@turns/dev 0.0.13 → 0.0.15

package/README.md

@@ -101,3 +101,53 @@ Against local Wrangler development, use the configured `DEV_USER` directly:
 turns daemon run --server http://127.0.0.1:8787 \
   --dev-user antimatter15 --directory /tmp/turns-driver-workspaces
 ```
+
+### Agent memory isolation and prompt recovery
+
+On Linux with systemd, each newly launched anchor runs in its own
+`turns-agent-*.scope`, including all of its harness and tool subprocesses.
+The installer also writes `turns-agents.slice`, which contains these scopes
+and enables systemd-oomd pressure monitoring at 40%. This targets an individual
+agent scope before pressure reaches the user manager's usual 50% threshold.
+Foreground launches still get individual scopes, but the
+parent slice's pressure policy requires running `turns install`.
+`OOMPolicy=kill` terminates that entire scope when a member is OOM-killed;
+other anchors and the uploader live in different cgroups. Turns imposes no
+per-agent RAM or swap limit: workloads share available host resources, and
+pressure handling selects an individual scope for termination. Scope creation requires an
+accessible systemd user manager, cgroup v2 memory control, and systemd 254 or
+newer. A launch failure is reported instead of silently running without
+isolation. macOS and Linux without systemd retain detached process launching.
+
+The Linux service records the installation PATH. Executable discovery and
+anchor environments also add the CLI's Node directory, `~/.local/bin`,
+`~/bin`, `~/.npm-global/bin`, `NPM_CONFIG_PREFIX/bin` when configured, and
+standard system/Homebrew directories. Explicit PATH entries retain priority;
+`TURNS_<HARNESS>_BIN` overrides and macOS app-bundled Codex preference remain
+in effect. Empty and relative PATH entries are excluded. Keeping Node on the
+anchor PATH also supports CLI wrappers using `#!/usr/bin/env node`.
+
+Queue dispatch now distinguishes optimistic transcript acknowledgement from
+durable delivery. New daemons request `dispatchTracking` when claiming and
+wait for `queue.renew` with `dispatchStarted: true` to be acknowledged before
+sending to the local anchor. The backend stores `pending` or `started` in
+`prompt_queue.dispatch_state`. A failure, lost anchor, or expired lease consumes
+a started queue entry; its transcript remains, and a user can submit a new
+follow-up to continue. Unsent prompts retain the existing paused/retry behavior.
+Surviving anchors retain their claims. A crash between the durable marker and
+local delivery is deliberately treated as uncertain delivery and is not
+replayed automatically.
+
+Deploy the backend before upgrading daemons. User DO schema version 20 adds
+`dispatch_state` without changing existing columns. Existing rows and claims
+from older daemons use `legacy`: acknowledged legacy claims are conservatively
+treated as started, since old daemons did not record a separate delivery
+boundary. This can consume a legacy optimistic-but-unsent prompt on failure;
+it prevents replay of work with unknown delivery state. New daemons refuse to
+send against backends that do not advertise dispatch tracking. Downgrade
+new daemons and drain active claims before rolling back the backend; an old
+backend ignores the new column and cannot provide the no-replay guarantee.
+Reinstall the Linux service with `turns install` after upgrading to persist its
+PATH. Existing warm anchors keep their old executable, environment, and cgroup
+until they exit; isolation applies to newly launched anchors. Previously
+requeued prompts are not automatically deleted by this migration.

package/dist/agent-anchor-client.js

@@ -6,6 +6,8 @@ import path from 'node:path';
 import readline from 'node:readline';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { executablePath } from "./executable-path.js";
+import { anchorLaunchCommand } from "./agent-isolation.js";
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 function withTimeout(promise, timeoutMs, label) {
     let timer;
@@ -188,17 +190,24 @@ export async function launchAgentAnchor(sessionId, timeoutMs = 15_000) {
     const logPath = path.join(logDirectory, `${path.basename(socketPath, '.sock')}.log`);
     const logFd = fs.openSync(logPath, 'a', 0o600);
     const entry = anchorEntryPoint();
-    const child = spawn(process.execPath, [entry, '--socket', socketPath], {
+    const launch = anchorLaunchCommand(entry, socketPath);
+    const child = spawn(launch.command, launch.args, {
         cwd: path.dirname(entry),
-        env: { ...process.env, TURNS_AGENT_ANCHOR_DIR: directory },
+        env: { ...process.env, PATH: executablePath(), TURNS_AGENT_ANCHOR_DIR: directory },
         detached: true,
         stdio: ['ignore', logFd, logFd],
     });
     fs.closeSync(logFd);
+    let spawnError;
+    child.once('error', (error) => {
+        spawnError = error;
+    });
     child.unref();
     const deadline = Date.now() + timeoutMs;
     let lastError;
     while (Date.now() < deadline) {
+        if (spawnError)
+            throw new Error(`Agent isolation launch failed: ${spawnError.message}. See ${logPath}`);
         if (child.exitCode !== null || child.signalCode !== null) {
             throw new Error(`Agent anchor exited before opening its socket (${child.signalCode || child.exitCode}). See ${logPath}`);
         }

package/dist/agent-anchor.js

@@ -9,7 +9,9 @@ import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath } from 'node:url';
 import { WebSocket } from 'ws';
 import { ACP_PROFILES, lettaHeadlessEnvironment, lettaSessionIdentity, PROCESS_HARNESSES, parseLettaSessionIdentity, processEventSessionId, processInvocation, RPC_PROFILES, resolveHarnessCommand, rpcFrameSessionIdentity, rpcUiRequestIsInformational, } from "./harness-registry.js";
+import { asyncQuestionInteractions, asyncQuestionReplyText, isAsyncQuestionInteraction, parseAsyncQuestionReplies, } from "./codex-async-questions.js";
 import { recordLettaSessionContext } from "./letta-session-context.js";
+import { recoverAsyncQuestion } from "./codex-async-question-recovery.js";
 const socketIndex = process.argv.indexOf('--socket');
 const socketPath = socketIndex >= 0 ? path.resolve(process.argv[socketIndex + 1] || '') : '';
 if (!socketPath)
@@ -500,6 +502,7 @@ class CodexAppServerTransport extends LineTransport {
     turnId;
     turnIdWaiter;
     turnWaiter;
+    asyncQuestionsSeen = new Set();
     constructor(anchor) {
         const profile = { command: 'codex' };
         const mcp = `mcp_servers.turns={command=${JSON.stringify(process.execPath)},args=[${JSON.stringify(questionMcpPath)}],env={TURNS_AGENT_ANCHOR_SOCKET=${JSON.stringify(socketPath)}}}`;
@@ -516,6 +519,32 @@ class CodexAppServerTransport extends LineTransport {
         this.turnId = String(turnId);
         this.turnIdWaiter?.resolve(this.turnId);
     }
+    registerAsyncQuestion(interaction) {
+        if (this.asyncQuestionsSeen.has(interaction.id))
+            return;
+        this.asyncQuestionsSeen.add(interaction.id);
+        void this.anchor
+            .askInteraction(interaction.request, {
+            id: interaction.id,
+            onAnswer: async (response) => {
+                const text = asyncQuestionReplyText(interaction, response);
+                if (this.turnWaiter)
+                    await this.steer(text);
+                else
+                    await this.anchor.startAsyncQuestionReply(text);
+            },
+        })
+            .catch(() => { });
+    }
+    async recoverAsyncQuestion(interactionId) {
+        if (this.asyncQuestionsSeen.has(interactionId))
+            return;
+        const interaction = await recoverAsyncQuestion(this.anchor.transcriptPath, interactionId);
+        // Registration checks again after the read: a live question or answer may
+        // have arrived while the transcript was being scanned.
+        if (interaction)
+            this.registerAsyncQuestion(interaction);
+    }
     onFrame(frame) {
         if (!frame || typeof frame !== 'object')
             return;
@@ -534,6 +563,24 @@ class CodexAppServerTransport extends LineTransport {
             return;
         }
         const ours = !frame.params?.threadId || frame.params.threadId === this.threadId;
+        if (ours && frame.method === 'item/completed') {
+            const item = frame.params?.item;
+            if (item?.type === 'agentMessage' && item.delivery === 'async') {
+                for (const interaction of asyncQuestionInteractions(item.id, item.questions)) {
+                    this.registerAsyncQuestion(interaction);
+                }
+            }
+            if (item?.type === 'userMessage') {
+                const text = (item.content || [])
+                    .filter((part) => part.type === 'text')
+                    .map((part) => part.text)
+                    .join('\n');
+                for (const reply of parseAsyncQuestionReplies(text)?.replies || []) {
+                    this.asyncQuestionsSeen.add(reply.questionItemId);
+                    this.anchor.resolveInteraction(reply.questionItemId, { answers: { [reply.questionItemId]: [reply.answer] } });
+                }
+            }
+        }
         if (frame.method === 'turn/started' && ours)
             this.setTurnId(frame.params?.turnId || frame.params?.turn?.id);
         if (['turn/completed', 'turn/failed', 'turn/aborted'].includes(frame.method) && ours && this.turnWaiter) {
@@ -628,8 +675,15 @@ class CodexAppServerTransport extends LineTransport {
         this.threadId = threadId;
         if (threadId !== this.anchor.agentSessionId)
             this.anchor.updateIdentity(threadId);
+        // Resume returns persisted thread items, including questions asked by a
+        // previous app-server connection. Rebuild only the still-unanswered items.
+        for (const turn of opened?.thread?.turns || []) {
+            for (const item of turn.items || []) {
+                this.onFrame({ method: 'item/completed', params: { threadId, item } });
+            }
+        }
     }
-    async prompt(text, timeoutMs) {
+    async prompt(text, timeoutMs, onAccepted = () => { }) {
         if (this.turnWaiter)
             throw new Error('Codex already has an active turn.');
         const waiter = deferred();
@@ -641,10 +695,10 @@ class CodexAppServerTransport extends LineTransport {
                 this.turnWaiter = null;
             this.turnIdWaiter?.resolve('');
             this.turnIdWaiter = null;
-            waiter.reject(error);
             throw error;
         });
         this.setTurnId(started?.turn?.id || started?.turnId);
+        onAccepted();
         const timer = setTimeout(() => {
             if (this.turnWaiter === waiter)
                 this.turnWaiter = null;
@@ -1389,20 +1443,45 @@ class Anchor {
     }
     askInteraction(request, options = {}) {
         const interaction = {
-            id: crypto.randomUUID(),
+            id: options.id || crypto.randomUUID(),
             harness: this.source,
             request,
         };
         const waiter = deferred();
         clearTimeout(this.idleTimer);
-        this.pendingInteractions.set(interaction.id, { interaction, waiter, onExpire: options.onExpire });
+        this.pendingInteractions.set(interaction.id, {
+            interaction,
+            waiter,
+            onExpire: options.onExpire,
+            onAnswer: options.onAnswer,
+            answering: false,
+        });
         this.emitLive({ event: 'user.interaction', agent: this.source, phase: 'queued', interaction });
         return waiter.promise;
     }
-    answerInteraction(interactionId, response) {
+    async answerInteraction(interactionId, response) {
+        if (!this.pendingInteractions.has(interactionId) && this.transport instanceof CodexAppServerTransport) {
+            await this.transport.recoverAsyncQuestion(interactionId);
+        }
         const pending = this.pendingInteractions.get(interactionId);
         if (!pending)
             throw new Error('The interaction is no longer waiting in this harness.');
+        if (pending.answering)
+            throw new Error('This answer is already being submitted.');
+        pending.answering = true;
+        try {
+            await pending.onAnswer?.(response);
+            this.resolveInteraction(interactionId, response);
+            return { answered: true, interactionId };
+        }
+        finally {
+            pending.answering = false;
+        }
+    }
+    resolveInteraction(interactionId, response) {
+        const pending = this.pendingInteractions.get(interactionId);
+        if (!pending)
+            return;
         this.pendingInteractions.delete(interactionId);
         this.emitLive({
             event: 'user.interaction_answer',
@@ -1416,6 +1495,49 @@ class Anchor {
             this.scheduleExit();
         return { answered: true, interactionId };
     }
+    async startAsyncQuestionReply(text) {
+        if (this.status === 'running')
+            throw new Error('The previous turn is still finishing; submit the answer again.');
+        const previousTurn = this.currentTurn;
+        const messageId = crypto.randomUUID();
+        const accepted = deferred();
+        let started = false;
+        this.currentTurn = {
+            messageId,
+            claimToken: '',
+            prompt: text,
+            expectedText: text,
+            status: 'running',
+            accepted: true,
+            startedAt: now(),
+            completedAt: null,
+            result: null,
+        };
+        this.setStatus('running');
+        void this.transport
+            .prompt(text, this.turnTimeoutMs, () => {
+            started = true;
+            this.emitLive({
+                event: 'turn.start',
+                agent: this.source,
+                phase: 'queued',
+                messageId,
+                displayPrompt: text,
+                prompt: text,
+            });
+            accepted.resolve();
+        })
+            .then(() => this.finish({ exitCode: 0, signal: null, timedOut: false, error: null }), (error) => {
+            if (started)
+                this.finish({ exitCode: 1, error: { message: errorText(error) } });
+            else {
+                this.currentTurn = previousTurn;
+                this.setStatus('idle');
+                accepted.reject(error);
+            }
+        });
+        await accepted.promise;
+    }
     expirePendingInteractions(reason) {
         const error = new Error(reason);
         for (const [interactionId, pending] of this.pendingInteractions) {
@@ -1469,7 +1591,7 @@ class Anchor {
         }
         if (this.status === 'running')
             throw new Error('The anchored agent is already running a turn.');
-        if (this.pendingInteractions.size)
+        if ([...this.pendingInteractions.values()].some((pending) => !isAsyncQuestionInteraction(pending.interaction)))
             throw new Error('The anchored agent is awaiting user input.');
         for (const key of ['source', 'sessionId', 'agentSessionId', 'messageId'])
             if (!request[key])

package/dist/agent-isolation.js

@@ -0,0 +1,29 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const AGENT_SLICE_NAME = 'turns-agents.slice';
+/** A detached process group still belongs to its parent's memory cgroup. */
+export function anchorLaunchCommand(entry, socketPath, { platform = process.platform, systemd = fs.existsSync('/run/systemd/system'), execPath = process.execPath, } = {}) {
+    const args = [entry, '--socket', socketPath];
+    if (platform !== 'linux' || !systemd)
+        return { command: execPath, args };
+    // A scope preserves the caller's environment and working directory. Failure
+    // must not silently fall back to putting an agent in the daemon's cgroup.
+    return {
+        command: '/usr/bin/systemd-run',
+        args: [
+            '--user',
+            '--scope',
+            `--slice=${AGENT_SLICE_NAME}`,
+            '--quiet',
+            '--no-ask-password',
+            '--collect',
+            '--expand-environment=no',
+            `--unit=turns-agent-${path.basename(socketPath, '.sock')}`,
+            '--property=OOMPolicy=kill',
+            '--property=MemoryAccounting=yes',
+            '--',
+            execPath,
+            ...args,
+        ],
+    };
+}

package/dist/codex-account.js

@@ -0,0 +1,86 @@
+import { spawn } from 'node:child_process';
+import os from 'node:os';
+/** Only copy public account metadata; never forward credentials or raw output. */
+export function parseCodexAccount(result) {
+    if (!result || typeof result !== 'object' || !('account' in result))
+        return null;
+    const account = result.account;
+    if (account === null)
+        return { authenticated: false };
+    if (!account || typeof account !== 'object' || !('type' in account))
+        return null;
+    if (account.type === 'apiKey')
+        return { authenticated: true, account: 'API key' };
+    if (account.type !== 'chatgpt')
+        return null;
+    const email = 'email' in account && typeof account.email === 'string' ? account.email.trim().slice(0, 400) : '';
+    const plan = 'planType' in account && typeof account.planType === 'string' ? account.planType.trim().slice(0, 80) : '';
+    return {
+        authenticated: true,
+        account: [email || 'ChatGPT', plan ? `(${plan})` : ''].filter(Boolean).join(' '),
+    };
+}
+/** A short-lived, read-only app-server connection, using Codex's own credential
+ * store (including keychain). No thread or turn is created, and no token refresh
+ * is requested. Failure falls back to login status in the auth manager.
+ * https://developers.openai.com/codex/app-server#1-check-auth-state */
+export function readCodexAccountStatus(command, timeoutMs = 10_000) {
+    return new Promise((resolve) => {
+        const child = spawn(command, ['app-server', '--listen', 'stdio://'], {
+            cwd: os.homedir(),
+            env: process.env,
+            stdio: ['pipe', 'pipe', 'ignore'],
+        });
+        let settled = false;
+        let initialized = false;
+        let buffer = '';
+        const finish = (answer = null) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.stdin.destroy();
+            child.kill('SIGKILL');
+            resolve(answer);
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        timer.unref?.();
+        const send = (frame) => child.stdin.write(`${JSON.stringify(frame)}\n`);
+        child.on('error', () => finish());
+        child.on('close', () => finish());
+        child.stdin.on('error', () => finish());
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            buffer += chunk;
+            if (buffer.length > 64 * 1024)
+                return finish();
+            while (!settled) {
+                const newline = buffer.indexOf('\n');
+                if (newline < 0)
+                    break;
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                let frame;
+                try {
+                    frame = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (!frame || frame.method)
+                    continue;
+                if (frame.id === 1 && !initialized) {
+                    if (frame.error || !frame.result)
+                        return finish();
+                    initialized = true;
+                    send({ method: 'initialized', params: {} });
+                    send({ id: 2, method: 'account/read', params: { refreshToken: false } });
+                }
+                else if (frame.id === 2 && initialized) {
+                    finish(frame.error ? null : parseCodexAccount(frame.result));
+                }
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'turns.dev', version: '1' } } });
+    });
+}

package/dist/codex-async-question-recovery.js

@@ -0,0 +1,98 @@
+import fs from 'node:fs';
+import readline from 'node:readline';
+import { ASYNC_QUESTION_TOOL, asyncQuestionInteractions, parseAsyncQuestionReplies } from "./codex-async-questions.js";
+export function isAsyncQuestionId(value) {
+    if (typeof value !== 'string')
+        return false;
+    try {
+        const id = JSON.parse(value);
+        return (Array.isArray(id) &&
+            id.length === 3 &&
+            id[0] === ASYNC_QUESTION_TOOL &&
+            typeof id[1] === 'string' &&
+            !!id[1] &&
+            Number.isSafeInteger(id[2]) &&
+            id[2] >= 0 &&
+            JSON.stringify(id) === value);
+    }
+    catch {
+        return false;
+    }
+}
+/** Recover only delivered, unanswered questions from this anchor's own rollout.
+ * A question can be absent from the live/resumed item projection while the
+ * viewer reconstructs it from the native transcript. Never trust a browser-supplied
+ * question or revive a blocking tool request that has already finished.
+ */
+export async function recoverAsyncQuestion(transcriptPath, interactionId) {
+    if (!isAsyncQuestionId(interactionId))
+        return null;
+    const [, callId] = JSON.parse(interactionId);
+    let candidate = null;
+    let delivered = false;
+    const stream = fs.createReadStream(transcriptPath, { encoding: 'utf8' });
+    const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+        for await (const line of lines) {
+            let doc;
+            try {
+                doc = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            const payload = doc?.payload;
+            if (!payload)
+                continue;
+            const item = doc.type === 'event_msg' && payload.type === 'item_completed' ? payload.item : null;
+            if (item?.type === 'AgentMessage' && item.delivery === 'async' && item.id === callId) {
+                candidate =
+                    asyncQuestionInteractions(item.id, item.questions).find((question) => question.id === interactionId) || null;
+                delivered = true;
+            }
+            if (doc.type === 'response_item' && payload.call_id === callId) {
+                if (['function_call', 'custom_tool_call'].includes(payload.type) &&
+                    [ASYNC_QUESTION_TOOL, `functions.${ASYNC_QUESTION_TOOL}`].includes(payload.name)) {
+                    try {
+                        const input = JSON.parse(payload.arguments ?? payload.input);
+                        candidate =
+                            asyncQuestionInteractions(callId, input?.questions).find((question) => question.id === interactionId) ||
+                                null;
+                    }
+                    catch { }
+                }
+                if (['function_call_output', 'custom_tool_call_output'].includes(payload.type)) {
+                    try {
+                        delivered = JSON.parse(payload.output)?.accepted === true;
+                    }
+                    catch {
+                        delivered = false;
+                    }
+                }
+            }
+            const content = item?.type === 'UserMessage'
+                ? item.content
+                : doc.type === 'response_item' && payload.type === 'message' && payload.role === 'user'
+                    ? payload.content
+                    : null;
+            if (Array.isArray(content)) {
+                const text = content
+                    .filter((part) => ['text', 'input_text'].includes(part?.type))
+                    .map((part) => part.text)
+                    .join('\n');
+                if (parseAsyncQuestionReplies(text)?.replies.some((reply) => reply.questionItemId === interactionId))
+                    return null;
+            }
+        }
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+    return delivered ? candidate : null;
+}

package/dist/codex-async-questions.js

@@ -0,0 +1,84 @@
+// Pure wire helpers shared by the anchor, transcript reducer, and viewer.
+export const ASYNC_QUESTION_TOOL = 'request_user_input_async';
+export function asyncQuestionInteractions(callId, value) {
+    if (typeof callId !== 'string' || !callId || !Array.isArray(value))
+        return [];
+    return value.flatMap((question, index) => {
+        if (!question || typeof question.title !== 'string' || !question.title.trim())
+            return [];
+        const id = JSON.stringify([ASYNC_QUESTION_TOOL, callId, index]);
+        return [
+            {
+                id,
+                harness: 'codex',
+                request: {
+                    method: ASYNC_QUESTION_TOOL,
+                    params: {
+                        questions: [
+                            {
+                                id,
+                                title: question.title,
+                                ...(Array.isArray(question.options)
+                                    ? { options: question.options.filter((option) => typeof option === 'string') }
+                                    : {}),
+                            },
+                        ],
+                    },
+                },
+            },
+        ];
+    });
+}
+export function isAsyncQuestionInteraction(value) {
+    const interaction = value;
+    return interaction?.harness === 'codex' && interaction.request?.method === ASYNC_QUESTION_TOOL;
+}
+export function parseAsyncQuestionReplies(text) {
+    const pattern = /<send_user_message_question_reply>\s*([\s\S]*?)\s*<\/send_user_message_question_reply>/g;
+    const replies = [];
+    const remainingText = text
+        .replace(pattern, (block, body) => {
+        try {
+            const rows = JSON.parse(body);
+            if (!Array.isArray(rows) || !rows.length)
+                return block;
+            const valid = rows.every((row) => {
+                if (typeof row?.questionItemId !== 'string' ||
+                    typeof row.question !== 'string' ||
+                    typeof row.answer !== 'string')
+                    return false;
+                const id = JSON.parse(row.questionItemId);
+                return (Array.isArray(id) &&
+                    id.length === 3 &&
+                    id[0] === ASYNC_QUESTION_TOOL &&
+                    typeof id[1] === 'string' &&
+                    !!id[1] &&
+                    Number.isSafeInteger(id[2]) &&
+                    id[2] >= 0);
+            });
+            if (!valid)
+                return block;
+            replies.push(...rows);
+            return '';
+        }
+        catch {
+            return block;
+        }
+    })
+        .trim();
+    return replies.length ? { replies, remainingText } : null;
+}
+export function asyncQuestionReplyText(interaction, response) {
+    const answers = response?.answers;
+    const question = interaction.request.params.questions[0];
+    const values = answers?.[question.id];
+    if (!Array.isArray(values) || values.length !== 1 || typeof values[0] !== 'string' || !values[0].trim())
+        throw new Error('Choose an option or enter an answer before submitting.');
+    return `<send_user_message_question_reply>\n${JSON.stringify([
+        {
+            questionItemId: question.id,
+            question: question.title,
+            answer: values[0],
+        },
+    ])}\n</send_user_message_question_reply>`;
+}

package/dist/codex-update.js

@@ -1,7 +1,7 @@
 /** Machine-local Codex CLI self-update, callable by the Turns daemon. */
 import { spawn } from 'node:child_process';
 import os from 'node:os';
-import { resolveHarnessCommand } from "./harness-registry.js";
+import { codexCommandIsAppManaged, resolveHarnessCommand } from "./harness-registry.js";
 const VERSION_TIMEOUT_MS = 15_000;
 const UPDATE_TIMEOUT_MS = 5 * 60_000;
 const OUTPUT_LIMIT = 64 * 1024;
@@ -58,20 +58,28 @@ function commandFailure(result, fallback) {
 }
 export function createCodexUpdateManager(dependencies = {}) {
     const resolveCommand = dependencies.resolveCommand || (() => resolveHarnessCommand('codex'));
+    const isAppManaged = dependencies.isAppManaged || codexCommandIsAppManaged;
     const run = dependencies.run || runCommand;
     let active = null;
+    const updateCommand = () => {
+        const command = resolveCommand();
+        if (isAppManaged(command)) {
+            throw new Error('Codex is managed by the macOS app. Update the Codex app to update its bundled CLI.');
+        }
+        return command;
+    };
     const perform = async () => {
-        const beforeRun = await run(resolveCommand(), ['--version'], VERSION_TIMEOUT_MS);
+        const beforeRun = await run(updateCommand(), ['--version'], VERSION_TIMEOUT_MS);
         if (beforeRun.failed || beforeRun.timedOut || beforeRun.exitCode !== 0) {
             throw commandFailure(beforeRun, 'Codex is not installed or its version could not be read.');
         }
         const previousVersion = parseCodexVersion(beforeRun.output);
-        const updateRun = await run(resolveCommand(), ['update'], UPDATE_TIMEOUT_MS);
+        const updateRun = await run(updateCommand(), ['update'], UPDATE_TIMEOUT_MS);
         if (updateRun.failed || updateRun.timedOut || updateRun.exitCode !== 0) {
             throw commandFailure(updateRun, 'Codex could not update itself. Run `codex update` in a terminal on the machine.');
         }
         // Resolve again because the updater may replace a shim or install path.
-        const afterRun = await run(resolveCommand(), ['--version'], VERSION_TIMEOUT_MS);
+        const afterRun = await run(updateCommand(), ['--version'], VERSION_TIMEOUT_MS);
         if (afterRun.failed || afterRun.timedOut || afterRun.exitCode !== 0) {
             throw commandFailure(afterRun, 'Codex updated, but its new version could not be read.');
         }
@@ -83,6 +91,15 @@ export function createCodexUpdateManager(dependencies = {}) {
         };
     };
     return {
+        /** App-bundled Codex is updated with the app, not by its CLI command. */
+        available() {
+            try {
+                return !isAppManaged(resolveCommand());
+            }
+            catch {
+                return false;
+            }
+        },
         /** Concurrent clicks share one installer process instead of racing writes. */
         update() {
             if (!active)