@skaile/workspaces 3.16.2 → 3.18.0

package/dist/{chunk-I3COVVFB.js → chunk-RJOGAEIY.js}

@@ -1,22 +1,27 @@
-import { WorkspacePlugin } from './chunk-GRVSSAAQ.js';
+import { buildWorkspaceToolDefs } from './chunk-QEZPFJX3.js';
+import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
+import { WorkspacePlugin } from './chunk-2IROGAS7.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
-import { resolveFlowPath } from './chunk-DUMD4AA2.js';
-import { findAiAssetsRoot, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-EXT2LNST.js';
-import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-5KSIVLOX.js';
-import { EventNormalizer } from './chunk-PBRMY64S.js';
+import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-T3YLZQS4.js';
+import { resolveFlowPath } from './chunk-FYVDBIZV.js';
+import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-SH7GXS7V.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-5T7Y3AZU.js';
+import { EventNormalizer } from './chunk-CQY7XKRV.js';
 import { SUPPORTED_CLOUDS, probeResumeTranscript, CLOUD_SECRET_ENV_KEYS } from './chunk-3NCGSSCU.js';
+import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
+import { dispatchCapability } from './chunk-7ZO3MUP3.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver } from './chunk-FRER2PEN.js';
-import { loadFlow } from './chunk-BQMRUH7J.js';
-import { parseFlowDefinition } from './chunk-HY6CIKFH.js';
+import { createDriver } from './chunk-J7VSUGGH.js';
+import { loadFlow } from './chunk-SFCVAEJ5.js';
+import { parseFlowDefinition } from './chunk-CP62G5PK.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
-import { PROTOCOL_VERSION } from './chunk-2KBA5OO2.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-CIPK5JMJ.js';
+import { PROTOCOL_VERSION } from './chunk-23L3P7IB.js';
+import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-H662SXKS.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveRuntimeAssets } from './chunk-OIDFK7SG.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-OZ7UNMTK.js';
+import { resolveRuntimeAssets } from './chunk-DCG4UWJM.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-RPVTPVGX.js';
 import { withFsDeadline, fsDeadlineMs, FsDeadlineError, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink } from './chunk-FTG7CRFD.js';
@@ -25,15 +30,19 @@ import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import fs4, { readFile, stat, rm, unlink, mkdir, writeFile, readdir, rename } from 'fs/promises';
+import fs4, { readFile, stat, rm, unlink, mkdir, writeFile, readdir, rename, realpath, mkdtemp, lstat } from 'fs/promises';
+import { createHash, randomBytes, timingSafeEqual, randomUUID } from 'crypto';
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, rmSync } from 'fs';
+import { existsSync, lstatSync, realpathSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, constants, rmSync } from 'fs';
 import { homedir } from 'os';
-import * as z5 from 'zod';
+import * as z7 from 'zod';
 import { z } from 'zod';
-import { createHash, randomUUID } from 'crypto';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
+import { createServer } from 'http';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { parse } from 'yaml';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
@@ -190,11 +199,11 @@ var MarkdownStreamer = class {
   }
 };
 function defineCapability(args) {
-  const inputSchema = z5.toJSONSchema(args.input, {
+  const inputSchema = z7.toJSONSchema(args.input, {
     target: "draft-07",
     io: "input"
   });
-  const outputSchema = args.output ? z5.toJSONSchema(args.output, {
+  const outputSchema = args.output ? z7.toJSONSchema(args.output, {
     target: "draft-07",
     io: "output"
   }) : void 0;
@@ -241,11 +250,11 @@ async function resolveMixin(ref, defaultKind, agentDir, repos) {
   return { content: stripFrontmatter(raw).trim(), source: entry.source };
 }
 async function resolveAgentMixins(manifest, agentDir, repos) {
-  const resolve4 = (refs, kind) => Promise.all((refs ?? []).map((r) => resolveMixin(r, kind, agentDir, repos)));
+  const resolve5 = (refs, kind) => Promise.all((refs ?? []).map((r) => resolveMixin(r, kind, agentDir, repos)));
   const [personaResults, rulesResults, knowledgeResults] = await Promise.all([
-    resolve4(manifest.persona, "persona"),
-    resolve4(manifest.rules, "ruleset"),
-    resolve4(manifest.knowledge, "knowledge")
+    resolve5(manifest.persona, "persona"),
+    resolve5(manifest.rules, "ruleset"),
+    resolve5(manifest.knowledge, "knowledge")
   ]);
   return {
     personas: personaResults.filter((r) => r !== null),
@@ -260,8 +269,8 @@ async function readFileSafe(filePath) {
     return "";
   }
 }
-function stripFrontmatter(text) {
-  return text.replace(/^---\s*\n[\s\S]*?\n---\s*\n?/, "");
+function stripFrontmatter(text2) {
+  return text2.replace(/^---\s*\n[\s\S]*?\n---\s*\n?/, "");
 }
 function parseRef(ref, defaultKind) {
   let rest = ref.trim();
@@ -545,7 +554,7 @@ function registerCompositionCapabilities(registry, entries) {
       scope: "session",
       kind: "query",
       userInvokable: false,
-      input: z5.strictObject({}),
+      input: z7.strictObject({}),
       handler: async (_args, ctx) => {
         ctx.log.info("loading composed asset content", {
           ref: entry.ref,
@@ -711,6 +720,363 @@ async function buildEnvironmentSection(projectDir) {
   lines.push(`**Working directory:** ${projectDir}`);
   return lines.join("\n");
 }
+async function cancellable(work, signal) {
+  let abort = () => {
+  };
+  try {
+    return await Promise.race([
+      work,
+      new Promise((_resolve, reject) => {
+        abort = () => reject(new Error("CODEX_TOOL_CANCELLED"));
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) abort();
+      })
+    ]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+async function prepareCodexTools(options) {
+  options.signal.throwIfAborted();
+  if (!options.requiredTools.length) throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
+  const { hooks } = options;
+  let turnSignal;
+  let toolsListTotal = 0;
+  let toolsCallTotal = 0;
+  const lifetime = new AbortController();
+  const signal = AbortSignal.any([options.signal, lifetime.signal]);
+  const list = () => hooks.composeTools().filter((tool) => {
+    const cap = hooks.resolve(tool.name);
+    return cap && (cap.audience ?? ["llm", "user"]).includes("llm") && !tool.name.startsWith("host.") && !tool.name.startsWith("runner.");
+  });
+  const validate = async () => {
+    signal.throwIfAborted();
+    const names = new Set(list().map((tool) => tool.name));
+    if (options.requiredTools.some((name) => !names.has(name)))
+      throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
+  };
+  await validate();
+  const signature = () => JSON.stringify(list());
+  const initialSignature = signature();
+  const bearer = randomBytes(32).toString("base64url");
+  const authorization = Buffer.from(`Bearer ${bearer}`);
+  const peers = /* @__PURE__ */ new Set();
+  const transports = /* @__PURE__ */ new Map();
+  let closed = false;
+  const http = createServer((request, response) => {
+    void (async () => {
+      const supplied = Buffer.from(request.headers.authorization ?? "");
+      if (closed || supplied.length !== authorization.length || !timingSafeEqual(supplied, authorization)) {
+        response.writeHead(401).end();
+        return;
+      }
+      if (request.url !== "/mcp") {
+        response.writeHead(404).end();
+        return;
+      }
+      const id = request.headers["mcp-session-id"];
+      let transport = typeof id === "string" ? transports.get(id) : void 0;
+      let allocation;
+      try {
+        if (!transport) {
+          if (id || request.method !== "POST") {
+            response.writeHead(400).end();
+            return;
+          }
+          if (peers.size >= 2) {
+            response.writeHead(429).end();
+            return;
+          }
+          const server = new Server(
+            { name: "skaile-capabilities", version: "1" },
+            { capabilities: { tools: { listChanged: true } } }
+          );
+          transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: randomUUID,
+            onsessioninitialized: (sessionId) => {
+              transports.set(sessionId, transport);
+            }
+          });
+          peers.add(server);
+          allocation = server;
+          server.setRequestHandler(ListToolsRequestSchema, async () => {
+            toolsListTotal = Math.min(512, toolsListTotal + 1);
+            return {
+              tools: list().map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: { ...tool.parameters, type: "object" }
+              }))
+            };
+          });
+          server.setRequestHandler(CallToolRequestSchema, async (call, extra) => {
+            toolsCallTotal = Math.min(512, toolsCallTotal + 1);
+            const currentTurn = turnSignal;
+            const cancellation = AbortSignal.any([
+              signal,
+              extra.signal,
+              ...currentTurn ? [currentTurn] : []
+            ]);
+            try {
+              cancellation.throwIfAborted();
+              if (!currentTurn || currentTurn !== turnSignal)
+                throw new Error("CODEX_TOOL_UNAVAILABLE");
+              if (!list().some((tool) => tool.name === call.params.name))
+                throw new Error("CODEX_TOOL_UNAVAILABLE");
+              const { result } = await cancellable(
+                dispatchCapability(
+                  hooks,
+                  randomUUID(),
+                  call.params.name,
+                  call.params.arguments ?? {},
+                  () => {
+                  },
+                  cancellation
+                ),
+                cancellation
+              );
+              cancellation.throwIfAborted();
+              if (!currentTurn || currentTurn !== turnSignal)
+                throw new Error("CODEX_TOOL_UNAVAILABLE");
+              const payload = result === void 0 ? {} : result;
+              const isError = typeof payload === "object" && payload !== null && ("error" in payload && typeof payload.error === "string" || "ok" in payload && payload.ok === false || "isError" in payload && payload.isError === true);
+              if (typeof payload === "object" && payload !== null && "content" in payload && Array.isArray(payload.content))
+                return { content: payload.content, isError };
+              return {
+                content: [{ type: "text", text: JSON.stringify(payload) }],
+                isError
+              };
+            } catch {
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: cancellation.aborted ? "CODEX_TOOL_CANCELLED" : "CODEX_TOOL_FAILED"
+                  }
+                ],
+                isError: true
+              };
+            }
+          });
+          server.onclose = () => {
+            peers.delete(server);
+            if (transport?.sessionId) transports.delete(transport.sessionId);
+          };
+          await server.connect(transport);
+        }
+        await transport.handleRequest(request, response);
+      } finally {
+        if (allocation && !transport?.sessionId) {
+          peers.delete(allocation);
+          await allocation.close();
+        }
+      }
+    })().catch(() => {
+      if (!response.headersSent) response.writeHead(500).end();
+      else response.destroy();
+    });
+  });
+  const unsubscribe = hooks.onToolsChanged?.(() => {
+    for (const peer of peers) void peer.sendToolListChanged().catch(() => {
+    });
+  });
+  let disposal;
+  const dispose = () => disposal ??= (async () => {
+    closed = true;
+    lifetime.abort();
+    unsubscribe?.();
+    options.signal.removeEventListener("abort", abort);
+    await Promise.allSettled([...peers].map((peer) => peer.close()));
+    http.closeAllConnections();
+    if (http.listening) await new Promise((resolve5) => http.close(() => resolve5()));
+  })();
+  const abort = () => {
+    void dispose();
+  };
+  options.signal.addEventListener("abort", abort, { once: true });
+  try {
+    signal.throwIfAborted();
+    await new Promise((resolve5, reject) => {
+      http.once("error", reject);
+      http.listen(0, "127.0.0.1", resolve5);
+    });
+    signal.throwIfAborted();
+    const address = http.address();
+    if (!address || typeof address === "string") throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
+    return {
+      diagnostics: {
+        serverName: "skaile-capabilities",
+        requestCounts: () => ({ toolsListTotal, toolsCallTotal })
+      },
+      mcpServers: {
+        "skaile-capabilities": {
+          url: `http://127.0.0.1:${address.port}/mcp`,
+          http_headers: { Authorization: `Bearer ${bearer}` },
+          required: true
+        }
+      },
+      onServerRequest: Object.fromEntries(
+        Object.entries(options.approvals).filter(
+          ([method, handler]) => [
+            "item/commandExecution/requestApproval",
+            "item/fileChange/requestApproval",
+            "item/permissions/requestApproval"
+          ].includes(method) && typeof handler === "function"
+        )
+      ),
+      beginTurn: (next) => {
+        turnSignal = next;
+      },
+      validate,
+      needsReload: () => signature() !== initialSignature,
+      instructions: `Available Skaile MCP tools: ${list().map((tool) => tool.name).join(", ")}`,
+      dispose
+    };
+  } catch {
+    await dispose();
+    http.closeAllConnections();
+    if (http.listening) await new Promise((resolve5) => http.close(() => resolve5()));
+    throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
+  }
+}
+function registerCodexToolDefinitions(registry, namespace, tools) {
+  const owned = tools.map(
+    (tool) => defineCapability({
+      name: `${namespace}.${tool.name}`,
+      description: tool.description,
+      input: z7.object(tool.inputSchema),
+      side: "agent",
+      origin: { kind: "framework" },
+      audience: ["llm"],
+      handler: async (input, ctx) => {
+        ctx.signal?.throwIfAborted();
+        return tool.handler(input);
+      }
+    })
+  );
+  if (owned.some((cap) => registry.resolve(cap.name))) throw new Error("CODEX_TOOL_CONFLICT");
+  for (const cap of owned) registry.register(cap, "agent");
+  return () => {
+    for (const cap of owned) if (registry.resolve(cap.name) === cap) registry.deregister(cap.name);
+  };
+}
+function contains(root, target) {
+  const path5 = relative(root, target);
+  return path5 === "" || !path5.startsWith("..") && !isAbsolute(path5);
+}
+async function canonical(path5) {
+  try {
+    return await realpath(path5);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = dirname(path5);
+    if (parent === path5) throw error;
+    return resolve(await canonical(parent), relative(parent, path5));
+  }
+}
+async function assertScopedTree(path5, root) {
+  let remaining = 1e4;
+  async function visit(entry) {
+    if (--remaining < 0) throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
+    let stat3;
+    try {
+      stat3 = await lstat(entry);
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    if (!contains(root, await realpath(entry)) || stat3.isSymbolicLink())
+      throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
+    if (stat3.isDirectory())
+      for (const child of await readdir(entry)) await visit(join(entry, child));
+  }
+  await visit(path5);
+}
+async function registerCodexResourceTools(options) {
+  const project = await realpath(options.projectDir);
+  const privateRoot = await canonical(resolve(options.privateDirectory));
+  if (contains(project, privateRoot) || contains(privateRoot, project))
+    throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
+  const statePath = join(project, ".skaile", "plugin-state.json");
+  const assertStateScope = async () => {
+    if (!contains(project, await canonical(statePath)))
+      throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
+  };
+  await assertStateScope();
+  const plugin = new WorkspacePlugin({
+    projectDir: options.projectDir,
+    connectorManager: options.manager ?? void 0,
+    driver: "codex",
+    provider: "openai",
+    model: options.model
+  });
+  await plugin.store.load();
+  const removals = [];
+  const protectFlow = (tools) => tools.map((tool) => ({
+    ...tool,
+    handler: async (input) => {
+      if (tool.name === "mount_read") {
+        const mount = options.manager?.listConnectors().find((entry) => entry.id === input.mount_id);
+        if (!mount?.mountPath || typeof input.path !== "string")
+          throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
+        const root = await realpath(mount.mountPath);
+        const target = await realpath(resolve(root, input.path));
+        if (!contains(project, root) || !contains(root, target))
+          throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
+      }
+      if (tool.name.startsWith("skill_") || ["flow_list", "flow_show", "flow_find_flow_for_session"].includes(tool.name)) {
+        const assets = await findAiAssetsRoot(project);
+        if (assets) await assertScopedTree(assets, project);
+      }
+      if (tool.name.startsWith("session_") || tool.name.includes("session"))
+        await assertScopedTree(join(project, ".skaile", "sessions"), project);
+      if (tool.name === "connector_exec" && options.manager && typeof input.connector_id === "string" && options.manager.listConnectors().some((entry) => entry.id === input.connector_id && entry.driver === "flow") && !buildFlowToolDefs(options.manager, input.connector_id).some(
+        (operation) => operation.name === input.operation
+      ))
+        throw new Error("CODEX_TOOL_UNAVAILABLE");
+      return tool.handler(input);
+    }
+  }));
+  try {
+    removals.push(
+      registerCodexToolDefinitions(
+        options.registry,
+        "workspace",
+        protectFlow(
+          buildWorkspaceToolDefs(plugin).filter(
+            (tool) => ![
+              "workspace_test_secret",
+              "workspace_validate",
+              "workspace_reload",
+              "skill_check_requirements"
+            ].includes(tool.name)
+          )
+        )
+      )
+    );
+    if (options.manager)
+      removals.push(
+        registerCodexToolDefinitions(
+          options.registry,
+          "connector",
+          protectFlow(buildConnectorToolDefs(options.manager, { shellAccess: false }))
+        )
+      );
+  } catch (error) {
+    for (const remove of removals) remove();
+    throw error;
+  }
+  return async () => {
+    for (const remove of removals) remove();
+    await assertStateScope();
+    await plugin.shutdown();
+  };
+}
+function registerCodexFlowTools(registry, manager, connectorId) {
+  const tools = buildFlowToolDefs(manager, connectorId);
+  if (!tools.length) throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
+  return registerCodexToolDefinitions(registry, "flow", tools);
+}
 async function agentDefinitionExists(agentDir) {
   try {
     await fs4.access(path4.join(agentDir, "agent.yaml"));
@@ -1043,17 +1409,17 @@ var McpServerAlreadyRegisteredError = class extends Error {
   }
   id;
 };
-function resolveRecordSecrets(record, secrets) {
-  if (!secrets) return record;
+function resolveRecordSecrets(record2, secrets) {
+  if (!secrets) return record2;
   const resolved = {};
-  for (const [k, v] of Object.entries(record)) {
+  for (const [k, v] of Object.entries(record2)) {
     resolved[k] = secrets.resolve(v) ?? v;
   }
   return resolved;
 }
-function resolveRecordSecretsStrict(record, secrets, ctx) {
+function resolveRecordSecretsStrict(record2, secrets, ctx) {
   const resolved = {};
-  for (const [k, v] of Object.entries(record)) {
+  for (const [k, v] of Object.entries(record2)) {
     const value = secrets?.resolve(v);
     if (value === void 0 && isKnownSecretRef(v)) {
       throw new Error(
@@ -1069,13 +1435,15 @@ var RESERVED_MCP_SERVER_IDS = /* @__PURE__ */ new Set([
   "skaile-workspace",
   "skaile-capabilities"
 ]);
-async function resolveExternalMcpDeclarations(projectDir, sessionId) {
+async function resolveExternalMcpDeclarations(projectDir, sessionId, managedCodex = false) {
   const mcpLog = createLogger({
     kind: "mcp",
     subkind: "wiring",
     instance: sessionId ?? "no-session"
   });
   const mcpDeclarations = await loadMcpServerDeclarations(projectDir);
+  if (managedCodex && mcpDeclarations.length > 0)
+    throw new Error("CODEX_MANAGED_PROJECT_MCP_UNSUPPORTED");
   mcpLog.debug("loaded MCP declarations", { count: mcpDeclarations.length });
   const recipeCache = createRecipeCache();
   const nixFlakeRef = process.env.SKAILE_NIX_FLAKE_REF ?? "/etc/skaile/flake";
@@ -1414,37 +1782,40 @@ var ExternalMcpManager = class {
       inputZod: PASSTHROUGH_INPUT_ZOD,
       handler: async (input, ctx) => {
         const call = { name: tool.name, arguments: input ?? {} };
+        const invoke = () => ctx.signal ? server.client.callTool(call, void 0, { signal: ctx.signal }) : server.client.callTool(call);
         let result;
         try {
-          result = await server.client.callTool(call);
+          result = await invoke();
         } catch (err) {
-          if (isMcpAuthError(err) && await this.reauthAndReconnect(server)) {
+          if (!ctx.signal?.aborted && isMcpAuthError(err) && await this.reauthAndReconnect(server)) {
             ctx.log.info("mcp tool retried after 401 re-mint", { tool: name });
-            result = await server.client.callTool(call);
+            result = await invoke();
           } else {
             throw err;
           }
         }
         const content = result.content ?? [];
-        const text = content.filter((c) => c.type === "text" && typeof c.text === "string").map((c) => c.text).join("\n");
+        const text2 = content.filter((c) => c.type === "text" && typeof c.text === "string").map((c) => c.text).join("\n");
         if (result.isError) {
-          throw new Error(text || `MCP tool ${name} returned an error`);
+          throw new Error(text2 || `MCP tool ${name} returned an error`);
         }
-        ctx.log.debug("mcp tool ok", { tool: name, hasText: text.length > 0 });
-        return text.length > 0 ? text : content;
+        ctx.log.debug("mcp tool ok", { tool: name, hasText: text2.length > 0 });
+        return text2.length > 0 ? text2 : content;
       }
     };
   }
   /**
    * Deregister every tool and close every client (kills the subprocesses).
-   * Best-effort: a failed close on one server does not prevent the rest.
+   * Best-effort by default: a failed close on one server does not prevent the rest.
+   * With strict:true, report close failures after all owned cleanup attempts.
    *
    * Drains any in-flight 401 reconnect first: a `doReauthAndReconnect` resolving
    * after teardown would set `server.client` to a freshly-connected client that
    * nothing then closes (leak). Awaiting `reauthInFlight` guarantees we close the
    * LATEST client.
    */
-  async dispose() {
+  async dispose(options = {}) {
+    const failures = [];
     await Promise.allSettled(this.servers.map((s) => s.reauthInFlight).filter(Boolean));
     for (const server of this.servers) {
       for (const toolName of server.toolNames) {
@@ -1453,6 +1824,7 @@ var ExternalMcpManager = class {
       try {
         await server.client.close();
       } catch (err) {
+        failures.push(err);
         this.log.warn("MCP server close failed", {
           id: server.id,
           error: err instanceof Error ? err.message : String(err)
@@ -1460,6 +1832,8 @@ var ExternalMcpManager = class {
       }
     }
     this.servers.length = 0;
+    if (options.strict && failures.length > 0)
+      throw new AggregateError(failures, "MCP server cleanup failed");
   }
 };
 
@@ -1486,6 +1860,7 @@ function buildMcpPromptSection(declarations, connected) {
 
 // runner/src/resources.ts
 async function buildAgentResources(projectDir, driverType, _onLog, watch, secretProvider, sessionMeta, tokenMediator, preMintedSecrets, deferFilesystemMounts, capabilityRegistry, fallbackConnectorDeclarations, extraMcpDeclarations) {
+  const managedProjectMcp = sessionMeta?.managedCodex ? await resolveExternalMcpDeclarations(projectDir, sessionMeta.sessionId, true) : void 0;
   const resLog = createLogger({
     kind: "runner",
     subkind: "resources",
@@ -1512,7 +1887,8 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
     for (const w of runtimeAssets.warnings) {
       resLog.warn("runtime asset warning", { code: w.code, message: w.message });
     }
-    await maybeInstallNpmPeerDeps(runtimeAssets, projectDir, resLog);
+    if (!sessionMeta?.managedCodex)
+      await maybeInstallNpmPeerDeps(runtimeAssets, projectDir, resLog);
     const diskDeclarations = loadConnectorDeclarations(projectDir);
     const connectorDeclarations = diskDeclarations.length > 0 ? diskDeclarations : fallbackConnectorDeclarations ?? [];
     if (diskDeclarations.length === 0 && connectorDeclarations.length > 0) {
@@ -1571,7 +1947,7 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
     }
     if (capabilityRegistry) {
       externalMcpDeclarations = mergeExtraMcpDeclarations(
-        await resolveExternalMcpDeclarations(projectDir, sessionMeta?.sessionId),
+        managedProjectMcp ?? await resolveExternalMcpDeclarations(projectDir, sessionMeta?.sessionId),
         extraMcpDeclarations
       );
       externalMcpManager = await startExternalMcpServers(
@@ -1832,6 +2208,9 @@ function toSdkMcpServerConfig(decl, secrets) {
 
 // runner/src/session-builder.ts
 async function createAgentSession(config) {
+  const managed = config.managedCodex;
+  if (managed && (config.driver !== "codex" || config.provider !== "openai" || !config.model || !config.aiProviderConfigId || !config.capabilityRegistry || !config.capabilities || config.apiKey || config.cloud && config.cloud !== "default" || config.cloudConfig || config.cloudSecrets))
+    throw new Error("AI_PROFILE_INVALID");
   const {
     projectDir,
     cwd: cwdOverride,
@@ -1850,7 +2229,17 @@ async function createAgentSession(config) {
     telemetry,
     trace
   } = config;
+  const managedWorkspaceConfig = managed ? wsConfigOverride ?? resolveSkWorkspaceConfig(projectDir) : void 0;
+  if (managedWorkspaceConfig?.agent?.["prompt-extensions"]?.length)
+    throw new Error("CODEX_MANAGED_PROMPT_EXTENSIONS_UNSUPPORTED");
   const agentCwd = cwdOverride ?? projectDir;
+  if (managed)
+    prepareNativePolicy({
+      cwd: agentCwd,
+      privateRoot: managed.runtime.privateRoot,
+      privateDirectory: managed.runtime.privateDirectory,
+      sandboxMode: managed.sandboxMode
+    });
   const sessionLog = createLogger({
     kind: "runner",
     subkind: "session",
@@ -1861,12 +2250,12 @@ async function createAgentSession(config) {
     provider: providerOverride,
     model: modelOverride
   });
-  const driverType = settings.driver ?? "omp";
-  const provider = settings.provider;
-  const model = settings.model;
-  const cloud = config.cloud ?? settings.cloud ?? "default";
-  const cloudConfig = config.cloudConfig ?? settings.cloudConfig;
-  const apiKey = cloud === "bedrock" || cloud === "vertex" || cloud === "azure" ? config.apiKey : config.apiKey ?? resolveApiKey(provider ?? "anthropic", settings);
+  const driverType = managed ? "codex" : settings.driver ?? "omp";
+  const provider = managed ? config.provider : settings.provider;
+  const model = managed ? config.model : settings.model;
+  const cloud = managed ? "default" : config.cloud ?? settings.cloud ?? "default";
+  const cloudConfig = managed ? void 0 : config.cloudConfig ?? settings.cloudConfig;
+  const apiKey = managed ? void 0 : cloud === "bedrock" || cloud === "vertex" || cloud === "azure" ? config.apiKey : config.apiKey ?? resolveApiKey(provider ?? "anthropic", settings);
   const manifest = agentDir ? await loadAgentManifest(agentDir) : void 0;
   const {
     resourceManager,
@@ -1887,7 +2276,8 @@ async function createAgentSession(config) {
     {
       provider,
       model,
-      sessionId
+      sessionId,
+      ...managed ? { managedCodex: true } : {}
     },
     config.tokenMediator,
     config.preMintedSecrets,
@@ -1896,7 +2286,7 @@ async function createAgentSession(config) {
     config.fallbackConnectorDeclarations,
     config.getExtraMcpDeclarations?.()
   );
-  const wsConfig = wsConfigOverride ?? resolveSkWorkspaceConfig(projectDir);
+  const wsConfig = managedWorkspaceConfig ?? wsConfigOverride ?? resolveSkWorkspaceConfig(projectDir);
   const contextSection = buildContextSection(wsConfig.agent?.context);
   const userPromptSection = wsConfig.agent?.prompt?.trim();
   const environmentSection = await buildEnvironmentSection(projectDir);
@@ -1912,6 +2302,20 @@ async function createAgentSession(config) {
   }
   const composition = await resolveSessionComposition(agentDir, manifest, projectDir, sessionLog);
   const compositionBlocks = composition?.inlineBlocks ?? [];
+  const disposeManagedTools = managed ? await registerCodexResourceTools({
+    registry: config.capabilityRegistry,
+    manager: resourceManager,
+    projectDir,
+    model: config.model,
+    privateDirectory: managed.runtime.privateRoot
+  }) : void 0;
+  const disposeSessionResources = async () => {
+    try {
+      await disposeManagedTools?.();
+    } finally {
+      await dispose();
+    }
+  };
   const additionalSections = config.additionalPromptSections ?? [];
   const systemPromptSections = buildSystemPromptSections({
     contextSection,
@@ -1935,27 +2339,39 @@ async function createAgentSession(config) {
   ]);
   logAssembledSystemPrompt(systemPrompt, sessionLog);
   const thinking = config.thinking ?? wsConfig.agent_config?.default?.thinking;
-  const effort = config.effort ?? wsConfig.agent_config?.default?.effort;
+  const effort = config.effort ?? (managed ? void 0 : wsConfig.agent_config?.default?.effort);
   const maxTurns = maxTurnsOverride ?? manifest?.runtime?.max_turns;
-  const driver = await createSessionDriver({
-    config,
-    driverType,
-    agentCwd,
-    provider,
-    model,
-    cloud,
-    cloudConfig,
-    manifest,
-    maxTurns,
-    apiKey,
-    systemPrompt,
-    thinking,
-    effort,
-    sessionId,
-    resumeSessionId,
-    mcpServers,
-    agentDir
-  });
+  let driver;
+  try {
+    driver = await createSessionDriver({
+      config,
+      driverType,
+      agentCwd,
+      provider,
+      model,
+      cloud,
+      cloudConfig,
+      manifest,
+      maxTurns,
+      apiKey,
+      systemPrompt,
+      thinking,
+      effort,
+      sessionId,
+      resumeSessionId,
+      mcpServers,
+      agentDir
+    });
+  } catch (error) {
+    try {
+      await disposeSessionResources();
+    } catch (cleanupError) {
+      throw new AggregateError([error, cleanupError], "Session creation and cleanup failed", {
+        cause: error
+      });
+    }
+    throw error;
+  }
   if (telemetry && trace) {
     driver.setTelemetry(telemetry, trace);
   }
@@ -1968,7 +2384,7 @@ async function createAgentSession(config) {
     driverType,
     provider,
     model,
-    dispose,
+    dispose: disposeSessionResources,
     startWatching,
     getOrCreateExternalMcpManager,
     getExternalMcpManager,
@@ -1976,6 +2392,45 @@ async function createAgentSession(config) {
     systemPromptSections
   };
 }
+function createManagedCodexSubpromptDriver(config, model, cwd, privateDirectory) {
+  const managed = config.managedCodex;
+  if (!managed || !model || !config.sessionId || !config.aiProviderConfigId || !config.capabilities)
+    return Promise.reject(new Error("AI_PROFILE_INVALID"));
+  prepareNativePolicy({
+    cwd,
+    privateRoot: managed.runtime.privateRoot,
+    privateDirectory,
+    sandboxMode: managed.sandboxMode
+  });
+  return createDriver("codex", {
+    cwd,
+    provider: "openai",
+    model,
+    sessionId: `${config.sessionId}:subprompt:${randomUUID()}`,
+    maxTurns: 1,
+    aiProviderConfigId: config.aiProviderConfigId,
+    driverOptions: {
+      codex: {
+        authSource: "managed",
+        approvalPolicy: managed.approvalPolicy,
+        sandboxMode: managed.sandboxMode,
+        reasoningEffort: managed.reasoningEffort,
+        managedRuntime: {
+          ...managed.runtime,
+          privateDirectory,
+          nativeTurnBudget: 1,
+          credential: structuredClone(managed.runtime.credential),
+          prepareTools: (signal) => prepareCodexTools({
+            hooks: config.capabilities,
+            requiredTools: managed.requiredTools,
+            approvals: managed.approvals,
+            signal
+          })
+        }
+      }
+    }
+  });
+}
 async function loadPromptExtensions(paths, projectDir, log) {
   if (!paths?.length) return [];
   const loaded = await Promise.all(
@@ -2079,6 +2534,25 @@ function createSessionDriver(args) {
     agentDir
   } = args;
   return createDriver(driverType, {
+    ...config.managedCodex ? {
+      driverOptions: {
+        codex: {
+          authSource: "managed",
+          approvalPolicy: config.managedCodex.approvalPolicy,
+          sandboxMode: config.managedCodex.sandboxMode,
+          reasoningEffort: config.managedCodex.reasoningEffort,
+          managedRuntime: {
+            ...config.managedCodex.runtime,
+            prepareTools: (signal) => prepareCodexTools({
+              hooks: config.capabilities,
+              requiredTools: config.managedCodex.requiredTools,
+              approvals: config.managedCodex.approvals,
+              signal
+            })
+          }
+        }
+      }
+    } : {},
     cwd: agentCwd,
     provider,
     model: model ?? manifest?.model?.preferred,
@@ -2149,14 +2623,14 @@ async function runAgentChat(opts) {
 ${message}`;
   }
   try {
-    await new Promise((resolve4, reject) => {
+    await new Promise((resolve5, reject) => {
       const onEvent = (event) => {
         if (event.type === "agent_end") {
           driver.off("agent-event", onEvent);
           mdStream.end();
           process.stdout.write("\n");
           driver.kill();
-          resolve4();
+          resolve5();
         } else if (event.type === "error") {
           driver.off("agent-event", onEvent);
           const err = Object.assign(new Error(String(event.error)), {
@@ -2206,10 +2680,10 @@ function keywordSearch(capabilities, query, limit) {
   return scored.slice(0, limit).map((x) => x.cap);
 }
 function builtinCapabilities(registry) {
-  const listFilterSchema = z5.strictObject({
-    side: z5.enum(["client", "agent"]).optional(),
-    originKind: z5.enum(["framework", "client", "agent", "flow", "skill", "mcp", "connector", "mount"]).optional(),
-    scope: z5.enum(["session", "turn"]).optional()
+  const listFilterSchema = z7.strictObject({
+    side: z7.enum(["client", "agent"]).optional(),
+    originKind: z7.enum(["framework", "client", "agent", "flow", "skill", "mcp", "connector", "mount"]).optional(),
+    scope: z7.enum(["session", "turn"]).optional()
   });
   return [
     defineCapability({
@@ -2235,9 +2709,9 @@ function builtinCapabilities(registry) {
       origin: { kind: "framework" },
       kind: "query",
       userInvokable: false,
-      input: z5.strictObject({
-        query: z5.string(),
-        limit: z5.number().int().positive().optional()
+      input: z7.strictObject({
+        query: z7.string(),
+        limit: z7.number().int().positive().optional()
       }),
       handler: async ({ query, limit }) => keywordSearch(registry.list(), query, limit ?? 10)
     }),
@@ -2249,7 +2723,7 @@ function builtinCapabilities(registry) {
       origin: { kind: "framework" },
       kind: "query",
       userInvokable: false,
-      input: z5.strictObject({ name: z5.string() }),
+      input: z7.strictObject({ name: z7.string() }),
       handler: async ({ name }) => {
         const cap = registry.resolve(name);
         if (!cap) return null;
@@ -2293,6 +2767,22 @@ var CapabilityRegistry = class {
   byName = /* @__PURE__ */ new Map();
   logger;
   remoteInvoker;
+  toolListeners = /* @__PURE__ */ new Set();
+  /** Observe inventory changes without caching a second tool registry. */
+  onToolsChanged(listener) {
+    this.toolListeners.add(listener);
+    return () => {
+      this.toolListeners.delete(listener);
+    };
+  }
+  toolsChanged() {
+    for (const listener of this.toolListeners) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+  }
   constructor(logger) {
     this.logger = logger ?? createLogger({ kind: "runner", subkind: "capability-registry" });
   }
@@ -2359,6 +2849,7 @@ var CapabilityRegistry = class {
       return;
     }
     this.byName.set(cap.name, cap);
+    this.toolsChanged();
     this.logger.info("capability registered", {
       name: cap.name,
       side: cap.side,
@@ -2372,6 +2863,7 @@ var CapabilityRegistry = class {
    */
   deregister(name) {
     if (this.byName.delete(name)) {
+      this.toolsChanged();
       this.logger.info("capability deregistered", { name });
     }
   }
@@ -2473,6 +2965,7 @@ var CapabilityRegistry = class {
         handler: HYDRATED_REJECT_HANDLER
       };
       this.byName.set(cap.name, stub);
+      this.toolsChanged();
       hydrated++;
     }
     this.logger.info("capability registry hydrated", { count: hydrated, total: snapshot.length });
@@ -2486,6 +2979,7 @@ var CapabilityRegistry = class {
    * @throws when the capability is unknown or the input fails validation
    */
   async invoke(name, input, baseCtx) {
+    baseCtx.signal?.throwIfAborted();
     const cap = this.resolve(name);
     if (!cap) {
       throw new Error(`Unknown capability: ${name}`);
@@ -2539,12 +3033,12 @@ var CapabilityRegistry = class {
   }
 };
 function computeCapabilitySignature(caps) {
-  const canonical = caps.slice().sort((a, b) => a.name.localeCompare(b.name)).map((c) => ({
+  const canonical2 = caps.slice().sort((a, b) => a.name.localeCompare(b.name)).map((c) => ({
     name: c.name,
     origin: c.origin.kind,
     schemaSha256: sha256(JSON.stringify(c.inputSchema ?? {}))
   }));
-  return sha256(JSON.stringify(canonical));
+  return sha256(JSON.stringify(canonical2));
 }
 function sha256(input) {
   return createHash("sha256").update(input).digest("hex");
@@ -2583,7 +3077,7 @@ function buildClientCapabilityHandler(args) {
       });
       return {};
     }
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const timer = setTimeout(() => {
         args.pending.delete(callId);
         reject(
@@ -2592,7 +3086,7 @@ function buildClientCapabilityHandler(args) {
           )
         );
       }, timeoutMs);
-      args.pending.set(callId, { resolve: resolve4, reject, timer });
+      args.pending.set(callId, { resolve: resolve5, reject, timer });
       args.emit({
         type: "capability_invoked",
         callId,
@@ -2832,6 +3326,134 @@ async function handleMountResourceRequest(command, manager, emit) {
     });
   }
 }
+
+// runner/src/codex-init.ts
+function validateCodexInit(cmd, supported, previous) {
+  const requirements = cmd.requiredRuntimeFeatures;
+  if (requirements !== void 0 && (!Array.isArray(requirements) || requirements.some((item) => typeof item !== "string" || !supported.includes(item))))
+    throw new Error("Unsupported runtime: required features are unavailable");
+  const profile = cmd.resolvedConfig.agentConfig;
+  const managed = profile?.driver === "codex" && (profile.authMode !== void 0 || requirements?.includes("codex-app-server-v1"));
+  if ((managed || cmd.credentials.ai !== void 0) && !supported.includes("codex-app-server-v1"))
+    throw new Error("Unsupported runtime: codex-app-server-v1 is unavailable");
+  if (!managed && cmd.credentials.ai === void 0) return;
+  if (previous && ["containerId", "sessionId", "projectId", "ownerUserId"].some(
+    (key) => previous[key] !== cmd.identity[key]
+  ))
+    throw new Error("Invalid managed AI session identity");
+  if (!managed || profile?.provider !== "openai" || !["subscription", "api-key"].includes(profile.authMode ?? ""))
+    throw new Error("Invalid managed OpenAI profile");
+  const credential = parseCodexCredential(cmd.credentials.ai);
+  if (credential.configId !== cmd.resolvedConfig.aiProviderConfigId || profile.authMode === "subscription" !== (credential.kind === "codex-subscription"))
+    throw new Error("Invalid managed AI credential binding");
+  if (cmd.secrets && Object.keys(cmd.secrets).some((key) => /openai|codex/i.test(key)))
+    throw new Error("Conflicting managed AI credential delivery");
+}
+var text = z7.string().min(1).max(4096);
+var timeout = z7.number().int().positive().max(18e5).optional();
+var zHost = z7.object({
+  schemaVersion: z7.literal(1),
+  sessionId: z7.string().min(1).max(128),
+  runtime: z7.object({
+    executable: text,
+    executableArgs: z7.array(text).max(64).optional(),
+    privateDirectory: text,
+    privateRoot: text,
+    environment: z7.record(z7.string(), z7.string()),
+    instructionFiles: z7.array(text).max(64).optional(),
+    skillsDirectory: text.optional(),
+    requestTimeoutMs: timeout,
+    turnTimeoutMs: timeout,
+    interactionTimeoutMs: timeout
+  }).strict(),
+  requiredTools: z7.array(z7.string().min(1).max(256)).min(1).max(1024),
+  approvalPolicy: z7.enum(["never", "on-request", "untrusted"]),
+  sandboxMode: z7.enum(["read-only", "workspace-write"]),
+  reasoningEffort: z7.enum(["minimal", "low", "medium", "high", "xhigh"]),
+  subpromptModels: z7.object({
+    small: text,
+    deep: text,
+    available: z7.array(text).min(1).max(1024)
+  }).strict()
+}).strict();
+var refused = () => new Error("CODEX_MANAGED_BOOTSTRAP_INVALID");
+var overlaps = (a, b) => {
+  const within = (child, parent) => {
+    const rel = relative(parent, child);
+    return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+  };
+  return within(a, b) || within(b, a);
+};
+var denyNativeGrants = {
+  "item/commandExecution/requestApproval": async () => ({ decision: "decline" }),
+  "item/fileChange/requestApproval": async () => ({ decision: "decline" }),
+  "item/permissions/requestApproval": async () => ({ permissions: {}, scope: "turn" })
+};
+function validateManagedCodexHost(input, projectDir) {
+  try {
+    const { approvals, ...config } = input;
+    const parsed = zHost.parse(config);
+    const runtime = parsed.runtime;
+    if (!isAbsolute(runtime.executable) || !isAbsolute(runtime.privateDirectory)) throw refused();
+    prepareNativePolicy({
+      cwd: projectDir,
+      privateRoot: runtime.privateRoot,
+      privateDirectory: runtime.privateDirectory,
+      sandboxMode: parsed.sandboxMode
+    });
+    const state = lstatSync(runtime.privateDirectory);
+    if (!state.isDirectory() || state.isSymbolicLink() || state.mode & 63) throw refused();
+    if (process.getuid && state.uid !== process.getuid()) throw refused();
+    if (overlaps(realpathSync(runtime.privateDirectory), realpathSync(projectDir))) throw refused();
+    if (!lstatSync(realpathSync(runtime.executable)).isFile()) throw refused();
+    accessSync(runtime.executable, constants.X_OK);
+    codexInstanceEnvironment(runtime.environment, runtime.privateDirectory);
+    for (const key of ["HTTP_PROXY", "HTTPS_PROXY"]) {
+      const value = runtime.environment[key];
+      if (value && (new URL(value).username || new URL(value).password)) throw refused();
+    }
+    return { ...parsed, approvals: { ...approvals ?? denyNativeGrants } };
+  } catch {
+    throw refused();
+  }
+}
+function loadManagedCodexHostConfig(file, projectDir) {
+  try {
+    if (!isAbsolute(file)) throw refused();
+    const stat3 = lstatSync(file);
+    if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > 64 * 1024 || stat3.mode & 63)
+      throw refused();
+    if (process.getuid && stat3.uid !== 0 && stat3.uid !== process.getuid()) throw refused();
+    if (overlaps(realpathSync(file), realpathSync(projectDir))) throw refused();
+    return validateManagedCodexHost(
+      zHost.parse(JSON.parse(readFileSync(file, "utf8"))),
+      projectDir
+    );
+  } catch {
+    throw refused();
+  }
+}
+function bindManagedCodexInit(host, cmd, refreshCredential) {
+  const profile = cmd.resolvedConfig.agentConfig;
+  const credential = parseCodexCredential(cmd.credentials.ai);
+  if (!profile?.authMode || !["subscription", "api-key"].includes(profile.authMode) || cmd.identity.sessionId !== host.sessionId || profile?.driver !== "codex" || profile.provider !== "openai" || profile.cloud !== void 0 && profile.cloud !== "default" || profile.cloudConfig || !profile.model || !host.subpromptModels.available.includes(profile.model) || credential.configId !== cmd.resolvedConfig.aiProviderConfigId || profile.authMode === "subscription" !== (credential.kind === "codex-subscription"))
+    throw refused();
+  const reasoningEffort = profile.effort ?? host.reasoningEffort;
+  if (!["minimal", "low", "medium", "high", "xhigh"].includes(reasoningEffort)) throw refused();
+  return {
+    runtime: {
+      ...host.runtime,
+      credential,
+      ...credential.kind === "codex-subscription" ? { refreshCredential } : {}
+    },
+    approvals: host.approvals ?? denyNativeGrants,
+    requiredTools: [...host.requiredTools],
+    approvalPolicy: host.approvalPolicy,
+    sandboxMode: host.sandboxMode,
+    reasoningEffort,
+    subpromptModels: { ...host.subpromptModels, available: [...host.subpromptModels.available] }
+  };
+}
 var MINT_RETRY_MAX_ATTEMPTS = 3;
 var MINT_RETRY_BASE_DELAY_MS = 2e3;
 var MINT_RETRY_MAX_DELAY_MS = 5e3;
@@ -3146,8 +3768,8 @@ var CompactionGate = class {
   begin() {
     const hold = /* @__PURE__ */ Symbol("compaction");
     if (this.held.size === 0) {
-      this.opened = new Promise((resolve4) => {
-        this.release = resolve4;
+      this.opened = new Promise((resolve5) => {
+        this.release = resolve5;
       });
     }
     this.held.add(hold);
@@ -3200,8 +3822,8 @@ var CompactionGate = class {
 };
 async function raceDeadline(opened, ms) {
   let timer;
-  const expired = new Promise((resolve4) => {
-    timer = setTimeout(() => resolve4("timeout"), ms);
+  const expired = new Promise((resolve5) => {
+    timer = setTimeout(() => resolve5("timeout"), ms);
     timer.unref?.();
   });
   try {
@@ -3239,8 +3861,8 @@ var DriverSwapGate = class {
    */
   beginTurn() {
     let resolveTurn;
-    const turn = new Promise((resolve4) => {
-      resolveTurn = resolve4;
+    const turn = new Promise((resolve5) => {
+      resolveTurn = resolve5;
     });
     this.turnTail = this.turnTail.then(() => turn);
     let ended = false;
@@ -3428,12 +4050,12 @@ tighter prose, never from leaving material out.`;
 var ABORT_SETTLE_GRACE_MS = 5e3;
 var MAX_CARRIED_SUMMARY_CHARS = 24e3;
 var MAX_FAILURE_DIAGNOSTIC_CHARS = 4e3;
-function truncateTo(text, max) {
-  if (text.length <= max) return text;
-  return `${text.slice(0, max)}... [truncated]`;
+function truncateTo(text2, max) {
+  if (text2.length <= max) return text2;
+  return `${text2.slice(0, max)}... [truncated]`;
 }
-function truncateDiagnostic(text) {
-  return truncateTo(text, MAX_FAILURE_DIAGNOSTIC_CHARS);
+function truncateDiagnostic(text2) {
+  return truncateTo(text2, MAX_FAILURE_DIAGNOSTIC_CHARS);
 }
 var RATE_LIMIT_TEXT_MAX_CHARS = 1500;
 var RATE_LIMIT_TEXT_PATTERNS = [
@@ -3457,14 +4079,14 @@ function resolveContextWindow(driverWindow, model) {
   }
   return driverWindow || DEFAULT_CONTEXT_WINDOW;
 }
-function detectRateLimitInSummary(text) {
-  if (text.length > RATE_LIMIT_TEXT_MAX_CHARS) return false;
-  return RATE_LIMIT_TEXT_PATTERNS.some((p) => p.test(text));
+function detectRateLimitInSummary(text2) {
+  if (text2.length > RATE_LIMIT_TEXT_MAX_CHARS) return false;
+  return RATE_LIMIT_TEXT_PATTERNS.some((p) => p.test(text2));
 }
-function validateCompactionOutput(text, tokensBefore, tokensAfter) {
-  if (!text.trim()) return { ok: false, errorCode: "empty" };
-  if (detectRateLimitInSummary(text)) return { ok: false, errorCode: "rate_limit" };
-  if (text.length < MIN_SUMMARY_CHARS) return { ok: false, errorCode: "too_short" };
+function validateCompactionOutput(text2, tokensBefore, tokensAfter) {
+  if (!text2.trim()) return { ok: false, errorCode: "empty" };
+  if (detectRateLimitInSummary(text2)) return { ok: false, errorCode: "rate_limit" };
+  if (text2.length < MIN_SUMMARY_CHARS) return { ok: false, errorCode: "too_short" };
   if (tokensBefore > 0 && tokensAfter / tokensBefore > MAX_COMPRESSION_RATIO) {
     return { ok: false, errorCode: "poor_ratio" };
   }
@@ -3722,8 +4344,8 @@ var CompactionOrchestrator = class {
     try {
       this.driver.on("agent-event", captureHandler);
       const running = this.driver.prompt(prompt);
-      const expiry = new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4("expired"), timeoutMs);
+      const expiry = new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5("expired"), timeoutMs);
       });
       const outcome = await Promise.race([running.then(() => "settled"), expiry]);
       if (outcome === "expired") {
@@ -3739,8 +4361,8 @@ var CompactionOrchestrator = class {
           this.opts.onLog?.(`[compaction] abort after timeout failed: ${String(abortErr)}`);
         });
         let settleTimer;
-        const graceExpired = new Promise((resolve4) => {
-          settleTimer = setTimeout(resolve4, ABORT_SETTLE_GRACE_MS);
+        const graceExpired = new Promise((resolve5) => {
+          settleTimer = setTimeout(resolve5, ABORT_SETTLE_GRACE_MS);
           settleTimer.unref?.();
         });
         await Promise.race([Promise.all([aborted, settled]), graceExpired]);
@@ -4151,8 +4773,8 @@ function toPreMinted(token) {
 function buildSessionResourceHandlers(deps) {
   const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log, getProjectDir } = deps;
   async function add(kind, input) {
-    const rm2 = getResourceManager();
-    if (!rm2) return { ok: false, code: "no_session", message: "session resources not ready" };
+    const rm3 = getResourceManager();
+    if (!rm3) return { ok: false, code: "no_session", message: "session resources not ready" };
     const decl = asDeclaration(input.declaration);
     if (!decl) {
       return { ok: false, code: "invalid_declaration", message: "declaration missing id/driver" };
@@ -4166,7 +4788,7 @@ function buildSessionResourceHandlers(deps) {
         );
     }
     try {
-      await rm2.connect(decl);
+      await rm3.connect(decl);
     } catch (err) {
       if (input.preMintedToken) {
         getPreMintedSecrets()?.unset(kind, decl.id);
@@ -4203,8 +4825,8 @@ function buildSessionResourceHandlers(deps) {
         message: `no materialized connector at ${join(root, name)}`
       };
     }
-    const rm2 = getResourceManager();
-    if (!rm2) return { ok: false, code: "no_session", message: "session resources not ready" };
+    const rm3 = getResourceManager();
+    if (!rm3) return { ok: false, code: "no_session", message: "session resources not ready" };
     if (preMintedToken) {
       const ps = getPreMintedSecrets();
       if (ps) ps.set("connector", decl.id, toPreMinted(preMintedToken));
@@ -4214,7 +4836,7 @@ function buildSessionResourceHandlers(deps) {
         );
     }
     try {
-      await rm2.connect(decl);
+      await rm3.connect(decl);
     } catch (err) {
       if (preMintedToken) {
         getPreMintedSecrets()?.unset("connector", decl.id);
@@ -4232,13 +4854,13 @@ function buildSessionResourceHandlers(deps) {
     addMount: (input) => add("mount", input),
     attachConnectorInstance,
     removeResource: async (input) => {
-      const rm2 = getResourceManager();
-      if (!rm2) return { ok: false, code: "no_session", message: "session resources not ready" };
-      if (!rm2.has(input.id)) {
+      const rm3 = getResourceManager();
+      if (!rm3) return { ok: false, code: "no_session", message: "session resources not ready" };
+      if (!rm3.has(input.id)) {
         return { ok: false, code: "not_found", message: `no resource with id ${input.id}` };
       }
       try {
-        await rm2.disconnect(input.id);
+        await rm3.disconnect(input.id);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         log(`[session-resource] runner.remove_resource failed for ${input.id}: ${message}`);
@@ -4254,8 +4876,8 @@ function buildSessionResourceHandlers(deps) {
     updateCredential: async (input) => {
       const ps = getPreMintedSecrets();
       if (!ps) return { ok: false, code: "no_session", message: "session resources not ready" };
-      const rm2 = getResourceManager();
-      if (rm2 && !rm2.has(input.id)) {
+      const rm3 = getResourceManager();
+      if (rm3 && !rm3.has(input.id)) {
         return { ok: false, code: "not_found", message: `no resource with id ${input.id}` };
       }
       ps.set(input.kind, input.id, input.mint);
@@ -4376,54 +4998,54 @@ function notImplemented(name) {
     message: `${name} handler not configured`
   };
 }
-var requiredUnknown = z5.unknown().refine(() => true);
-var preMintedTokenSchema = z5.object({
-  token: z5.string(),
-  expiresAt: z5.string().nullable().optional()
+var requiredUnknown = z7.unknown().refine(() => true);
+var preMintedTokenSchema = z7.object({
+  token: z7.string(),
+  expiresAt: z7.string().nullable().optional()
 }).optional();
-var mountDeclarationInput = z5.strictObject({
+var mountDeclarationInput = z7.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema,
   // The platform attaches a workspace-migration directive on add_mount; the
   // handler ignores it for now (replace-workspace hot-migration is a follow-up).
   // Accepted here so a real platform add_mount payload validates.
-  migration: z5.unknown().optional()
+  migration: z7.unknown().optional()
 });
-var connectorDeclarationInput = z5.strictObject({
+var connectorDeclarationInput = z7.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema
 });
-var addMcpServerInputSchema = z5.strictObject({
+var addMcpServerInputSchema = z7.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema
 });
-var attachInstanceInputSchema = z5.strictObject({
-  kind: z5.string(),
-  name: z5.string(),
+var attachInstanceInputSchema = z7.strictObject({
+  kind: z7.string(),
+  name: z7.string(),
   preMintedToken: preMintedTokenSchema
 });
-var removeResourceInput = z5.strictObject({
-  id: z5.string()
+var removeResourceInput = z7.strictObject({
+  id: z7.string()
 });
-var updateCredentialInput = z5.strictObject({
-  kind: z5.enum(["mount", "connector"]),
-  id: z5.string(),
+var updateCredentialInput = z7.strictObject({
+  kind: z7.enum(["mount", "connector"]),
+  id: z7.string(),
   // `CredentialMint` is a discriminated union from `@skaile/workspaces/types`.
   // We accept it as `z.unknown()` here because Zod can't easily mirror
   // a discriminated TypeScript union without duplicating the schema —
   // the platform side has already validated the shape before sending.
   mint: requiredUnknown
 });
-var setLogLevelInput = z5.strictObject({
-  level: z5.enum(["silent", "error", "warn", "info", "debug", "trace"])
+var setLogLevelInput = z7.strictObject({
+  level: z7.enum(["silent", "error", "warn", "info", "debug", "trace"])
 });
-var setStateInput = z5.strictObject({
-  store: z5.string(),
-  key: z5.string(),
+var setStateInput = z7.strictObject({
+  store: z7.string(),
+  key: z7.string(),
   value: requiredUnknown
 });
-var lifecycleInput = z5.strictObject({
-  phase: z5.enum(["hibernate", "close", "compact"])
+var lifecycleInput = z7.strictObject({
+  phase: z7.enum(["hibernate", "close", "compact"])
 });
 var VALID_LOG_STORE_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 function buildRunnerCapabilities(handlers) {
@@ -4721,9 +5343,9 @@ function createSessionStimulusBus(opts) {
         connectorId,
         fragmentLength: sig.promptFragment.length
       });
-      return new Promise((resolve4, reject) => {
+      return new Promise((resolve5, reject) => {
         const q = getQueue(connectorId);
-        q.pending.push({ signal: sig, resolve: resolve4, reject });
+        q.pending.push({ signal: sig, resolve: resolve5, reject });
         startTimerIfNeeded(connectorId, q, coalesceMs);
       });
     }
@@ -4808,6 +5430,9 @@ function pickRepointedManager(next, current, disposed) {
   if (current !== null && current === disposed) return null;
   return current;
 }
+function supportsLiveToolUpdates(driverType, managedCodex = false) {
+  return driverType !== "claude-sdk" && !(driverType === "codex" && managedCodex);
+}
 function buildResourcesAvailablePayload(manager, mcpManager, driverLive, bakedServerIds) {
   const { mounts, connectors } = splitConnectorsForWire(manager);
   const mcp_servers = (mcpManager?.listServers() ?? []).map((s) => ({
@@ -5053,19 +5678,19 @@ function createFlowConnectorReadiness(isReady) {
     wait(timeoutMs, isSatisfied) {
       const satisfied = isSatisfied ?? isReady;
       if (satisfied()) return Promise.resolve(true);
-      return new Promise((resolve4) => {
+      return new Promise((resolve5) => {
         let timer;
         const waiter = {
           satisfied,
           release: () => {
             clearTimeout(timer);
-            resolve4(true);
+            resolve5(true);
           }
         };
         timer = setTimeout(() => {
           const idx = waiters.indexOf(waiter);
           if (idx >= 0) waiters.splice(idx, 1);
-          resolve4(false);
+          resolve5(false);
         }, timeoutMs);
         timer.unref?.();
         waiters.push(waiter);
@@ -5416,10 +6041,20 @@ function stimulusFromMetas(metas) {
   return { kind: "state_changed" };
 }
 async function startAgentServer(opts) {
+  const managedHost = opts.managedCodex ? validateManagedCodexHost(opts.managedCodex, opts.projectDir) : void 0;
+  if (managedHost && opts.sessionId && opts.sessionId !== managedHost.sessionId)
+    throw new Error("CODEX_MANAGED_BOOTSTRAP_INVALID");
+  const authToken = opts.authToken ?? process.env.SKAILE_WS_AUTH_TOKEN;
+  if (managedHost && !opts.transport && !authToken)
+    throw new Error("CODEX_MANAGED_BOOTSTRAP_INVALID");
+  const supportedRuntimeFeatures = managedHost ? ["codex-app-server-v1"] : [];
+  let managedBootstrapClosed = false;
   const port = opts.port ?? 8080;
-  const sessionId = opts.sessionId ?? process.env.SKAILE_SESSION_ID ?? "session-unknown";
+  const sessionId = managedHost?.sessionId ?? opts.sessionId ?? process.env.SKAILE_SESSION_ID ?? "session-unknown";
   const resumeSessionId = opts.resumeSessionId ?? process.env.SKAILE_RESUME_SESSION_ID;
   const wsConfig = resolveSkWorkspaceConfig(opts.projectDir);
+  if (managedHost && wsConfig.agent?.["prompt-extensions"]?.length)
+    throw new Error("CODEX_MANAGED_PROMPT_EXTENSIONS_UNSUPPORTED");
   const { store: logStore, dispose: disposeLogStore } = bootstrapRunnerLogStore({
     sessionId,
     projectDir: opts.projectDir,
@@ -5445,7 +6080,6 @@ async function startAgentServer(opts) {
   } else {
     serverLog.warn("no agent definition found in skaile.yaml");
   }
-  const authToken = opts.authToken ?? process.env.SKAILE_WS_AUTH_TOKEN;
   const transport = opts.transport ?? new WebSocketServerTransport({ port, onLog: log, ...authToken ? { authToken } : {} });
   logStore.addSink(
     new WsLogSink({
@@ -5468,30 +6102,45 @@ async function startAgentServer(opts) {
   );
   bootstrapCapabilityRegistry(capabilityRegistry);
   const pendingCapabilityCalls = /* @__PURE__ */ new Map();
-  const remoteCapabilityInvoker = (name, input, timeoutMs) => {
+  const remoteCapabilityInvoker = (name, input, timeoutMs, signal) => {
     const callId = typeof crypto?.randomUUID === "function" ? crypto.randomUUID() : `rcap-${Date.now()}-${Math.floor(Math.random() * 1e9)}`;
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (!transport.connected) {
         reject(new Error(`Transport disconnected; cannot invoke remote capability ${name}`));
         return;
       }
-      const timer = setTimeout(() => {
+      if (signal?.aborted) {
+        reject(signal.reason);
+        return;
+      }
+      const finish = (error, value) => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", abort);
         pendingCapabilityCalls.delete(callId);
-        reject(new Error(`Remote capability ${name} (callId=${callId}) timed out`));
-      }, timeoutMs ?? DEFAULT_CAPABILITY_CALL_TIMEOUT_MS);
-      pendingCapabilityCalls.set(callId, { resolve: resolve4, reject, timer });
-      transport.send({
-        type: "capability_invoked",
-        callId,
-        name,
-        input,
-        invokedBy: "agent"
+        if (error) reject(error);
+        else resolve5(value);
+      };
+      const abort = () => finish(signal?.reason ?? new Error("Remote capability aborted"));
+      const timer = setTimeout(
+        () => finish(new Error(`Remote capability ${name} (callId=${callId}) timed out`)),
+        timeoutMs ?? DEFAULT_CAPABILITY_CALL_TIMEOUT_MS
+      );
+      pendingCapabilityCalls.set(callId, {
+        resolve: (value) => finish(null, value),
+        reject: (error) => finish(error),
+        timer
       });
+      signal?.addEventListener("abort", abort, { once: true });
+      try {
+        transport.send({ type: "capability_invoked", callId, name, input, invokedBy: "agent" });
+      } catch (error) {
+        finish(error);
+      }
     });
   };
   let aiProviderConfigId;
-  const sleep = (ms) => new Promise((resolve4) => {
-    const t = setTimeout(resolve4, ms);
+  const sleep = (ms) => new Promise((resolve5) => {
+    const t = setTimeout(resolve5, ms);
     t.unref?.();
   });
   async function mintAndPersistAiCredential(args) {
@@ -5642,11 +6291,12 @@ async function startAgentServer(opts) {
         if (!cap) return null;
         return capabilityRegistry.list().find((c) => c.name === name) ?? null;
       },
-      invoke: (name, input) => capabilityRegistry.invoke(name, input, { sessionId }),
+      invoke: (name, input, signal) => capabilityRegistry.invoke(name, input, { sessionId, signal }),
+      onToolsChanged: (listener) => capabilityRegistry.onToolsChanged(listener),
       emitRender: (event) => sendEvent(event),
-      emitText: (text) => sendEvent({
+      emitText: (text2) => sendEvent({
         type: "text",
-        content: text
+        content: text2
       })
     };
   }
@@ -5658,7 +6308,7 @@ async function startAgentServer(opts) {
       );
     }
   }
-  const secretsMode = wsConfig.secrets?.provider ?? "env";
+  const secretsMode = managedHost ? "provisioned" : wsConfig.secrets?.provider ?? "env";
   wsConfig.secrets?.timeoutMs ?? 3e4;
   const rawCloud = profile?.cloud ?? "default";
   const effectiveCloud = SUPPORTED_CLOUDS.includes(rawCloud) ? rawCloud : "default";
@@ -5670,6 +6320,7 @@ async function startAgentServer(opts) {
   const effectiveCloudConfig = cloudConfigFromProfile(profile);
   const diskProfileHasAgentSettings = (p) => !!p && !!(p.driver || p.provider || p.model || p.cloud || p.cloud_config || p.thinking || p.effort);
   function resolveEffectiveCloudForSession() {
+    if (managedCodex) return { cloud: "default" };
     if (effectiveCloud !== "default" || !wireAgentConfig) {
       return { cloud: effectiveCloud, cloudConfig: effectiveCloudConfig };
     }
@@ -5682,17 +6333,18 @@ async function startAgentServer(opts) {
     return {
       projectDir: opts.projectDir,
       agentDir,
-      driver: opts.driver ?? wireAgentConfig?.driver,
-      model: opts.model ?? wireAgentConfig?.model,
-      provider: opts.provider ?? wireAgentConfig?.provider,
+      driver: managedCodex ? "codex" : opts.driver ?? wireAgentConfig?.driver,
+      model: managedCodex ? wireAgentConfig?.model : opts.model ?? wireAgentConfig?.model,
+      provider: managedCodex ? "openai" : opts.provider ?? wireAgentConfig?.provider,
       promptsDir: opts.promptsDir,
       sessionId,
-      resumeSessionId,
+      resumeSessionId: managedCodex ? void 0 : resumeSessionId,
+      ...managedCodex ? { managedCodex } : {},
       maxTurns,
       wsConfig,
-      externalPromptFile: process.env.SKAILE_SYSTEM_PROMPT_FILE,
+      externalPromptFile: managedCodex ? void 0 : process.env.SKAILE_SYSTEM_PROMPT_FILE,
       secretProvider: secretProvider2,
-      onAuthError,
+      onAuthError: managedCodex ? void 0 : onAuthError,
       onLimitBlocked,
       onProviderResponse,
       ...apiKey ? { apiKey } : {},
@@ -5777,8 +6429,8 @@ async function startAgentServer(opts) {
   }
   let resolveSessionReady;
   let rejectSessionReady;
-  const sessionReady = new Promise((resolve4, reject) => {
-    resolveSessionReady = resolve4;
+  const sessionReady = new Promise((resolve5, reject) => {
+    resolveSessionReady = resolve5;
     rejectSessionReady = reject;
   });
   let sessionConfig;
@@ -5788,10 +6440,14 @@ async function startAgentServer(opts) {
   let preMintedSecrets;
   const liveAttachedMcpDeclarations = /* @__PURE__ */ new Map();
   let wireAgentConfig;
+  let managedCodex;
+  let managedInitFingerprint;
+  let managedInitComplete = false;
   let appliedWireAgentConfigKey;
   const stagedSkillDirs = /* @__PURE__ */ new Set();
   await restageMaterializedSkills(false);
   async function restageMaterializedSkills(allowRestart) {
+    if (managedHost) return;
     try {
       const { skillsDir } = resolveDriverPaths({
         driver: opts.driver ?? wsConfig.agent_config?.default?.driver ?? wireAgentConfig?.driver ?? "claude-sdk"
@@ -5841,7 +6497,7 @@ async function startAgentServer(opts) {
     captureBakedMcpServers();
   }
   let resourceManager = secretsMode === "env" ? agentSession.resourceManager : null;
-  const driverPicksUpToolsLive = () => agentSession?.driverType !== "claude-sdk";
+  const driverPicksUpToolsLive = () => supportsLiveToolUpdates(agentSession?.driverType, !!sessionConfig?.managedCodex);
   const emitResourcesAvailable = () => sendEvent(
     buildResourcesAvailablePayload(
       resourceManager,
@@ -6026,6 +6682,7 @@ async function startAgentServer(opts) {
     rebuildCompactionOrchestrator();
   }
   const activeFlows = /* @__PURE__ */ new Map();
+  let removeCodexFlowTools;
   let stimulusBus = null;
   const FLOW_TURN_TIMEOUT_MS = 4 * 60 * 60 * 1e3;
   function getOnlyActiveFlow() {
@@ -6098,7 +6755,7 @@ async function startAgentServer(opts) {
     return stimulusBus;
   }
   function awaitFlowAgentEnd(prompt, timeoutMs) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       let settled = false;
       const onEvent = (event) => {
         if (event.type === "agent_end") done();
@@ -6116,7 +6773,7 @@ async function startAgentServer(opts) {
           onEvent
         ) ?? driver.removeListener("agent-event", onEvent);
         if (err) reject(err);
-        else resolve4();
+        else resolve5();
       };
       const timer = setTimeout(
         () => done(new Error(`Flow turn timed out after ${timeoutMs / 1e3}s`)),
@@ -6149,6 +6806,8 @@ async function startAgentServer(opts) {
   async function createActiveFlow(flowDef, seedOrExecution) {
     const bus = getOrCreateStimulusBus();
     const nodeExecutor = new SessionNodeExecutor({ workspaceDir: opts.projectDir });
+    const managedSubprompts = sessionConfig.managedCodex?.subpromptModels;
+    if (sessionConfig.managedCodex && !managedSubprompts) throw new Error("AI_PROFILE_INVALID");
     const subpromptRunner = new SessionSubpromptRunner({
       driverType: agentSession.driverType,
       provider: agentSession.provider,
@@ -6157,7 +6816,34 @@ async function startAgentServer(opts) {
       apiKey: sessionConfig.apiKey,
       cloud: sessionConfig.cloud,
       cloudConfig: sessionConfig.cloudConfig,
-      cloudSecrets: sessionConfig.cloudSecrets
+      cloudSecrets: sessionConfig.cloudSecrets,
+      ...managedSubprompts ? {
+        modelTierOverrides: {
+          small: managedSubprompts.small,
+          default: agentSession.model,
+          deep: managedSubprompts.deep
+        },
+        availableModels: managedSubprompts.available,
+        createIsolatedDriver: async (model) => {
+          const parentPrivate = sessionConfig.managedCodex.runtime.privateDirectory;
+          const privateDirectory = await mkdtemp(join(dirname(parentPrivate), ".subprompt-"));
+          try {
+            const child = await createManagedCodexSubpromptDriver(
+              sessionConfig,
+              model,
+              opts.projectDir,
+              privateDirectory
+            );
+            return {
+              driver: child,
+              dispose: () => rm(privateDirectory, { recursive: true, force: true })
+            };
+          } catch (error) {
+            await rm(privateDirectory, { recursive: true, force: true });
+            throw error;
+          }
+        }
+      } : {}
     });
     const inlineSubFlowRunner = new SessionInlineSubFlowRunner({
       resolveFlow: (flowId) => loadFlow(resolveFlowPath(flowId, opts.projectDir)),
@@ -6233,6 +6919,10 @@ async function startAgentServer(opts) {
         log(`[serve] failed to rebuild MCP tools for flow: ${errMsg}`);
       }
     }
+    if (agentSession?.driverType === "codex" && !driver.acceptsReplyAsPrompt) {
+      removeCodexFlowTools?.();
+      removeCodexFlowTools = registerCodexFlowTools(capabilityRegistry, manager, connectorId);
+    }
     emitAvailability();
     const entry = {
       runId,
@@ -6298,18 +6988,20 @@ async function startAgentServer(opts) {
     });
   }
   async function cleanup() {
+    if (managedHost) managedBootstrapClosed = true;
     try {
       await Promise.race([
         sessionReady,
-        new Promise((resolve4) => {
-          const t = setTimeout(resolve4, 2e3);
+        new Promise((resolve5) => {
+          const t = setTimeout(resolve5, 2e3);
           t.unref?.();
         })
       ]);
     } catch {
     }
     try {
-      driver?.kill();
+      if (managedHost) await driver?.dispose();
+      else driver?.kill();
     } catch {
     }
     aiCredentialRefreshScheduler.cancel();
@@ -6400,11 +7092,11 @@ async function startAgentServer(opts) {
     let apiKeyFromSecrets;
     let cloudSecrets;
     const { cloud: initCloud } = resolveEffectiveCloudForSession();
-    if (initCloud === "default") {
+    if (!managedCodex && initCloud === "default") {
       const effectiveProvider = opts.provider ?? wireAgentConfig?.provider ?? "anthropic";
       const envKey = providerEnvKey(effectiveProvider);
       apiKeyFromSecrets = secrets?.[envKey];
-    } else {
+    } else if (!managedCodex) {
       ({ cloudSecrets } = resolveCloudSecretBundle({
         cloud: initCloud,
         secrets,
@@ -6420,7 +7112,12 @@ async function startAgentServer(opts) {
     let needsWireFallbackRecreate = false;
     const agentSessionExistedBeforeThisInit = !!agentSession;
     if (!agentSession) {
+      if (managedHost && managedBootstrapClosed) throw new Error("CODEX_RUNTIME_UNSUPPORTED");
       agentSession = await createAgentSession(sessionConfig);
+      if (managedHost && managedBootstrapClosed) {
+        await agentSession.dispose();
+        throw new Error("CODEX_RUNTIME_UNSUPPORTED");
+      }
       emitSystemPromptComposed(agentSession, sendEvent);
       resourceManager = agentSession.resourceManager;
       driver = agentSession.driver;
@@ -6466,8 +7163,8 @@ async function startAgentServer(opts) {
   async function recreateAgentSession(overrides) {
     let markSwapDone;
     driverSwapGate.beginSwap(
-      new Promise((resolve4) => {
-        markSwapDone = resolve4;
+      new Promise((resolve5) => {
+        markSwapDone = resolve5;
       })
     );
     try {
@@ -6481,8 +7178,13 @@ async function startAgentServer(opts) {
     const disposedManager = agentSession.resourceManager;
     const disposeStartedAt = Date.now();
     await agentSession.dispose();
+    if (managedHost && managedBootstrapClosed) throw new Error("CODEX_RUNTIME_UNSUPPORTED");
     const createStartedAt = Date.now();
     agentSession = await createAgentSession({ ...sessionConfig, ...overrides });
+    if (managedHost && managedBootstrapClosed) {
+      await agentSession.dispose();
+      throw new Error("CODEX_RUNTIME_UNSUPPORTED");
+    }
     logPhase("session_rebuild", disposeStartedAt, {
       disposeMs: createStartedAt - disposeStartedAt,
       createMs: Date.now() - createStartedAt,
@@ -6623,7 +7325,7 @@ async function startAgentServer(opts) {
     log(`[serve] aiResources catalog actions: ${catalogActions.length}`);
     try {
       const skillsDir = join(sessionConfig.projectDir ?? process.cwd(), ".claude", "skills");
-      const assetsRoot = process.env.SKAILE_ASSETS_ROOT ?? await findAiAssetsRoot(sessionConfig.projectDir ?? process.cwd()) ?? "/app/ai-assets";
+      const assetsRoot = process.env.SKAILE_ASSETS_ROOT ?? await findAiAssetsRoot$1(sessionConfig.projectDir ?? process.cwd()) ?? "/app/ai-assets";
       for (const res of catalogActions) {
         await applyCatalogAction(res, { assetsRoot, skillsDir });
       }
@@ -6719,6 +7421,7 @@ async function startAgentServer(opts) {
       }))
     });
   }
+  let runtimeRejected = false;
   async function handleSessionInit(cmd) {
     const initReceivedAt = Date.now();
     if (cmd.protocolVersion.major !== PROTOCOL_VERSION.major) {
@@ -6735,6 +7438,68 @@ async function startAgentServer(opts) {
       disposeLogStore();
       return;
     }
+    try {
+      validateCodexInit(cmd, supportedRuntimeFeatures, runtimeIdentity ?? void 0);
+      const wantsManaged = cmd.resolvedConfig.agentConfig?.driver === "codex";
+      if (managedHost && !wantsManaged) throw new Error("AI_PROFILE_INVALID");
+      if (managedHost && wantsManaged) {
+        if (managedBootstrapClosed || agentSession && !managedInitFingerprint || cmd.secrets && CLAUDE_CODE_CREDENTIALS_KEY in cmd.secrets)
+          throw new Error("AI_PROFILE_INVALID");
+        const profile2 = cmd.resolvedConfig.agentConfig;
+        if (opts.driver && opts.driver !== "codex" || opts.provider && opts.provider !== "openai" || opts.model && opts.model !== profile2.model)
+          throw new Error("AI_PROFILE_INVALID");
+        const initialCredential = parseCodexCredential(cmd.credentials.ai);
+        const binding = bindManagedCodexInit(managedHost, cmd, async (input, signal) => {
+          signal.throwIfAborted();
+          if (initialCredential.kind !== "codex-subscription")
+            throw new Error("AI_PROFILE_INVALID");
+          const pinned = { ...initialCredential, credentialVersion: input.credentialVersion };
+          const result = await remoteCapabilityInvoker(
+            "host.refresh_credential",
+            parseCodexRefreshInput(input, pinned),
+            void 0,
+            signal
+          );
+          signal.throwIfAborted();
+          return parseCodexRefreshResult(result, pinned);
+        });
+        const credential = binding.runtime.credential;
+        const fingerprint = JSON.stringify([
+          cmd.identity,
+          // A repeated init is idempotent only for the same host capability contract.
+          // Keep all policy fields, not only the narrower resume signature.
+          cmd.capabilities ?? [],
+          profile2,
+          credential.configId,
+          credential.kind,
+          credential.kind === "codex-subscription" ? credential.chatgptAccountId : null
+        ]);
+        if (managedInitFingerprint) {
+          if (managedInitFingerprint !== fingerprint) throw new Error("AI_PROFILE_INVALID");
+          if (managedInitComplete)
+            sendEvent({
+              type: "session_init_ack",
+              capabilitySignature: computeCapabilitySignature(capabilityRegistry.list())
+            });
+          return;
+        }
+        managedInitFingerprint = fingerprint;
+        managedCodex = binding;
+      }
+    } catch {
+      runtimeRejected = true;
+      sendEvent({
+        type: "error",
+        fatal: true,
+        category: "config",
+        message: "Unsupported runtime: managed Codex initialization is unavailable or invalid"
+      });
+      await cleanup();
+      teardownProcessHandlers();
+      disposeLogStore();
+      await transport.close();
+      return;
+    }
     if (runtimeIdentity && runtimeIdentity.containerId !== cmd.identity.containerId) {
       log(
         `[serve] session_init_mismatch: expected=${runtimeIdentity.containerId} received=${cmd.identity.containerId}`
@@ -6751,23 +7516,29 @@ async function startAgentServer(opts) {
     }
     runtimeIdentity = cmd.identity;
     registerInitClientCapabilities(cmd.capabilities ?? []);
-    sendEvent({ type: "protocol_info", version: PROTOCOL_VERSION });
+    sendEvent({
+      type: "protocol_info",
+      version: PROTOCOL_VERSION,
+      ...managedHost ? { runtimeFeatures: supportedRuntimeFeatures } : {}
+    });
     preMintedSecrets = new PreMintedSecretProvider(cmd.credentials);
     const initialAiCredentialExpiresAt = await provisionInitSecrets(cmd.secrets);
+    if (managedCodex) secretsProvisioned = true;
     if (cmd.resolvedConfig.aiProviderConfigId) {
       aiProviderConfigId = cmd.resolvedConfig.aiProviderConfigId;
       log(`[serve] stashed aiProviderConfigId=${aiProviderConfigId}`);
     }
-    wireAgentConfig = diskProfileHasAgentSettings(profile) ? void 0 : cmd.resolvedConfig.agentConfig ?? wireAgentConfig;
-    if (aiProviderConfigId && initialAiCredentialExpiresAt) {
+    wireAgentConfig = managedCodex ? cmd.resolvedConfig.agentConfig : diskProfileHasAgentSettings(profile) ? void 0 : cmd.resolvedConfig.agentConfig ?? wireAgentConfig;
+    if (!managedCodex && aiProviderConfigId && initialAiCredentialExpiresAt) {
       aiCredentialRefreshScheduler.schedule(initialAiCredentialExpiresAt);
     }
-    const resumeProbe = cmd.resume?.sessionId ? await probeResumeTranscript(cmd.resume.sessionId) : void 0;
-    sendEvent({
-      type: "session_init_ack",
-      capabilitySignature: computeCapabilitySignature(capabilityRegistry.list()),
-      ...resumeProbe ? { resumeProbe } : {}
-    });
+    const resumeProbe = !managedCodex && cmd.resume?.sessionId ? await probeResumeTranscript(cmd.resume.sessionId) : void 0;
+    if (!managedCodex)
+      sendEvent({
+        type: "session_init_ack",
+        capabilitySignature: computeCapabilitySignature(capabilityRegistry.list()),
+        ...resumeProbe ? { resumeProbe } : {}
+      });
     const buildSession = async () => {
       const firstBuildStartedAt = Date.now();
       const { needsWireFallbackRecreate, needsWireAgentConfigRecreate } = await buildSessionFromInit(cmd.secrets, resolvedConfigToDeclarations(cmd.resolvedConfig));
@@ -6785,7 +7556,7 @@ async function startAgentServer(opts) {
       log(
         `[serve] configure cfg keys=${Object.keys(cfg).join(",")} sharedState=${cfg.sharedState ? cfg.sharedState.length : "undefined"} resourceManager=${resourceManager ? "set" : "null"}`
       );
-      if (aiProviderConfigId) {
+      if (!managedCodex && aiProviderConfigId) {
         aiCredentialRefreshScheduler.ensureArmed();
       }
       let pendingResumeSessionId;
@@ -6831,6 +7602,33 @@ async function startAgentServer(opts) {
         ready: true,
         resumeRequested: !!cmd.resume?.sessionId
       });
+      if (managedCodex) {
+        if (managedBootstrapClosed) throw new Error("CODEX_RUNTIME_UNSUPPORTED");
+        try {
+          await ensureDriverStarted();
+        } catch (error) {
+          if (!(error instanceof CodexNativeStateUnavailable) || !pendingResumeSessionId || managedBootstrapClosed)
+            throw error;
+          await recreateAgentSession({ resumeSessionId: void 0 });
+          if (cfg.sharedState && !await applyInitSharedState(cfg.sharedState))
+            throw new Error("session_init: shared-state setup failed");
+          if (cfg.aiResources) await applyInitAiResources(cfg.aiResources);
+          await ensureDriverStarted();
+          if (managedBootstrapClosed || !driverStarted)
+            throw new Error("CODEX_RUNTIME_UNSUPPORTED");
+          sendEvent({
+            type: "resume_failed",
+            resumeSessionId: pendingResumeSessionId,
+            reason: "native_state_unavailable"
+          });
+        }
+        if (managedBootstrapClosed || !driverStarted) throw new Error("CODEX_RUNTIME_UNSUPPORTED");
+        managedInitComplete = true;
+        sendEvent({
+          type: "session_init_ack",
+          capabilitySignature: computeCapabilitySignature(capabilityRegistry.list())
+        });
+      }
       resolveSessionReady();
     };
     void buildSession().catch((err) => {
@@ -6839,6 +7637,14 @@ async function startAgentServer(opts) {
       log(`[serve] session_init failed to build session: ${errMsg}`);
       sendEvent({ type: "error", message: errMsg, fatal: true });
       rejectSessionReady(err instanceof Error ? err : new Error(errMsg));
+      if (managedHost) {
+        runtimeRejected = true;
+        void cleanup().finally(async () => {
+          teardownProcessHandlers();
+          disposeLogStore();
+          await transport.close();
+        });
+      }
     });
   }
   const awaitCompactionIdle = (what) => guardTurnAgainstCompaction({ gate: compactionGate, what, log, sendEvent });
@@ -6903,7 +7709,7 @@ async function startAgentServer(opts) {
     sendEvent({ type: "status", phase: "thinking" });
     const endTurn = driverSwapGate.beginTurn();
     try {
-      await driver.prompt(cmd.prompt);
+      await driver.promptInput({ text: cmd.prompt, attachments: cmd.attachments });
     } catch (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
       log(`[serve] prompt failed: ${errMsg}`);
@@ -6916,7 +7722,9 @@ async function startAgentServer(opts) {
     if (!await awaitSessionReadyOrFail()) return;
     log(`[serve] reply: ${cmd.answer.slice(0, 80)}...`);
     await driverSwapGate.awaitSwap();
-    if (driver.hasPendingQuestion() && driver.answerQuestion(cmd.answer, cmd.question)) return;
+    if (driver.hasPendingQuestion() && driver.answerQuestion(cmd.answer, cmd.question, cmd.requestId))
+      return;
+    if (!driver.acceptsReplyAsPrompt) return;
     if (!await awaitCompactionIdle("reply")) return;
     const endTurn = driverSwapGate.beginTurn();
     try {
@@ -7159,8 +7967,10 @@ async function startAgentServer(opts) {
     }
   }
   async function handleCommand(cmd) {
+    if (runtimeRejected || managedHost && managedBootstrapClosed) return;
     const inbound = cmd;
     if (isCredentialRotatedSignal(cmd)) {
+      if (managedCodex) return;
       await handleCredentialRotatedSignal({
         configId: readCredentialRotatedConfigId(cmd),
         repull: async (configId) => (await aiProviderConfigSwitcher.repull({
@@ -7251,6 +8061,14 @@ async function startAgentServer(opts) {
   transport.onCommand((cmd) => {
     void handleCommand(cmd);
   });
+  transport.onConnect(() => {
+    if (managedHost && !managedBootstrapClosed)
+      sendEvent({
+        type: "protocol_info",
+        version: PROTOCOL_VERSION,
+        runtimeFeatures: supportedRuntimeFeatures
+      });
+  });
   await transport.listen();
   if (secretsMode === "env" && agentSession) {
     agentSession.startWatching();
@@ -7275,7 +8093,9 @@ async function startAgentServer(opts) {
       sendEvent({ type: "commands_available", commands });
     }
   }
-  transport.onConnect(emitAvailability);
+  transport.onConnect(() => {
+    emitAvailability();
+  });
   async function replayStoreSnapshots() {
     if (!resourceManager) return;
     for (const event of await buildStoreSnapshotReplay(resourceManager, activeFlows.values())) {
@@ -7455,6 +8275,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickRepointedManager, planFlowMutate, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-I3COVVFB.js.map
-//# sourceMappingURL=chunk-I3COVVFB.js.map
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
+//# sourceMappingURL=chunk-RJOGAEIY.js.map
+//# sourceMappingURL=chunk-RJOGAEIY.js.map