@turns/dev 0.0.14 → 0.0.16

package/README.md

@@ -101,3 +101,53 @@ Against local Wrangler development, use the configured `DEV_USER` directly:
 turns daemon run --server http://127.0.0.1:8787 \
   --dev-user antimatter15 --directory /tmp/turns-driver-workspaces
 ```
+
+### Agent memory isolation and prompt recovery
+
+On Linux with systemd, each newly launched anchor runs in its own
+`turns-agent-*.scope`, including all of its harness and tool subprocesses.
+The installer also writes `turns-agents.slice`, which contains these scopes
+and enables systemd-oomd pressure monitoring at 40%. This targets an individual
+agent scope before pressure reaches the user manager's usual 50% threshold.
+Foreground launches still get individual scopes, but the
+parent slice's pressure policy requires running `turns install`.
+`OOMPolicy=kill` terminates that entire scope when a member is OOM-killed;
+other anchors and the uploader live in different cgroups. Turns imposes no
+per-agent RAM or swap limit: workloads share available host resources, and
+pressure handling selects an individual scope for termination. Scope creation requires an
+accessible systemd user manager, cgroup v2 memory control, and systemd 254 or
+newer. A launch failure is reported instead of silently running without
+isolation. macOS and Linux without systemd retain detached process launching.
+
+The Linux service records the installation PATH. Executable discovery and
+anchor environments also add the CLI's Node directory, `~/.local/bin`,
+`~/bin`, `~/.npm-global/bin`, `NPM_CONFIG_PREFIX/bin` when configured, and
+standard system/Homebrew directories. Explicit PATH entries retain priority;
+`TURNS_<HARNESS>_BIN` overrides and macOS app-bundled Codex preference remain
+in effect. Empty and relative PATH entries are excluded. Keeping Node on the
+anchor PATH also supports CLI wrappers using `#!/usr/bin/env node`.
+
+Queue dispatch now distinguishes optimistic transcript acknowledgement from
+durable delivery. New daemons request `dispatchTracking` when claiming and
+wait for `queue.renew` with `dispatchStarted: true` to be acknowledged before
+sending to the local anchor. The backend stores `pending` or `started` in
+`prompt_queue.dispatch_state`. A failure, lost anchor, or expired lease consumes
+a started queue entry; its transcript remains, and a user can submit a new
+follow-up to continue. Unsent prompts retain the existing paused/retry behavior.
+Surviving anchors retain their claims. A crash between the durable marker and
+local delivery is deliberately treated as uncertain delivery and is not
+replayed automatically.
+
+Deploy the backend before upgrading daemons. User DO schema version 20 adds
+`dispatch_state` without changing existing columns. Existing rows and claims
+from older daemons use `legacy`: acknowledged legacy claims are conservatively
+treated as started, since old daemons did not record a separate delivery
+boundary. This can consume a legacy optimistic-but-unsent prompt on failure;
+it prevents replay of work with unknown delivery state. New daemons refuse to
+send against backends that do not advertise dispatch tracking. Downgrade
+new daemons and drain active claims before rolling back the backend; an old
+backend ignores the new column and cannot provide the no-replay guarantee.
+Reinstall the Linux service with `turns install` after upgrading to persist its
+PATH. Existing warm anchors keep their old executable, environment, and cgroup
+until they exit; isolation applies to newly launched anchors. Previously
+requeued prompts are not automatically deleted by this migration.

package/dist/agent-anchor-client.js

@@ -6,6 +6,8 @@ import path from 'node:path';
 import readline from 'node:readline';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { executablePath } from "./executable-path.js";
+import { anchorLaunchCommand } from "./agent-isolation.js";
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 function withTimeout(promise, timeoutMs, label) {
     let timer;
@@ -188,17 +190,24 @@ export async function launchAgentAnchor(sessionId, timeoutMs = 15_000) {
     const logPath = path.join(logDirectory, `${path.basename(socketPath, '.sock')}.log`);
     const logFd = fs.openSync(logPath, 'a', 0o600);
     const entry = anchorEntryPoint();
-    const child = spawn(process.execPath, [entry, '--socket', socketPath], {
+    const launch = anchorLaunchCommand(entry, socketPath);
+    const child = spawn(launch.command, launch.args, {
         cwd: path.dirname(entry),
-        env: { ...process.env, TURNS_AGENT_ANCHOR_DIR: directory },
+        env: { ...process.env, PATH: executablePath(), TURNS_AGENT_ANCHOR_DIR: directory },
         detached: true,
         stdio: ['ignore', logFd, logFd],
     });
     fs.closeSync(logFd);
+    let spawnError;
+    child.once('error', (error) => {
+        spawnError = error;
+    });
     child.unref();
     const deadline = Date.now() + timeoutMs;
     let lastError;
     while (Date.now() < deadline) {
+        if (spawnError)
+            throw new Error(`Agent isolation launch failed: ${spawnError.message}. See ${logPath}`);
         if (child.exitCode !== null || child.signalCode !== null) {
             throw new Error(`Agent anchor exited before opening its socket (${child.signalCode || child.exitCode}). See ${logPath}`);
         }

package/dist/agent-anchor.js

@@ -9,7 +9,9 @@ import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath } from 'node:url';
 import { WebSocket } from 'ws';
 import { ACP_PROFILES, lettaHeadlessEnvironment, lettaSessionIdentity, PROCESS_HARNESSES, parseLettaSessionIdentity, processEventSessionId, processInvocation, RPC_PROFILES, resolveHarnessCommand, rpcFrameSessionIdentity, rpcUiRequestIsInformational, } from "./harness-registry.js";
+import { asyncQuestionInteractions, asyncQuestionReplyText, isAsyncQuestionInteraction, parseAsyncQuestionReplies, } from "./codex-async-questions.js";
 import { recordLettaSessionContext } from "./letta-session-context.js";
+import { recoverAsyncQuestion } from "./codex-async-question-recovery.js";
 const socketIndex = process.argv.indexOf('--socket');
 const socketPath = socketIndex >= 0 ? path.resolve(process.argv[socketIndex + 1] || '') : '';
 if (!socketPath)
@@ -186,6 +188,7 @@ class LineTransport {
     }
 }
 class ClaudeTransport extends LineTransport {
+    backgroundTasks = new Set();
     sessionId;
     permissionMode;
     turnWaiter;
@@ -225,6 +228,18 @@ class ClaudeTransport extends LineTransport {
     onFrame(frame) {
         if (!frame || typeof frame !== 'object')
             return;
+        if (frame.type === 'system' && typeof frame.task_id === 'string') {
+            if (frame.subtype === 'task_started' && frame.is_backgrounded !== false) {
+                this.backgroundTasks.add(frame.task_id);
+            }
+            else if (frame.subtype === 'task_notification') {
+                this.backgroundTasks.delete(frame.task_id);
+            }
+            // A result completes the foreground prompt, not the tasks it launched.
+            // Keep accepting new prompts while those tasks retain the warm process.
+            if (this.anchor.status === 'idle')
+                this.anchor.scheduleExit();
+        }
         if (frame.type === 'system' && frame.subtype === 'init' && frame.session_id) {
             this.sessionId = String(frame.session_id);
             if (this.sessionId !== this.anchor.agentSessionId)
@@ -254,6 +269,9 @@ class ClaudeTransport extends LineTransport {
             void this.answerReverse(frame);
     }
     onClose(error) {
+        this.backgroundTasks.clear();
+        if (this.anchor.status === 'idle')
+            this.anchor.scheduleExit();
         if (this.turnWaiter) {
             this.turnWaiter.reject(error);
             this.turnWaiter = null;
@@ -500,6 +518,7 @@ class CodexAppServerTransport extends LineTransport {
     turnId;
     turnIdWaiter;
     turnWaiter;
+    asyncQuestionsSeen = new Set();
     constructor(anchor) {
         const profile = { command: 'codex' };
         const mcp = `mcp_servers.turns={command=${JSON.stringify(process.execPath)},args=[${JSON.stringify(questionMcpPath)}],env={TURNS_AGENT_ANCHOR_SOCKET=${JSON.stringify(socketPath)}}}`;
@@ -516,6 +535,32 @@ class CodexAppServerTransport extends LineTransport {
         this.turnId = String(turnId);
         this.turnIdWaiter?.resolve(this.turnId);
     }
+    registerAsyncQuestion(interaction) {
+        if (this.asyncQuestionsSeen.has(interaction.id))
+            return;
+        this.asyncQuestionsSeen.add(interaction.id);
+        void this.anchor
+            .askInteraction(interaction.request, {
+            id: interaction.id,
+            onAnswer: async (response) => {
+                const text = asyncQuestionReplyText(interaction, response);
+                if (this.turnWaiter)
+                    await this.steer(text);
+                else
+                    await this.anchor.startAsyncQuestionReply(text);
+            },
+        })
+            .catch(() => { });
+    }
+    async recoverAsyncQuestion(interactionId) {
+        if (this.asyncQuestionsSeen.has(interactionId))
+            return;
+        const interaction = await recoverAsyncQuestion(this.anchor.transcriptPath, interactionId);
+        // Registration checks again after the read: a live question or answer may
+        // have arrived while the transcript was being scanned.
+        if (interaction)
+            this.registerAsyncQuestion(interaction);
+    }
     onFrame(frame) {
         if (!frame || typeof frame !== 'object')
             return;
@@ -534,6 +579,24 @@ class CodexAppServerTransport extends LineTransport {
             return;
         }
         const ours = !frame.params?.threadId || frame.params.threadId === this.threadId;
+        if (ours && frame.method === 'item/completed') {
+            const item = frame.params?.item;
+            if (item?.type === 'agentMessage' && item.delivery === 'async') {
+                for (const interaction of asyncQuestionInteractions(item.id, item.questions)) {
+                    this.registerAsyncQuestion(interaction);
+                }
+            }
+            if (item?.type === 'userMessage') {
+                const text = (item.content || [])
+                    .filter((part) => part.type === 'text')
+                    .map((part) => part.text)
+                    .join('\n');
+                for (const reply of parseAsyncQuestionReplies(text)?.replies || []) {
+                    this.asyncQuestionsSeen.add(reply.questionItemId);
+                    this.anchor.resolveInteraction(reply.questionItemId, { answers: { [reply.questionItemId]: [reply.answer] } });
+                }
+            }
+        }
         if (frame.method === 'turn/started' && ours)
             this.setTurnId(frame.params?.turnId || frame.params?.turn?.id);
         if (['turn/completed', 'turn/failed', 'turn/aborted'].includes(frame.method) && ours && this.turnWaiter) {
@@ -628,8 +691,15 @@ class CodexAppServerTransport extends LineTransport {
         this.threadId = threadId;
         if (threadId !== this.anchor.agentSessionId)
             this.anchor.updateIdentity(threadId);
+        // Resume returns persisted thread items, including questions asked by a
+        // previous app-server connection. Rebuild only the still-unanswered items.
+        for (const turn of opened?.thread?.turns || []) {
+            for (const item of turn.items || []) {
+                this.onFrame({ method: 'item/completed', params: { threadId, item } });
+            }
+        }
     }
-    async prompt(text, timeoutMs) {
+    async prompt(text, timeoutMs, onAccepted = () => { }) {
         if (this.turnWaiter)
             throw new Error('Codex already has an active turn.');
         const waiter = deferred();
@@ -641,10 +711,10 @@ class CodexAppServerTransport extends LineTransport {
                 this.turnWaiter = null;
             this.turnIdWaiter?.resolve('');
             this.turnIdWaiter = null;
-            waiter.reject(error);
             throw error;
         });
         this.setTurnId(started?.turn?.id || started?.turnId);
+        onAccepted();
         const timer = setTimeout(() => {
             if (this.turnWaiter === waiter)
                 this.turnWaiter = null;
@@ -1389,20 +1459,45 @@ class Anchor {
     }
     askInteraction(request, options = {}) {
         const interaction = {
-            id: crypto.randomUUID(),
+            id: options.id || crypto.randomUUID(),
             harness: this.source,
             request,
         };
         const waiter = deferred();
         clearTimeout(this.idleTimer);
-        this.pendingInteractions.set(interaction.id, { interaction, waiter, onExpire: options.onExpire });
+        this.pendingInteractions.set(interaction.id, {
+            interaction,
+            waiter,
+            onExpire: options.onExpire,
+            onAnswer: options.onAnswer,
+            answering: false,
+        });
         this.emitLive({ event: 'user.interaction', agent: this.source, phase: 'queued', interaction });
         return waiter.promise;
     }
-    answerInteraction(interactionId, response) {
+    async answerInteraction(interactionId, response) {
+        if (!this.pendingInteractions.has(interactionId) && this.transport instanceof CodexAppServerTransport) {
+            await this.transport.recoverAsyncQuestion(interactionId);
+        }
         const pending = this.pendingInteractions.get(interactionId);
         if (!pending)
             throw new Error('The interaction is no longer waiting in this harness.');
+        if (pending.answering)
+            throw new Error('This answer is already being submitted.');
+        pending.answering = true;
+        try {
+            await pending.onAnswer?.(response);
+            this.resolveInteraction(interactionId, response);
+            return { answered: true, interactionId };
+        }
+        finally {
+            pending.answering = false;
+        }
+    }
+    resolveInteraction(interactionId, response) {
+        const pending = this.pendingInteractions.get(interactionId);
+        if (!pending)
+            return;
         this.pendingInteractions.delete(interactionId);
         this.emitLive({
             event: 'user.interaction_answer',
@@ -1416,6 +1511,49 @@ class Anchor {
             this.scheduleExit();
         return { answered: true, interactionId };
     }
+    async startAsyncQuestionReply(text) {
+        if (this.status === 'running')
+            throw new Error('The previous turn is still finishing; submit the answer again.');
+        const previousTurn = this.currentTurn;
+        const messageId = crypto.randomUUID();
+        const accepted = deferred();
+        let started = false;
+        this.currentTurn = {
+            messageId,
+            claimToken: '',
+            prompt: text,
+            expectedText: text,
+            status: 'running',
+            accepted: true,
+            startedAt: now(),
+            completedAt: null,
+            result: null,
+        };
+        this.setStatus('running');
+        void this.transport
+            .prompt(text, this.turnTimeoutMs, () => {
+            started = true;
+            this.emitLive({
+                event: 'turn.start',
+                agent: this.source,
+                phase: 'queued',
+                messageId,
+                displayPrompt: text,
+                prompt: text,
+            });
+            accepted.resolve();
+        })
+            .then(() => this.finish({ exitCode: 0, signal: null, timedOut: false, error: null }), (error) => {
+            if (started)
+                this.finish({ exitCode: 1, error: { message: errorText(error) } });
+            else {
+                this.currentTurn = previousTurn;
+                this.setStatus('idle');
+                accepted.reject(error);
+            }
+        });
+        await accepted.promise;
+    }
     expirePendingInteractions(reason) {
         const error = new Error(reason);
         for (const [interactionId, pending] of this.pendingInteractions) {
@@ -1436,7 +1574,7 @@ class Anchor {
     }
     scheduleExit() {
         clearTimeout(this.idleTimer);
-        if (this.pendingInteractions.size) {
+        if (this.status === 'running' || this.pendingInteractions.size || this.transport?.backgroundTasks?.size) {
             this.idleTimer = null;
             return;
         }
@@ -1469,7 +1607,7 @@ class Anchor {
         }
         if (this.status === 'running')
             throw new Error('The anchored agent is already running a turn.');
-        if (this.pendingInteractions.size)
+        if ([...this.pendingInteractions.values()].some((pending) => !isAsyncQuestionInteraction(pending.interaction)))
             throw new Error('The anchored agent is awaiting user input.');
         for (const key of ['source', 'sessionId', 'agentSessionId', 'messageId'])
             if (!request[key])

package/dist/agent-isolation.js

@@ -0,0 +1,29 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const AGENT_SLICE_NAME = 'turns-agents.slice';
+/** A detached process group still belongs to its parent's memory cgroup. */
+export function anchorLaunchCommand(entry, socketPath, { platform = process.platform, systemd = fs.existsSync('/run/systemd/system'), execPath = process.execPath, } = {}) {
+    const args = [entry, '--socket', socketPath];
+    if (platform !== 'linux' || !systemd)
+        return { command: execPath, args };
+    // A scope preserves the caller's environment and working directory. Failure
+    // must not silently fall back to putting an agent in the daemon's cgroup.
+    return {
+        command: '/usr/bin/systemd-run',
+        args: [
+            '--user',
+            '--scope',
+            `--slice=${AGENT_SLICE_NAME}`,
+            '--quiet',
+            '--no-ask-password',
+            '--collect',
+            '--expand-environment=no',
+            `--unit=turns-agent-${path.basename(socketPath, '.sock')}`,
+            '--property=OOMPolicy=kill',
+            '--property=MemoryAccounting=yes',
+            '--',
+            execPath,
+            ...args,
+        ],
+    };
+}

package/dist/codex-account.js

@@ -0,0 +1,86 @@
+import { spawn } from 'node:child_process';
+import os from 'node:os';
+/** Only copy public account metadata; never forward credentials or raw output. */
+export function parseCodexAccount(result) {
+    if (!result || typeof result !== 'object' || !('account' in result))
+        return null;
+    const account = result.account;
+    if (account === null)
+        return { authenticated: false };
+    if (!account || typeof account !== 'object' || !('type' in account))
+        return null;
+    if (account.type === 'apiKey')
+        return { authenticated: true, account: 'API key' };
+    if (account.type !== 'chatgpt')
+        return null;
+    const email = 'email' in account && typeof account.email === 'string' ? account.email.trim().slice(0, 400) : '';
+    const plan = 'planType' in account && typeof account.planType === 'string' ? account.planType.trim().slice(0, 80) : '';
+    return {
+        authenticated: true,
+        account: [email || 'ChatGPT', plan ? `(${plan})` : ''].filter(Boolean).join(' '),
+    };
+}
+/** A short-lived, read-only app-server connection, using Codex's own credential
+ * store (including keychain). No thread or turn is created, and no token refresh
+ * is requested. Failure falls back to login status in the auth manager.
+ * https://developers.openai.com/codex/app-server#1-check-auth-state */
+export function readCodexAccountStatus(command, timeoutMs = 10_000) {
+    return new Promise((resolve) => {
+        const child = spawn(command, ['app-server', '--listen', 'stdio://'], {
+            cwd: os.homedir(),
+            env: process.env,
+            stdio: ['pipe', 'pipe', 'ignore'],
+        });
+        let settled = false;
+        let initialized = false;
+        let buffer = '';
+        const finish = (answer = null) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.stdin.destroy();
+            child.kill('SIGKILL');
+            resolve(answer);
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        timer.unref?.();
+        const send = (frame) => child.stdin.write(`${JSON.stringify(frame)}\n`);
+        child.on('error', () => finish());
+        child.on('close', () => finish());
+        child.stdin.on('error', () => finish());
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            buffer += chunk;
+            if (buffer.length > 64 * 1024)
+                return finish();
+            while (!settled) {
+                const newline = buffer.indexOf('\n');
+                if (newline < 0)
+                    break;
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                let frame;
+                try {
+                    frame = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (!frame || frame.method)
+                    continue;
+                if (frame.id === 1 && !initialized) {
+                    if (frame.error || !frame.result)
+                        return finish();
+                    initialized = true;
+                    send({ method: 'initialized', params: {} });
+                    send({ id: 2, method: 'account/read', params: { refreshToken: false } });
+                }
+                else if (frame.id === 2 && initialized) {
+                    finish(frame.error ? null : parseCodexAccount(frame.result));
+                }
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'turns.dev', version: '1' } } });
+    });
+}

package/dist/codex-async-question-recovery.js

@@ -0,0 +1,98 @@
+import fs from 'node:fs';
+import readline from 'node:readline';
+import { ASYNC_QUESTION_TOOL, asyncQuestionInteractions, parseAsyncQuestionReplies } from "./codex-async-questions.js";
+export function isAsyncQuestionId(value) {
+    if (typeof value !== 'string')
+        return false;
+    try {
+        const id = JSON.parse(value);
+        return (Array.isArray(id) &&
+            id.length === 3 &&
+            id[0] === ASYNC_QUESTION_TOOL &&
+            typeof id[1] === 'string' &&
+            !!id[1] &&
+            Number.isSafeInteger(id[2]) &&
+            id[2] >= 0 &&
+            JSON.stringify(id) === value);
+    }
+    catch {
+        return false;
+    }
+}
+/** Recover only delivered, unanswered questions from this anchor's own rollout.
+ * A question can be absent from the live/resumed item projection while the
+ * viewer reconstructs it from the native transcript. Never trust a browser-supplied
+ * question or revive a blocking tool request that has already finished.
+ */
+export async function recoverAsyncQuestion(transcriptPath, interactionId) {
+    if (!isAsyncQuestionId(interactionId))
+        return null;
+    const [, callId] = JSON.parse(interactionId);
+    let candidate = null;
+    let delivered = false;
+    const stream = fs.createReadStream(transcriptPath, { encoding: 'utf8' });
+    const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+        for await (const line of lines) {
+            let doc;
+            try {
+                doc = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            const payload = doc?.payload;
+            if (!payload)
+                continue;
+            const item = doc.type === 'event_msg' && payload.type === 'item_completed' ? payload.item : null;
+            if (item?.type === 'AgentMessage' && item.delivery === 'async' && item.id === callId) {
+                candidate =
+                    asyncQuestionInteractions(item.id, item.questions).find((question) => question.id === interactionId) || null;
+                delivered = true;
+            }
+            if (doc.type === 'response_item' && payload.call_id === callId) {
+                if (['function_call', 'custom_tool_call'].includes(payload.type) &&
+                    [ASYNC_QUESTION_TOOL, `functions.${ASYNC_QUESTION_TOOL}`].includes(payload.name)) {
+                    try {
+                        const input = JSON.parse(payload.arguments ?? payload.input);
+                        candidate =
+                            asyncQuestionInteractions(callId, input?.questions).find((question) => question.id === interactionId) ||
+                                null;
+                    }
+                    catch { }
+                }
+                if (['function_call_output', 'custom_tool_call_output'].includes(payload.type)) {
+                    try {
+                        delivered = JSON.parse(payload.output)?.accepted === true;
+                    }
+                    catch {
+                        delivered = false;
+                    }
+                }
+            }
+            const content = item?.type === 'UserMessage'
+                ? item.content
+                : doc.type === 'response_item' && payload.type === 'message' && payload.role === 'user'
+                    ? payload.content
+                    : null;
+            if (Array.isArray(content)) {
+                const text = content
+                    .filter((part) => ['text', 'input_text'].includes(part?.type))
+                    .map((part) => part.text)
+                    .join('\n');
+                if (parseAsyncQuestionReplies(text)?.replies.some((reply) => reply.questionItemId === interactionId))
+                    return null;
+            }
+        }
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+    return delivered ? candidate : null;
+}

package/dist/codex-async-questions.js

@@ -0,0 +1,84 @@
+// Pure wire helpers shared by the anchor, transcript reducer, and viewer.
+export const ASYNC_QUESTION_TOOL = 'request_user_input_async';
+export function asyncQuestionInteractions(callId, value) {
+    if (typeof callId !== 'string' || !callId || !Array.isArray(value))
+        return [];
+    return value.flatMap((question, index) => {
+        if (!question || typeof question.title !== 'string' || !question.title.trim())
+            return [];
+        const id = JSON.stringify([ASYNC_QUESTION_TOOL, callId, index]);
+        return [
+            {
+                id,
+                harness: 'codex',
+                request: {
+                    method: ASYNC_QUESTION_TOOL,
+                    params: {
+                        questions: [
+                            {
+                                id,
+                                title: question.title,
+                                ...(Array.isArray(question.options)
+                                    ? { options: question.options.filter((option) => typeof option === 'string') }
+                                    : {}),
+                            },
+                        ],
+                    },
+                },
+            },
+        ];
+    });
+}
+export function isAsyncQuestionInteraction(value) {
+    const interaction = value;
+    return interaction?.harness === 'codex' && interaction.request?.method === ASYNC_QUESTION_TOOL;
+}
+export function parseAsyncQuestionReplies(text) {
+    const pattern = /<send_user_message_question_reply>\s*([\s\S]*?)\s*<\/send_user_message_question_reply>/g;
+    const replies = [];
+    const remainingText = text
+        .replace(pattern, (block, body) => {
+        try {
+            const rows = JSON.parse(body);
+            if (!Array.isArray(rows) || !rows.length)
+                return block;
+            const valid = rows.every((row) => {
+                if (typeof row?.questionItemId !== 'string' ||
+                    typeof row.question !== 'string' ||
+                    typeof row.answer !== 'string')
+                    return false;
+                const id = JSON.parse(row.questionItemId);
+                return (Array.isArray(id) &&
+                    id.length === 3 &&
+                    id[0] === ASYNC_QUESTION_TOOL &&
+                    typeof id[1] === 'string' &&
+                    !!id[1] &&
+                    Number.isSafeInteger(id[2]) &&
+                    id[2] >= 0);
+            });
+            if (!valid)
+                return block;
+            replies.push(...rows);
+            return '';
+        }
+        catch {
+            return block;
+        }
+    })
+        .trim();
+    return replies.length ? { replies, remainingText } : null;
+}
+export function asyncQuestionReplyText(interaction, response) {
+    const answers = response?.answers;
+    const question = interaction.request.params.questions[0];
+    const values = answers?.[question.id];
+    if (!Array.isArray(values) || values.length !== 1 || typeof values[0] !== 'string' || !values[0].trim())
+        throw new Error('Choose an option or enter an answer before submitting.');
+    return `<send_user_message_question_reply>\n${JSON.stringify([
+        {
+            questionItemId: question.id,
+            question: question.title,
+            answer: values[0],
+        },
+    ])}\n</send_user_message_question_reply>`;
+}

package/dist/daemon.js

@@ -4,6 +4,8 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { AGENT_SLICE_NAME } from "./agent-isolation.js";
+import { executablePath } from "./executable-path.js";
 import { applicationPaths } from "./auth.js";
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 /** Resolve linked-worktree installs back to the primary checkout. A service
@@ -41,7 +43,7 @@ export const MAC_LAUNCH_AGENT_LABEL = 'dev.turns.cli';
 function systemdQuote(value) {
     return `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')}"`;
 }
-export function linuxServiceUnit({ cliEntry = canonicalDaemonCliEntry(), execPath = process.execPath } = {}) {
+export function linuxServiceUnit({ cliEntry = canonicalDaemonCliEntry(), execPath = process.execPath, pathEnvironment = executablePath(), } = {}) {
     return `[Unit]
 Description=Continuously upload local AI sessions to turns.dev
 Wants=network-online.target
@@ -56,11 +58,23 @@ ExecStart=${systemdQuote(execPath)} --max-old-space-size=256 --max-semi-space-si
 Restart=on-failure
 RestartSec=5
 Environment=NODE_NO_WARNINGS=1
+Environment=${systemdQuote(`PATH=${pathEnvironment}`)}
 
 [Install]
 WantedBy=default.target
 `;
 }
+/** Monitor agents separately, before pressure reaches the user-manager limit. */
+export function linuxAgentSliceUnit() {
+    return `[Unit]
+Description=Turns agent workloads
+
+[Slice]
+MemoryAccounting=yes
+ManagedOOMMemoryPressure=kill
+ManagedOOMMemoryPressureLimit=40%
+`;
+}
 function xmlEscape(value) {
     return String(value)
         .replaceAll('&', '&')
@@ -140,6 +154,10 @@ export function installLinuxDaemon({ paths = applicationPaths(), spawnSyncImpl =
     const temporary = `${paths.linuxService}.${process.pid}.tmp`;
     fs.writeFileSync(temporary, unit, { mode: 0o644 });
     fs.renameSync(temporary, paths.linuxService);
+    const slicePath = path.join(path.dirname(paths.linuxService), AGENT_SLICE_NAME);
+    const sliceTemporary = `${slicePath}.${process.pid}.tmp`;
+    fs.writeFileSync(sliceTemporary, linuxAgentSliceUnit(), { mode: 0o644 });
+    fs.renameSync(sliceTemporary, slicePath);
     systemctl(['disable', '--now', LEGACY_SYSTEMD_SERVICE_NAME], { spawnSyncImpl, allowFailure: true });
     const unitDirectory = path.dirname(paths.linuxService);
     for (const legacyLink of [
@@ -174,6 +192,7 @@ export function uninstallLinuxDaemon({ paths = applicationPaths(), spawnSyncImpl
         if (error?.code !== 'ENOENT')
             throw error;
     }
+    fs.rmSync(path.join(path.dirname(paths.linuxService), AGENT_SLICE_NAME), { force: true });
     systemctl(['daemon-reload'], { spawnSyncImpl, allowFailure: true });
 }
 export function linuxDaemonStatus({ spawnSyncImpl = spawnSync } = {}) {

package/dist/executable-path.js

@@ -0,0 +1,19 @@
+import os from 'node:os';
+import path from 'node:path';
+/** Preserve explicit PATH precedence and add installations absent from service environments. */
+export function executablePath(env = process.env, home = os.homedir(), execPath = process.execPath) {
+    return [
+        ...new Set([
+            ...String(env.PATH || '').split(path.delimiter),
+            path.dirname(execPath),
+            path.join(home, '.local', 'bin'),
+            path.join(home, 'bin'),
+            path.join(home, '.npm-global', 'bin'),
+            ...(env.NPM_CONFIG_PREFIX ? [path.join(env.NPM_CONFIG_PREFIX, 'bin')] : []),
+            '/opt/homebrew/bin',
+            '/usr/local/bin',
+            '/usr/bin',
+            '/bin',
+        ].filter((directory) => path.isAbsolute(directory))),
+    ].join(path.delimiter);
+}

package/dist/file-browsing.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { workingDirectoryIsAllowed } from "./directory-policy.js";
-import { uploadFileStream } from "./path-resolution.js";
+import { storedFileMetadata, uploadFileStream } from "./path-resolution.js";
 /**
  * Answering "what is in that directory?" from the machine that knows.
  *
@@ -248,6 +248,22 @@ export async function browseMachinePath({ requested, machine, baseUrl, options,
     if (resolved.stat.size > MAX_BROWSE_FILE_BYTES) {
         throw new Error(`File is larger than the ${BROWSE_FILE_LIMIT_LABEL} browse limit.`);
     }
+    // Compare metadata attached to the R2 object, not the directory index:
+    // directory observations can already describe newer, unuploaded bytes.
+    // Post-edit hashes always force an upload, even when mtime was preserved.
+    if (resolved.stat.size > 0 && !contentEtag) {
+        const cached = await storedFileMetadata({ baseUrl, options, machine, absolutePath: resolved.path, fetchImpl });
+        // The file can change while its stored metadata is being fetched.
+        resolved.stat = fs.statSync(resolved.path);
+        if (!resolved.stat.isFile())
+            throw new Error('The file changed while its stored metadata was being checked.');
+        if (resolved.stat.size > MAX_BROWSE_FILE_BYTES)
+            throw new Error(`File is larger than the ${BROWSE_FILE_LIMIT_LABEL} browse limit.`);
+        const modifiedAt = isoTime(resolved.stat.mtimeMs);
+        if (cached && cached.bytes === resolved.stat.size && cached.modifiedAt === modifiedAt) {
+            return { path: resolved.path, kind: 'file', bytes: cached.bytes, contentType: cached.contentType, modifiedAt };
+        }
+    }
     const sample = readFileTypeSample(resolved.path, resolved.stat.size);
     const contentType = browseContentType(resolved.path, sample, sample.byteLength === resolved.stat.size);
     const modifiedAt = isoTime(resolved.stat.mtimeMs);

package/dist/harness-account.js

@@ -0,0 +1,299 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+/** Fixed, read-only CLI commands. Never invoke a prompt, login, or config dump. */
+export const NATIVE_ACCOUNT_COMMANDS = {
+    cursor: ['status', '--format', 'json'],
+    devin: ['auth', 'status'],
+    kilo: ['profile', '--json'],
+};
+function text(value, limit = 160) {
+    if (typeof value !== 'string')
+        return '';
+    const result = value.trim();
+    if (result.length > limit || /[\x00-\x1f]|(?:sk-|gh[pousr]_|github_pat_|eyJ)[A-Za-z0-9_-]{12}/u.test(result))
+        return '';
+    return result;
+}
+/** Allowlisted display metadata, never serialized credentials or arbitrary messages. */
+export function accountSummary(value) {
+    if (!value || typeof value !== 'object')
+        return '';
+    const identity = text(value.email) || text(value.login) || text(value.username) || text(value.name);
+    const plan = text(value.planType ?? value.subscriptionType ?? value.plan_name ?? value.plan, 80);
+    return [identity, plan ? `(${plan})` : ''].filter(Boolean).join(' ');
+}
+function jsonDocument(output) {
+    try {
+        // Some CLIs put warnings before their JSON response.
+        return JSON.parse(output.slice(output.indexOf('{'), output.lastIndexOf('}') + 1));
+    }
+    catch {
+        return null;
+    }
+}
+export function parseNativeHarnessAccount(harness, output) {
+    const clean = output.replace(/\u001b\[[0-9;?]*[A-Za-z]/g, '');
+    if (harness === 'devin') {
+        if (/not logged in|not authenticated/iu.test(clean))
+            return { authenticated: false };
+        if (!/^Logged in/mu.test(clean))
+            return null;
+        const email = clean.match(/^\s*Email:\s*(.+)$/mu)?.[1];
+        const plan = clean.match(/^\s*Plan:\s*(.+)$/mu)?.[1] || clean.match(/^\s*Tier:\s*(.+)$/mu)?.[1];
+        const account = accountSummary({ email, plan });
+        return { authenticated: true, ...(account ? { account } : {}) };
+    }
+    const data = jsonDocument(clean);
+    if (!data)
+        return null;
+    if (harness === 'cursor') {
+        if (typeof data.isAuthenticated !== 'boolean')
+            return null;
+        const email = data.email ||
+            data.user?.email ||
+            clean.match(/[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/u)?.[0];
+        const account = accountSummary({ email, plan: data.membershipType || data.plan });
+        return { authenticated: data.isAuthenticated, ...(data.isAuthenticated && account ? { account } : {}) };
+    }
+    if (harness === 'kilo') {
+        const account = accountSummary(data.user ?? data.profile ?? data);
+        return account ? { authenticated: true, account } : null;
+    }
+    return null;
+}
+/** JSONC support for Copilot, preserving quoted URLs and trailing-comma strings. */
+function readJson(file) {
+    try {
+        if (fs.statSync(file).size > 1024 * 1024)
+            return null;
+        const content = fs
+            .readFileSync(file, 'utf8')
+            .replace(/("(?:\\.|[^"\\])*")|\/\/[^\n]*|\/\*[\s\S]*?\*\//gu, (_match, quoted) => quoted || '')
+            .replace(/("(?:\\.|[^"\\])*")|,\s*(?=[}\]])/gu, (_match, quoted) => quoted || '');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+/** Decode only display claims locally. They are NOT proof that a grant is valid. */
+function tokenAccount(value) {
+    if (typeof value !== 'string' || value.length > 32_768)
+        return '';
+    try {
+        const claims = JSON.parse(Buffer.from(value.split('.')[1], 'base64url').toString('utf8'));
+        return accountSummary({
+            email: claims.email || claims['https://api.openai.com/profile']?.email,
+            username: claims.preferred_username,
+            plan: claims['https://api.openai.com/auth']?.chatgpt_plan_type,
+        });
+    }
+    catch {
+        return '';
+    }
+}
+function credentialSummary(value) {
+    if (!value || typeof value !== 'object')
+        return '';
+    const tokens = value.tokens ?? value;
+    return (accountSummary(value.user) ||
+        accountSummary(value.account) ||
+        accountSummary(value) ||
+        tokenAccount(tokens.id_token ?? tokens.idToken) ||
+        tokenAccount(tokens.access_token ?? tokens.accessToken ?? tokens.access ?? tokens.token));
+}
+function stored(account) {
+    return account ? { authenticated: null, account: account.slice(0, 512) } : null;
+}
+const PROVIDER_LABELS = {
+    'openai-codex': 'ChatGPT',
+    anthropic: 'Claude',
+    'github-copilot': 'Copilot',
+    'google-gemini-cli': 'Gemini',
+    'google-antigravity': 'Antigravity',
+    opencode: 'OpenCode Zen',
+    'opencode-go': 'OpenCode Go',
+    kilo: 'Kilo',
+};
+/** Multiple configured providers stay explicitly labelled; never pick an arbitrary
+ * saved account and present it as the selected model's subscription. */
+function providerAccounts(providers) {
+    if (!providers || typeof providers !== 'object' || Array.isArray(providers))
+        return null;
+    const entries = Object.entries(providers)
+        .slice(0, 8)
+        .flatMap(([id, credential]) => {
+        if (!credential || typeof credential !== 'object')
+            return [];
+        const label = PROVIDER_LABELS[id] || text(id, 60);
+        if (!label)
+            return [];
+        const identity = credentialSummary(credential);
+        const method = credential.type === 'oauth' || credential.tokens
+            ? 'OAuth configured'
+            : credential.type === 'api' || credential.type === 'api_key'
+                ? 'API key configured'
+                : '';
+        return identity || method ? [`${label}: ${identity || method}`] : [];
+    });
+    return stored(entries.join('; '));
+}
+/** Local metadata is a saved account hint, not a live auth/entitlement check.
+ * Read only each harness's own store, honour home overrides, and never send keys,
+ * access/refresh tokens, or a whole configuration over the socket. Missing,
+ * opaque, encrypted, or unfamiliar stores report unknown rather than signed out. */
+export function readLocalHarnessAccount(harness, { home = os.homedir(), env = process.env } = {}) {
+    const dataHome = env.XDG_DATA_HOME || path.join(home, '.local/share');
+    const configHome = env.XDG_CONFIG_HOME || path.join(home, '.config');
+    const read = (...parts) => readJson(path.join(...parts));
+    if (harness === 'copilot') {
+        if (env.COPILOT_GITHUB_TOKEN || env.GH_TOKEN || env.GITHUB_TOKEN)
+            return stored('GitHub token configured');
+        const config = read(env.COPILOT_HOME || path.join(home, '.copilot'), 'config.json');
+        const user = config?.lastLoggedInUser;
+        const login = text(user?.login);
+        return stored(login ? `@${login}` : '');
+    }
+    if (harness === 'gemini' || harness === 'qwen') {
+        const root = path.join(harness === 'gemini' ? env.GEMINI_CLI_HOME || home : home, `.${harness}`);
+        const config = read(root, 'settings.json');
+        const authType = config?.security?.auth?.selectedType;
+        if (authType && !['oauth-personal', 'qwen-oauth'].includes(authType)) {
+            return stored(authType === 'vertex-ai' ? 'Vertex AI configured' : 'API key configured');
+        }
+        if (harness === 'gemini') {
+            const email = text(read(root, 'google_accounts.json')?.active);
+            if (email)
+                return stored(email);
+        }
+        return stored(credentialSummary(read(root, 'oauth_creds.json')));
+    }
+    if (harness === 'grok') {
+        if (env.XAI_API_KEY || env.GROK_API_KEY)
+            return stored('API key configured');
+        const auth = read(env.GROK_HOME || path.join(home, '.grok'), 'auth.json');
+        const accounts = Object.values(auth ?? {})
+            .map(credentialSummary)
+            .filter(Boolean);
+        return stored([...new Set(accounts)].join('; '));
+    }
+    if (harness === 'kimi') {
+        const root = env.KIMI_SHARE_DIR || path.join(home, '.kimi');
+        // The Python and newer standalone CLIs use separate credential roots.
+        for (const directory of [path.join(root, 'credentials'), path.join(home, '.kimi-code/credentials')]) {
+            try {
+                const accounts = fs
+                    .readdirSync(directory)
+                    .filter((name) => name.endsWith('.json'))
+                    .slice(0, 8)
+                    .map((name) => credentialSummary(read(directory, name)))
+                    .filter(Boolean);
+                if (accounts.length)
+                    return stored([...new Set(accounts)].join('; '));
+            }
+            catch { }
+        }
+        return null;
+    }
+    if (harness === 'opencode' || harness === 'kilo')
+        return providerAccounts(read(dataHome, harness, 'auth.json'));
+    if (harness === 'pi' || harness === 'prime') {
+        return providerAccounts(read(harness === 'pi'
+            ? env.PI_CODING_AGENT_DIR || path.join(home, '.pi/agent')
+            : env.PRIME_AGENT_CODING_AGENT_DIR || path.join(home, '.prime/agent'), 'auth.json'));
+    }
+    if (harness === 'hermes') {
+        const config = read(env.HERMES_HOME || path.join(home, '.hermes'), 'auth.json');
+        const active = config?.active_provider;
+        return providerAccounts(active && config?.providers?.[active] ? { [active]: config.providers[active] } : config?.providers);
+    }
+    if (harness === 'openclaw') {
+        const config = read(env.OPENCLAW_STATE_DIR || path.join(home, '.openclaw'), 'agents/main/agent/auth-profiles.json');
+        return providerAccounts(config?.profiles);
+    }
+    if (harness === 'letta') {
+        if (env.LETTA_API_KEY)
+            return stored('Letta API key configured');
+        const settings = read(path.join(home, '.letta'), 'settings.json');
+        const identity = credentialSummary(settings);
+        return stored(identity || tokenAccount(settings?.env?.LETTA_API_KEY));
+    }
+    if (harness === 'codebuddy') {
+        if (env.CODEBUDDY_API_KEY)
+            return stored('CodeBuddy API key configured');
+        // CodeBuddy encrypts credential fields but leaves its account metadata in
+        // the shared auth session. Do not inspect the historical `accounts` array.
+        const roots = [
+            path.join(dataHome, 'CodeBuddyExtension'),
+            path.join(home, 'Library/Application Support/CodeBuddyExtension'),
+        ];
+        for (const root of roots) {
+            const directory = path.join(root, 'Data/Public/auth');
+            try {
+                const accounts = fs
+                    .readdirSync(directory)
+                    .filter((name) => name.endsWith('.info'))
+                    .slice(0, 8)
+                    .map((name) => read(directory, name)?.account)
+                    .map((account) => accountSummary({ name: account?.nickname, email: account?.email, plan: account?.enterpriseName }))
+                    .filter(Boolean);
+                if (accounts.length)
+                    return stored([...new Set(accounts)].join('; '));
+            }
+            catch { }
+        }
+        return null;
+    }
+    if (harness === 'poolside') {
+        const credentials = read(configHome, 'poolside/credentials.json');
+        if (!Array.isArray(credentials))
+            return null;
+        return stored(credentials.map(credentialSummary).filter(Boolean).join('; '));
+    }
+    return null;
+}
+/** Vibe's own account endpoint supplies its subscription plan without a model
+ * request. Mirror the installed CLI's /api/vibe/whoami contract; restrict this
+ * fallback to the standard Mistral host rather than sending a tenant key there.
+ * https://github.com/mistralai/mistral-vibe */
+export async function readVibeAccount({ home = os.homedir(), env = process.env, fetchImpl = fetch, } = {}) {
+    const root = env.VIBE_HOME || path.join(home, '.vibe');
+    let config = '';
+    let dotenv = '';
+    try {
+        config = fs.readFileSync(path.join(root, 'config.toml'), 'utf8');
+    }
+    catch { }
+    try {
+        dotenv = fs.readFileSync(path.join(root, '.env'), 'utf8');
+    }
+    catch { }
+    const consoleOverride = env.VIBE_CONSOLE_BASE_URL || config.match(/^\s*console_base_url\s*=\s*["']([^"']+)["']/mu)?.[1];
+    if (consoleOverride && consoleOverride.replace(/\/$/u, '') !== 'https://console.mistral.ai')
+        return null;
+    const raw = dotenv.match(/^\s*(?:export\s+)?MISTRAL_API_KEY\s*=\s*(.+)\s*$/mu)?.[1]?.trim() || '';
+    const key = env.MISTRAL_API_KEY || raw.replace(/^(["'])(.*)\1$/u, '$2');
+    if (!key)
+        return null;
+    try {
+        const response = await fetchImpl('https://console.mistral.ai/api/vibe/whoami', {
+            headers: { Authorization: `Bearer ${key}` },
+            redirect: 'error',
+            signal: AbortSignal.timeout(8_000),
+        });
+        if (response.status === 401)
+            return { authenticated: false };
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const plan = data.plan_type === 'chat'
+            ? { INDIVIDUAL: 'Pro', TEAM: 'Team', EDU: 'Student', FREE: 'Free' }[data.plan_name || ''] || data.plan_name
+            : data.plan_name;
+        const account = accountSummary({ email: data.email || 'Mistral', plan });
+        return data.plan_name ? { authenticated: true, account } : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/harness-auth.js

@@ -14,8 +14,8 @@
  * scraping is deliberately loose — the first https URL is the approval
  * link, a short hyphenated all-caps token is the device code — so cosmetic
  * output changes in either CLI degrade to "no URL yet" rather than to a
- * crash. Auth *status*, by contrast, is read from the commands both CLIs
- * commit to: `claude auth status --json` and `codex login status`.
+ * crash. Auth status comes from `claude auth status --json` or Codex's
+ * structured `account/read`, with `codex login status` as a fallback.
  *
  * One flow per harness runs at a time. Flow state lives in this process and
  * dies with it; the credentials themselves live where the harness put them,
@@ -23,10 +23,12 @@
  */
 import { spawn } from 'node:child_process';
 import os from 'node:os';
-import { resolveHarnessCommand } from "./harness-registry.js";
-/** Harnesses whose sign-in this module can run. Mirrors the shared
+import { readCodexAccountStatus } from "./codex-account.js";
+import { readVibeAccount, readLocalHarnessAccount, parseNativeHarnessAccount, NATIVE_ACCOUNT_COMMANDS, } from "./harness-account.js";
+import { ACP_PROFILES, HARNESS_IDS, resolveHarnessCommand } from "./harness-registry.js";
+/** Harnesses whose account status this module can inspect. Mirrors the shared
  * HARNESS_AUTH_HARNESSES list; cli/ cannot import cloudflare/shared. */
-export const HARNESS_AUTH_HARNESSES = ['claude', 'codex'];
+export const HARNESS_AUTH_HARNESSES = HARNESS_IDS;
 const STATUS_TIMEOUT_MS = 30_000;
 const STATUS_CACHE_MS = 10_000;
 const FLOW_TIMEOUT_MS = 15 * 60_000;
@@ -140,7 +142,32 @@ export function createHarnessAuthManager() {
             return cached.answer;
         let answer = { authenticated: null };
         try {
+            if (harness !== 'claude' && harness !== 'codex') {
+                const local = readLocalHarnessAccount(harness);
+                const args = NATIVE_ACCOUNT_COMMANDS[harness];
+                let native = harness === 'vibe' ? await readVibeAccount() : null;
+                if (args) {
+                    try {
+                        const run = await runCommand(resolveHarnessCommand(harness, ACP_PROFILES[harness]), args, STATUS_TIMEOUT_MS);
+                        if (!run.failed && !run.timedOut)
+                            native = parseNativeHarnessAccount(harness, run.output);
+                    }
+                    catch {
+                        // Keep saved metadata when this CLI version cannot answer status.
+                    }
+                }
+                const result = native?.authenticated === false ? native : native?.account ? native : (local ?? native ?? answer);
+                statusCache.set(harness, { at: Date.now(), answer: result });
+                return result;
+            }
             const command = resolveHarnessCommand(harness);
+            // The structured account report includes the email, unlike login status.
+            // Older CLIs can still answer the existing human-readable status command.
+            const account = harness === 'codex' ? await readCodexAccountStatus(command) : null;
+            if (account) {
+                statusCache.set(harness, { at: Date.now(), answer: account });
+                return account;
+            }
             const args = harness === 'claude' ? ['auth', 'status', '--json'] : ['login', 'status'];
             const run = await runCommand(command, args, STATUS_TIMEOUT_MS);
             if (!run.failed && !run.timedOut) {
@@ -228,7 +255,10 @@ export function createHarnessAuthManager() {
             else {
                 // The last output line is usually the CLI's own explanation. It has
                 // secrets stripped by the caller like every other error string.
-                const lines = stripAnsi(flow.tail).split('\n').map((line) => line.trim()).filter(Boolean);
+                const lines = stripAnsi(flow.tail)
+                    .split('\n')
+                    .map((line) => line.trim())
+                    .filter(Boolean);
                 finishFlow(harness, flow, 'failed', lines.at(-1) || 'The sign-in flow ended without succeeding.');
             }
         });
@@ -265,6 +295,9 @@ export function createHarnessAuthManager() {
         if (!HARNESS_AUTH_HARNESSES.includes(harness)) {
             throw new Error(`Sign-in is not supported for harness "${harness}".`);
         }
+        if (action !== 'status' && harness !== 'claude' && harness !== 'codex') {
+            throw new Error('Use this harness’s terminal sign-in; account status is read-only here.');
+        }
         if (action === 'login')
             startFlow(harness);
         else if (action === 'code')

package/dist/harness-registry.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { executablePath } from "./executable-path.js";
 const HOME = os.homedir();
 // Turns owns this catalog.  It mirrors the transports verified by
 // turns/scaffolding; queue execution must never depend on another product's
@@ -304,7 +305,7 @@ export function resolveHarnessCommand(harness, profile = {}, dependencies = {})
         }
     }
     const command = profile.command || ({ cursor: 'cursor-agent', antigravity: 'agy' }[harness] ?? harness);
-    for (const directory of String(env.PATH || '').split(path.delimiter)) {
+    for (const directory of executablePath(env, home).split(path.delimiter)) {
         const found = executable(path.join(directory, command));
         if (found)
             return found;

package/dist/path-resolution.js

@@ -181,6 +181,34 @@ function fileUploadUrl(baseUrl, machine, absolutePath) {
             : encoded;
     return new URL(`/api/file/${encodeURIComponent(machine)}/${encodedPath}`, String(baseUrl));
 }
+/** Read only the R2 object's upload metadata. Older servers, cache misses,
+ * and unavailable metadata conservatively retain the normal upload path. */
+export async function storedFileMetadata({ baseUrl, options, machine, absolutePath, fetchImpl = fetch, }) {
+    const url = fileUploadUrl(baseUrl, machine, absolutePath);
+    url.pathname = url.pathname.replace('/api/file/', '/api/file-metadata/');
+    try {
+        const response = await fetchImpl(url, {
+            method: 'HEAD', headers: uploadHeaders(options), signal: AbortSignal.timeout(5000),
+        });
+        try {
+            if (!response.ok)
+                return null;
+            const size = response.headers.get('x-turns-file-size');
+            const bytes = Number(size);
+            const modifiedAt = response.headers.get('x-turns-file-modified-at') || '';
+            const contentType = response.headers.get('content-type') || '';
+            if (size === null || !Number.isSafeInteger(bytes) || bytes < 0 || !Number.isFinite(Date.parse(modifiedAt)) || !contentType)
+                return null;
+            return { bytes, modifiedAt: new Date(modifiedAt).toISOString(), contentType };
+        }
+        finally {
+            await response.body?.cancel();
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /** Kept in step with the explicit-browse transport constants in shared/files.ts. */
 export const MAX_SINGLE_BROWSE_UPLOAD_BYTES = 100 * 1024 * 1024;
 export const BROWSE_MULTIPART_PART_BYTES = 32 * 1024 * 1024;

package/dist/queue-worker.js

@@ -6,11 +6,13 @@ import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { anchorId, connectExistingAgentAnchors, launchAgentAnchor, waitForAgentTurn } from "./agent-anchor-client.js";
 import { createCodexUpdateManager } from "./codex-update.js";
+import { isAsyncQuestionId } from "./codex-async-question-recovery.js";
 import { assertAllowedWorkingDirectory, workingDirectoryIsAllowed } from "./directory-policy.js";
 import { browseMachinePath, streamMachineFileRange } from "./file-browsing.js";
 import { applyFileEdit } from "./file-edits.js";
 import { searchMachinePaths } from "./file-search.js";
 import { readMachineGitBaseBlob, readMachineGitPatch, readMachineGitStatus } from "./git-status.js";
+import { resolveHarnessCommand } from "./harness-registry.js";
 import { createHarnessAuthManager } from "./harness-auth.js";
 import { nativeDescriptorAgentSessionId, nativeDescriptorWorkingDirectory } from "./local-session-sources.js";
 import { compactRuntimeValue } from "./native-record-compaction.js";
@@ -24,6 +26,27 @@ const MACHINE_HEARTBEAT_TIMEOUT_MS = 15_000;
 const RUNTIME_BATCH_SIZE = 100;
 const MAX_RUNTIME_FLUSH_FAILURES = 10;
 const DEFAULT_REDACTOR = createSecretRedactor();
+export async function answerAnchorInteraction(entry, interactionId, response) {
+    if (!entry || entry.connection.closed)
+        throw new Error('The detached harness is offline.');
+    entry.snapshot = await entry.connection.request('snapshot', {}, 5_000).catch(() => entry.snapshot);
+    const pending = entry.snapshot?.pendingInteractions?.some((interaction) => interaction.id === interactionId);
+    // Async questions can be reconstructed from the native transcript without
+    // appearing in the app-server's live/resumed item projection. Let the anchor
+    // verify and recover them instead of declaring the viewer's question stale.
+    if (!pending && !(entry.snapshot?.source === 'codex' && isAsyncQuestionId(interactionId))) {
+        throw new Error('The detached harness is no longer waiting for this interaction.');
+    }
+    try {
+        await entry.connection.request('answer_interaction', { interactionId, response }, 30_000);
+    }
+    catch (error) {
+        if (error?.message === 'The interaction is no longer waiting in this harness.') {
+            throw new Error('The detached harness is no longer waiting for this interaction.');
+        }
+        throw error;
+    }
+}
 function wait(milliseconds) {
     return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
@@ -316,7 +339,7 @@ export function dispatchErrorIsRetryable(error) {
     // OpenCode emits this only after its provider stream has exhausted its own
     // backoff. Re-queueing the turn starts that entire retry sequence again and
     // also persists another copy of the user's prompt in the native session.
-    return !(/(?:not supported|does not support|no resumable native session|session key.*unavailable|no local transcript descriptor|working directory (?:is (?:unavailable|not a directory|inaccessible)|must be|could not be created)|outside the daemon allowlist|agent executable not found|provider finish_reason:\s*network_error)/iu.test(message) || /attachment .* (?:size mismatch|download failed \(4\d\d\))/iu.test(message));
+    return !(/(?:not supported|does not support|no resumable native session|session key.*unavailable|no local transcript descriptor|working directory (?:is (?:unavailable|not a directory|inaccessible)|must be|could not be created)|outside the daemon allowlist|agent executable not found|backend must be upgraded|agent (?:isolation launch failed|anchor exited before opening)|provider finish_reason:\s*network_error)/iu.test(message) || /attachment .* (?:size mismatch|download failed \(4\d\d\))/iu.test(message));
 }
 export function queueFailureIsRetryable(error, promptStarted) {
     return !promptStarted && dispatchErrorIsRetryable(error);
@@ -657,6 +680,10 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
                     : path.dirname(descriptor.file), options.allowedDirectories);
             if (!fs.statSync(cwd).isDirectory())
                 throw new Error(`Working directory is unavailable: ${cwd}`);
+            // Check discovery before the durable delivery boundary, so an absent
+            // Codex installation leaves a recoverable unsent prompt in the queue.
+            if (descriptor.harness === 'codex')
+                resolveHarnessCommand('codex');
             entry = await usableAnchor(sessionId, descriptor.harness, agentSessionId);
         }
         if (!entry)
@@ -727,10 +754,16 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
             // boundary before starting this attempt so an earlier turn_error with
             // that ID cannot immediately settle the new turn.
             const eventCursor = entry.connection.eventCursor();
-            // A local request can lose its response after the anchor has accepted
-            // the prompt, so crossing this boundary permanently disables automatic
-            // replay even when the exact delivery outcome is unknown.
+            // Persist before local delivery: either acknowledgement can be lost
+            // after acceptance. Uncertain delivery must never trigger automatic replay.
             queued.promptStarted = true;
+            await request({
+                type: 'queue.renew',
+                sessionId,
+                promptId: claim.prompt.id,
+                claimToken: claim.claimToken,
+                dispatchStarted: true,
+            });
             await entry.connection.request('send_message', {
                 source: descriptor.harness,
                 sessionId,
@@ -771,10 +804,12 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
         claimStarts.add(sessionId);
         let claim;
         try {
-            const response = await request({ type: 'queue.claim', sessionId });
+            const response = await request({ type: 'queue.claim', sessionId, dispatchTracking: true });
             claim = response.claim;
             if (!claim)
                 return;
+            if (!response.dispatchTracking)
+                throw new Error('The backend must be upgraded before dispatching prompts with this daemon.');
             await runClaim(sessionId, claim);
             // A completion can make the next item ready before its unsolicited event
             // crosses the socket. Claim once more immediately for zero-gap draining.
@@ -986,16 +1021,7 @@ export async function watchQueuedPrompts({ rpc, options, machine, getDescriptors
         const sessionId = String(message.sessionId || '');
         const entry = anchors.get(sessionId);
         try {
-            if (!entry || entry.connection.closed)
-                throw new Error('The detached harness is offline.');
-            entry.snapshot = await entry.connection.request('snapshot', {}, 5_000).catch(() => entry.snapshot);
-            if (!entry.snapshot?.pendingInteractions?.some((interaction) => interaction.id === message.interactionId)) {
-                throw new Error('The detached harness is no longer waiting for this interaction.');
-            }
-            await entry.connection.request('answer_interaction', {
-                interactionId: String(message.interactionId || ''),
-                response: message.response,
-            }, 30_000);
+            await answerAnchorInteraction(entry, String(message.interactionId || ''), message.response);
             await flushRuntime(sessionId);
             replyRpc.notify({
                 type: 'session.interaction.answer.result',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@turns/dev",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "Upload local AI agent sessions to turns.dev",
   "license": "MIT",
   "type": "module",