIES;
+        this.goalsEnabledPromise = null;
+    }
+    // codex `goals` feature gate. Determined once per client (version probe is a
+    // separate `--version` spawn) and cached, so create/resume don't each probe.
+    //
+    // The cache is keyed at the client level (one `CodexAppServerAgentClient`
+    // per provider, constructed once from static `runtimeSettings`). The binary
+    // that gets probed here is resolved from `runtimeSettings.command` /
+    // `runtimeSettings.env.PATH` — the same path that `spawnAppServer` uses at
+    // launch time. `launchContext.env` (injected per-session by agent-manager)
+    // only carries `SEAWORK_AGENT_ID`, which is a runtime identifier and has no
+    // effect on binary resolution, so the cached result stays consistent with
+    // the actual spawn.
+    resolveGoalsEnabled() {
+        if (!this.goalsEnabledPromise) {
+            this.goalsEnabledPromise = this.resolveCodexVersion().then(({ version }) => isVersionAtLeast(version, CODEX_GOALS_MIN_VERSION), () => false);
+        }
+        return this.goalsEnabledPromise;
     }
     async spawnAppServer(options) {
         const launchPrefix = await resolveCodexLaunchPrefix(this.runtimeSettings, this.logger);
@@ -3600,10 +5629,18 @@ export class CodexAppServerAgentClient {
         }, "Spawning Codex app server");
         const launchEnv = options?.launchEnv;
         const codexEnv = buildCodexAppServerEnv(this.runtimeSettings, launchEnv);
+        const managedCodexHome = await prepareManagedCodexHome({
+            env: codexEnv,
+            logger: this.logger,
+        });
+        if (managedCodexHome) {
+            codexEnv.CODEX_HOME = managedCodexHome;
+        }
         this.logger.info({
             hasOpenaiKey: !!codexEnv.OPENAI_API_KEY,
             openaiKeyPrefix: codexEnv.OPENAI_API_KEY?.slice(0, 10) ?? null,
             openaiBaseUrl: codexEnv.OPENAI_BASE_URL ?? null,
+            managedCodexHome,
         }, "Codex app-server env check");
         // If a Seawork-managed base URL is available, inject a "seawork" provider
         // via -c flags to override any user config.
@@ -3612,13 +5649,14 @@ export class CodexAppServerAgentClient {
         const seaworkProvider = readStringRecord(readStringRecord(seaworkConfig?.model_providers)[CODEX_SEAWORK_PROVIDER_ID]);
         const seaworkBaseUrl = readStringMetadata(seaworkProvider.base_url);
         if (seaworkConfig && seaworkBaseUrl) {
-            extraArgs.push("-c", `model_provider="${CODEX_SEAWORK_PROVIDER_ID}"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.name="Seawork"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.base_url="${seaworkBaseUrl}"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.env_key="SEAWORK_API_KEY"`, "--disable", "js_repl");
+            extraArgs.push("-c", `model_provider="${CODEX_SEAWORK_PROVIDER_ID}"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.name="Seawork"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.base_url="${seaworkBaseUrl}"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.env_key="SEAWORK_API_KEY"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.http_headers."${SEAWORK_AGENT_PROVIDER_HEADER_NAME}"="${CODEX_PROVIDER}"`, "-c", `model_providers.${CODEX_SEAWORK_PROVIDER_ID}.http_headers."${SEAWORK_SOURCE_HEADER_NAME}"="${SEAWORK_SOURCE_HEADER_VALUE}"`, "--disable", "js_repl");
         }
         let command = launchPrefix.command;
         let fullArgs = [
             ...launchPrefix.args,
             "app-server",
             ...(options?.enableExternalMigration ? ["--enable", "external_migration"] : []),
+            ...(options?.enableGoals ? ["--enable", "goals"] : []),
             ...extraArgs,
         ];
         let runtimeKind = "default";
@@ -3739,13 +5777,20 @@ export class CodexAppServerAgentClient {
         // Falling back to process.env.CODEX_HOME would silently break setups that
         // override CODEX_HOME via provider runtimeSettings.env.
         const spawnEnv = buildCodexAppServerEnv(this.runtimeSettings, input.launchContext?.env);
-        const codexHome = readStringMetadata(spawnEnv.CODEX_HOME) ?? path.join(os.homedir(), ".codex");
+        const managedCodexHome = await prepareManagedCodexHome({
+            env: spawnEnv,
+            logger: this.logger,
+        });
+        const codexHome = managedCodexHome ??
+            readStringMetadata(spawnEnv.CODEX_HOME) ??
+            path.join(os.homedir(), ".codex");
         this.logger.info({
             sourceProvider: input.source.provider,
             sourceSessionId: input.source.sessionId,
             sourcePath,
             sourceCwd,
             codexHome,
+            managedCodexHome,
         }, "Codex external migration: starting import");
         // Short-circuit: codex's `externalAgentConfig/detect` deliberately omits
         // sessions it has already imported (dedup against the ledger). If we
@@ -3923,7 +5968,8 @@ export class CodexAppServerAgentClient {
     }
     async createSession(config, launchContext) {
         const sessionConfig = withManagedCodexConfig({ ...config, provider: CODEX_PROVIDER }, this.runtimeSettings, launchContext?.env);
-        const session = new CodexAppServerAgentSession(sessionConfig, null, this.logger, () => this.spawnAppServer({ launchEnv: launchContext?.env }));
+        const goalsEnabled = await this.resolveGoalsEnabled();
+        const session = new CodexAppServerAgentSession(sessionConfig, null, this.logger, () => this.spawnAppServer({ launchEnv: launchContext?.env, enableGoals: goalsEnabled }), goalsEnabled);
         await session.connect();
         return session;
     }
@@ -3937,7 +5983,8 @@ export class CodexAppServerAgentClient {
             modeId: overrides?.modeId ?? storedConfig.modeId ?? "auto",
         };
         const sessionConfig = withManagedCodexConfig(merged, this.runtimeSettings, launchContext?.env);
-        const session = new CodexAppServerAgentSession(sessionConfig, handle, this.logger, () => this.spawnAppServer({ launchEnv: launchContext?.env }));
+        const goalsEnabled = await this.resolveGoalsEnabled();
+        const session = new CodexAppServerAgentSession(sessionConfig, handle, this.logger, () => this.spawnAppServer({ launchEnv: launchContext?.env, enableGoals: goalsEnabled }), goalsEnabled);
         await session.connect();
         return session;
     }
@@ -3955,26 +6002,32 @@ export class CodexAppServerAgentClient {
                 const threadId = thread.id;
                 const cwd = thread.cwd ?? process.cwd();
                 const title = thread.preview ?? null;
+                // Loading a timeline costs a `thread/read` round-trip plus a rollout
+                // file parse per thread. The daemon discards it unless the caller
+                // passed `includeTimeline`, so skip the work entirely otherwise —
+                // listing 20 threads would otherwise blow past the client timeout.
                 let timeline = [];
-                try {
-                    const rolloutTimeline = await loadCodexPersistedTimeline(threadId, undefined, this.logger);
-                    const read = (await client.request("thread/read", {
-                        threadId,
-                        includeTurns: true,
-                    }));
-                    const turns = read.thread?.turns ?? [];
-                    const itemsFromThreadRead = [];
-                    for (const turn of turns) {
-                        for (const item of turn.items ?? []) {
-                            const timelineItem = threadItemToTimeline(item, { cwd });
-                            if (timelineItem)
-                                itemsFromThreadRead.push(timelineItem);
+                if (options?.includeTimeline) {
+                    try {
+                        const rolloutTimeline = await loadCodexPersistedTimeline(threadId, undefined, this.logger);
+                        const read = (await client.request("thread/read", {
+                            threadId,
+                            includeTurns: true,
+                        }));
+                        const turns = read.thread?.turns ?? [];
+                        const itemsFromThreadRead = [];
+                        for (const turn of turns) {
+                            for (const item of turn.items ?? []) {
+                                const timelineItem = threadItemToTimeline(item, { cwd });
+                                if (timelineItem)
+                                    itemsFromThreadRead.push(timelineItem);
+                            }
                         }
+                        timeline = rolloutTimeline.length > 0 ? rolloutTimeline : itemsFromThreadRead;
+                    }
+                    catch {
+                        timeline = [];
                     }
-                    timeline = rolloutTimeline.length > 0 ? rolloutTimeline : itemsFromThreadRead;
-                }
-                catch {
-                    timeline = [];
                 }
                 descriptors.push({
                     provider: CODEX_PROVIDER,
@@ -4002,33 +6055,41 @@ export class CodexAppServerAgentClient {
             await client.dispose();
         }
     }
+    async loadPersistedTimeline(handle) {
+        const metadata = handle.metadata ?? {};
+        const threadId = readStringMetadata(metadata.threadId) ??
+            readStringMetadata(handle.nativeHandle) ??
+            handle.sessionId;
+        const sessionRoot = readStringMetadata(metadata.sessionRoot);
+        const rolloutPath = readStringMetadata(metadata.rolloutPath);
+        return loadCodexPersistedTimeline(threadId, {
+            ...(sessionRoot ? { sessionRoot } : {}),
+            ...(rolloutPath ? { rolloutPath } : {}),
+        }, this.logger);
+    }
     async listModels(_options) {
         return getSeaworkModels("codex");
     }
     async isAvailable() {
         try {
-            // Same selector daemon spawn uses, so UI availability matches actual
-            // launch behavior. We always run `verifyCommandAvailable` against
-            // the resolved binary — without that check `install-state-stale`
-            // (recorded path that's now missing/broken) and unhealthy PATH
-            // candidates would still report Available even though daemon spawn
-            // would fail immediately. The bare-name semantics of
-            // `verifyCommandAvailable` cover `command-override` cases like
-            // `argv=["docker", ...]` while still rejecting paths that don't
-            // exist or aren't executable.
+            // Mirror the daemon spawn path exactly: resolve the binary with the
+            // same selector, then check it is launchable. `verifyCommandAvailable`
+            // covers `command-override` bare names (`argv=["docker", ...]`) and
+            // rejects paths that don't exist or aren't executable — the only
+            // gates daemon spawn itself would care about.
             //
-            // `installStateRejected` is set by the resolver when an unhealthy
-            // recorded install OR an unhealthy PATH candidate was selected as
-            // a last-resort. Trust the probe verdict and report unavailable
-            // rather than letting `verifyCommandAvailable` (file-existence
-            // only) accept a fake/stale shim that just happens to be
-            // launchable. Diagnostic still surfaces the path + reason for
-            // troubleshooting.
+            // We deliberately do NOT short-circuit on `selection.installStateRejected`.
+            // That field is set when the `codex --help` health probe rejects the
+            // candidate (stale install-state, fake/echo shim, OR transient probe
+            // timeout on a slow Windows host / AV-scanned binary). Daemon spawn
+            // doesn't gate on that probe, so neither should UI availability —
+            // otherwise a transient probe timeout silently hides every codex
+            // model from the selector while daemon could still spawn codex fine
+            // (issue #479). For genuine fake-shim cases, the real spawn surfaces
+            // the error directly; `getDiagnostic` still reports the probe
+            // verdict for troubleshooting.
             const spawnEnv = buildCodexAppServerEnv(this.runtimeSettings);
             const selection = await selectEffectiveCodexBinary(this.runtimeSettings, { spawnEnv });
-            if (selection.installStateRejected) {
-                return false;
-            }
             return await verifyCommandAvailable(selection.binary, { spawnEnv });
         }
         catch {
@@ -4121,9 +6182,11 @@ export class CodexAppServerAgentClient {
     }
 }
 export const __codexAppServerInternals = {
+    buildManagedCodexConfigToml,
     buildCodexAppServerEnv,
     buildCodexSeaworkProviderConfig,
     codexModelSupportsFastMode,
+    CodexAppServerClient,
     CodexAppServerAgentSession,
     listCodexSkillEntries,
     formatCodexQuestionPrompts,
@@ -4132,10 +6195,17 @@ export const __codexAppServerInternals = {
     mapCodexQuestionRequestToToolCall,
     mapCodexPatchNotificationToToolCall,
     planStepsToMarkdown,
+    prepareManagedCodexHome,
     mapCodexPlanToToolCall,
     normalizeCodexOutputSchema,
     normalizeCodexQuestionPrompts,
+    summarizeJsonRpcParamsForLog,
     toAgentUsage,
     threadItemToTimeline,
+    TURN_WATCHDOG_IDLE_MS,
+    WATCHDOG_LATE_COMPLETION_GRACE_MS,
+    TURN_WATCHDOG_MAX_INFLIGHT_CYCLES,
+    TURN_WATCHDOG_MAX_COMPACTION_CYCLES,
+    COMPACTION_ITEM_WATCHDOG_MS,
 };
 //# sourceMappingURL=codex-app-server-agent.js.map