@workerdeck/core 0.17.0 → 0.19.0

package/build/index.mjs

@@ -1,15 +1,15 @@
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { getSessionInfo, getSessionMessages, listSessions, query } from "@anthropic-ai/claude-agent-sdk";
-import { ENGINE_CAPABILITIES, PROTOCOL_VERSION, SUBAGENT_HISTORY, TOOL_RESULT_HEAD_CHARS, imagePartRef, replayCoalesceKey, replayRetains, snapshotRetains, transcriptActivity, transcriptContent } from "@workerdeck/protocol";
+import { ENGINE_CAPABILITIES, PROTOCOL_VERSION, SUBAGENT_HISTORY, TOOL_RESULT_HEAD_CHARS, contextReading, imagePartRef, replayCoalesceKey, replayRetains, snapshotRetains, transcriptActivity, transcriptContent } from "@workerdeck/protocol";
 import { ToolLoopAgent, generateText, isStepCount, tool } from "ai";
 import { execFile, spawn } from "node:child_process";
-import { existsSync, mkdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createVfs, runScript } from "@workerdeck/sandbox";
 import { z } from "zod";
 import { lookup } from "node:dns/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve, sep } from "node:path";
 //#region src/lib/attachments.ts
 /** The four the Anthropic API accepts. Notably absent: image/heic — an iPhone's
 * native photo format, which clients must transcode before upload. */
@@ -1100,6 +1100,13 @@ var SessionRunner = class {
 	#events = [];
 	#subscribers = new SubscriberSet();
 	#seq = 0;
+	/**
+	* Latest context-window reading, retained from the last `context_usage` this
+	* runner emitted so `GET /sessions` can answer it without an attach — see
+	* `SessionInfo.contextUsage`. Folded in the emit path, so it is by
+	* construction the same number the transcript last drew.
+	*/
+	#contextUsage;
 	#activityCount = 0;
 	/**
 	* Seq of the latest `conversation_reset` event, 0 when none. The log itself is
@@ -1194,6 +1201,7 @@ var SessionRunner = class {
 			createdAt: this.createdAt,
 			lastSeq: this.#seq,
 			activityCount: this.#activityCount,
+			contextUsage: this.#contextUsage,
 			pendingPermissionCount: this.#pending.size,
 			subagents: this.#subagents.list(),
 			meta: this.#config.meta,
@@ -1768,7 +1776,11 @@ var SessionRunner = class {
 		};
 		this.#lastActivityAt = event.ts;
 		this.#activityCount += transcriptActivity(body);
-		if (body.type === "conversation_reset") this.#resetSeq = event.seq;
+		this.#contextUsage = contextReading(body) ?? this.#contextUsage;
+		if (body.type === "conversation_reset") {
+			this.#resetSeq = event.seq;
+			this.#contextUsage = void 0;
+		}
 		this.#subagents.observe(body, event.ts);
 		this.#events.push(event);
 		this.#subscribers.emit(event);
@@ -1816,6 +1828,13 @@ var AiSdkRunner = class {
 	#events = [];
 	#subscribers = new SubscriberSet();
 	#seq = 0;
+	/**
+	* Latest context-window reading, retained from the last `context_usage` this
+	* runner emitted so `GET /sessions` can answer it without an attach — see
+	* `SessionInfo.contextUsage`. Folded in the emit path, so it is by
+	* construction the same number the transcript last drew.
+	*/
+	#contextUsage;
 	#activityCount = 0;
 	#status = "starting";
 	#permissionMode;
@@ -1865,7 +1884,12 @@ var AiSdkRunner = class {
 		if (!state || !Array.isArray(state.messages)) throw new Error("session snapshot is missing its provider-engine state");
 		this.#seq = snapshot.seq;
 		this.#events = [...snapshot.events];
-		this.#activityCount = this.#events.reduce((total, event) => total + transcriptActivity(event), 0);
+		this.#activityCount = 0;
+		for (const event of this.#events) {
+			this.#activityCount += transcriptActivity(event);
+			if (event.type === "conversation_reset") this.#contextUsage = void 0;
+			else this.#contextUsage = contextReading(event) ?? this.#contextUsage;
+		}
 		this.#messages = [...state.messages];
 		for (const call of state.pendingToolCalls) this.#pendingToolCalls.set(call.toolCallId, call);
 		this.#dispatched = new Set(state.dispatched);
@@ -1916,6 +1940,7 @@ var AiSdkRunner = class {
 			createdAt: this.createdAt,
 			lastSeq: this.#seq,
 			activityCount: this.#activityCount,
+			contextUsage: this.#contextUsage,
 			pendingPermissionCount: 0,
 			meta: this.#config.meta,
 			scope: this.#config.scope,
@@ -2602,6 +2627,8 @@ var AiSdkRunner = class {
 		};
 		this.#lastActivityAt = event.ts;
 		this.#activityCount += transcriptActivity(body);
+		this.#contextUsage = contextReading(body) ?? this.#contextUsage;
+		if (body.type === "conversation_reset") this.#contextUsage = void 0;
 		this.#events.push(event);
 		this.#subscribers.emit(event);
 	}
@@ -3822,8 +3849,6 @@ const claudeAdapter = {
 		}));
 	}
 };
-//#endregion
-//#region src/engines/codex/jsonrpc.ts
 /**
 * A JSON-RPC error response from the peer, or one we return to it. `code`
 * follows the JSON-RPC 2.0 reserved ranges (-32601 = method not found).
@@ -3855,9 +3880,12 @@ var JsonRpcStdioConnection = class {
 	#buffer = "";
 	#closed = false;
 	#notificationHandler;
+	/** Where {@link CODEX_TRACE_ENV} pointed, or undefined — read once. */
+	#trace;
 	#requestHandler;
 	constructor(options) {
 		this.#output = options.output;
+		this.#trace = process.env["WORKERDECK_CODEX_TRACE"] || void 0;
 		options.input.on("data", (chunk) => this.#feed(String(chunk)));
 		options.input.on("error", () => {});
 		options.output.on("error", () => {});
@@ -3918,9 +3946,28 @@ var JsonRpcStdioConnection = class {
 			} catch {
 				continue;
 			}
+			this.#traceLine(message);
 			this.#dispatch(message);
 		}
 	}
+	/**
+	* Append one inbound message to the trace file, when the operator asked for
+	* one. **Notifications and server→client requests only** — a response body is
+	* not needed to answer the questions this exists for, and `account/*` results
+	* are the one place app-server traffic can carry a masked credential
+	* fragment, which nothing of ours writes to disk (see the auth red lines).
+	* Best-effort and synchronous: a debug sink that loses lines proves nothing,
+	* and a debug sink that throws must not take the session with it.
+	*/
+	#traceLine(message) {
+		if (!this.#trace) return;
+		const method = message.method;
+		if (typeof method !== "string") return;
+		if (method.startsWith("account/") || method.startsWith("login")) return;
+		try {
+			appendFileSync(this.#trace, JSON.stringify(message) + "\n");
+		} catch {}
+	}
 	#dispatch(message) {
 		const { id, method } = message;
 		if (typeof method === "string") {
@@ -3959,6 +4006,441 @@ var JsonRpcStdioConnection = class {
 	}
 };
 //#endregion
+//#region src/engines/codex/subagents.ts
+/**
+* The codex side of `SessionInfo.subagents` — and the attribution table that
+* gives every event a spawned agent produces its `parentToolUseId`.
+*
+* Codex's signal is stronger than the claude engine's, so this is deliberately
+* NOT that tracker generalised (`engines/claude/subagents.ts` infers spawns
+* from tool names and verdicts from result-text sniffing, ~290 lines of module
+* doc explaining the inference). Here nothing is inferred: `subAgentActivity
+* {kind: 'started'}` on the owning thread positively announces an agent, names
+* it (`agentPath`), keys it (`agentThreadId` — the id every one of its later
+* notifications carries) and hands over the model's own `spawn_agent` call id;
+* the agent's end is its own thread's `turn/completed`, status included. So a
+* record is keyed by **thread id** — the wire's handle — while exposing a
+* **tool-use id** — the protocol's: `parentToolUseId` on nested events must
+* equal the anchor `tool_use`'s id for `subagentItems` (the frame membership
+* rule every client shares) to reassemble the sidechain, and this map is where
+* the two vocabularies meet.
+*
+* Two decisions worth their prose:
+*
+* **A record survives the runner's turns.** Codex agents are designed to
+* outlive the root turn that spawned them (`sendInput`/`resumeAgent` address a
+* thread that kept existing), so — unlike a pending approval — nothing here is
+* swept when a root turn ends. What does end every agent is the app-server
+* process itself: the runner calls {@link sweep} when the child dies or the
+* session closes, because an agent whose host process is gone can never report,
+* and `running` on a closed session would be a lie a polled list re-renders
+* forever (the claude tracker's argument, inherited whole).
+*
+* **The settled tail is bounded, running records never are** — the same
+* {@link SUBAGENT_HISTORY} discipline as the claude tracker, and enforced at
+* settle time for the same reason: a settle happens once per agent, `list()`
+* once per row of a 1.2s-polled sessions list.
+*/
+var CodexAgentTracker = class {
+	#byThread = /* @__PURE__ */ new Map();
+	#settleCounter = 0;
+	/** The record whose thread this is — the attribution lookup. */
+	get(agentThreadId) {
+		return this.#byThread.get(agentThreadId);
+	}
+	/** Open (or return) the record for a thread. Fill-in, never overwrite: a
+	* label-less fallback record keeps its accumulated count and its already
+	* published toolUseId when the announcing item arrives late. */
+	open(agentThreadId, toolUseId, agentType, ts) {
+		let record = this.#byThread.get(agentThreadId);
+		if (!record) {
+			record = {
+				agentThreadId,
+				toolUseId,
+				status: "running",
+				startedAt: ts,
+				toolCount: 0,
+				counted: /* @__PURE__ */ new Set()
+			};
+			this.#byThread.set(agentThreadId, record);
+		}
+		record.agentType ??= agentType;
+		return record;
+	}
+	/** The agent's thread ran again (`kind: 'interacted'`, or a fresh
+	* `turn/started` on its thread): a settled verdict no longer describes it. */
+	revive(record) {
+		record.status = "running";
+		record.settledOrder = void 0;
+	}
+	#settle(record, status) {
+		record.status = status;
+		record.settledOrder = ++this.#settleCounter;
+		let settled = 0;
+		for (const r of this.#byThread.values()) if (r.settledOrder !== void 0) settled++;
+		while (settled > SUBAGENT_HISTORY) {
+			let oldest;
+			for (const r of this.#byThread.values()) {
+				if (r.settledOrder === void 0) continue;
+				if (!oldest || r.settledOrder < oldest.settledOrder) oldest = r;
+			}
+			if (!oldest) break;
+			this.#byThread.delete(oldest.agentThreadId);
+			settled--;
+		}
+	}
+	/** A real verdict for one agent — its thread's `turn/completed`, or the
+	* `interrupted` activity edge. */
+	settle(record, status) {
+		if (record.status === status) return;
+		this.#settle(record, status);
+	}
+	/** The process the agents lived in is gone (child death, session close):
+	* everything still running is settled as failed — the report can never come. */
+	sweep() {
+		for (const record of this.#byThread.values()) if (record.status === "running") this.#settle(record, "failed");
+	}
+	/** The rollup as `SessionInfo.subagents` serves it — spawn order, fresh
+	* objects, and `undefined` when there is nothing to say (absent and empty
+	* mean the same thing to a client, and bytes on a polled list are paid for). */
+	list() {
+		if (this.#byThread.size === 0) return void 0;
+		const out = [];
+		for (const r of this.#byThread.values()) out.push({
+			toolUseId: r.toolUseId,
+			agentType: r.agentType,
+			status: r.status,
+			startedAt: r.startedAt,
+			toolCount: r.toolCount
+		});
+		return out;
+	}
+};
+//#endregion
+//#region src/engines/codex/trust.ts
+/**
+* Codex project trust: will this session's cwd get its `.codex/config.toml`?
+*
+* Codex only layers a project's `.codex/config.toml` onto the operator's base
+* config when the project is *trusted* (a `[projects."<path>"]
+* trust_level = "trusted"` entry in `$CODEX_HOME/config.toml`), and the
+* app-server surface has no trust prompt — that lives in the TUI. So under
+* WorkerDeck an untrusted project's config, MCP servers included, is silently
+* ignored: no error, no notice, servers just missing. The runner asks this
+* module at session start whether that is about to happen, so the transcript
+* can say so.
+*
+* Semantics, all measured against both the bundled 0.146.0 and 0.149.0
+* (2026-08-22, via `codex mcp list` from probe cwds and via `thread/start` +
+* `mcpServerStatus/list` on the app-server surface — identical answers):
+*
+* - **Discovery**: config layers come from the cwd and its ancestors up to and
+*   including the nearest directory containing `.git` (dir or file). With no
+*   git anywhere above, the cwd alone is consulted. Directories above the
+*   nearest git root never contribute, trusted or not.
+* - **Trust per layer**: an exact entry for the layer's own canonical path
+*   decides (an explicit `"untrusted"` beats inherited trust); without one the
+*   layer inherits from the chain's git root — trusted iff the git root has a
+*   trusted entry, where a linked worktree's root also counts its main
+*   repository's entry (the `.git` file's gitdir names it). A trusted
+*   mid-chain directory does NOT trust its children, and plain path
+*   containment without git confers nothing.
+* - **Canonical paths**: codex matches entries against the canonicalized cwd —
+*   a macOS `/tmp/...` entry never matches the `/private/tmp/...` it points
+*   at, while the reverse spelling works (and the app-server canonicalizes its
+*   `cwd` param too). Both sides here are realpath'd, which can only err
+*   toward silence.
+* - **The gate is sandbox-scoped**: `thread/start` under `workspace-write` or
+*   `danger-full-access` (permission modes `acceptEdits`/`bypassPermissions`)
+*   WRITES the trust entry itself and loads the config — only `read-only`
+*   (mode `default`) leaves the project untrusted and the config ignored. A
+*   later `turn/start` with a wider sandboxPolicy does not heal the thread
+*   (measured): the caller probes `default`-mode sessions only, and the notice
+*   stays true for the session it opens.
+* - `trust_level`'s vocabulary is exactly `trusted`/`untrusted`; any other
+*   value fails codex's bootstrap outright ("unknown variant"), so a config
+*   carrying one probes silent — that session announces its own failure.
+*
+* The correctness bar for every degrade path: a FALSE notice — warning about a
+* project codex actually trusts — is worse than a missed one. The narrow TOML
+* reader below refuses (→ silence) anything it cannot interpret with
+* certainty, rather than guessing.
+*/
+const BARE_KEY = /[A-Za-z0-9_-]/;
+function skipWs(text, pos) {
+	let i = pos;
+	while (i < text.length && (text[i] === " " || text[i] === "	")) i++;
+	return i;
+}
+/** One-line TOML basic string starting at `pos` (which must be `"`). Undefined
+* on an escape TOML doesn't define or a close quote that never comes — the
+* caller refuses the file rather than guessing what codex would read. */
+function parseBasicString(text, pos) {
+	let out = "";
+	let i = pos + 1;
+	while (i < text.length) {
+		const ch = text[i];
+		if (ch === "\"") return {
+			value: out,
+			end: i + 1
+		};
+		if (ch === "\\") {
+			const esc = text[i + 1];
+			if (esc === "b") out += "\b";
+			else if (esc === "t") out += "	";
+			else if (esc === "n") out += "\n";
+			else if (esc === "f") out += "\f";
+			else if (esc === "r") out += "\r";
+			else if (esc === "\"") out += "\"";
+			else if (esc === "\\") out += "\\";
+			else if (esc === "u" || esc === "U") {
+				const width = esc === "u" ? 4 : 8;
+				const hex = text.slice(i + 2, i + 2 + width);
+				if (hex.length !== width || !/^[0-9A-Fa-f]+$/.test(hex)) return void 0;
+				const code = Number.parseInt(hex, 16);
+				if (code > 1114111) return void 0;
+				out += String.fromCodePoint(code);
+				i += width;
+			} else return void 0;
+			i += 2;
+			continue;
+		}
+		out += ch;
+		i++;
+	}
+}
+/** One-line TOML literal string starting at `pos` (which must be `'`). */
+function parseLiteralString(text, pos) {
+	const close = text.indexOf("'", pos + 1);
+	if (close === -1) return void 0;
+	return {
+		value: text.slice(pos + 1, close),
+		end: close + 1
+	};
+}
+/** A dotted key path — bare, `"basic"` and `'literal'` keys, whitespace around
+* the dots — as found in table headers and on the left of assignments. */
+function parseKeyPath(text, pos) {
+	const keys = [];
+	let i = pos;
+	for (;;) {
+		i = skipWs(text, i);
+		const ch = text[i];
+		if (ch === "\"" || ch === "'") {
+			const str = ch === "\"" ? parseBasicString(text, i) : parseLiteralString(text, i);
+			if (!str) return void 0;
+			keys.push(str.value);
+			i = str.end;
+		} else if (ch !== void 0 && BARE_KEY.test(ch)) {
+			let end = i;
+			while (end < text.length && BARE_KEY.test(text[end])) end++;
+			keys.push(text.slice(i, end));
+			i = end;
+		} else return;
+		i = skipWs(text, i);
+		if (text[i] !== ".") return {
+			value: keys,
+			end: i
+		};
+		i++;
+	}
+}
+/**
+* Scan an assignment's value (or the continuation line of a multi-line array),
+* confirming where it ends. Returns the bracket depth carried onto the next
+* line (0 = the value is complete) plus the string itself when the whole value
+* was one plain one-line string. Undefined refuses the file: multi-line
+* strings are where a line reader starts misreading string *content* as
+* sections and entries — the exact mistake that could flip a real trust entry
+* — so they are not parsed around, they end the attempt.
+*/
+function scanValueLine(text, pos, depth) {
+	let i = skipWs(text, pos);
+	if (depth === 0 && (text[i] === "\"" || text[i] === "'")) {
+		if (text.startsWith("\"\"\"", i) || text.startsWith("'''", i)) return void 0;
+		const str = text[i] === "\"" ? parseBasicString(text, i) : parseLiteralString(text, i);
+		if (!str) return void 0;
+		const rest = skipWs(text, str.end);
+		if (rest < text.length && text[rest] !== "#") return void 0;
+		return {
+			depth: 0,
+			value: str.value
+		};
+	}
+	while (i < text.length) {
+		const ch = text[i];
+		if (ch === "#") break;
+		if (ch === "\"" || ch === "'") {
+			if (text.startsWith("\"\"\"", i) || text.startsWith("'''", i)) return void 0;
+			const str = ch === "\"" ? parseBasicString(text, i) : parseLiteralString(text, i);
+			if (!str) return void 0;
+			i = str.end;
+			continue;
+		}
+		if (ch === "[" || ch === "{") depth++;
+		else if (ch === "]" || ch === "}") {
+			depth--;
+			if (depth < 0) return void 0;
+		}
+		i++;
+	}
+	return { depth };
+}
+/**
+* The `[projects."<path>"] trust_level = "..."` entries of a codex
+* `config.toml`, by a deliberately narrow reader (core takes no TOML
+* dependency for this). Handles what codex itself writes plus the reasonable
+* hand-edits — comments, CRLF, whitespace, quoted keys with escapes, literal
+* and bare keys, `[projects]`-with-dotted-keys and top-level dotted forms,
+* single-line inline tables, multi-line arrays — and returns **undefined for
+* anything else it meets anywhere in the file** (multi-line strings,
+* `projects` as an inline table, array-of-tables, junk): the caller treats
+* undefined as "cannot know" and stays silent. Conflicting duplicate entries
+* also refuse — invalid for TOML, and guessing wrong is a false notice.
+*/
+function parseProjectTrustEntries(source) {
+	const entries = /* @__PURE__ */ new Map();
+	let section = [];
+	let carryDepth = 0;
+	for (const rawLine of source.split("\n")) {
+		const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+		if (carryDepth > 0) {
+			const scanned = scanValueLine(line, 0, carryDepth);
+			if (!scanned) return void 0;
+			carryDepth = scanned.depth;
+			continue;
+		}
+		const start = skipWs(line, 0);
+		if (start >= line.length || line[start] === "#") continue;
+		if (line[start] === "[") {
+			const array = line.startsWith("[[", start);
+			const path = parseKeyPath(line, start + (array ? 2 : 1));
+			if (!path) return void 0;
+			const close = array ? "]]" : "]";
+			if (!line.startsWith(close, path.end)) return void 0;
+			const rest = skipWs(line, path.end + close.length);
+			if (rest < line.length && line[rest] !== "#") return void 0;
+			if (array && path.value[0] === "projects") return void 0;
+			section = path.value;
+			continue;
+		}
+		const key = parseKeyPath(line, start);
+		if (!key) return void 0;
+		if (line[key.end] !== "=") return void 0;
+		const scanned = scanValueLine(line, key.end + 1, 0);
+		if (!scanned) return void 0;
+		carryDepth = scanned.depth;
+		const full = [...section, ...key.value];
+		if (full[0] !== "projects") continue;
+		if (full.length < 3) return void 0;
+		if (full.length === 3 && full[2] === "trust_level") {
+			if (carryDepth !== 0 || scanned.value === void 0) return void 0;
+			const project = full[1];
+			const existing = entries.get(project);
+			if (existing !== void 0 && existing !== scanned.value) return void 0;
+			entries.set(project, scanned.value);
+		}
+	}
+	if (carryDepth > 0) return void 0;
+	return entries;
+}
+/**
+* A linked worktree inherits trust from its main repository's entry (measured:
+* trusting the main repo path loads the worktree's project config). The
+* worktree's `.git` is a FILE whose `gitdir:` line names
+* `<main>/.git/worktrees/<name>`; the directory owning that `.git` is the
+* anchor to look up. Anything unreadable or shaped differently resolves false
+* — this route can only ADD trust, i.e. silence, never a false notice.
+*/
+function mainRepositoryTrusted(gitRootDir, canonical) {
+	const gitPath = join(gitRootDir, ".git");
+	try {
+		if (!statSync(gitPath).isFile()) return false;
+		const match = /^gitdir:[ \t]*(.+?)[ \t]*$/m.exec(readFileSync(gitPath, "utf8"));
+		if (!match) return false;
+		const gitdir = resolve(gitRootDir, match[1]);
+		const at = gitdir.lastIndexOf(`${sep}.git${sep}`);
+		if (at <= 0) return false;
+		let main = gitdir.slice(0, at);
+		try {
+			main = realpathSync(main);
+		} catch {}
+		return canonical.get(main) === "trusted";
+	} catch {
+		return false;
+	}
+}
+/**
+* The notice for a codex session about to run on a cwd whose
+* `.codex/config.toml` codex will ignore, or undefined when there is nothing
+* to say — no project config anywhere codex would look, the project is
+* trusted, or the situation cannot be established with certainty. Read-only
+* throughout: WorkerDeck never writes trust entries (adjacent to the auth red
+* lines — trusting a directory is the operator's decision, made in codex's
+* own prompt or by their own hand).
+*/
+function untrustedProjectNotice(options) {
+	let cwd;
+	try {
+		cwd = realpathSync(options.cwd);
+	} catch {
+		return;
+	}
+	let home = resolve(options.codexHome);
+	try {
+		home = realpathSync(options.codexHome);
+	} catch {}
+	const chain = [];
+	let dir = cwd;
+	for (;;) {
+		chain.push(dir);
+		if (existsSync(join(dir, ".git"))) break;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	const anchor = chain[chain.length - 1];
+	const gitRoot = existsSync(join(anchor, ".git")) ? anchor : void 0;
+	const layers = (gitRoot ? chain : [cwd]).filter((layer) => {
+		if (!existsSync(join(layer, ".codex", "config.toml"))) return false;
+		try {
+			return realpathSync(join(layer, ".codex")) !== home;
+		} catch {
+			return false;
+		}
+	});
+	if (layers.length === 0) return void 0;
+	const homeConfigPath = join(options.codexHome, "config.toml");
+	let source = "";
+	try {
+		source = readFileSync(homeConfigPath, "utf8");
+	} catch (error) {
+		if (error.code !== "ENOENT") return void 0;
+	}
+	const entries = parseProjectTrustEntries(source);
+	if (!entries) return void 0;
+	for (const value of entries.values()) if (value !== "trusted" && value !== "untrusted") return void 0;
+	const canonical = /* @__PURE__ */ new Map();
+	for (const [key, value] of entries) {
+		let path = key;
+		try {
+			path = realpathSync(key);
+		} catch {}
+		if (canonical.get(path) === "trusted") continue;
+		canonical.set(path, value);
+	}
+	const rootTrusted = gitRoot !== void 0 && (canonical.get(gitRoot) === "trusted" || mainRepositoryTrusted(gitRoot, canonical));
+	const ignored = layers.filter((layer) => {
+		const entry = canonical.get(layer);
+		if (entry !== void 0) return entry !== "trusted";
+		return !rootTrusted;
+	});
+	if (ignored.length === 0) return void 0;
+	const trustDir = gitRoot ?? cwd;
+	const configs = ignored.map((layer) => join(layer, ".codex", "config.toml"));
+	return `codex does not trust this directory, so ${configs.length === 1 ? `its project config (${configs[0]}) is` : `its project configs (${configs.join(", ")}) are`} being ignored — MCP servers and settings declared there will be missing from this session. To trust it, run codex once in ${trustDir} and accept the trust prompt, or add [projects."${trustDir}"] with trust_level = "trusted" to ${homeConfigPath}.`;
+}
+//#endregion
 //#region src/engines/codex/runner.ts
 /**
 * thread/start's sandbox axis (string form) — our permission modes as codex
@@ -3966,16 +4448,30 @@ var JsonRpcStdioConnection = class {
 * the OS sandbox and — with the ask policy below — escalates to a real
 * question), `acceptEdits` → workspace-write (in-workspace writes sail
 * through, the acceptEdits grant), `bypassPermissions` → danger-full-access.
+* `auto` rides the SAME sandbox as acceptEdits — it is not a wider grant, it
+* only moves *who answers* the approvals (see {@link APPROVALS_REVIEWER_BY_MODE}).
 */
 const THREAD_SANDBOX_BY_MODE = {
 	default: "read-only",
 	acceptEdits: "workspace-write",
+	auto: "workspace-write",
 	bypassPermissions: "danger-full-access"
 };
-/** turn/start's sandboxPolicy axis (object form — same policy, second shape). */
+/**
+* turn/start's sandboxPolicy axis (object form — same policy, second shape).
+*
+* The `workspaceWrite` entries here are a SHAPE, not the whole policy: every
+* unstated field of that variant is serde-defaulted by the app-server, so
+* sending it bare silently overrides the operator's `[sandbox_workspace_write]`
+* — `network_access` back to false, `writable_roots` back to empty — on every
+* turn. {@link CodexRunner.#turnSandboxPolicy} restates those fields from
+* `config/read`; nothing else may send this map's `workspaceWrite` entries
+* directly.
+*/
 const TURN_SANDBOX_BY_MODE = {
 	default: { type: "readOnly" },
 	acceptEdits: { type: "workspaceWrite" },
+	auto: { type: "workspaceWrite" },
 	bypassPermissions: { type: "dangerFullAccess" }
 };
 /**
@@ -3999,16 +4495,52 @@ const GRANULAR_ASK = { granular: {
 	request_permissions: true,
 	skill_approval: true
 } };
+const GRANULAR_NEVER = { granular: {
+	sandbox_approval: false,
+	rules: false,
+	mcp_elicitations: false,
+	request_permissions: false,
+	skill_approval: false
+} };
+/**
+* Notifications whose meaning is scoped to ONE thread, and which are therefore
+* only ever read off the session's own. Everything else (items, deltas) is
+* accepted from any thread on the connection — see `#handleNotification`.
+*/
+const THREAD_SCOPED_NOTIFICATIONS = new Set([
+	"turn/started",
+	"turn/completed",
+	"thread/tokenUsage/updated"
+]);
 const APPROVAL_POLICY_BY_MODE = {
 	default: GRANULAR_ASK,
 	acceptEdits: GRANULAR_ASK,
-	bypassPermissions: { granular: {
-		sandbox_approval: false,
-		rules: false,
-		mcp_elicitations: false,
-		request_permissions: false,
-		skill_approval: false
-	} }
+	auto: GRANULAR_ASK,
+	bypassPermissions: GRANULAR_NEVER
+};
+/**
+* The THIRD approval axis — *who reviews*, independent of the sandbox axis and
+* the ask axis above. Codex's `approvalsReviewer` (thread/start and turn/start,
+* present since 0.146.0) routes every approval request either to the user
+* (`'user'`, codex's own default) or to `'auto_review'`: a prompted subagent
+* that gathers context and applies a risk framework before allowing or denying.
+* That is codex's "Approve for me" preset, and our `auto` mode is exactly it.
+*
+* Sent explicitly for EVERY mode rather than omitted for the default — a thread
+* inherits `approvalsReviewer` across turns ("this turn and subsequent turns"),
+* so leaving it unset would let a stale reviewer from an earlier turn survive a
+* mode switch back to a user-reviewed mode. Stating it every time makes the
+* mode the single source of truth.
+*
+* NOTE the asymmetry with the Claude engine's `auto`: that classifier is
+* operator-configurable (`autoMode.environment`, allow/soft_deny/hard_deny);
+* this reviewer has no configuration surface at all.
+*/
+const APPROVALS_REVIEWER_BY_MODE = {
+	default: "user",
+	acceptEdits: "user",
+	auto: "auto_review",
+	bypassPermissions: "user"
 };
 /** Fallback timeout for a pending approval nobody answers — the SessionRunner
 * default, so unattended codex sessions land the same way Claude ones do. */
@@ -4019,6 +4551,47 @@ const DEFAULT_APPROVAL_TIMEOUT_MS = 3e5;
 * host filesystem, an inline preview) off it.
 */
 const CODEX_IMAGE_TOOL = "CodexImageGeneration";
+/**
+* Tool name for a spawned agent's anchor `tool_use` — the claude engine's
+* `Task` in this engine's vocabulary. Codex never sends such a call: the model's
+* `spawn_agent` surfaces only as the `subAgentActivity` marker item, so the
+* runner authors the call itself, because everything downstream is built on a
+* top-level `tool_use` existing — `terminalBlocks` absorbs a sidechain into the
+* call whose id its events carry as `parentToolUseId`, the takeover frames by
+* it, and `taskIdentity` labels it from the input's `subagent_type`. Not a new
+* wire idea, just a row: the same shape every other codex tool card uses.
+*/
+const CODEX_AGENT_TOOL = "CodexAgent";
+/** Tool name for the model's collab-agent calls (`wait`, `sendInput`, …), the
+* `tool` field carried in the input. One name for the whole open axis rather
+* than a name per verb, so a future verb renders instead of vanishing. */
+const CODEX_COLLAB_TOOL = "CodexCollab";
+/** An agent's name is its path's basename: '/root/date_one' → 'date_one'. */
+function agentName(agentPath) {
+	if (typeof agentPath !== "string") return void 0;
+	return agentPath.split("/").filter(Boolean).at(-1) || void 0;
+}
+/** The collab card's input: the verb always, the rich fields only when codex
+* actually filled them (measured against 0.146.0 they arrive empty — the card
+* must not render five null columns to say 'wait'). */
+function collabInput(item) {
+	return {
+		tool: item.tool,
+		...item.receiverThreadIds?.length ? { receiverThreadIds: item.receiverThreadIds } : {},
+		...item.prompt ? { prompt: item.prompt } : {},
+		...item.model ? { model: item.model } : {}
+	};
+}
+/** A completed turn's answer, from its summary `items` page — the last
+* `agentMessage` text. For a sub-agent's thread this is the agent's report,
+* which is exactly what belongs in the anchor's `tool_result`. */
+function turnReport(turn) {
+	const items = Array.isArray(turn.items) ? turn.items : [];
+	for (let index = items.length - 1; index >= 0; index--) {
+		const item = items[index];
+		if (item?.type === "agentMessage" && typeof item.text === "string" && item.text) return item.text;
+	}
+}
 /** Longest `result` worth putting in a tool card. The field is free-form and
 * undocumented; anything past this is assumed to be an encoded image rather
 * than a sentence, and encoded images do not go in the event log. */
@@ -4362,6 +4935,13 @@ var CodexRunner = class {
 	#events = [];
 	#subscribers = new SubscriberSet();
 	#seq = 0;
+	/**
+	* Latest context-window reading, retained from the last `context_usage` this
+	* runner emitted so `GET /sessions` can answer it without an attach — see
+	* `SessionInfo.contextUsage`. Folded in the emit path, so it is by
+	* construction the same number the transcript last drew.
+	*/
+	#contextUsage;
 	#activityCount = 0;
 	#status = "starting";
 	#sdkSessionId;
@@ -4379,6 +4959,8 @@ var CodexRunner = class {
 	#turnChain = Promise.resolve();
 	#activeTurn;
 	#connection;
+	/** Per-child, from `config/read`; undefined = read failed, send the bare shape. */
+	#workspaceWrite;
 	#threadLoaded = false;
 	#numTurns = 0;
 	#totalCostUsd;
@@ -4417,6 +4999,12 @@ var CodexRunner = class {
 	* `mcpServerStatus/list` does not carry a status field at all, so without
 	* this every server would read as "configured" and never as up or down. */
 	#mcpStatus = /* @__PURE__ */ new Map();
+	/** The spawned agents, keyed by their thread ids — the attribution table
+	* behind `parentToolUseId` and the rollup behind `info().subagents`. Runner-
+	* level, not per-turn: an agent's thread outlives the root turn that spawned
+	* it, and only the child process dying (or the session closing) ends them
+	* all — see the module doc in `subagents.ts`. */
+	#agents = new CodexAgentTracker();
 	constructor(config, id = randomUUID()) {
 		const mode = config.permissionMode ?? "default";
 		if (!ENGINE_CAPABILITIES.codex.permissionModes.includes(mode)) throw new Error(`permission mode '${mode}' is not supported by the codex engine`);
@@ -4468,13 +5056,15 @@ var CodexRunner = class {
 			createdAt: this.createdAt,
 			lastSeq: this.#seq,
 			activityCount: this.#activityCount,
+			contextUsage: this.#contextUsage,
 			pendingPermissionCount: this.#approvals.size,
 			meta: this.#config.meta,
 			scope: this.#config.scope,
 			title: this.#title(),
 			totalCostUsd: this.#totalCostUsd,
 			numTurns: this.#numTurns || void 0,
-			lastActivityAt: this.#lastActivityAt
+			lastActivityAt: this.#lastActivityAt,
+			subagents: this.#agents.list()
 		};
 	}
 	#title() {
@@ -4498,6 +5088,7 @@ var CodexRunner = class {
 	start() {
 		if (this.#started) return this.#turnChain;
 		this.#started = true;
+		this.#warnUntrustedProject();
 		if (this.#config.resume && this.#config.backfillHistory !== false) {
 			this.#backfillPending = true;
 			this.#turnChain = this.#turnChain.then(() => this.#backfillHistory());
@@ -4507,6 +5098,37 @@ var CodexRunner = class {
 		return this.#turnChain;
 	}
 	/**
+	* One-time transcript notice for the codex trust gap: a `default`-mode
+	* session (read-only sandbox) on an untrusted cwd has its
+	* `.codex/config.toml` — MCP servers included — silently ignored, and the
+	* app-server surface has no trust prompt to say so (the TUI's prompt is
+	* where the entry normally gets written). `acceptEdits`/`bypassPermissions`
+	* sessions are exempt because their `thread/start` (workspace-write /
+	* danger-full-access sandbox) writes the trust entry itself and loads the
+	* config — measured against 0.146.0 and 0.149.0; a notice there would be
+	* false. Emitted as `session_error`, which both clients render as an inline
+	* notice while the session keeps running (the backfill-history precedent),
+	* so nothing new rides the wire. Every degrade path is silence: a false
+	* warning on a trusted project is worse than a missed one.
+	*/
+	#warnUntrustedProject() {
+		if (this.#permissionMode !== "default") return;
+		try {
+			const env = this.#childEnv();
+			const pin = env.CODEX_HOME;
+			if (pin !== void 0 && pin.length === 0) return;
+			const codexHome = pin ?? join(env.HOME ?? homedir(), ".codex");
+			const message = untrustedProjectNotice({
+				cwd: this.#cwd,
+				codexHome
+			});
+			if (message) this.#emit({
+				type: "session_error",
+				message
+			});
+		} catch {}
+	}
+	/**
 	* List skills over a **throwaway** connection, for a session with nothing else
 	* to do yet.
 	*
@@ -4688,6 +5310,7 @@ var CodexRunner = class {
 		}, "policy");
 		this.#connection?.close();
 		this.#connection = void 0;
+		this.#agents.sweep();
 		this.#activeTurn?.reject(/* @__PURE__ */ new Error("session closed"));
 		if (this.#imageDir) try {
 			rmSync(this.#imageDir, {
@@ -4714,6 +5337,48 @@ var CodexRunner = class {
 		this.#turnChain = this.#turnChain.then(() => this.#runTurn());
 	}
 	/**
+	* Read `[sandbox_workspace_write]` as codex resolves it for this session's
+	* cwd, once per child, so {@link CodexRunner.#turnSandboxPolicy} can restate
+	* it verbatim.
+	*
+	* Why this exists at all: `turn/start`'s object-form sandbox policy is
+	* serde-defaulted field by field, so `{type: 'workspaceWrite'}` bare means
+	* `networkAccess: false, writableRoots: []` NO MATTER what the operator
+	* configured — and we must keep sending the object every turn, because
+	* restating it is what makes a between-turns permission-mode switch take
+	* effect. Measured against 0.149.0 with `network_access = true` set: the
+	* bare object produced `curl: (6) Could not resolve host`, the fully-stated
+	* object and an omitted policy both produced `200`. `read-only` is not
+	* affected — the setting is scoped to workspace-write, as its name says, and
+	* a read-only sandbox has no network either way.
+	*
+	* A failure here is not fatal: `#workspaceWrite` stays undefined and we send
+	* the bare shape, which is exactly the behaviour that shipped before.
+	*/
+	async #readWorkspaceWrite(connection) {
+		this.#workspaceWrite = void 0;
+		try {
+			const block = (await connection.request("config/read", { cwd: this.#cwd }))?.config?.sandbox_workspace_write;
+			if (!block) return;
+			const roots = block.writable_roots;
+			this.#workspaceWrite = {
+				writableRoots: Array.isArray(roots) ? roots.filter((r) => typeof r === "string") : [],
+				networkAccess: block.network_access === true,
+				excludeTmpdirEnvVar: block.exclude_tmpdir_env_var === true,
+				excludeSlashTmp: block.exclude_slash_tmp === true
+			};
+		} catch {}
+	}
+	/** The mode's turn-level sandbox policy, with the operator's workspace-write settings intact. */
+	#turnSandboxPolicy() {
+		const policy = TURN_SANDBOX_BY_MODE[this.#permissionMode];
+		if (policy?.type !== "workspaceWrite" || !this.#workspaceWrite) return policy;
+		return {
+			type: "workspaceWrite",
+			...this.#workspaceWrite
+		};
+	}
+	/**
 	* The session's live connection with its thread loaded, (re)building both as
 	* needed: spawn + `initialize`/`initialized` on a fresh child, then
 	* `thread/start` (new) or `thread/resume` (a create-request `resume`, or a
@@ -4738,6 +5403,7 @@ var CodexRunner = class {
 					behavior: "deny",
 					message
 				}, "policy");
+				this.#agents.sweep();
 				this.#activeTurn?.reject(new Error(message));
 			});
 			try {
@@ -4756,12 +5422,14 @@ var CodexRunner = class {
 				throw error;
 			}
 			connection.notify("initialized");
+			await this.#readWorkspaceWrite(connection);
 		}
 		if (!this.#threadLoaded) {
 			const options = {
 				cwd: this.#cwd,
 				approvalPolicy: APPROVAL_POLICY_BY_MODE[this.#permissionMode],
-				sandbox: THREAD_SANDBOX_BY_MODE[this.#permissionMode]
+				sandbox: THREAD_SANDBOX_BY_MODE[this.#permissionMode],
+				approvalsReviewer: APPROVALS_REVIEWER_BY_MODE[this.#permissionMode]
 			};
 			if (this.#model) options.model = this.#model;
 			const resuming = this.#sdkSessionId !== void 0;
@@ -5004,7 +5672,8 @@ var CodexRunner = class {
 				input: turn.input,
 				cwd: this.#cwd,
 				approvalPolicy: APPROVAL_POLICY_BY_MODE[this.#permissionMode],
-				sandboxPolicy: TURN_SANDBOX_BY_MODE[this.#permissionMode]
+				sandboxPolicy: this.#turnSandboxPolicy(),
+				approvalsReviewer: APPROVALS_REVIEWER_BY_MODE[this.#permissionMode]
 			};
 			const model = this.#model ?? this.#resolvedModel;
 			if (model) params.model = model;
@@ -5033,11 +5702,79 @@ var CodexRunner = class {
 	}
 	#handleNotification(method, params) {
 		if (this.#closed) return;
+		if (THREAD_SCOPED_NOTIFICATIONS.has(method) && !this.#isRootThread(params)) {
+			if (method === "turn/completed") this.#settleAgentTurn(params);
+			else if (method === "turn/started") {
+				const threadId = this.#threadIdOf(params);
+				const record = threadId ? this.#agents.get(threadId) : void 0;
+				if (record && record.status !== "running") this.#agents.revive(record);
+			}
+			return;
+		}
 		this.#notifications[method]?.(params);
 	}
+	/** Whether a notification is about the session's own thread. A notification
+	* with no `threadId` counts as the root's: every thread-scoped method the
+	* schema defines carries one, so an absent id means an older or narrower
+	* shape, not a sub-agent. */
+	#isRootThread(params) {
+		const threadId = this.#threadIdOf(params);
+		if (threadId === void 0) return true;
+		return threadId === this.#sdkSessionId;
+	}
+	#threadIdOf(params) {
+		const threadId = params?.threadId;
+		return typeof threadId === "string" ? threadId : void 0;
+	}
+	/**
+	* The agent behind a notification's `threadId` — the attribution every item
+	* and delta handler asks before emitting, so two agents streaming
+	* concurrently into this one connection come apart again by the id each
+	* frame carries, never by any mutable "current agent".
+	*
+	* A non-root thread with no record still gets one: a thread emitting items on
+	* this connection *is* an agent, whatever announced it (codex runs threads of
+	* its own for review/compact, and a `subAgentActivity` could in principle be
+	* missed) — the claude tracker's nested-event fallback, on a stronger signal.
+	* The minted record is label-less and its anchor is authored here, because an
+	* attributed event whose parent id matches no top-level `tool_use` would
+	* render inline rather than as a frame; a late `started` edge fills the name
+	* in. Root-thread traffic — and, defensively, the pre-thread shapes with no
+	* id at all — stays unattributed (`undefined`).
+	*/
+	#agentFor(params) {
+		const threadId = this.#threadIdOf(params);
+		if (threadId === void 0 || threadId === this.#sdkSessionId) return void 0;
+		const known = this.#agents.get(threadId);
+		if (known) return known;
+		const nonce = this.#activeTurn?.nonce ?? "codex";
+		const record = this.#agents.open(threadId, `${nonce}:agent:${threadId}`, void 0, Date.now());
+		record.anchored = true;
+		this.#emitToolUse(record.toolUseId, CODEX_AGENT_TOOL, { agentThreadId: threadId });
+		return record;
+	}
+	/**
+	* A child thread's `turn/completed` is that AGENT's completion — the one
+	* codex sends (`subAgentActivity` has no 'completed' kind, verified live).
+	* The verdict is the turn's own status, and the report is the completed
+	* turn's final message, delivered as the anchor's `tool_result` so the row
+	* settles exactly the way a claude `Task`'s does. Deliberately not gated on
+	* `#activeTurn`: an agent finishing between root turns still finished.
+	*/
+	#settleAgentTurn(params) {
+		const threadId = this.#threadIdOf(params);
+		const record = threadId ? this.#agents.get(threadId) : void 0;
+		if (!record || record.status !== "running") return;
+		const turn = params?.turn;
+		const status = turn?.status === "completed" ? "done" : "failed";
+		this.#agents.settle(record, status);
+		const report = (turn ? turnReport(turn) : void 0) ?? turn?.error?.message ?? (status === "done" ? "" : turn?.status ?? "failed");
+		this.#emitToolResult(record.toolUseId, report, status === "failed");
+	}
 	/** Reasoning deltas arrive on two methods that differ only in which section
 	* counter they advance; the section key carries the method so the two streams
-	* never share a boundary. Section boundaries (a new summary/content entry)
+	* never share a boundary (and item ids are per-thread, so two agents' streams
+	* never share one either). Section boundaries (a new summary/content entry)
 	* render as paragraph breaks — the completed item joins sections with '\n\n'. */
 	#reasoningDelta(method) {
 		return (params) => {
@@ -5053,7 +5790,7 @@ var CodexRunner = class {
 			this.#emitDelta({
 				type: "thinking_delta",
 				thinking: separator + payload.delta
-			});
+			}, this.#agentFor(params)?.toolUseId ?? null);
 		};
 	}
 	/** One item-progress handler serves `item/started` and `item/updated`. */
@@ -5061,7 +5798,7 @@ var CodexRunner = class {
 		const active = this.#activeTurn;
 		if (!active) return;
 		const item = params?.item;
-		if (item) this.#handleItemProgress(item, active);
+		if (item) this.#handleItemProgress(item, active, this.#agentFor(params));
 	};
 	/** The notification dispatch table — every method the child emits that this
 	* runner maps, in one place. Handlers read `this.#activeTurn` themselves:
@@ -5079,7 +5816,9 @@ var CodexRunner = class {
 		"turn/completed": (params) => {
 			const active = this.#activeTurn;
 			const turn = params?.turn;
-			if (active && turn) active.resolve(turn);
+			if (!active || !turn) return;
+			if (active.turnId && turn.id && turn.id !== active.turnId) return;
+			active.resolve(turn);
 		},
 		"item/started": this.#itemProgress,
 		"item/updated": this.#itemProgress,
@@ -5087,7 +5826,7 @@ var CodexRunner = class {
 			const active = this.#activeTurn;
 			if (!active) return;
 			const item = params?.item;
-			if (item) this.#handleItemCompleted(item, active);
+			if (item) this.#handleItemCompleted(item, active, this.#agentFor(params));
 		},
 		"item/agentMessage/delta": (params) => {
 			if (!this.#activeTurn) return;
@@ -5095,7 +5834,7 @@ var CodexRunner = class {
 			if (typeof delta === "string" && delta) this.#emitDelta({
 				type: "text_delta",
 				text: delta
-			});
+			}, this.#agentFor(params)?.toolUseId ?? null);
 		},
 		"item/reasoning/textDelta": this.#reasoningDelta("item/reasoning/textDelta"),
 		"item/reasoning/summaryTextDelta": this.#reasoningDelta("item/reasoning/summaryTextDelta"),
@@ -5288,30 +6027,40 @@ var CodexRunner = class {
 		if (!this.#closed && this.#approvals.size === 0 && this.#status === "awaiting_approval") this.#setStatus("running");
 	}
 	/** Tool calls surface as tool_use when they start; text and reasoning stream
-	* natively via the delta notifications. */
-	#handleItemProgress(item, active) {
+	* natively via the delta notifications. `agent` is the sub-agent whose thread
+	* the item arrived on — undefined for the session's own. */
+	#handleItemProgress(item, active, agent) {
 		const id = `${active.nonce}:${item.id}`;
+		if (item.type === "subAgentActivity") {
+			this.#itemCompleted.subAgentActivity(item, active, id, agent);
+			return;
+		}
 		if (item.type === "commandExecution" && !active.toolUseEmitted.has(id)) {
 			active.toolUseEmitted.add(id);
-			this.#emitToolUse(id, "CodexCommand", { command: item.command });
+			this.#emitToolUse(id, "CodexCommand", { command: item.command }, agent);
 			return;
 		}
 		if (item.type === "mcpToolCall" && !active.toolUseEmitted.has(id)) {
 			active.toolUseEmitted.add(id);
-			this.#emitToolUse(id, `mcp__${item.server}__${item.tool}`, item.arguments);
+			this.#emitToolUse(id, `mcp__${item.server}__${item.tool}`, item.arguments, agent);
+			return;
+		}
+		if (item.type === "collabAgentToolCall" && !active.toolUseEmitted.has(id)) {
+			active.toolUseEmitted.add(id);
+			this.#emitToolUse(id, CODEX_COLLAB_TOOL, collabInput(item), agent);
 			return;
 		}
 		if (item.type === "imageGeneration" && !active.toolUseEmitted.has(id)) {
 			active.toolUseEmitted.add(id);
-			this.#emitToolUse(id, CODEX_IMAGE_TOOL, imageGenerationInput(item));
+			this.#emitToolUse(id, CODEX_IMAGE_TOOL, imageGenerationInput(item), agent);
 			if (item.savedPath) this.#emitFileProduced(item.savedPath, id);
 		}
 	}
-	#handleItemCompleted(item, active) {
+	#handleItemCompleted(item, active, agent) {
 		const id = `${active.nonce}:${item.id}`;
 		const handler = this.#itemCompleted[item.type];
 		if (handler) {
-			handler(item, active, id);
+			handler(item, active, id, agent);
 			return;
 		}
 		const unknown = item;
@@ -5332,67 +6081,121 @@ var CodexRunner = class {
 	* union has never heard of; those take the passthrough above.)
 	*/
 	#itemCompleted = {
-		userMessage: () => {},
-		agentMessage: (item, active, id) => {
+		userMessage: (item, active, _id, agent) => {
+			if (!agent) return;
+			const text = historyUserText(item);
+			if (!text) return;
+			this.#emit({
+				type: "user_message",
+				message: {
+					role: "user",
+					content: text
+				},
+				parentToolUseId: agent.toolUseId,
+				uuid: `${active.nonce}:${item.id}`
+			});
+		},
+		agentMessage: (item, active, id, agent) => {
 			const text = typeof item.text === "string" ? item.text : "";
 			this.#emitAssistant(id, [{
 				type: "text",
 				text
-			}]);
-			active.finalText = text;
+			}], agent?.toolUseId ?? null);
+			if (!agent) active.finalText = text;
 		},
-		reasoning: (item, _active, id) => {
+		reasoning: (item, _active, id, agent) => {
 			const summary = Array.isArray(item.summary) ? item.summary.filter(Boolean) : [];
 			const content = Array.isArray(item.content) ? item.content.filter(Boolean) : [];
 			const thinking = (summary.length > 0 ? summary : content).join("\n\n");
 			if (thinking) this.#emitAssistant(id, [{
 				type: "thinking",
 				thinking
-			}]);
+			}], agent?.toolUseId ?? null);
 		},
-		commandExecution: (item, active, id) => {
+		commandExecution: (item, active, id, agent) => {
 			if (!active.toolUseEmitted.has(id)) {
 				active.toolUseEmitted.add(id);
-				this.#emitToolUse(id, "CodexCommand", { command: item.command });
+				this.#emitToolUse(id, "CodexCommand", { command: item.command }, agent);
 			}
 			const exitCode = item.exitCode ?? void 0;
 			const failed = item.status === "failed" || item.status === "declined" || exitCode !== void 0 && exitCode !== 0;
 			const output = (item.aggregatedOutput ?? "") + (exitCode !== void 0 && exitCode !== 0 ? `\n(exit code ${exitCode})` : "");
-			this.#emitToolResult(id, output, failed);
+			this.#emitToolResult(id, output, failed, void 0, agent?.toolUseId ?? null);
 		},
-		fileChange: (item, _active, id) => {
-			this.#emitToolUse(id, "CodexFileChange", { changes: item.changes });
+		fileChange: (item, _active, id, agent) => {
+			this.#emitToolUse(id, "CodexFileChange", { changes: item.changes }, agent);
 			const lines = item.changes.map((change) => {
 				return `${(typeof change.kind === "string" ? change.kind : change.kind?.type) ?? "change"}: ${change.path}`;
 			});
 			const only = item.changes.length === 1 ? item.changes[0] : void 0;
-			this.#emitToolResult(id, lines.join("\n") || item.status, item.status === "failed" || item.status === "declined", only?.diff ? parseUnifiedDiff(only.diff, only.path) : void 0);
+			this.#emitToolResult(id, lines.join("\n") || item.status, item.status === "failed" || item.status === "declined", only?.diff ? parseUnifiedDiff(only.diff, only.path) : void 0, agent?.toolUseId ?? null);
 		},
-		mcpToolCall: (item, active, id) => {
+		mcpToolCall: (item, active, id, agent) => {
 			if (!active.toolUseEmitted.has(id)) {
 				active.toolUseEmitted.add(id);
-				this.#emitToolUse(id, `mcp__${item.server}__${item.tool}`, item.arguments);
+				this.#emitToolUse(id, `mcp__${item.server}__${item.tool}`, item.arguments, agent);
 			}
 			const isError = item.error !== void 0 && item.error !== null || item.status === "failed";
-			this.#emitToolResult(id, item.error?.message ?? (item.result === void 0 || item.result === null ? "" : JSON.stringify(item.result)), isError);
+			this.#emitToolResult(id, item.error?.message ?? (item.result === void 0 || item.result === null ? "" : JSON.stringify(item.result)), isError, void 0, agent?.toolUseId ?? null);
 		},
-		webSearch: (item, _active, id) => {
-			this.#emitToolUse(id, "CodexWebSearch", { query: item.query });
-			this.#emitToolResult(id, "", false);
+		webSearch: (item, _active, id, agent) => {
+			this.#emitToolUse(id, "CodexWebSearch", { query: item.query }, agent);
+			this.#emitToolResult(id, "", false, void 0, agent?.toolUseId ?? null);
 		},
-		imageGeneration: (item, active, id) => {
+		imageGeneration: (item, active, id, agent) => {
 			active.toolUseEmitted.add(id);
-			this.#emitToolUse(id, CODEX_IMAGE_TOOL, imageGenerationInput(item));
+			this.#emitToolUse(id, CODEX_IMAGE_TOOL, imageGenerationInput(item), agent);
 			if (item.savedPath) this.#emitFileProduced(item.savedPath, id);
 			const lines = [item.savedPath ? `Saved to ${item.savedPath}` : "No saved path reported", ...shortResult(item.result) ? [item.result] : []];
-			this.#emitToolResult(id, lines.join("\n"), item.status === "failed");
+			this.#emitToolResult(id, lines.join("\n"), item.status === "failed", void 0, agent?.toolUseId ?? null);
+		},
+		imageView: (item, _active, id, agent) => {
+			this.#emitToolUse(id, "CodexImageView", { path: item.path }, agent);
+			this.#emitToolResult(id, item.path, false, void 0, agent?.toolUseId ?? null);
+		},
+		subAgentActivity: (item, _active, id, agent) => {
+			if (this.#replayingHistory) {
+				if (item.kind !== "started") return;
+				this.#emitToolUse(id, CODEX_AGENT_TOOL, {
+					...agentName(item.agentPath) ? { subagent_type: agentName(item.agentPath) } : {},
+					agentThreadId: item.agentThreadId,
+					...item.agentPath ? { agentPath: item.agentPath } : {}
+				}, agent);
+				this.#emitToolResult(id, "(ran in its own thread — its work is not part of this thread's stored history)", false, void 0, agent?.toolUseId ?? null);
+				return;
+			}
+			const record = this.#agents.get(item.agentThreadId) ?? this.#agents.open(item.agentThreadId, id, void 0, Date.now());
+			const name = agentName(item.agentPath);
+			const relabel = record.agentType === void 0 && name !== void 0;
+			if (relabel) record.agentType = name;
+			if (!record.anchored || relabel) {
+				record.anchored = true;
+				this.#emitToolUse(record.toolUseId, CODEX_AGENT_TOOL, {
+					...record.agentType ? { subagent_type: record.agentType } : {},
+					agentThreadId: item.agentThreadId,
+					...item.agentPath ? { agentPath: item.agentPath } : {}
+				}, agent);
+			}
+			if (item.kind === "interrupted") {
+				if (record.status === "running") {
+					this.#agents.settle(record, "failed");
+					this.#emitToolResult(record.toolUseId, "interrupted", true);
+				}
+				return;
+			}
+			if (item.kind !== "started" && record.status !== "running") this.#agents.revive(record);
 		},
-		imageView: (item, _active, id) => {
-			this.#emitToolUse(id, "CodexImageView", { path: item.path });
-			this.#emitToolResult(id, item.path, false);
+		collabAgentToolCall: (item, active, id, agent) => {
+			if (!active.toolUseEmitted.has(id)) {
+				active.toolUseEmitted.add(id);
+				this.#emitToolUse(id, CODEX_COLLAB_TOOL, collabInput(item), agent);
+			}
+			if (item.status === "inProgress") return;
+			const failed = item.status === "failed" || item.status === "declined";
+			this.#emitToolResult(id, failed ? item.status : "", failed, void 0, agent?.toolUseId ?? null);
 		}
 	};
-	#emitDelta(delta) {
+	#emitDelta(delta, parent) {
 		if (this.#config.includePartialMessages === false) return;
 		this.#emit({
 			type: "stream_delta",
@@ -5400,11 +6203,11 @@ var CodexRunner = class {
 				type: "content_block_delta",
 				delta
 			},
-			parentToolUseId: null,
+			parentToolUseId: parent,
 			uuid: randomUUID()
 		});
 	}
-	#emitAssistant(uuid, content) {
+	#emitAssistant(uuid, content, parent) {
 		this.#emit({
 			type: "assistant_message",
 			message: {
@@ -5412,11 +6215,19 @@ var CodexRunner = class {
 				content,
 				model: this.#model ?? this.#resolvedModel
 			},
-			parentToolUseId: null,
+			parentToolUseId: parent,
 			uuid
 		});
 	}
-	#emitToolUse(id, name, input) {
+	/** `agent` (rather than a bare parent id) because a nested call is also the
+	* agent's progress reading: `SubagentInfo.toolCount` ticks here, once per
+	* card — the `counted` set is what keeps an upserted re-emission (the
+	* finished imageGeneration input) from counting one picture twice. */
+	#emitToolUse(id, name, input, agent) {
+		if (agent && !agent.counted.has(id)) {
+			agent.counted.add(id);
+			agent.toolCount += 1;
+		}
 		this.#emit({
 			type: "assistant_message",
 			message: {
@@ -5429,11 +6240,11 @@ var CodexRunner = class {
 				}],
 				model: this.#model ?? this.#resolvedModel
 			},
-			parentToolUseId: null,
+			parentToolUseId: agent?.toolUseId ?? null,
 			uuid: `${id}-use`
 		});
 	}
-	#emitToolResult(toolUseId, content, isError, patch) {
+	#emitToolResult(toolUseId, content, isError, patch, parent = null) {
 		this.#emit({
 			type: "user_message",
 			message: {
@@ -5445,7 +6256,7 @@ var CodexRunner = class {
 					is_error: isError || void 0
 				}]
 			},
-			parentToolUseId: null,
+			parentToolUseId: parent,
 			synthetic: true,
 			patch,
 			uuid: `${toolUseId}-result`
@@ -5573,6 +6384,8 @@ var CodexRunner = class {
 		};
 		this.#lastActivityAt = event.ts;
 		this.#activityCount += transcriptActivity(body);
+		this.#contextUsage = contextReading(body) ?? this.#contextUsage;
+		if (body.type === "conversation_reset") this.#contextUsage = void 0;
 		this.#events.push(event);
 		this.#subscribers.emit(event);
 	}
@@ -5594,7 +6407,15 @@ var CodexRunner = class {
 *     const c=JSON.parse(d.slice(s,i));
 *     for(const m of c.models) console.log(m.slug, m.display_name,
 *       m.visibility, m.supported_reasoning_levels.map(l=>l.effort).join(","))'\
-*     "$(node -p 'require.resolve("@openai/codex-darwin-arm64/package.json").replace("package.json","vendor/aarch64-apple-darwin/bin/codex")')"
+*     "$(node -p 'const{createRequire}=require("module");
+*       const w=require.resolve("@openai/codex/package.json");
+*       createRequire(w).resolve("@openai/codex-darwin-arm64/package.json")
+*         .replace("package.json","vendor/aarch64-apple-darwin/bin/codex")')"
+*
+* The two-hop resolve is NOT optional: under pnpm's strict layout the platform
+* package is a dependency of `@openai/codex`, so it resolves only from that
+* wrapper's location, never from the repo root. Resolving it directly throws
+* MODULE_NOT_FOUND — the same two hops `resolveBundledCodexExecutable` makes.
 *
 * Mapping decisions:
 * - the internal `codex-auto-review` row is dropped (the codex analogue of
@@ -5606,7 +6427,7 @@ var CodexRunner = class {
 *   `max`/`ultra` beyond the SDK union; trust the binary, keep strings open.
 */
 const CODEX_CATALOG = {
-	provenance: "embedded model presets of @openai/codex@0.146.0 (darwin-arm64 binary), extracted 2026-08-05",
+	provenance: "embedded model presets of @openai/codex@0.149.0 (darwin-arm64 binary), extracted 2026-08-22",
 	models: [
 		{
 			value: "gpt-5.6-sol",