@workerdeck/core 0.22.0 → 1.0.0

package/build/index.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { getSessionInfo, getSessionMessages, listSessions, query } from "@anthropic-ai/claude-agent-sdk";
-import { ENGINE_CAPABILITIES, PROTOCOL_VERSION, SUBAGENT_HISTORY, TOOL_RESULT_HEAD_CHARS, contextReading, imagePartRef, replayCoalesceKey, replayRetains, snapshotRetains, transcriptActivity, transcriptContent } from "@workerdeck/protocol";
+import { ENGINE_CAPABILITIES, PROTOCOL_VERSION, SUBAGENT_HISTORY, TOOL_RESULT_HEAD_CHARS, contextReading, imagePartRef, replayCoalesceKey, replayRetains, snapshotRetains, transcriptActivity, transcriptContent, transcriptProse } from "@workerdeck/protocol";
 import { ToolLoopAgent, generateText, isStepCount, tool } from "ai";
 import { execFile, spawn } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -11,15 +11,12 @@ import { lookup } from "node:dns/promises";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, resolve, sep } from "node:path";
 //#region src/lib/attachments.ts
-/** The four the Anthropic API accepts. Notably absent: image/heic — an iPhone's
-* native photo format, which clients must transcode before upload. */
 const IMAGE_TYPES = new Set([
 	"image/jpeg",
 	"image/png",
 	"image/gif",
 	"image/webp"
 ]);
-/** Textual types whose media type doesn't start with `text/`. */
 const TEXT_TYPES = new Set([
 	"application/json",
 	"application/xml",
@@ -32,11 +29,9 @@ const TEXT_TYPES = new Set([
 	"application/x-httpd-php",
 	"application/sql"
 ]);
-/** Strips any `; charset=…` parameter and lowercases. */
 function normalizeMediaType(mediaType) {
 	return mediaType.split(";")[0].trim().toLowerCase();
 }
-/** How this media type can be sent, or null if it can't be. */
 function attachmentKind(mediaType) {
 	const type = normalizeMediaType(mediaType);
 	if (IMAGE_TYPES.has(type)) return "image";
@@ -44,23 +39,11 @@ function attachmentKind(mediaType) {
 	if (type.startsWith("text/") || TEXT_TYPES.has(type)) return "text";
 	return null;
 }
-/** Human-readable list for the 415 an unsupported upload gets. */
 const SUPPORTED_ATTACHMENT_TYPES = [
 	...IMAGE_TYPES,
 	"application/pdf",
 	"text/*"
 ].join(", ");
-/**
-* Anthropic content blocks for a set of attachments, in the given order.
-*
-* Blocks lead the message and the user's text follows: the model reads the
-* picture, then the instruction about it. Text files are inlined in a named
-* envelope rather than as a bare block, so "here is my config" doesn't read as
-* something the user typed.
-*
-* Structurally typed — `packages/core` models Anthropic content the way
-* `packages/protocol` does, and the caller casts into the SDK's own param type.
-*/
 function attachmentContentBlocks(attachments) {
 	return attachments.map((attachment) => {
 		const mediaType = normalizeMediaType(attachment.mediaType);
@@ -90,7 +73,6 @@ function attachmentContentBlocks(attachments) {
 		}
 	});
 }
-/** Strip the bytes: the log-safe half of an attachment. */
 function attachmentRef(attachment) {
 	return {
 		id: attachment.id,
@@ -104,10 +86,6 @@ function decodeText(base64) {
 }
 //#endregion
 //#region src/lib/input-queue.ts
-/**
-* Push-based single-consumer AsyncIterable bridging imperative sendMessage() calls
-* into the streaming `prompt` the Agent SDK consumes.
-*/
 var InputQueue = class {
 	#buffer = [];
 	#waiter = null;
@@ -163,30 +141,8 @@ var InputQueue = class {
 };
 //#endregion
 //#region src/lib/patch.ts
-/**
-* Turning an engine's edit output into the wire's {@link FilePatch}.
-*
-* Both engines know exactly which lines of which file changed, and both say so
-* in their own vocabulary: the Claude SDK hands over a `structuredPatch` array
-* on `SDKUserMessage.tool_use_result`, codex puts a unified diff string on each
-* `fileChange` item. A client can reconstruct neither — it has never seen the
-* file — so anything not normalized here is a diff that renders without line
-* numbers.
-*
-* Normalizing in the runner rather than in each client is the point: one shape
-* reaches the wire, and the dashboard, the extension and the phone all render
-* from it without a per-engine branch or a diff parser of their own.
-*/
-/**
-* The most lines a patch may put on the wire.
-*
-* A patch is replayed on every attach and captured into parking snapshots, so
-* "the diff is big" must not become "this session is expensive to open forever".
-* Whole hunks are kept or dropped — half a hunk has misleading line numbers —
-* and the drop is flagged so a renderer can say the diff is partial instead of
-* presenting it as the whole change.
-*/
 const MAX_PATCH_LINES = 400;
+const HUNK_HEADER = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 function capHunks(hunks) {
 	const kept = [];
 	let lines = 0;
@@ -200,25 +156,15 @@ function capHunks(hunks) {
 	}
 	return { hunks: kept };
 }
-/** Structural, not `instanceof`: this reads a field the SDK types as `unknown`,
-* and a shape check is the only honest way to know what arrived. */
 function isHunk(value) {
 	const hunk = value;
 	return !!hunk && typeof hunk.oldStart === "number" && typeof hunk.oldLines === "number" && typeof hunk.newStart === "number" && typeof hunk.newLines === "number" && Array.isArray(hunk.lines) && hunk.lines.every((line) => typeof line === "string");
 }
-/**
-* A {@link FilePatch} from the Claude SDK's structured tool output
-* (`SDKUserMessage.tool_use_result` for Edit/Write/NotebookEdit).
-*
-* Everything else on that object is deliberately left behind — `originalFile`
-* alone is the entire pre-edit file, which is precisely what must not be logged
-* (see `FilePatch`'s own note).
-*/
 function filePatchFromToolResult(result) {
 	const output = result;
-	if (!output || !Array.isArray(output.structuredPatch)) return void 0;
+	if (!output || !Array.isArray(output.structuredPatch)) return;
 	const hunks = output.structuredPatch.filter(isHunk);
-	if (hunks.length === 0) return void 0;
+	if (hunks.length === 0) return;
 	const { hunks: kept, truncated } = capHunks(hunks);
 	return {
 		...typeof output.filePath === "string" && { path: output.filePath },
@@ -227,20 +173,6 @@ function filePatchFromToolResult(result) {
 		...truncated && { truncated }
 	};
 }
-/** `@@ -oldStart,oldLines +newStart,newLines @@` — the counts are optional and
-* mean 1 when absent, which is what a single-line hunk looks like. */
-const HUNK_HEADER = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
-/**
-* A {@link FilePatch} from a unified diff — codex's `fileChange.diff`.
-*
-* Only the hunks are read. A diff's `---`/`+++` header names the file, but codex
-* already reports the path on the change itself, and a header path is often
-* relative or `/dev/null`, so the caller's path is the one worth trusting.
-*
-* Returns undefined when there is no hunk header at all: that is not a unified
-* diff, and inventing hunk numbers for it would put wrong line numbers on screen
-* — worse than none.
-*/
 function parseUnifiedDiff(diff, path) {
 	const hunks = [];
 	let current;
@@ -262,7 +194,7 @@ function parseUnifiedDiff(diff, path) {
 		else if (line === "") current.lines.push(" ");
 		else current = void 0;
 	}
-	if (hunks.length === 0) return void 0;
+	if (hunks.length === 0) return;
 	const { hunks: kept, truncated } = capHunks(hunks);
 	return {
 		...path && { path },
@@ -272,43 +204,18 @@ function parseUnifiedDiff(diff, path) {
 }
 //#endregion
 //#region src/lib/normalize.ts
-/** Does this message answer exactly one tool call? A patch is per-file-edit and
-* the message says nothing about which of two results it describes, so anything
-* else gets no patch rather than a diff pinned to the wrong call. */
+const FAMILY_ORDER = [
+	"fable",
+	"opus",
+	"sonnet",
+	"haiku"
+];
 function singleToolResult(message) {
 	const content = message.content;
 	if (!Array.isArray(content)) return false;
 	return content.filter((block) => block.type === "tool_result").length === 1;
 }
-/**
-* The wrappers the CLI writes into the transcript when the *harness* is talking
-* to the model rather than a person talking to the session.
-*
-* Deliberately a text test, and only these two. The live path has structure to
-* go on (`isSynthetic`, `origin.kind`), but **the resumed path has none**: the
-* SDK's `SessionMessage` carries exactly `message`, `uuid`, `session_id`,
-* `parent_tool_use_id`, `parent_agent_id` and `timestamp` — every one of
-* `isMeta`, `isSidechain`, `promptSource` and `origin` is dropped between the
-* stored JSONL and what `getSessionMessages` hands back (verified against real
-* transcripts). So on resume this is the only signal there is, and without it a
-* `<task-notification>` blob comes back as a blue user row and a scrubber mark,
-* as if someone had typed it.
-*
-* `<local-command-caveat>` is here for symmetry and cheap insurance: the SDK
-* filters `isMeta` entries out of a resumed transcript itself today, which is
-* not a contract anyone wrote down.
-*
-* What is *not* here matters as much:
-* - `<local-command-stdout>` — the reducer turns it into a notice row on
-*   purpose; marking it synthetic would delete a row both paths show.
-* - `<command-name>` — that is a person running a slash command. The reducer
-*   renders it as the command line they typed; hiding it would erase the turn's
-*   cause.
-*/
 const SYNTHETIC_USER_PREFIXES = ["<task-notification>", "<local-command-caveat>"];
-/** First text block's leading tag, for the test above. Tool results and images
-* carry no text and are never synthetic by this rule (a tool result is already
-* a tool result to every renderer). */
 function isSyntheticUserText(message) {
 	const content = message.content;
 	const text = typeof content === "string" ? content : Array.isArray(content) ? content.find((block) => block.type === "text")?.text : void 0;
@@ -326,20 +233,6 @@ function toApiMessage(message) {
 		usage: m.usage
 	};
 }
-/**
-* Plan rate-limit windows from the CLI's structured `/usage` data, as `rate_limit`
-* events — the same shape a live `rate_limit_event` produces.
-*
-* Without this a client shows no usage at all until a window *changes*, which the
-* CLI only reports after a turn moves the needle, and never for a session that is
-* only being watched. Polling the snapshot and forwarding it through the existing
-* event means replay, the dashboard and the iOS app all get it for free, with no
-* new protocol surface.
-*
-* `status` is not per-window in the usage payload — 'allowed' is what a session
-* the CLI is running for us is, by construction. A window with no utilization is
-* unknown, not zero, and is dropped rather than reported at 0%.
-*/
 function rateLimitEventsFromUsage(usage) {
 	if (!usage.rate_limits_available || !usage.rate_limits) return [];
 	const limits = usage.rate_limits;
@@ -370,15 +263,6 @@ function rateLimitEventsFromUsage(usage) {
 	}
 	return events;
 }
-/**
-* The CLI's MCP status, as `McpServerStatusInfo`.
-*
-* The narrowing is the point: the SDK's config object carries `env` for stdio
-* servers and `headers` for HTTP ones, and both routinely hold API tokens. This
-* is the one place they are dropped, so no client — dashboard, phone, or a host
-* app reading the REST route — can turn "show me my MCP servers" into a
-* credential dump. Only the connection's identity survives.
-*/
 function mcpStatusInfo(status) {
 	const config = status.config;
 	const transport = config?.type ?? (config?.command ? "stdio" : void 0);
@@ -399,26 +283,6 @@ function mcpStatusInfo(status) {
 		}))
 	};
 }
-/**
-* The CLI's model list, as `ModelOption[]`.
-*
-* Two decisions live here rather than in each client:
-*
-* - **`default` is dropped.** The CLI offers a row whose id is literally
-*   `default` ("Default (recommended)"), meaning "whatever I would have picked".
-*   It is a legal id to send, but it is not a model: a session running on it
-*   reports a real model, so a picker showing it has a row that can never be
-*   checked, and a status bar naming it would say "Default" for a session
-*   answering as Opus. Which model the default resolved to is a different
-*   question, and `system_init` answers it.
-* - **`primary` is derived.** The CLI reports one flat list; Claude Code's own
-*   picker shows the newest of each family and files the rest under "more
-*   models". The list arrives newest-first, so the first row of each family is
-*   the primary one. A heuristic, but a stable one — and doing it once here
-*   means the dashboard and the phone group identically.
-*/
-/** What the CLI's `default` row resolves to — the model a session will answer as
-* before it has answered anything. Dropped from the list, kept as this. */
 function defaultModelFromSdk(models) {
 	return models.find((model) => model.value === "default")?.resolvedModel;
 }
@@ -452,50 +316,26 @@ function modelOptionsFromSdk(models) {
 		return rankA === rankB ? a.index - b.index : rankA - rankB;
 	}).map(({ option }) => option);
 }
-const FAMILY_ORDER = [
-	"fable",
-	"opus",
-	"sonnet",
-	"haiku"
-];
 function familyRank(option) {
 	const rank = FAMILY_ORDER.indexOf(modelFamily(option.resolvedModel ?? option.value));
 	return rank === -1 ? FAMILY_ORDER.length : rank;
 }
-/**
-* The name a person says, from a wire model id: 'claude-opus-5[1m]' → "Opus 5",
-* 'claude-haiku-4-5-20251001' → "Haiku 4.5".
-*
-* The CLI's own `displayName` is the family alone ("Opus", "Haiku") or carries a
-* variant instead of a version ("Opus (1M context)"), and the version is the part
-* that answers "is this the current one". It is only ever in the id, so it is
-* read from there. Returns null when the id has no version to read — a bare
-* alias like 'sonnet' — and the CLI's name stands.
-*/
-function friendlyModelName(id) {
+function modelIdParts(id) {
 	const parts = (id.split("[")[0] ?? id).toLowerCase().split("-").filter(Boolean);
 	if (parts[0] === "claude") parts.shift();
+	return parts;
+}
+function friendlyModelName(id) {
+	const parts = modelIdParts(id);
 	const family = parts.shift();
 	if (!family) return null;
 	const version = parts.filter((part) => !/^\d{8}$/.test(part));
 	if (version.length === 0 || version.some((part) => !/^\d+$/.test(part))) return null;
 	return `${family.charAt(0).toUpperCase()}${family.slice(1)} ${version.join(".")}`;
 }
-/** 'claude-opus-4-8[1m]' → "opus". The vendor prefix, the context-window suffix
-* and the version tail are all dropped; what is left is the family a person
-* names. Unrecognisable ids become their own family, so a model this rule has
-* never seen lands in the main list rather than being hidden. */
 function modelFamily(id) {
-	const withoutVariant = id.split("[")[0] ?? id;
-	const parts = withoutVariant.toLowerCase().split("-");
-	if (parts[0] === "claude") parts.shift();
-	return parts[0] ?? withoutVariant;
+	return modelIdParts(id)[0] ?? id;
 }
-/**
-* Map one SDKMessage to a wire-protocol event body, or null for messages the runner
-* consumes itself (system_init and session-state changes carry runner state and are
-* emitted by the runner with extra context).
-*/
 function normalizeSdkMessage(msg) {
 	switch (msg.type) {
 		case "assistant": return {
@@ -560,26 +400,73 @@ function normalizeSdkMessage(msg) {
 	}
 }
 //#endregion
+//#region src/lib/event-log.ts
+var EventLog = class {
+	#events = [];
+	#seq = 0;
+	#activityCount = 0;
+	#proseCount = 0;
+	#contextUsage;
+	#resetSeq = 0;
+	#lastActivityAt;
+	get events() {
+		return this.#events;
+	}
+	get seq() {
+		return this.#seq;
+	}
+	get activityCount() {
+		return this.#activityCount;
+	}
+	/** The unread badge's unit — see `transcriptProse`. Folded here so a restored log recomputes it. */
+	get proseCount() {
+		return this.#proseCount;
+	}
+	get contextUsage() {
+		return this.#contextUsage;
+	}
+	get resetSeq() {
+		return this.#resetSeq;
+	}
+	get lastActivityAt() {
+		return this.#lastActivityAt;
+	}
+	append(body) {
+		const event = {
+			...body,
+			seq: ++this.#seq,
+			ts: Date.now()
+		};
+		this.#lastActivityAt = event.ts;
+		this.#fold(event);
+		this.#events.push(event);
+		return event;
+	}
+	at(seq) {
+		return this.#events.find((event) => event.seq === seq);
+	}
+	restore(events, seq, lastActivityAt) {
+		this.#events = [...events];
+		this.#seq = seq;
+		this.#activityCount = 0;
+		this.#proseCount = 0;
+		this.#contextUsage = void 0;
+		this.#resetSeq = 0;
+		for (const event of this.#events) this.#fold(event);
+		this.#lastActivityAt = lastActivityAt;
+	}
+	#fold(event) {
+		this.#activityCount += transcriptActivity(event);
+		this.#proseCount += transcriptProse(event);
+		this.#contextUsage = contextReading(event) ?? this.#contextUsage;
+		if (event.type === "conversation_reset") {
+			this.#resetSeq = event.seq;
+			this.#contextUsage = void 0;
+		}
+	}
+};
+//#endregion
 //#region src/lib/replay.ts
-/**
-* Which buffered events a coalesced replay should skip: everything superseded
-* by a later event with the same {@link replayCoalesceKey}.
-*
-* A **backwards** scan, keeping the first occurrence of each key — which is the
-* whole trick. Walking forwards would need a second pass to know which of the
-* fifty context readings was the last one; walking backwards, the first one you
-* meet *is* the last one, and everything after it (in scan order) is history.
-*
-* Note what this does **not** do: it never reorders and never touches an event
-* with no key. Transcript content is an ordered fold — a stream delta
-* accumulates onto a message, a tool result attaches to a call that came
-* earlier, a turn result finalizes — so it must arrive exactly as it was
-* emitted. Only last-write-wins *state* is eligible, and `replayCoalesceKey`
-* is where that judgement lives.
-*
-* `afterSeq` is honoured so the scan agrees with the caller's replay window: an
-* event the caller was never going to send must not suppress one it was.
-*/
 function staleReplaySeqs(events, afterSeq) {
 	const stale = /* @__PURE__ */ new Set();
 	const seen = /* @__PURE__ */ new Set();
@@ -593,45 +480,6 @@ function staleReplaySeqs(events, afterSeq) {
 	}
 	return stale;
 }
-/**
-* The one replay body, and what a socket receives from it.
-*
-* Every runner had a byte-identical copy of this loop — three spellings of four
-* rules, one of which ("never drop the highest-seq event, whatever the rule
-* says") is load-bearing and was three copies of a comment. Not a base class:
-* the runners share nothing else, and a base class would have to own `#emit`,
-* the most engine-specific method each of them has.
-*
-* The rules, in the order they are applied:
-*
-* 1. `afterSeq` — the caller already holds everything at or below it.
-* 2. `resetSeq` — transcript *content* strictly below the latest
-*    `conversation_reset` is skipped, so a re-attach cannot resurrect a cleared
-*    conversation while state events still replay. **Every engine that can emit
-*    a reset must track it and pass it** — this was Claude's alone only for as
-*    long as Claude's was the only engine that could produce the event, and the
-*    failure when a runner forgets is quiet: the end state is right for a
-*    current reducer, so nothing looks broken while every attach re-sends the
-*    whole cleared conversation for the process's lifetime.
-* 3. `coalesceReplay` — last-write-wins state readings superseded later in the
-*    same replay (`staleReplaySeqs`), plus everything `replayRetains` says the
-*    reducer reads and discards. Opt-in, and only sound for a consumer whose
-*    handling of those events is last-write-wins.
-* 4. `imageRefs` — a base64 image part is delivered as an `image_ref` address
-*    (protocol's {@link imagePartRef}), its bytes one REST fetch away. Applied
-*    **before** rule 5, because it stamps indices from the stored part array
-*    which rule 5 then reshapes. Unlike rule 5 this also applies to the live
-*    path (see `SubscriberSet`), which is the one place these two rules differ.
-* 5. `truncateResults` — a huge `tool_result` block is delivered as its head
-*    plus the markers that say so. **Never mutates the stored event**: the live
-*    path, the parking snapshot and the fetch route all need the whole thing,
-*    so this builds a copy and the log stays the log.
-*
-* The highest-seq event is delivered whatever rules 2 and 3 say — a client's
-* replay hold waits for `state.lastSeq` to reach the attach's and would
-* otherwise hang forever — but it is still *truncated* when rule 4 applies. A
-* session that ends on a `find /` puts its 641 KB frame exactly there.
-*/
 function replaySlice(events, options) {
 	const { afterSeq, resetSeq = 0, coalesceReplay, truncateResults, imageRefs } = options;
 	const stale = coalesceReplay ? staleReplaySeqs(events, afterSeq) : void 0;
@@ -649,16 +497,6 @@ function replaySlice(events, options) {
 	}
 	return out;
 }
-/**
-* A copy of `event` whose oversized `tool_result` blocks carry their head and
-* say so — or `event` itself, unchanged and un-copied, when nothing is over the
-* budget. That identity matters: an attach is mostly small events, and a fresh
-* object for every one of them would cost more than the feature saves.
-*
-* Blocks are measured and cut **individually**. A message answering three calls
-* where one is a `find /` keeps the two small results whole, which is what makes
-* the per-block marker (rather than a per-event one) honest.
-*/
 function truncateResultBlocks(event) {
 	if (event.type !== "user_message") return event;
 	const content = event.message.content;
@@ -687,22 +525,11 @@ function truncateResultBlocks(event) {
 		}
 	};
 }
-/** Characters in a result's content, in the same terms a reader sees it: the
-* string itself, or every text part of a block list joined by newlines — which
-* is exactly what `blockText` in the reducer builds. Non-text parts (an image
-* block) contribute nothing, because they are not what is large here and
-* slicing them would corrupt them. */
 function resultChars(content) {
 	if (typeof content === "string") return content.length;
 	if (!Array.isArray(content)) return 0;
 	return content.reduce((total, part, index) => total + (typeof part.text === "string" ? part.text.length + (index > 0 ? 1 : 0) : 0), 0);
 }
-/** The first `chars` characters, in the content's own shape — a string stays a
-* string, a block list stays a block list (cut at the part that crosses the
-* budget, with the remaining parts dropped). Shape-preserving on purpose: the
-* reducer, both renderers and the copy button all read this the same way they
-* read a whole one, so truncation is a shorter result and never a different
-* kind of one. */
 function headOf(content, chars) {
 	if (typeof content === "string") return content.slice(0, chars);
 	if (!Array.isArray(content)) return content;
@@ -724,23 +551,6 @@ function headOf(content, chars) {
 	}
 	return parts;
 }
-/**
-* A copy of `event` whose `tool_result` blocks carry `image_ref` addresses in
-* place of their base64 image parts — or `event` itself, unchanged and
-* un-copied, when it holds none. Same identity rule as
-* {@link truncateResultBlocks}, and it matters more here: an event carrying an
-* image at all is the exception, so the common path must not allocate.
-*
-* **Never mutates the stored event.** The log is what the parking snapshot
-* embeds, what `Runner.eventAt` reads, and therefore what the fetch route
-* serves the bytes back from — a drop that reached the log would 404 the very
-* lazy-load this rule promises.
-*
-* Indices are stamped from the **stored** array, which is why this runs *before*
-* truncation rather than after: `headOf` reshapes a block's parts, so an address
-* computed on its output would name the wrong part of the stored block. That
-* ordering is asserted in `replay-image-ref.test.ts`, not merely intended.
-*/
 function refImageParts(event) {
 	if (event.type !== "user_message") return event;
 	const content = event.message.content;
@@ -778,14 +588,6 @@ function refImageParts(event) {
 //#region src/lib/subscribers.ts
 var SubscriberSet = class {
 	#listeners = /* @__PURE__ */ new Map();
-	/**
-	* Replay `events` to `listener` under `options`, then hold it for live
-	* delivery. Returns the unsubscribe.
-	*
-	* The replay runs *before* the listener joins the set, which is the ordering
-	* every runner already had and is load-bearing: joining first would deliver a
-	* live event emitted mid-replay ahead of the buffered events preceding it.
-	*/
 	subscribe(events, listener, afterSeq = 0, options, resetSeq = 0) {
 		const asked = options ?? {};
 		for (const event of replaySlice(events, {
@@ -798,11 +600,9 @@ var SubscriberSet = class {
 			this.#listeners.delete(listener);
 		};
 	}
-	/** Drop every subscriber — a park, which ends the session's live stream. */
 	clear() {
 		this.#listeners.clear();
 	}
-	/** Fan one event out, transformed per subscriber. */
 	emit(event) {
 		for (const [listener, asked] of this.#listeners) try {
 			listener(asked.imageRefs ? refImageParts(event) : event);
@@ -810,71 +610,34 @@ var SubscriberSet = class {
 	}
 };
 //#endregion
+//#region src/lib/title.ts
+function hostTitle(meta) {
+	const title = meta?.title;
+	return typeof title === "string" && title.length > 0 ? title : void 0;
+}
+function sessionTitle(config, engineTitle) {
+	const host = hostTitle(config.meta);
+	if (host) return host;
+	if (engineTitle) return engineTitle;
+	const prompt = config.prompt;
+	if (!prompt) return;
+	return prompt.length > 80 ? prompt.slice(0, 77) + "…" : prompt;
+}
+function withTitle(config, title) {
+	const meta = { ...config.meta };
+	if (title) meta.title = title;
+	else delete meta.title;
+	return {
+		...config,
+		meta
+	};
+}
+//#endregion
 //#region src/engines/claude/subagents.ts
-/**
-* The rollup behind `SessionInfo.subagents` — what a sessions list (which never
-* attaches) can know about the sub-agents running inside a session. Fed from
-* `SessionRunner.#emit`, the one chokepoint every event passes through, so the
-* resume backfill — which replays history through the same path — reconstructs
-* it with no persistence of its own. Grouping is by Task id throughout, never
-* adjacency: parallel sub-agents interleave in the stream, the same fact that
-* broke the terminal theme's positional row model.
-*
-* Three decisions live here rather than in the protocol doc:
-*
-* **What counts as a spawn.** A record opens when a *top-level* assistant
-* message carries a `tool_use` named `Task` or `Agent` — the moment the
-* sub-agent exists, so a just-spawned agent is visible before its first nested
-* event, with the block's input in hand for its labels. Both names are observed
-* SDK spellings (`Task` synchronous, `Agent` async), and the name is a
-* convention, not a law — a session that spawned three `Agent`s under a tracker
-* that only knew `Task` reported all three as label-less failures. So three
-* more openers back the allowlist up: the CLI's own `task_started` system event
-* (which positively names the `tool_use_id` an agent runs under, with the brief
-* as labels), the launch acknowledgement (below), and — as before — any nested
-* event whose `parentToolUseId` has no record: an id that events demonstrably
-* nest under *is* a sub-agent, whatever the spawning call was named. A fallback
-* record never saw an input, so it stays label-less until a named signal fills
-* it in rather than resetting an accumulated count.
-*
-* **A background agent's `tool_result` is a launch receipt, not a verdict.**
-* An async agent's spawn call resolves seconds after the spawn with "Async
-* agent launched successfully. (This tool result is internal metadata …)" —
-* long before the agent has done anything — and its actual outcome travels on
-* a `task_notification` system event instead (`status: 'completed'` is `done`,
-* any other way of stopping is `failed`: the report the notification exists to
-* deliver never came). Settling on the receipt would read "0 of 3 agents
-* running" while three agents burn tokens, so a non-error result on a record
-* known to be background never settles it. Known how: the `task_started` event
-* live, or the receipt's own wrapper text on a resume — the stored transcript
-* carries none of the CLI's system events, so, exactly as
-* `isSyntheticUserText` documents for the `<task-notification>` blob, the text
-* is the only signal the replayed path has.
-*
-* **What an interrupted turn leaves behind.** A Task whose `tool_result` never
-* arrives — interrupt, session error, a turn or budget cap — would otherwise
-* read `running` on an idle session forever, a lie a list re-renders at every
-* poll. So the end of a turn settles every still-running record as `failed`:
-* the report never came, which is the one thing `done` could have claimed. The
-* sweep keys on `turn_result`, on the status coming to rest (`idle` — which is
-* how a resumed history that ends mid-Task settles, since the backfill replays
-* no `turn_result` — or a terminal state), and on the session closing. A real
-* verdict arriving anyway outranks the sweep's inference. The sweep's premise
-* — "the turn ended, so anything still running was cut off" — is false for a
-* background agent, which is *designed* to outlive its turn: the real session
-* behind this file ended three turns while its agents ran, and every
-* `turn_result` re-branded live, working agents as failures. So the turn and
-* idle sweeps spare a record marked background by a **live** signal. They do
-* not spare one whose only evidence is replayed: the backfill describes a
-* process that is gone, and a background agent the old process died inside can
-* never notify — `running` would be the forever-lie again. `session_closed`
-* and the terminal statuses settle everything, background included, for the
-* same reason: the process hosting those agents is gone.
-*/
+const SPAWNER_NAMES = new Set(["Task", "Agent"]);
 var SubagentTracker = class {
 	#records = /* @__PURE__ */ new Map();
 	#settleCounter = 0;
-	/** Fold one emitted event body into the rollup, in log order. */
 	observe(body, ts) {
 		switch (body.type) {
 			case "assistant_message":
@@ -954,14 +717,8 @@ var SubagentTracker = class {
 			default: return;
 		}
 	}
-	/**
-	* The rollup as `SessionInfo.subagents` serves it: spawn order (the
-	* transcript's own), fresh objects, and `undefined` when there is nothing to
-	* say — absent and empty mean the same thing to a client, and an empty array
-	* on every row of a 1.2s-polled list is bytes spent saying nothing.
-	*/
 	list() {
-		if (this.#records.size === 0) return void 0;
+		if (this.#records.size === 0) return;
 		const out = [];
 		for (const r of this.#records.values()) out.push({
 			toolUseId: r.toolUseId,
@@ -992,13 +749,6 @@ var SubagentTracker = class {
 		record.agentType ??= cleaned(input?.subagent_type);
 		record.description ??= cleaned(input?.description);
 	}
-	/**
-	* End of turn (`final: false`): anything still running was cut off before
-	* its report — except a background agent the live process still hosts, which
-	* is designed to outlive the turn and settles by notification instead. End
-	* of session (`final: true`): everything, background included, because the
-	* process those agents lived in is gone.
-	*/
 	#sweep(final) {
 		for (const record of this.#records.values()) {
 			if (record.status !== "running") continue;
@@ -1025,53 +775,32 @@ var SubagentTracker = class {
 		}
 	}
 };
-/** The spawner names observed in the wild: `Task` runs the agent inside the
-* turn, `Agent` launches it in the background. Deliberately just these two —
-* a third spelling is caught by `task_started`, the launch receipt, or the
-* nested-event fallback, so widening this to every tool would only turn
-* ordinary calls into phantom agents. */
-const SPAWNER_NAMES = new Set(["Task", "Agent"]);
-/** The async spawn's immediate `tool_result` — "Async agent launched
-* successfully. (This tool result is internal metadata …)" — recognized by its
-* wrapper text because on a resume that text is the only signal there is (the
-* `SYNTHETIC_USER_PREFIXES` argument; the CLI's system events are not stored).
-* Live, `task_started` marks the record first and this is redundant armor. */
-const isLaunchAck = (content) => {
+function isLaunchAck(content) {
 	const text = typeof content === "string" ? content : firstText(Array.isArray(content) ? content : []);
 	return typeof text === "string" && text.trimStart().startsWith("Async agent launched");
-};
-/** A background agent stopping, parsed from the `<task-notification>` wrapper
-* the CLI writes into the transcript. Field-tolerant on purpose: only the
-* `tool-use-id` (this rollup's key) and the `status` verdict are read. */
-const parseTaskNotification = (text) => {
-	if (text === void 0 || !text.trimStart().startsWith("<task-notification>")) return void 0;
+}
+function parseTaskNotification(text) {
+	if (text === void 0 || !text.trimStart().startsWith("<task-notification>")) return;
 	const toolUseId = /<tool-use-id>\s*([^<\s]+)\s*<\/tool-use-id>/.exec(text)?.[1];
-	if (toolUseId === void 0) return void 0;
+	if (toolUseId === void 0) return;
 	return {
 		toolUseId,
 		status: /<status>\s*([^<]*?)\s*<\/status>/.exec(text)?.[1] ?? ""
 	};
-};
-/** The first text of a message body, however the content is spelled — the
-* stored transcript uses bare strings, the live stream uses blocks. */
-const firstText = (content) => {
+}
+function firstText(content) {
 	if (typeof content === "string") return content;
 	for (const block of content) {
 		const b = block;
 		if (b?.type === "text" && typeof b.text === "string") return b.text;
 	}
-};
-/** Trim, drop blank, clip at the same 80 the terminal theme's `taskLabel` uses.
-* Model-authored input rides every row of a polled sessions list, so it is
-* bounded here rather than trusted — a 10KB `description` would be paid for at
-* every poll. */
-const cleaned = (value) => {
-	if (typeof value !== "string") return void 0;
+}
+function cleaned(value) {
+	if (typeof value !== "string") return;
 	const text = value.trim();
-	if (text === "") return void 0;
+	if (text === "") return;
 	return text.length > 80 ? text.slice(0, 79) + "…" : text;
-};
-/** The `tool_use` blocks of a message body, however the content is spelled. */
+}
 function toolUseBlocks(content) {
 	if (typeof content === "string") return [];
 	const blocks = [];
@@ -1090,37 +819,13 @@ function toolUseBlocks(content) {
 //#endregion
 //#region src/engines/claude/runner.ts
 const DEFAULT_APPROVAL_TIMEOUT_MS$1 = 3e5;
-/**
-* One live Agent SDK session: owns the query() call, the streaming input queue, the
-* pending-approval table, and a seq-numbered event log that subscribers can replay.
-* No transport — the server (or any host) subscribes and bridges to the wire.
-*/
 var SessionRunner = class {
 	id;
 	createdAt;
 	#config;
-	/** {@link SessionRunnerConfig.cwd}, checked once in the constructor. */
 	#cwd;
-	#events = [];
+	#log = new EventLog();
 	#subscribers = new SubscriberSet();
-	#seq = 0;
-	/**
-	* Latest context-window reading, retained from the last `context_usage` this
-	* runner emitted so `GET /sessions` can answer it without an attach — see
-	* `SessionInfo.contextUsage`. Folded in the emit path, so it is by
-	* construction the same number the transcript last drew.
-	*/
-	#contextUsage;
-	#activityCount = 0;
-	/**
-	* Seq of the latest `conversation_reset` event, 0 when none. The log itself is
-	* never truncated — it still carries the state-bearing events (`capabilities`,
-	* `system_init`, …) a fresh attacher depends on and which are not re-emitted —
-	* but `subscribe()` skips transcript *content* strictly below this mark, so a
-	* replay does not resurrect a cleared conversation. A later reset supersedes
-	* an earlier one by overwriting it.
-	*/
-	#resetSeq = 0;
 	#status = "starting";
 	#statusDetail;
 	#sdkSessionId;
@@ -1128,39 +833,14 @@ var SessionRunner = class {
 	#apiKeySource;
 	#permissionMode;
 	#pending = /* @__PURE__ */ new Map();
-	/**
-	* The turn ended while an approval was standing, and nothing has started a
-	* new one since.
-	*
-	* `awaiting_approval` rightly outranks `idle` for display, so a turn-over
-	* signal arriving under a standing approval cannot be applied when it lands.
-	* It used to be **discarded** for that reason, which is a different thing
-	* from outranked: the settle path then asserted `running` on the assumption
-	* that an answered approval means work resumes, and when the turn was already
-	* over — an interrupt, a timeout — the session claimed to be running one that
-	* had produced its result. Status is purely edge-driven here, with no poll and
-	* no reconciliation anywhere, so that single dropped edge never came back and
-	* every client rendered it faithfully for the life of the session.
-	*
-	* So the fact is *deferred* rather than dropped, and it is deliberately
-	* cleared the moment work genuinely resumes — a turn-over belongs to the turn
-	* that produced it and must not settle the next one.
-	*/
 	#turnOverWhileBlocked = false;
-	/** The read-time sub-agent rollup (`SessionInfo.subagents`), fed from #emit —
-	* the one chokepoint — so the resume backfill reconstructs it for free. */
 	#subagents = new SubagentTracker();
 	#totalCostUsd;
 	#numTurns;
-	#lastActivityAt;
 	#input = new InputQueue();
 	#query;
 	#capabilitiesEmitted = false;
-	/** Last plan reported by the usage poll, so `plan_info` is emitted on change
-	* rather than once per turn. */
 	#subscriptionType;
-	/** The title the CLI gave this thread (see `#fetchEngineTitle`). Undefined
-	* until it has one — a session gets its summary a turn or two in. */
 	#engineTitle;
 	#started = false;
 	#closed = false;
@@ -1180,9 +860,8 @@ var SessionRunner = class {
 		return this.#sdkSessionId;
 	}
 	get lastSeq() {
-		return this.#seq;
+		return this.#log.seq;
 	}
-	/** 'oauth' = claude.ai subscription credentials; other values are API-key provenance. */
 	get apiKeySource() {
 		return this.#apiKeySource;
 	}
@@ -1203,49 +882,23 @@ var SessionRunner = class {
 			canBypassPermissions: this.#config.permissionMode === "bypassPermissions" || this.#config.allowDangerouslySkipPermissions === true,
 			apiKeySource: this.#apiKeySource,
 			createdAt: this.createdAt,
-			lastSeq: this.#seq,
-			activityCount: this.#activityCount,
-			contextUsage: this.#contextUsage,
+			lastSeq: this.#log.seq,
+			activityCount: this.#log.activityCount,
+			proseCount: this.#log.proseCount,
+			contextUsage: this.#log.contextUsage,
 			pendingPermissionCount: this.#pending.size,
 			subagents: this.#subagents.list(),
 			meta: this.#config.meta,
 			scope: this.#config.scope,
-			title: this.#title(),
+			title: sessionTitle(this.#config, this.#engineTitle),
 			totalCostUsd: this.#totalCostUsd,
 			numTurns: this.#numTurns,
-			lastActivityAt: this.#lastActivityAt
+			lastActivityAt: this.#log.lastActivityAt
 		};
 	}
-	/**
-	* Three sources, most-deliberate first: the host's own rename (`meta.title`),
-	* the title the CLI gave this thread (`#engineTitle`), then the first prompt
-	* truncated.
-	*
-	* The rename outranks everything by design — a person naming a session must
-	* not have it renamed under them by a model — which is also why the engine
-	* title is *only ever read* while `meta.title` is unset (see
-	* `#fetchEngineTitle`), rather than read and then discarded here.
-	*/
-	#title() {
-		const metaTitle = this.#config.meta?.title;
-		if (typeof metaTitle === "string" && metaTitle.length > 0) return metaTitle;
-		if (this.#engineTitle) return this.#engineTitle;
-		const prompt = this.#config.prompt;
-		if (!prompt) return void 0;
-		return prompt.length > 80 ? prompt.slice(0, 77) + "…" : prompt;
-	}
-	/** Host-facing rename: writes `meta.title`, which `#title()` prefers. Clearing
-	* it (undefined) restores the derived title. The engine is never told. */
 	setTitle(title) {
-		const meta = { ...this.#config.meta };
-		if (title) meta.title = title;
-		else delete meta.title;
-		this.#config = {
-			...this.#config,
-			meta
-		};
+		this.#config = withTitle(this.#config, title);
 	}
-	/** Begin the session. Idempotent; returns the run promise (resolves when the query ends). */
 	start() {
 		if (this.#started) return this.#runPromise;
 		this.#started = true;
@@ -1253,11 +906,6 @@ var SessionRunner = class {
 		this.#runPromise = this.#run();
 		return this.#runPromise;
 	}
-	/** Queue a user message for the session (starts the next turn when idle).
-	*
-	* `attachments` carry their own bytes; they reach the CLI as content blocks and
-	* are logged as references. A message may be attachments alone — an empty text
-	* block is not valid API input, so the text is only added when there is some. */
 	sendMessage(text, attachments) {
 		if (this.#closed) throw new Error("session is closed");
 		const blocks = attachments?.length ? attachmentContentBlocks(attachments) : [];
@@ -1285,12 +933,9 @@ var SessionRunner = class {
 			uuid: randomUUID()
 		});
 	}
-	/** Live MCP server status, straight from the CLI. Undefined when the engine
-	* can't answer (an injected fake query in tests) — the caller 501s rather than
-	* pretending the session has no servers. */
 	async mcpServers() {
 		const query = this.#query;
-		if (typeof query?.mcpServerStatus !== "function") return void 0;
+		if (typeof query?.mcpServerStatus !== "function") return;
 		return (await query.mcpServerStatus()).map(mcpStatusInfo);
 	}
 	async reconnectMcpServer(name) {
@@ -1303,7 +948,6 @@ var SessionRunner = class {
 		if (typeof query?.toggleMcpServer !== "function") throw new Error("this session cannot enable or disable MCP servers");
 		await query.toggleMcpServer(name, enabled);
 	}
-	/** Resolve a pending permission request. Returns false if the id is unknown (e.g. timed out). */
 	resolvePermission(requestId, decision) {
 		const pending = this.#pending.get(requestId);
 		if (!pending) return false;
@@ -1313,24 +957,6 @@ var SessionRunner = class {
 	async interrupt() {
 		await this.#query?.interrupt();
 	}
-	/**
-	* Reset the conversation by sending the `/clear` the CLI already honors.
-	*
-	* Deliberately not a second mechanism: this engine's reset arrives *from the
-	* SDK*, and `normalizeSdkMessage` turns the CLI's report of it into the
-	* `conversation_reset` event (adopting the new conversation id and re-polling
-	* context usage on the way through). Reimplementing the clear here would give
-	* one engine two ways to reach the same state, and only one of them would get
-	* the id adoption right. So the command and the composer's `/clear` are one
-	* behaviour, and this method is the thin end of it.
-	*
-	* The one place it differs from the other two engines: this resolves when the
-	* `/clear` has been **handed to the CLI**, not when the reset has happened —
-	* the CLI queues its own streamed input, so waiting is its job, and there is
-	* no chain here to ride. The observable contract is the same (a clear sent
-	* mid-turn queues rather than cutting the turn short); only the moment the
-	* promise settles is weaker, and no caller depends on it.
-	*/
 	async clearContext() {
 		if (this.#status === "closed" || this.#status === "failed") throw new Error("session is closed");
 		this.sendMessage("/clear");
@@ -1343,7 +969,6 @@ var SessionRunner = class {
 			mode
 		});
 	}
-	/** Switch the model for subsequent responses; undefined = back to the default. */
 	async setModel(model) {
 		await this.#query?.setModel(model);
 		this.#model = model;
@@ -1352,7 +977,6 @@ var SessionRunner = class {
 			model
 		});
 	}
-	/** Emit a session_error and terminate. For host-enforced policy (e.g. requireApiKey). */
 	fail(message) {
 		if (this.#closed) return;
 		this.#emit({
@@ -1362,7 +986,6 @@ var SessionRunner = class {
 		this.#setStatus("failed");
 		this.close("error");
 	}
-	/** Terminate the session and the underlying CLI subprocess. */
 	close(reason = "client") {
 		if (this.#closed) return;
 		this.#closed = true;
@@ -1378,27 +1001,11 @@ var SessionRunner = class {
 		});
 		this.#setStatus("closed");
 	}
-	/** See `Runner.eventAt`. A linear scan: the one caller is a reader pressing
-	* "show everything" on one row, so a per-runner seq index would be a map
-	* maintained on every emit to save a walk nobody makes twice a minute. */
 	eventAt(seq) {
-		return this.#events.find((event) => event.seq === seq);
+		return this.#log.at(seq);
 	}
-	/**
-	* Replay buffered events with seq > afterSeq, then deliver live events.
-	* Returns an unsubscribe function.
-	*
-	* Replay honours the reset watermark: transcript content below the latest
-	* `conversation_reset` is skipped (the reducer would clear it again anyway,
-	* and a pre-reset client that never learned the reducer's case would render
-	* a conversation the engine has discarded), while state-bearing events —
-	* which are emitted once and never again — always replay. The reset event
-	* itself replays (the skip is strictly-below), which is what clears a
-	* reconnecting client still holding pre-reset rows; superseded resets are
-	* content below the newer one and are skipped with what they cleared.
-	*/
 	subscribe(listener, afterSeq = 0, options) {
-		return this.#subscribers.subscribe(this.#events, listener, afterSeq, options, this.#resetSeq);
+		return this.#subscribers.subscribe(this.#log.events, listener, afterSeq, options, this.#log.resetSeq);
 	}
 	async #run() {
 		const queryFn = this.#config.queryFn ?? query;
@@ -1436,12 +1043,6 @@ var SessionRunner = class {
 			}
 		}
 	}
-	/**
-	* On resume, emit the prior session's transcript as replay events (seq'd before any
-	* live event). The SDK only re-streams *user* messages on resume; assistant history
-	* would otherwise be lost to clients attaching after a server restart. Duplicated
-	* user messages are deduped client-side by uuid.
-	*/
 	async #backfillHistory() {
 		const c = this.#config;
 		if (!c.resume || c.backfillHistory === false) return;
@@ -1552,11 +1153,6 @@ var SessionRunner = class {
 			}
 		}
 	}
-	/** Ask the CLI what models/commands it supports and surface them as an event
-	* (replayed to late attachers). Called eagerly for promptless sessions and again
-	* on init — the flag keeps it a single emit. Optional-chained: injected fake
-	* queries in tests may not implement these, and a failure must not affect the
-	* session. */
 	async #fetchCapabilities() {
 		if (this.#capabilitiesEmitted) return;
 		const query = this.#query;
@@ -1578,33 +1174,8 @@ var SessionRunner = class {
 			});
 		} catch {}
 	}
-	/**
-	* Adopt the title the CLI gave this thread — the "friendly title" it writes a
-	* turn or two into a session, and the name a resumed thread already carries.
-	*
-	* A **poll, not an observation**, and unavoidably so: no member of the SDK's
-	* `SDKMessage` union carries it (the whole union was checked). It lives on
-	* `SDKSessionInfo`, which only `getSessionInfo` / `listSessions` return — the
-	* same record `GET /sdk-sessions` already serves as `SdkSessionSummary`. So it
-	* is read at init and after each turn, which is also roughly the rate at which
-	* it changes.
-	*
-	* Two rules:
-	* - **Never while `meta.title` is set.** A rename is a person's decision and a
-	*   generated summary must not overwrite it. Not read at all in that case, so
-	*   there is no stored value waiting to resurface if the rename is cleared —
-	*   the next turn simply fetches it again.
-	* - `summary` falls back to the first prompt when the session has no real
-	*   title yet, so it is taken only when it *differs* from `firstPrompt`.
-	*   Otherwise `#title()`'s own prompt fallback covers it, and the two would
-	*   disagree only in how they truncate.
-	*
-	* Best-effort throughout: an unreadable transcript, a session file that is not
-	* there yet, an SDK without the function — all leave the title as it was.
-	*/
 	async #fetchEngineTitle() {
-		const metaTitle = this.#config.meta?.title;
-		if (typeof metaTitle === "string" && metaTitle.length > 0) return;
+		if (hostTitle(this.#config.meta)) return;
 		const sdkSessionId = this.#sdkSessionId;
 		if (!sdkSessionId) return;
 		const read = this.#config.sessionInfoFn ?? getSessionInfo;
@@ -1616,8 +1187,6 @@ var SessionRunner = class {
 			if (title) this.#engineTitle = title;
 		} catch {}
 	}
-	/** Snapshot the context window after a turn and surface it as an event. Optional-chained
-	* and best-effort for the same reasons as #fetchCapabilities. */
 	async #fetchContextUsage() {
 		const query = this.#query;
 		if (typeof query?.getContextUsage !== "function") return;
@@ -1640,17 +1209,6 @@ var SessionRunner = class {
 			});
 		} catch {}
 	}
-	/**
-	* Snapshot the plan's rate-limit windows and surface them as `rate_limit`
-	* events — the same event a live `rate_limit_event` produces, so clients need
-	* nothing new to render it.
-	*
-	* The CLI only *pushes* a window when it changes, which for a session being
-	* watched rather than driven can be never; polling is what makes usage show up
-	* at all. The control request is marked experimental in the SDK, name included,
-	* so it is probed for by name and every failure is silent — one more reason
-	* this can only ever be decoration.
-	*/
 	async #fetchRateLimits() {
 		const query = this.#query;
 		const fetchUsage = query?.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET;
@@ -1716,10 +1274,6 @@ var SessionRunner = class {
 			this.#setStatus("awaiting_approval");
 		});
 	};
-	/** 'auto'/'deny' sessions settle AskUserQuestion synchronously instead of pending:
-	* 'auto' picks each question's first (recommended) option, 'deny' sends the model
-	* back to decide for itself. Request/resolved events still fire so transcripts and
-	* job webhooks show what was chosen. */
 	#resolveQuestionByPolicy(request, mode) {
 		this.#emit({
 			type: "permission_requested",
@@ -1795,26 +1349,11 @@ var SessionRunner = class {
 		});
 	}
 	#emit(body) {
-		const event = {
-			...body,
-			seq: ++this.#seq,
-			ts: Date.now()
-		};
-		this.#lastActivityAt = event.ts;
-		this.#activityCount += transcriptActivity(body);
-		this.#contextUsage = contextReading(body) ?? this.#contextUsage;
-		if (body.type === "conversation_reset") {
-			this.#resetSeq = event.seq;
-			this.#contextUsage = void 0;
-		}
+		const event = this.#log.append(body);
 		this.#subagents.observe(body, event.ts);
-		this.#events.push(event);
 		this.#subscribers.emit(event);
 	}
 };
-/** Answer each AskUserQuestion question with its first option's label — the tool's
-* convention puts the recommended choice first. Keyed by question text, the shape the
-* CLI expects back in `updatedInput.answers`. */
 function recommendedAnswers(input) {
 	const answers = {};
 	const questions = Array.isArray(input.questions) ? input.questions : [];
@@ -1828,60 +1367,26 @@ function recommendedAnswers(input) {
 }
 //#endregion
 //#region src/engines/provider/runner.ts
-/** Permission modes this engine can honor. The rest of the protocol vocabulary
-* (acceptEdits/plan/auto) is Claude Code CLI semantics with no meaning here —
-* setPermissionMode rejects them, which the server surfaces as protocol_error. */
 const SUPPORTED_PERMISSION_MODES = [
 	"default",
 	"bypassPermissions",
 	"dontAsk"
 ];
-/**
-* Model-agnostic runner over the AI SDK v7 ToolLoopAgent. The session's durable
-* state is its ModelMessage history: every turn — including continuation after an
-* externally-executed tool call — is a fresh streamed call over that history
-* (message-state replay; the loop cannot be suspended). Output is emitted as it
-* happens: `stream_delta` per token (unless includePartialMessages is false) and
-* assistant/tool messages per step. Emits the same seq-numbered SessionEvent log
-* as SessionRunner; engine-specific CLI telemetry (system_init, capabilities,
-* rate_limit, ...) is simply never emitted.
-*/
 var AiSdkRunner = class {
 	id;
 	createdAt;
 	#config;
 	#model;
-	#events = [];
+	#log = new EventLog();
 	#subscribers = new SubscriberSet();
-	#seq = 0;
-	/**
-	* Latest context-window reading, retained from the last `context_usage` this
-	* runner emitted so `GET /sessions` can answer it without an attach — see
-	* `SessionInfo.contextUsage`. Folded in the emit path, so it is by
-	* construction the same number the transcript last drew.
-	*/
-	#contextUsage;
-	#activityCount = 0;
-	/**
-	* Seq of the latest `conversation_reset` event, 0 when none. The log itself is
-	* never truncated — it still carries the state-bearing events (`capabilities`,
-	* `system_init`, …) a fresh attacher depends on and which are not re-emitted —
-	* but `subscribe()` skips transcript *content* strictly below this mark, so a
-	* replay does not resurrect a cleared conversation. A later reset supersedes
-	* an earlier one by overwriting it.
-	*/
-	#resetSeq = 0;
 	#status = "starting";
+	#statusDetail;
 	#permissionMode;
 	#messages = [];
 	#pendingToolCalls = /* @__PURE__ */ new Map();
-	/** Calls already handed to the executor, so a re-park never double-dispatches. */
 	#dispatched = /* @__PURE__ */ new Set();
 	#turnChain = Promise.resolve();
 	#abort;
-	/** Accumulates across every leg of one turn. A turn that parks on external
-	* tool calls spans several generate() calls; usage and elapsed time must
-	* cover all of them, not just the leg that happens to finish. */
 	#turnAccum;
 	#numTurns = 0;
 	#totalUsage = {
@@ -1890,15 +1395,11 @@ var AiSdkRunner = class {
 		cacheWrite: 0,
 		cacheRead: 0
 	};
-	#lastActivityAt;
 	#started = false;
 	#closed = false;
-	/** Parked: state has been snapshotted and this instance is inert. Not closed —
-	* the session lives on in the snapshot and resumes as a new instance. */
 	#parked = false;
-	/** Model alias as requested (not the resolved provider id) — what set_model was
-	* given, so a rehydrated session can re-resolve the same choice. */
 	#modelAlias;
+	#pendingApprovals = /* @__PURE__ */ new Map();
 	constructor(config, id = randomUUID()) {
 		const mode = config.permissionMode ?? "default";
 		if (!SUPPORTED_PERMISSION_MODES.includes(mode)) throw new Error(`permission mode '${mode}' is not supported by the AI SDK engine`);
@@ -1910,23 +1411,11 @@ var AiSdkRunner = class {
 		this.createdAt = config.restore?.createdAt ?? Date.now();
 		if (config.restore) this.#restore(config.restore);
 	}
-	/** Adopt a parked session's state. The event log and seq counter come back
-	* verbatim: a client reattaching with `afterSeq` must see one unbroken stream
-	* across the teardown, not a second session that restarts at 1. */
 	#restore(snapshot) {
 		if (snapshot.engine !== "provider") throw new Error(`cannot restore a '${snapshot.engine}' snapshot into the AI SDK engine`);
 		const state = snapshot.state;
 		if (!state || !Array.isArray(state.messages)) throw new Error("session snapshot is missing its provider-engine state");
-		this.#seq = snapshot.seq;
-		this.#events = [...snapshot.events];
-		this.#activityCount = 0;
-		for (const event of this.#events) {
-			this.#activityCount += transcriptActivity(event);
-			if (event.type === "conversation_reset") {
-				this.#resetSeq = event.seq;
-				this.#contextUsage = void 0;
-			} else this.#contextUsage = contextReading(event) ?? this.#contextUsage;
-		}
+		this.#log.restore(snapshot.events, snapshot.seq, state.lastActivityAt);
 		this.#messages = [...state.messages];
 		for (const call of state.pendingToolCalls) this.#pendingToolCalls.set(call.toolCallId, call);
 		this.#dispatched = new Set(state.dispatched);
@@ -1935,7 +1424,6 @@ var AiSdkRunner = class {
 		this.#turnAccum = state.turnAccum ? { ...state.turnAccum } : void 0;
 		if (this.#turnAccum && state.parkedAt !== void 0) this.#turnAccum.startedAt += Date.now() - state.parkedAt;
 		this.#permissionMode = state.permissionMode;
-		this.#lastActivityAt = state.lastActivityAt;
 		this.#status = this.#pendingToolCalls.size > 0 ? "parked" : "idle";
 		if (state.model !== void 0 && state.model !== this.#modelAlias && this.#config.resolveModel) {
 			this.#modelAlias = state.model;
@@ -1946,21 +1434,17 @@ var AiSdkRunner = class {
 		return this.#status;
 	}
 	get lastSeq() {
-		return this.#seq;
+		return this.#log.seq;
 	}
-	/** The session's durable state — persist to park, replay to rehydrate. */
 	get messages() {
 		return [...this.#messages];
 	}
-	/** External tool calls the loop is currently parked on. */
 	get pendingToolCalls() {
 		return [...this.#pendingToolCalls.values()];
 	}
 	get pendingApprovals() {
-		return [];
+		return [...this.#pendingApprovals.values()].map((a) => a.request);
 	}
-	/** The session's scratch filesystem (see Runner.vfs) — the server's file
-	* routes serve deliverables straight from it. */
 	get vfs() {
 		return this.#config.vfs;
 	}
@@ -1971,19 +1455,23 @@ var AiSdkRunner = class {
 			cwd: this.#config.cwd ?? "",
 			profile: this.#config.profile,
 			engine: "provider",
-			capabilities: ENGINE_CAPABILITIES.provider,
+			capabilities: this.#config.shouldApprove ? {
+				...ENGINE_CAPABILITIES.provider,
+				interactiveApprovals: true
+			} : ENGINE_CAPABILITIES.provider,
 			model: this.#modelId(),
 			permissionMode: this.#permissionMode,
 			createdAt: this.createdAt,
-			lastSeq: this.#seq,
-			activityCount: this.#activityCount,
-			contextUsage: this.#contextUsage,
-			pendingPermissionCount: 0,
+			lastSeq: this.#log.seq,
+			activityCount: this.#log.activityCount,
+			proseCount: this.#log.proseCount,
+			contextUsage: this.#log.contextUsage,
+			pendingPermissionCount: this.#pendingApprovals.size,
 			meta: this.#config.meta,
 			scope: this.#config.scope,
-			title: this.#title(),
+			title: sessionTitle(this.#config),
 			numTurns: this.#numTurns || void 0,
-			lastActivityAt: this.#lastActivityAt
+			lastActivityAt: this.#log.lastActivityAt
 		};
 	}
 	start() {
@@ -1994,15 +1482,9 @@ var AiSdkRunner = class {
 		if (this.#config.prompt) this.sendMessage(this.#config.prompt);
 		return this.#turnChain;
 	}
-	/**
-	* Snapshot durable state, release engine resources, and go inert — the session
-	* continues in the snapshot, not in this object. Returns undefined when parking
-	* would lose work or has nothing to wait for: a turn in flight, no parked call,
-	* or an already-closed/parked runner.
-	*/
 	park() {
-		if (this.#closed || this.#parked) return void 0;
-		if (this.#abort || !this.#restingOnDeferred()) return void 0;
+		if (this.#closed || this.#parked) return;
+		if (this.#abort || !this.#restingOnDeferred()) return;
 		this.#setStatus("parked");
 		const snapshot = this.#buildSnapshot();
 		this.#parked = true;
@@ -2012,52 +1494,11 @@ var AiSdkRunner = class {
 		} catch {}
 		return snapshot;
 	}
-	/**
-	* The same snapshot, taken without ending anything.
-	*
-	* `park()` and this are two operations that happen to produce the same value,
-	* and the difference is the whole point: `park()` *ends* the live runner
-	* (inert, listeners dropped, `onClose` called), which is right for deferred
-	* execution — the session has nothing to do for possibly days — and wrong for
-	* restart-survival, where the session is active and someone is mid-
-	* conversation. This one changes nothing at all: no status emit, no listener
-	* clear, no disposer. The host writes the value through to durable storage
-	* after each turn and keeps the runner live and warm, so a restart rebuilds
-	* from the last write through the existing `restore` path and the next message
-	* costs no wake.
-	*
-	* The gate is `park()`'s minus the requirement that there be something parked:
-	*
-	* - `#abort` set is refused for the reason it always was — a `generate()` in
-	*   flight has produced messages that are not in the history yet, so the
-	*   snapshot would be of a turn that half-happened.
-	* - Pending calls that are **not** all deferred are refused, which is
-	*   `park()`'s rule wearing a different hat. An in-process execution's result
-	*   is coming back to *this* runner and dies with the process; a restore would
-	*   wait on it forever, and `state.dispatched` is what would stop the rebuilt
-	*   runner from simply calling it again.
-	* - Idle with nothing pending — the case `park()` exists to refuse — is
-	*   exactly the case this exists to allow.
-	*/
 	snapshot() {
-		if (this.#closed || this.#parked || this.#abort) return void 0;
-		if (this.#pendingToolCalls.size > 0 && !this.#restingOnDeferred()) return void 0;
+		if (this.#closed || this.#parked || this.#abort) return;
+		if (this.#pendingToolCalls.size > 0 && !this.#restingOnDeferred()) return;
 		return this.#buildSnapshot();
 	}
-	/**
-	* The snapshot value itself, shared so a park and a write-through cannot
-	* disagree about what a session *is*.
-	*
-	* The event log is filtered through {@link snapshotRetains} — the persisted
-	* log drops stream deltas, which are superseded by the `assistant_message`
-	* that flushes them and would otherwise be tens of times the size of the text
-	* they spell. Parks get it too, and should: a park sits on disk for days.
-	*
-	* The `parked` list and `state.parkedAt` are honest under both callers. An
-	* idle write-through has no pending calls, so `parked` is empty and the host
-	* arms no watchdogs; `parkedAt` is "when this was taken", which is what
-	* `#restore` needs to discount a turn's clock either way.
-	*/
 	#buildSnapshot() {
 		const parked = [...this.#pendingToolCalls.values()].map((call) => ({
 			executionId: call.toolCallId,
@@ -2073,15 +1514,15 @@ var AiSdkRunner = class {
 			turnAccum: this.#turnAccum ? { ...this.#turnAccum } : void 0,
 			permissionMode: this.#permissionMode,
 			model: this.#modelAlias,
-			lastActivityAt: this.#lastActivityAt,
+			lastActivityAt: this.#log.lastActivityAt,
 			parkedAt: Date.now()
 		};
 		return {
 			engine: "provider",
 			id: this.id,
 			createdAt: this.createdAt,
-			seq: this.#seq,
-			events: this.#events.filter((event) => snapshotRetains(event)),
+			seq: this.#log.seq,
+			events: this.#log.events.filter((event) => snapshotRetains(event)),
 			vfs: this.#config.vfs?.snapshot(),
 			parked,
 			state
@@ -2115,19 +1556,11 @@ var AiSdkRunner = class {
 		});
 		this.#scheduleTurn();
 	}
-	/**
-	* Deliver the result of an external (execute-less) tool call. Appends the
-	* tool-result message and, once no calls remain pending, re-enters the loop.
-	* Idempotent per toolCallId: unknown/already-settled ids return false.
-	*/
 	resolveToolCall(toolCallId, output, options) {
 		if (!this.#settlePendingCall(toolCallId, output, options?.isError === true)) return false;
 		if (this.#pendingToolCalls.size === 0) this.#scheduleTurn();
 		return true;
 	}
-	/** Record a parked call's outcome into the message history (so it stays
-	* replayable — a dangling tool call without a result is invalid input for
-	* providers) and the event log. Does NOT re-enter the loop. */
 	#settlePendingCall(toolCallId, output, isError) {
 		const pending = this.#pendingToolCalls.get(toolCallId);
 		if (!pending || this.#closed || this.#parked) return false;
@@ -2163,11 +1596,38 @@ var AiSdkRunner = class {
 		});
 		return true;
 	}
-	resolvePermission(_requestId, _decision) {
-		return false;
+	resolvePermission(requestId, decision) {
+		const approval = this.#pendingApprovals.get(requestId);
+		if (!approval) return false;
+		clearTimeout(approval.timer);
+		this.#pendingApprovals.delete(requestId);
+		const source = "client";
+		if (decision.behavior === "allow") {
+			this.#emit({
+				type: "permission_resolved",
+				requestId,
+				behavior: "allow",
+				resolvedBy: source
+			});
+			this.#dispatchSingle(approval.toolCallId);
+		} else {
+			const message = decision.message ?? "Permission denied by user";
+			this.#emit({
+				type: "permission_resolved",
+				requestId,
+				behavior: "deny",
+				resolvedBy: source,
+				message
+			});
+			this.#applyExecutionResult(approval.toolCallId, {
+				status: "failed",
+				reason: "permission_denied",
+				error: message
+			});
+			if (decision.interrupt) this.interrupt();
+		}
+		return true;
 	}
-	/** Emit `file_delivered` — the deliver_file tool's hand-over event (wired by
-	* createEngineSession via ToolContextOptions.onFileDelivered). */
 	emitFileDelivered(file) {
 		if (this.#closed || this.#parked) return;
 		this.#emit({
@@ -2175,11 +1635,6 @@ var AiSdkRunner = class {
 			...file
 		});
 	}
-	/**
-	* One plain generateText over the session's current model, billed into the
-	* running turn's usage accumulator — the web_fetch digest pass uses this so
-	* its tokens are never lost from the turn's accounting.
-	*/
 	async generateDigest(prompt) {
 		const result = await generateText({
 			model: this.#model,
@@ -2195,19 +1650,6 @@ var AiSdkRunner = class {
 		}
 		return result.text;
 	}
-	/**
-	* Reset the conversation: drop the message array the next turn would have
-	* been built from. There is no engine round trip — this runner *is* where the
-	* transcript lives, so clearing it is the whole operation.
-	*
-	* Two things ride along, both already written elsewhere and both load-bearing
-	* here. `#emit`'s `conversation_reset` arm retires `#contextUsage` (the
-	* reading described a conversation that no longer exists), and the same arm
-	* in `restore` keeps a parked session that comes back after a clear from
-	* resurrecting it. Pending tool calls are NOT swept: a parked call is work a
-	* backend still owes an answer for, and a clear is not an interrupt — the
-	* refusal below is what keeps the two apart.
-	*/
 	async clearContext() {
 		if (this.#status === "closed" || this.#status === "failed") throw new Error("session is closed");
 		const run = this.#turnChain.then(() => {
@@ -2283,6 +1725,8 @@ var AiSdkRunner = class {
 		this.#abort?.abort();
 		this.#pendingToolCalls.clear();
 		this.#dispatched.clear();
+		for (const { timer } of this.#pendingApprovals.values()) clearTimeout(timer);
+		this.#pendingApprovals.clear();
 		this.#emit({
 			type: "session_closed",
 			reason
@@ -2292,92 +1736,131 @@ var AiSdkRunner = class {
 			Promise.resolve(this.#config.onClose?.()).catch(() => {});
 		} catch {}
 	}
-	/** See `Runner.eventAt`. A linear scan: the one caller is a reader pressing
-	* "show everything" on one row, so a per-runner seq index would be a map
-	* maintained on every emit to save a walk nobody makes twice a minute. */
 	eventAt(seq) {
-		return this.#events.find((event) => event.seq === seq);
+		return this.#log.at(seq);
 	}
 	subscribe(listener, afterSeq = 0, options) {
-		return this.#subscribers.subscribe(this.#events, listener, afterSeq, options, this.#resetSeq);
+		return this.#subscribers.subscribe(this.#log.events, listener, afterSeq, options, this.#log.resetSeq);
 	}
 	#scheduleTurn() {
 		this.#turnChain = this.#turnChain.then(() => this.#runTurn());
 	}
-	/**
-	* Deliver the result of an execution this runner dispatched. Used by the host
-	* when a backend settled out-of-band (a browser bridge answering later, a
-	* deferred executor). Idempotent by executionId.
-	*/
 	settleExecution(executionId, result) {
 		if (this.#closed || this.#parked) return false;
 		if (!this.#pendingToolCalls.has(executionId)) return false;
 		this.#applyExecutionResult(executionId, result);
 		return true;
 	}
-	/** Hand every parked call the executor owns to it. */
 	#dispatchPending() {
 		const executor = this.#config.executor;
 		if (!executor) return;
 		const executable = this.#config.executableTools;
+		const needsApproval = this.#permissionMode === "default" && this.#config.shouldApprove;
 		const inFlight = [];
 		let anyDeferred = false;
+		let anyAwaiting = false;
 		for (const call of Array.from(this.#pendingToolCalls.values())) {
 			if (executable && !executable.includes(call.toolName)) continue;
 			if (this.#dispatched.has(call.toolCallId)) continue;
-			this.#dispatched.add(call.toolCallId);
-			const toolCall = {
-				executionId: call.toolCallId,
-				sessionId: this.id,
-				tool: call.toolName,
-				input: call.input,
-				vfs: this.#config.vfs,
-				limits: this.#config.executionLimits,
-				signal: this.#abort?.signal
-			};
-			const profile = executor.describe?.(toolCall) ?? {};
-			call.deferred = profile.deferred === true ? true : void 0;
-			call.expiresAt = profile.timeoutMs === void 0 ? void 0 : Date.now() + profile.timeoutMs;
-			anyDeferred ||= call.deferred === true;
-			this.#emit({
-				type: "execution_dispatched",
-				executionId: call.toolCallId,
+			if (needsApproval && needsApproval({
 				toolName: call.toolName,
-				backend: profile.backend ?? this.#config.executionBackend ?? "server",
-				deferred: call.deferred,
-				expiresAt: call.expiresAt
-			});
-			inFlight.push(executor.dispatch(toolCall).then((dispatch) => {
-				if (dispatch.status === "settled") this.#applyExecutionResult(call.toolCallId, dispatch.result);
-			}).catch((error) => {
-				this.#applyExecutionResult(call.toolCallId, {
-					status: "failed",
-					reason: "dispatch_error",
-					error: error instanceof Error ? error.message : String(error)
+				input: call.input
+			})) {
+				if ([...this.#pendingApprovals.values()].some((a) => a.toolCallId === call.toolCallId)) {
+					anyAwaiting = true;
+					continue;
+				}
+				const requestId = randomUUID();
+				const timeoutMs = this.#config.approvalTimeoutMs ?? 12e4;
+				const request = {
+					id: requestId,
+					toolName: call.toolName,
+					input: call.input,
+					toolUseId: call.toolCallId,
+					title: `Agent wants to run ${call.toolName}`,
+					displayName: call.toolName,
+					expiresAt: Date.now() + timeoutMs
+				};
+				const timer = setTimeout(() => {
+					if (!this.#pendingApprovals.has(requestId)) return;
+					this.resolvePermission(requestId, {
+						behavior: "deny",
+						message: "Approval timed out"
+					});
+				}, timeoutMs);
+				this.#pendingApprovals.set(requestId, {
+					request,
+					toolCallId: call.toolCallId,
+					timer
+				});
+				this.#emit({
+					type: "permission_requested",
+					request
 				});
-			}));
+				anyAwaiting = true;
+				continue;
+			}
+			this.#dispatched.add(call.toolCallId);
+			const dispatched = this.#dispatchCall(executor, call);
+			anyDeferred ||= dispatched.deferred;
+			inFlight.push(dispatched.promise);
 		}
+		if (anyAwaiting) this.#setStatus("awaiting_approval");
 		if (anyDeferred) Promise.allSettled(inFlight).then(() => this.#announceParked());
 	}
-	/**
-	* The turn has come to rest on deferred executions: nothing is in flight, and
-	* only a host-delivered result can move it. `status_changed: 'parked'` is the
-	* host's cue to snapshot via {@link park} — a single, correctly-timed signal
-	* rather than an inference from individual dispatch events.
-	*/
+	#dispatchSingle(toolCallId) {
+		const executor = this.#config.executor;
+		if (!executor) return;
+		const call = this.#pendingToolCalls.get(toolCallId);
+		if (!call || this.#dispatched.has(toolCallId)) return;
+		this.#dispatched.add(toolCallId);
+		const dispatched = this.#dispatchCall(executor, call);
+		if (dispatched.deferred) dispatched.promise.then(() => this.#announceParked());
+	}
+	#dispatchCall(executor, call) {
+		const toolCall = {
+			executionId: call.toolCallId,
+			sessionId: this.id,
+			tool: call.toolName,
+			input: call.input,
+			vfs: this.#config.vfs,
+			limits: this.#config.executionLimits,
+			signal: this.#abort?.signal
+		};
+		const profile = executor.describe?.(toolCall) ?? {};
+		call.deferred = profile.deferred === true ? true : void 0;
+		call.expiresAt = profile.timeoutMs === void 0 ? void 0 : Date.now() + profile.timeoutMs;
+		this.#emit({
+			type: "execution_dispatched",
+			executionId: call.toolCallId,
+			toolName: call.toolName,
+			backend: profile.backend ?? this.#config.executionBackend ?? "server",
+			deferred: call.deferred,
+			expiresAt: call.expiresAt
+		});
+		const promise = executor.dispatch(toolCall).then((dispatch) => {
+			if (dispatch.status === "settled") this.#applyExecutionResult(call.toolCallId, dispatch.result);
+		}).catch((error) => {
+			this.#applyExecutionResult(call.toolCallId, {
+				status: "failed",
+				reason: "dispatch_error",
+				error: error instanceof Error ? error.message : String(error)
+			});
+		});
+		return {
+			deferred: call.deferred === true,
+			promise
+		};
+	}
 	#announceParked() {
 		if (this.#closed || this.#parked || this.#abort) return;
 		if (this.#restingOnDeferred()) this.#setStatus("parked");
 	}
-	/** The loop is waiting, and everything it waits on can only be answered from
-	* outside this process. One still-live in-process execution means a result is
-	* coming back to THIS runner, and tearing it down would strand it. */
 	#restingOnDeferred() {
 		if (this.#pendingToolCalls.size === 0) return false;
 		for (const call of this.#pendingToolCalls.values()) if (call.deferred !== true) return false;
 		return true;
 	}
-	/** Fold an execution's outcome back into the loop, whichever way it went. */
 	#applyExecutionResult(executionId, result) {
 		if (this.#closed || this.#parked) return;
 		this.#dispatched.delete(executionId);
@@ -2607,9 +2090,6 @@ var AiSdkRunner = class {
 			if (this.#abort === abort) this.#abort = void 0;
 		}
 	}
-	/** Emit the turn's result from the whole-turn accumulator, so a turn that
-	* parked on external tool calls reports every leg's tokens and the full
-	* elapsed time (including the time spent executing those tools). */
 	#finishTurn(text) {
 		const accum = this.#turnAccum ?? {
 			startedAt: Date.now(),
@@ -2641,39 +2121,17 @@ var AiSdkRunner = class {
 		if (typeof model === "string") return model;
 		return model.modelId;
 	}
-	#title() {
-		const metaTitle = this.#config.meta?.title;
-		if (typeof metaTitle === "string" && metaTitle.length > 0) return metaTitle;
-		const prompt = this.#config.prompt;
-		if (!prompt) return void 0;
-		return prompt.length > 80 ? prompt.slice(0, 77) + "…" : prompt;
-	}
-	/**
-	* This session's MCP servers, as the host assembled them.
-	*
-	* Always answers — an empty list when no MCP was wired — because the
-	* alternative (undefined, which the server turns into a 501) says "this
-	* engine cannot tell you", and this engine can: the host that built the
-	* session is the only party who knows, and it has been asked.
-	*/
 	async mcpServers() {
 		return await this.#config.reportMcpServers?.() ?? [];
 	}
-	/** Host-facing rename: writes `meta.title`, which `#title()` prefers. Clearing
-	* it (undefined) restores the derived title. The engine is never told. */
 	setTitle(title) {
-		const meta = { ...this.#config.meta };
-		if (title) meta.title = title;
-		else delete meta.title;
-		this.#config = {
-			...this.#config,
-			meta
-		};
+		this.#config = withTitle(this.#config, title);
 	}
 	#setStatus(status, detail) {
-		if (this.#status === status) return;
+		if (this.#status === status && this.#statusDetail === detail) return;
 		if (this.#status === "closed" || this.#status === "failed") return;
 		this.#status = status;
+		this.#statusDetail = detail;
 		this.#emit({
 			type: "status_changed",
 			status,
@@ -2681,20 +2139,7 @@ var AiSdkRunner = class {
 		});
 	}
 	#emit(body) {
-		const event = {
-			...body,
-			seq: ++this.#seq,
-			ts: Date.now()
-		};
-		this.#lastActivityAt = event.ts;
-		this.#activityCount += transcriptActivity(body);
-		this.#contextUsage = contextReading(body) ?? this.#contextUsage;
-		if (body.type === "conversation_reset") {
-			this.#resetSeq = event.seq;
-			this.#contextUsage = void 0;
-		}
-		this.#events.push(event);
-		this.#subscribers.emit(event);
+		this.#subscribers.emit(this.#log.append(body));
 	}
 };
 function turnUsage(accum) {
@@ -2713,16 +2158,6 @@ function errorText(error) {
 }
 //#endregion
 //#region src/engines/claude/auth.ts
-/**
-* The native Claude Code binary the Agent SDK itself spawns, resolved the way
-* the SDK resolves it: the platform-specific optional dependency installed next
-* to the SDK package (`@anthropic-ai/claude-agent-sdk-<platform>-<arch>/claude`).
-* Probing this binary rather than whatever `claude` is on PATH means an auth
-* check answers for the executable sessions will actually run — the two can be
-* different versions logged into different places. Returns undefined when it
-* can't be found (optional dep skipped, unsupported platform); callers degrade
-* to 'unknown', and the SDK surfaces its own error if a session is created.
-*/
 function resolveBundledClaudeExecutable() {
 	try {
 		const fromSdk = createRequire(createRequire(import.meta.url).resolve("@anthropic-ai/claude-agent-sdk"));
@@ -2734,18 +2169,6 @@ function resolveBundledClaudeExecutable() {
 		} catch {}
 	} catch {}
 }
-/**
-* Ask the CLI whether `env` holds usable credentials: `claude auth status`
-* prints a JSON verdict covering every source the CLI itself consults for that
-* environment — `<CLAUDE_CONFIG_DIR>/.credentials.json`, the macOS login
-* Keychain, ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, Bedrock/Vertex
-* (verified against 2.1.217). Only the `loggedIn` boolean is ever read; the
-* identity fields in the payload (email, org, subscription) never leave the
-* parse. The exit code is deliberately ignored — 2.1.217 exits 1 on a
-* logged-out verdict where other versions exit 0 — and anything that doesn't
-* parse to a `loggedIn` boolean is 'unknown', because `auth status` is not a
-* stable contract. Never rejects.
-*/
 function checkClaudeAuth(env, options = {}) {
 	const executable = options.executable ?? resolveBundledClaudeExecutable();
 	if (!executable) return Promise.resolve("unknown");
@@ -2767,11 +2190,6 @@ function checkClaudeAuth(env, options = {}) {
 }
 //#endregion
 //#region src/executors/quickjs-executor.ts
-/**
-* In-process execution backend: runs a tool's untrusted script in the QuickJS
-* WASM guest. Always settles inline — nothing downstream assumes that, which is
-* what lets a deferred backend replace it behind the same seam.
-*/
 var QuickJsExecutor = class {
 	#options;
 	constructor(options) {
@@ -2845,8 +2263,6 @@ function safeHost(url) {
 		return;
 	}
 }
-/** Exact hostname match, or a single leading `*.` wildcard covering subdomains
-* (not the bare parent). Only http(s) — no file:, data:, or other schemes. */
 function isHostAllowed(url, allowedHosts) {
 	let parsed;
 	try {
@@ -2870,14 +2286,6 @@ var PendingRequestRegistry = class {
 	get size() {
 		return this.#slots.size;
 	}
-	/**
-	* Register a request and get a promise for its outcome. The promise **never
-	* rejects**: a timeout or cancellation resolves with `ok: false` so callers
-	* feed the failure back into the agent loop instead of unwinding it.
-	*
-	* Re-registering a live id throws — silently replacing it would strand the
-	* first waiter forever.
-	*/
 	register(options) {
 		if (this.#slots.has(options.id)) throw new Error(`pending request '${options.id}' is already registered`);
 		const entry = {
@@ -2909,8 +2317,6 @@ var PendingRequestRegistry = class {
 			this.#slots.set(options.id, slot);
 		});
 	}
-	/** Deliver a result. Returns false for unknown or already-settled ids —
-	* duplicate and late deliveries are no-ops, never a second application. */
 	settle(id, value, settledBy = "client") {
 		return this.#settle(id, {
 			ok: true,
@@ -2918,7 +2324,6 @@ var PendingRequestRegistry = class {
 			settledBy
 		});
 	}
-	/** Fail a request. Same idempotence guarantee as {@link settle}. */
 	fail(id, reason, error, settledBy = "server") {
 		return this.#settle(id, {
 			ok: false,
@@ -2938,7 +2343,6 @@ var PendingRequestRegistry = class {
 		const entries = [...this.#slots.values()].map(toEntry);
 		return kind ? entries.filter((e) => e.kind === kind) : entries;
 	}
-	/** Fail everything (optionally of one kind) — session close, turn interrupt. */
 	cancelAll(reason, error, kind) {
 		let canceled = 0;
 		for (const slot of Array.from(this.#slots.values())) {
@@ -2972,21 +2376,9 @@ function toEntry(slot) {
 }
 //#endregion
 //#region src/executors/browser-bridge-executor.ts
-/**
-* Executes tool calls in the attached client's own sandbox. The first backend
-* that genuinely returns `pending`: dispatch puts a request on the wire and
-* returns, and the result arrives later through {@link resolve}.
-*
-* Data locality is the point — documents can stay in the browser and never
-* reach the server. The tradeoff is trust: whatever comes back is untrusted
-* input, fine for the user's own data but never a source for authoritative
-* server state (that is why MCP and secret-bearing tools are never bridged).
-*/
 var BrowserBridgeExecutor = class {
 	registry;
 	#options;
-	/** Results that arrive before dispatch registers them (fast client, slow
-	* bookkeeping) would otherwise be dropped — hold them briefly. */
 	#early = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.#options = options;
@@ -3040,10 +2432,6 @@ var BrowserBridgeExecutor = class {
 			status: "pending"
 		};
 	}
-	/**
-	* Apply a client's answer. Returns false when the id is unknown or already
-	* settled — a late result after a timeout must not re-open a settled call.
-	*/
 	resolve(executionId, answer) {
 		if (!this.registry.has(executionId)) {
 			this.#early.set(executionId, answer);
@@ -3056,13 +2444,12 @@ var BrowserBridgeExecutor = class {
 		return "output" in answer ? this.registry.settle(executionId, answer, "client") : this.registry.fail(executionId, answer.reason, answer.error, "client");
 	}
 };
-/** Map a registry outcome onto the executor's result contract. */
 function toExecutionResult(outcome) {
 	if (outcome.ok && "output" in outcome.value) {
 		const { output, logs } = outcome.value;
 		return {
 			status: "ok",
-			output: output.type === "text" ? output.value : output.value,
+			output: output.value,
 			logs
 		};
 	}
@@ -3083,17 +2470,6 @@ function toExecutionResult(outcome) {
 }
 //#endregion
 //#region src/executors/deferred-executor.ts
-/**
-* The executor for work that outlives the session's process residency: dispatch
-* hands the call off and returns `pending` **without holding a promise**, because
-* the runner it would resolve into is about to be torn down. The result can only
-* come back through the host — the execution-result route → `settleExecution` on a
-* rehydrated runner — which is exactly what makes a park durable rather than a
-* long in-memory await.
-*
-* Contrast {@link BrowserBridgeExecutor}, which is also `pending` but keeps its
-* answer in memory for the ~60s the tab has to reply.
-*/
 var DeferredExecutor = class {
 	backend;
 	timeoutMs;
@@ -3103,8 +2479,6 @@ var DeferredExecutor = class {
 		this.backend = options.backend ?? "remote";
 		this.timeoutMs = options.timeoutMs;
 	}
-	/** Every call this executor takes is deferred — route only the tools that
-	* belong on the remote side to it. */
 	describe() {
 		return {
 			backend: this.backend,
@@ -3131,15 +2505,6 @@ var DeferredExecutor = class {
 //#endregion
 //#region src/engines/provider/tools.ts
 const MAX_FILE_BYTES = 1024 * 1024;
-/**
-* Build the capability-scoped tool set for a session.
-*
-* The agent's authority is exactly what is granted here — there are no built-in
-* filesystem or shell tools, and nothing reaches the host filesystem: `fs_*`
-* operate on an in-memory scratch VFS. Tools whose backend is not supplied are
-* simply absent rather than present-and-failing, so a model cannot be tempted
-* by a capability the operator did not grant.
-*/
 function createToolContext(options) {
 	const vfs = options.vfs ?? createVfs();
 	const definitions = [];
@@ -3292,29 +2657,12 @@ function createToolContext(options) {
 		sandboxedToolNames: definitions.filter((d) => d.trust === "sandboxed").map((d) => d.name)
 	};
 }
-/** Add host-side MCP tools to a context. They are ALWAYS authoritative: they run
-* server-side with server credentials, and must never be handed to a browser. */
 function withMcpTools(context, mcpTools) {
 	return withHostTools(context, Object.fromEntries(Object.entries(mcpTools).map(([name, mcpTool]) => [name, {
 		tool: mcpTool,
 		trust: "authoritative"
 	}])), "MCP tool");
 }
-/**
-* Add host-supplied tools to a context at an explicit trust level.
-*
-* The trust level is the whole point of the seam: {@link withMcpTools} can only
-* produce authoritative tools, so a host tool that *should* be sandboxed — and
-* therefore executable in the browser tab that asked for it — had no way to be
-* expressed at all. Here the host says which it is, and the contradictions are
-* refused rather than silently resolved:
-*
-* - a `sandboxed` tool carrying `execute` would run inline in this process with
-*   the gateway's ambient authority, which is exactly what sandboxing it was
-*   meant to prevent;
-* - an `authoritative` tool *without* `execute` would park the turn on a call no
-*   executor claims, and the session would simply stop.
-*/
 function withHostTools(context, hostTools, kind = "host tool") {
 	const entries = Object.entries(hostTools);
 	if (entries.length === 0) return context;
@@ -3461,10 +2809,6 @@ function parseUrl(raw) {
 		return;
 	}
 }
-/** SSRF guard: resolve the hostname and refuse private, loopback, and link-local
-* destinations. Checked per redirect hop. Resolution happens once here and again
-* inside fetch (a DNS-rebinding TOCTOU); this tier accepts that — operators who
-* need pinning can supply `fetchImpl` with a pinned agent. */
 async function denyReason(url, allowedHosts) {
 	const host = url.hostname.toLowerCase();
 	if (allowedHosts && allowedHosts.length > 0 && !hostMatches(host, allowedHosts)) return `host not allowed: ${host}`;
@@ -3489,7 +2833,6 @@ function hostMatches(host, allowedHosts) {
 		return host === pattern;
 	});
 }
-/** Private / loopback / link-local / unspecified, IPv4 and IPv6 (incl. v4-mapped). */
 function isPrivateAddress(address) {
 	const ip = address.toLowerCase();
 	if (ip.includes(":")) {
@@ -3530,12 +2873,6 @@ async function readCapped(response, maxBytes) {
 function looksLikeHtml(body) {
 	return /<(!doctype|html|head|body)[\s>]/i.test(body.slice(0, 1024));
 }
-/**
-* Dependency-free HTML → markdown, tuned for "give the model readable text":
-* drops non-content subtrees, keeps headings/lists/links/emphasis/code, strips
-* everything else. Not a spec-grade converter on purpose — a small predictable
-* transform beats dragging a DOM into core.
-*/
 function htmlToMarkdown(html) {
 	let text = html.replace(/<!--[\s\S]*?-->/g, "").replace(/<(script|style|noscript|svg|template|iframe)\b[\s\S]*?<\/\1>/gi, "").replace(/<(head)\b[\s\S]*?<\/\1>/gi, "");
 	text = text.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
@@ -3558,28 +2895,27 @@ function decodeEntities(text) {
 }
 //#endregion
 //#region src/engines/provider/session.ts
-/** Which capability a wired backend yields, for grant filtering. */
 const CAPABILITY_TOOLS = {
 	search: "web_search",
 	download: "download",
 	webFetch: "web_fetch",
 	deliverFiles: "deliver_file"
 };
-/**
-* Assemble a model-agnostic session: provider model, capability-scoped tools,
-* a scratch VFS, and the executor that runs the sandboxed ones.
-*
-* This is the piece an operator wires into the server's `createEngineRunner`.
-*
-* The host wires the *backends*; the profile and the session request decide which
-* of them are actually granted (`profile.session`, `config.capabilities`). A
-* backend that isn't granted is simply not built into the tool set, so withholding
-* a capability costs the host no branching. No declaration anywhere = everything
-* the host wired, which is what a host that ignores profiles gets.
-*/
 function createEngineSession(options) {
 	const vfs = options.config.vfs ?? createVfs(options.config.restore ? options.config.restore.vfs : options.seedVfs);
-	const executor = options.selectExecutor();
+	const executor = options.selectExecutor.length > 0 ? {
+		describe(call) {
+			const target = options.selectExecutor(call);
+			const backend = typeof options.backend === "function" ? options.backend(call) : options.backend;
+			return {
+				...target.describe?.(call),
+				...backend ? { backend } : {}
+			};
+		},
+		dispatch(call) {
+			return options.selectExecutor(call).dispatch(call);
+		}
+	} : options.selectExecutor();
 	const granted = options.config.capabilities ?? options.profile?.session?.capabilities;
 	const isGranted = (key) => granted === void 0 || granted.includes(CAPABILITY_TOOLS[key]);
 	let runner;
@@ -3613,26 +2949,14 @@ function createEngineSession(options) {
 		vfs,
 		executor,
 		executableTools: context.sandboxedToolNames,
-		executionBackend: options.backend ?? "server",
+		executionBackend: typeof options.backend === "function" ? void 0 : options.backend ?? "server",
 		executionLimits: options.executionLimits,
+		shouldApprove: options.shouldApprove,
+		approvalTimeoutMs: options.approvalTimeoutMs,
 		reportMcpServers: options.mcp ? () => Promise.resolve(declaredServers === void 0 ? options.mcp.servers : options.mcp.servers.filter((s) => declaredServers.includes(s.name))) : void 0
 	}, options.id);
 	return runner;
 }
-/**
-* Refuse to build a session whose profile names an MCP server that isn't there.
-*
-* A profile's `mcpServers` list is a **declaration**, not a filter: an embedder
-* who wrote it meant the agent to have those tools. Honouring it partially is
-* the worst failure mode this engine has — the session starts, reports healthy,
-* and the agent apologises its way through every request that needed the server,
-* with one warning line in a log nobody is reading.
-*
-* With a {@link McpConnection} the check is exact (did this server connect?).
-* With a bare tool set all we can see is whether any tool carries the server's
-* namespace, so a genuinely tool-less server would trip it — the fix there is to
-* pass `mcp` rather than to weaken this.
-*/
 function requireDeclaredServers(profileName, declared, mcp, tools) {
 	if (!declared || declared.length === 0) return;
 	const missing = declared.filter((name) => {
@@ -3649,33 +2973,11 @@ function requireDeclaredServers(profileName, declared, mcp, tools) {
 	}).join(", ");
 	throw new Error(`profile '${profileName}' declares MCP server(s) that are not connected: ${reasons}. A session missing a declared server is a session whose agent silently cannot do its job.`);
 }
-/**
-* Restrict a connected tool set to the MCP servers a profile grants, by the
-* `<server>__<tool>` namespace {@link connectMcpTools} assigns. Undefined `servers`
-* = no declaration, so every connected server passes through.
-*
-* This is how one process-wide MCP connection serves a mixed fleet: the host
-* connects everything once, each profile grants a subset. The transport configs —
-* and any credentials in their headers — never leave the host for a profile.
-*/
 function selectMcpTools(tools, servers) {
 	if (!tools || servers === void 0) return tools;
 	const allowed = new Set(servers);
 	return Object.fromEntries(Object.entries(tools).filter(([name]) => allowed.has(name.split("__")[0])));
 }
-/**
-* Connect to MCP servers and return their tools, ready for {@link withMcpTools}.
-*
-* Server-side only, with server credentials: these tools are authoritative and
-* must never be bridged to a browser. `@ai-sdk/mcp` is imported lazily and is an
-* optional dependency — an operator who wires no MCP servers never needs it.
-*
-* **A stateless MCP server must answer `GET` with 405.** The client opens the
-* SSE stream with a `GET` before it sends anything, and a POST-only server
-* mounted under a framework's default 404 makes the whole connect fail with an
-* error that names neither the method nor the route. This is the single most
-* common way an otherwise-correct MCP mount fails.
-*/
 async function connectMcpTools(servers, options = {}) {
 	const entries = Object.entries(servers);
 	if (entries.length === 0) return {
@@ -3717,7 +3019,7 @@ async function connectMcpTools(servers, options = {}) {
 			options.onError?.(name, error);
 			if (options.required) {
 				await closeAll();
-				throw new Error(`MCP server '${name}' failed to connect: ${message}`);
+				throw new Error(`MCP server '${name}' failed to connect: ${message}`, { cause: error });
 			}
 		}
 	}
@@ -3727,7 +3029,6 @@ async function connectMcpTools(servers, options = {}) {
 		close: closeAll
 	};
 }
-/** The connection's identity, minus its secrets — `headers` never travel. */
 function describeServer(server) {
 	if ("url" in server) return {
 		transport: server.type === "sse" ? "sse" : "http",
@@ -3739,12 +3040,6 @@ function describeServer(server) {
 		args: server.args
 	};
 }
-/**
-* The AI SDK hands back its own `Tool`, whose `inputSchema` may be a zod schema
-* or a `jsonSchema()` wrapper. Only the latter carries a JSON Schema document,
-* so that is the only case where parameters are reported — `McpServerToolInfo`
-* models the absence deliberately, and inventing one here would be worse.
-*/
 function toToolInfo(name, mcpTool) {
 	const { description, inputSchema } = mcpTool ?? {};
 	return {
@@ -3753,12 +3048,6 @@ function toToolInfo(name, mcpTool) {
 		inputSchema: inputSchema?.jsonSchema
 	};
 }
-/**
-* Only http/sse: the AI SDK's built-in transports are the remote ones, and its
-* own docs mark stdio local-only and not deployable. A stdio server here is a
-* misconfiguration worth surfacing rather than silently dropping — the Claude
-* engine still supports stdio, since the CLI spawns those itself.
-*/
 function toTransport(server) {
 	if (!("url" in server)) throw new Error("stdio MCP servers are not supported by the model-agnostic engine (use an http or sse server, or run this session under a Claude profile)");
 	return server.type === "sse" ? {
@@ -3773,30 +3062,6 @@ function toTransport(server) {
 }
 //#endregion
 //#region src/engines/claude/catalog.ts
-/**
-* The Claude engine's model catalog — what a create form offers before any
-* session has run.
-*
-* **Refresh procedure** (release checklist): run `supportedModels()` on a
-* throwaway SDK query (no tokens spent) and re-apply the shaping rules of
-* `modelOptionsFromSdk` (`src/normalize.ts`) at authoring time: drop the
-* `default` sentinel row, derive display names from resolved ids where
-* unambiguous, mark the newest of each family `primary`, sort by family rank.
-* A unit test replays the raw extraction through `modelOptionsFromSdk` and
-* asserts these rows match, so the rules cannot drift.
-*
-* Two things the live `capabilities` event can never offer:
-* - rows for **older models** the CLI no longer reports (hand-maintained, the
-*   accepted cost of a static catalog; the CLI silently downgrades an effort a
-*   model doesn't support, so `reasoningEfforts` is omitted on them and the
-*   engine default set applies);
-* - an answer on a **cold server**. The live event still exists and remains
-*   the in-session truth for the model switcher; this catalog is the
-*   create-form truth.
-*
-* `defaultModel` is deliberately NOT here: a claude profile's default is the
-* operator's CLI config, unknowable statically.
-*/
 const CLAUDE_CATALOG = {
 	provenance: "supportedModels() of @anthropic-ai/claude-agent-sdk 0.3.221 (Claude Code CLI), extracted 2026-08-05; older-model rows hand-maintained",
 	models: [
@@ -3866,13 +3131,6 @@ const CLAUDE_CATALOG = {
 };
 //#endregion
 //#region src/engines/claude/adapter.ts
-/**
-* The Claude engine as an adapter — a thin, behaviourally inert wrapper:
-* `SessionRunner` unchanged, `checkClaudeAuth` as the probe, the static
-* catalog for create forms. Exists so catalogs, capabilities and availability
-* have one shape across engines; the runner itself is exactly what
-* `registry.prepare()` builds.
-*/
 const claudeAdapter = {
 	engine: "claude",
 	capabilities: ENGINE_CAPABILITIES.claude,
@@ -3890,12 +3148,6 @@ const claudeAdapter = {
 		if (restore) throw new Error("the Claude engine cannot rebuild a parked session");
 		return new SessionRunner(config, id);
 	},
-	/**
-	* The Agent SDK's on-disk session store, mapped browser-safe. The SDK reads
-	* the store of the *process* environment — it takes no config dir — so a
-	* profile pin cannot narrow this listing; that matches the route's
-	* pre-adapter behavior exactly (the listing was always process-global).
-	*/
 	async listSessions({ dir, limit, offset }) {
 		return (await listSessions({
 			dir,
@@ -3913,10 +3165,28 @@ const claudeAdapter = {
 		}));
 	}
 };
+//#endregion
+//#region src/engines/codex/connect.ts
 /**
-* A JSON-RPC error response from the peer, or one we return to it. `code`
-* follows the JSON-RPC 2.0 reserved ranges (-32601 = method not found).
+* The operator's environment reaches the child whole — WorkerDeck resolves no credential of its
+* own — and the profile's CODEX_HOME is the one key it pins, last, so a profile always wins over
+* an inherited value. Every path that spawns or connects to an app-server goes through here.
 */
+function codexChildEnv(base, codexHome) {
+	const env = {};
+	for (const [key, value] of Object.entries(base)) if (value !== void 0) env[key] = value;
+	if (codexHome) env.CODEX_HOME = codexHome;
+	return env;
+}
+/** `experimentalApi` gates the granular approval policy and there is no non-experimental fallback, so it is not per-call-site. */
+const INITIALIZE_PARAMS = {
+	clientInfo: {
+		name: "workerdeck",
+		title: "WorkerDeck",
+		version: `protocol-${PROTOCOL_VERSION}`
+	},
+	capabilities: { experimentalApi: true }
+};
 var JsonRpcError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -3925,18 +3195,6 @@ var JsonRpcError = class extends Error {
 		this.code = code;
 	}
 };
-/**
-* JSON-RPC over a `codex app-server` child's stdio: **newline-delimited JSON**,
-* one message per line, and — verified against 0.146.0 — an envelope *without*
-* the `jsonrpc: "2.0"` field (`{id, method, params}` / `{id, result}` /
-* `{id, error}`; the binary's own schema marks only those required). Server→
-* client notifications additionally carry a top-level `emittedAtMs`, ignored
-* here.
-*
-* Transport only: no method knowledge, no process ownership. The process
-* wrapper (`process.ts`) owns the child and calls {@link fail} when it dies so
-* every in-flight request rejects instead of hanging.
-*/
 var JsonRpcStdioConnection = class {
 	#output;
 	#nextId = 1;
@@ -3944,7 +3202,6 @@ var JsonRpcStdioConnection = class {
 	#buffer = "";
 	#closed = false;
 	#notificationHandler;
-	/** Where {@link CODEX_TRACE_ENV} pointed, or undefined — read once. */
 	#trace;
 	#requestHandler;
 	constructor(options) {
@@ -3983,8 +3240,6 @@ var JsonRpcStdioConnection = class {
 	onRequest(handler) {
 		this.#requestHandler = handler;
 	}
-	/** Reject everything in flight and refuse new traffic — the child is gone
-	* (or the session is over). Idempotent. */
 	fail(message) {
 		if (this.#closed) return;
 		this.#closed = true;
@@ -4014,15 +3269,6 @@ var JsonRpcStdioConnection = class {
 			this.#dispatch(message);
 		}
 	}
-	/**
-	* Append one inbound message to the trace file, when the operator asked for
-	* one. **Notifications and server→client requests only** — a response body is
-	* not needed to answer the questions this exists for, and `account/*` results
-	* are the one place app-server traffic can carry a masked credential
-	* fragment, which nothing of ours writes to disk (see the auth red lines).
-	* Best-effort and synchronous: a debug sink that loses lines proves nothing,
-	* and a debug sink that throws must not take the session with it.
-	*/
 	#traceLine(message) {
 		if (!this.#trace) return;
 		const method = message.method;
@@ -4071,50 +3317,12 @@ var JsonRpcStdioConnection = class {
 };
 //#endregion
 //#region src/engines/codex/subagents.ts
-/**
-* The codex side of `SessionInfo.subagents` — and the attribution table that
-* gives every event a spawned agent produces its `parentToolUseId`.
-*
-* Codex's signal is stronger than the claude engine's, so this is deliberately
-* NOT that tracker generalised (`engines/claude/subagents.ts` infers spawns
-* from tool names and verdicts from result-text sniffing, ~290 lines of module
-* doc explaining the inference). Here nothing is inferred: `subAgentActivity
-* {kind: 'started'}` on the owning thread positively announces an agent, names
-* it (`agentPath`), keys it (`agentThreadId` — the id every one of its later
-* notifications carries) and hands over the model's own `spawn_agent` call id;
-* the agent's end is its own thread's `turn/completed`, status included. So a
-* record is keyed by **thread id** — the wire's handle — while exposing a
-* **tool-use id** — the protocol's: `parentToolUseId` on nested events must
-* equal the anchor `tool_use`'s id for `subagentItems` (the frame membership
-* rule every client shares) to reassemble the sidechain, and this map is where
-* the two vocabularies meet.
-*
-* Two decisions worth their prose:
-*
-* **A record survives the runner's turns.** Codex agents are designed to
-* outlive the root turn that spawned them (`sendInput`/`resumeAgent` address a
-* thread that kept existing), so — unlike a pending approval — nothing here is
-* swept when a root turn ends. What does end every agent is the app-server
-* process itself: the runner calls {@link sweep} when the child dies or the
-* session closes, because an agent whose host process is gone can never report,
-* and `running` on a closed session would be a lie a polled list re-renders
-* forever (the claude tracker's argument, inherited whole).
-*
-* **The settled tail is bounded, running records never are** — the same
-* {@link SUBAGENT_HISTORY} discipline as the claude tracker, and enforced at
-* settle time for the same reason: a settle happens once per agent, `list()`
-* once per row of a 1.2s-polled sessions list.
-*/
 var CodexAgentTracker = class {
 	#byThread = /* @__PURE__ */ new Map();
 	#settleCounter = 0;
-	/** The record whose thread this is — the attribution lookup. */
 	get(agentThreadId) {
 		return this.#byThread.get(agentThreadId);
 	}
-	/** Open (or return) the record for a thread. Fill-in, never overwrite: a
-	* label-less fallback record keeps its accumulated count and its already
-	* published toolUseId when the announcing item arrives late. */
 	open(agentThreadId, toolUseId, agentType, ts) {
 		let record = this.#byThread.get(agentThreadId);
 		if (!record) {
@@ -4131,8 +3339,6 @@ var CodexAgentTracker = class {
 		record.agentType ??= agentType;
 		return record;
 	}
-	/** The agent's thread ran again (`kind: 'interacted'`, or a fresh
-	* `turn/started` on its thread): a settled verdict no longer describes it. */
 	revive(record) {
 		record.status = "running";
 		record.settledOrder = void 0;
@@ -4153,41 +3359,21 @@ var CodexAgentTracker = class {
 			settled--;
 		}
 	}
-	/** A real verdict for one agent — its thread's `turn/completed`, or the
-	* `interrupted` activity edge. */
 	settle(record, status) {
 		if (record.status === status) return;
 		this.#settle(record, status);
 	}
-	/** The process the agents lived in is gone (child death, session close):
-	* everything still running is settled as failed — the report can never come. */
 	sweep() {
 		for (const record of this.#byThread.values()) if (record.status === "running") this.#settle(record, "failed");
 	}
-	/**
-	* The conversation these agents belonged to is gone (a `conversation_reset`).
-	*
-	* Deliberately NOT {@link CodexAgentTracker.sweep}: that settles the running
-	* ones as failed and keeps the rows, which is right when the *process* dies —
-	* the transcript still holds the anchor `tool_use` each row points at, and a
-	* row that vanished would leave that card unexplained. A clear is the other
-	* way round. The anchors go with the transcript, so a surviving row would
-	* publish a `toolUseId` that resolves to nothing — and clients key a
-	* pressable, enterable agent line off exactly that id.
-	*/
 	forget() {
 		this.#byThread.clear();
 	}
-	/** The thread ids currently tracked — what a clear remembers so a still-running
-	* agent's later traffic can be dropped rather than re-anchored. */
 	threadIds() {
 		return Array.from(this.#byThread.keys());
 	}
-	/** The rollup as `SessionInfo.subagents` serves it — spawn order, fresh
-	* objects, and `undefined` when there is nothing to say (absent and empty
-	* mean the same thing to a client, and bytes on a polled list are paid for). */
 	list() {
-		if (this.#byThread.size === 0) return void 0;
+		if (this.#byThread.size === 0) return;
 		const out = [];
 		for (const r of this.#byThread.values()) out.push({
 			toolUseId: r.toolUseId,
@@ -4201,63 +3387,12 @@ var CodexAgentTracker = class {
 };
 //#endregion
 //#region src/engines/codex/trust.ts
-/**
-* Codex project trust: will this session's cwd get its `.codex/config.toml`?
-*
-* Codex only layers a project's `.codex/config.toml` onto the operator's base
-* config when the project is *trusted* (a `[projects."<path>"]
-* trust_level = "trusted"` entry in `$CODEX_HOME/config.toml`), and the
-* app-server surface has no trust prompt — that lives in the TUI. So under
-* WorkerDeck an untrusted project's config, MCP servers included, is silently
-* ignored: no error, no notice, servers just missing. The runner asks this
-* module at session start whether that is about to happen, so the transcript
-* can say so.
-*
-* Semantics, all measured against both the bundled 0.146.0 and 0.149.0
-* (2026-08-22, via `codex mcp list` from probe cwds and via `thread/start` +
-* `mcpServerStatus/list` on the app-server surface — identical answers):
-*
-* - **Discovery**: config layers come from the cwd and its ancestors up to and
-*   including the nearest directory containing `.git` (dir or file). With no
-*   git anywhere above, the cwd alone is consulted. Directories above the
-*   nearest git root never contribute, trusted or not.
-* - **Trust per layer**: an exact entry for the layer's own canonical path
-*   decides (an explicit `"untrusted"` beats inherited trust); without one the
-*   layer inherits from the chain's git root — trusted iff the git root has a
-*   trusted entry, where a linked worktree's root also counts its main
-*   repository's entry (the `.git` file's gitdir names it). A trusted
-*   mid-chain directory does NOT trust its children, and plain path
-*   containment without git confers nothing.
-* - **Canonical paths**: codex matches entries against the canonicalized cwd —
-*   a macOS `/tmp/...` entry never matches the `/private/tmp/...` it points
-*   at, while the reverse spelling works (and the app-server canonicalizes its
-*   `cwd` param too). Both sides here are realpath'd, which can only err
-*   toward silence.
-* - **The gate is sandbox-scoped**: `thread/start` under `workspace-write` or
-*   `danger-full-access` (permission modes `acceptEdits`/`bypassPermissions`)
-*   WRITES the trust entry itself and loads the config — only `read-only`
-*   (mode `default`) leaves the project untrusted and the config ignored. A
-*   later `turn/start` with a wider sandboxPolicy does not heal the thread
-*   (measured): the caller probes `default`-mode sessions only, and the notice
-*   stays true for the session it opens.
-* - `trust_level`'s vocabulary is exactly `trusted`/`untrusted`; any other
-*   value fails codex's bootstrap outright ("unknown variant"), so a config
-*   carrying one probes silent — that session announces its own failure.
-*
-* The correctness bar for every degrade path: a FALSE notice — warning about a
-* project codex actually trusts — is worse than a missed one. The narrow TOML
-* reader below refuses (→ silence) anything it cannot interpret with
-* certainty, rather than guessing.
-*/
 const BARE_KEY = /[A-Za-z0-9_-]/;
 function skipWs(text, pos) {
 	let i = pos;
 	while (i < text.length && (text[i] === " " || text[i] === "	")) i++;
 	return i;
 }
-/** One-line TOML basic string starting at `pos` (which must be `"`). Undefined
-* on an escape TOML doesn't define or a close quote that never comes — the
-* caller refuses the file rather than guessing what codex would read. */
 function parseBasicString(text, pos) {
 	let out = "";
 	let i = pos + 1;
@@ -4279,12 +3414,12 @@ function parseBasicString(text, pos) {
 			else if (esc === "u" || esc === "U") {
 				const width = esc === "u" ? 4 : 8;
 				const hex = text.slice(i + 2, i + 2 + width);
-				if (hex.length !== width || !/^[0-9A-Fa-f]+$/.test(hex)) return void 0;
+				if (hex.length !== width || !/^[0-9A-Fa-f]+$/.test(hex)) return;
 				const code = Number.parseInt(hex, 16);
-				if (code > 1114111) return void 0;
+				if (code > 1114111) return;
 				out += String.fromCodePoint(code);
 				i += width;
-			} else return void 0;
+			} else return;
 			i += 2;
 			continue;
 		}
@@ -4292,17 +3427,14 @@ function parseBasicString(text, pos) {
 		i++;
 	}
 }
-/** One-line TOML literal string starting at `pos` (which must be `'`). */
 function parseLiteralString(text, pos) {
 	const close = text.indexOf("'", pos + 1);
-	if (close === -1) return void 0;
+	if (close === -1) return;
 	return {
 		value: text.slice(pos + 1, close),
 		end: close + 1
 	};
 }
-/** A dotted key path — bare, `"basic"` and `'literal'` keys, whitespace around
-* the dots — as found in table headers and on the left of assignments. */
 function parseKeyPath(text, pos) {
 	const keys = [];
 	let i = pos;
@@ -4311,7 +3443,7 @@ function parseKeyPath(text, pos) {
 		const ch = text[i];
 		if (ch === "\"" || ch === "'") {
 			const str = ch === "\"" ? parseBasicString(text, i) : parseLiteralString(text, i);
-			if (!str) return void 0;
+			if (!str) return;
 			keys.push(str.value);
 			i = str.end;
 		} else if (ch !== void 0 && BARE_KEY.test(ch)) {
@@ -4328,23 +3460,14 @@ function parseKeyPath(text, pos) {
 		i++;
 	}
 }
-/**
-* Scan an assignment's value (or the continuation line of a multi-line array),
-* confirming where it ends. Returns the bracket depth carried onto the next
-* line (0 = the value is complete) plus the string itself when the whole value
-* was one plain one-line string. Undefined refuses the file: multi-line
-* strings are where a line reader starts misreading string *content* as
-* sections and entries — the exact mistake that could flip a real trust entry
-* — so they are not parsed around, they end the attempt.
-*/
 function scanValueLine(text, pos, depth) {
 	let i = skipWs(text, pos);
 	if (depth === 0 && (text[i] === "\"" || text[i] === "'")) {
-		if (text.startsWith("\"\"\"", i) || text.startsWith("'''", i)) return void 0;
+		if (text.startsWith("\"\"\"", i) || text.startsWith("'''", i)) return;
 		const str = text[i] === "\"" ? parseBasicString(text, i) : parseLiteralString(text, i);
-		if (!str) return void 0;
+		if (!str) return;
 		const rest = skipWs(text, str.end);
-		if (rest < text.length && text[rest] !== "#") return void 0;
+		if (rest < text.length && text[rest] !== "#") return;
 		return {
 			depth: 0,
 			value: str.value
@@ -4354,33 +3477,21 @@ function scanValueLine(text, pos, depth) {
 		const ch = text[i];
 		if (ch === "#") break;
 		if (ch === "\"" || ch === "'") {
-			if (text.startsWith("\"\"\"", i) || text.startsWith("'''", i)) return void 0;
+			if (text.startsWith("\"\"\"", i) || text.startsWith("'''", i)) return;
 			const str = ch === "\"" ? parseBasicString(text, i) : parseLiteralString(text, i);
-			if (!str) return void 0;
+			if (!str) return;
 			i = str.end;
 			continue;
 		}
 		if (ch === "[" || ch === "{") depth++;
 		else if (ch === "]" || ch === "}") {
 			depth--;
-			if (depth < 0) return void 0;
+			if (depth < 0) return;
 		}
 		i++;
 	}
 	return { depth };
 }
-/**
-* The `[projects."<path>"] trust_level = "..."` entries of a codex
-* `config.toml`, by a deliberately narrow reader (core takes no TOML
-* dependency for this). Handles what codex itself writes plus the reasonable
-* hand-edits — comments, CRLF, whitespace, quoted keys with escapes, literal
-* and bare keys, `[projects]`-with-dotted-keys and top-level dotted forms,
-* single-line inline tables, multi-line arrays — and returns **undefined for
-* anything else it meets anywhere in the file** (multi-line strings,
-* `projects` as an inline table, array-of-tables, junk): the caller treats
-* undefined as "cannot know" and stays silent. Conflicting duplicate entries
-* also refuse — invalid for TOML, and guessing wrong is a false notice.
-*/
 function parseProjectTrustEntries(source) {
 	const entries = /* @__PURE__ */ new Map();
 	let section = [];
@@ -4389,7 +3500,7 @@ function parseProjectTrustEntries(source) {
 		const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
 		if (carryDepth > 0) {
 			const scanned = scanValueLine(line, 0, carryDepth);
-			if (!scanned) return void 0;
+			if (!scanned) return;
 			carryDepth = scanned.depth;
 			continue;
 		}
@@ -4398,43 +3509,35 @@ function parseProjectTrustEntries(source) {
 		if (line[start] === "[") {
 			const array = line.startsWith("[[", start);
 			const path = parseKeyPath(line, start + (array ? 2 : 1));
-			if (!path) return void 0;
+			if (!path) return;
 			const close = array ? "]]" : "]";
-			if (!line.startsWith(close, path.end)) return void 0;
+			if (!line.startsWith(close, path.end)) return;
 			const rest = skipWs(line, path.end + close.length);
-			if (rest < line.length && line[rest] !== "#") return void 0;
-			if (array && path.value[0] === "projects") return void 0;
+			if (rest < line.length && line[rest] !== "#") return;
+			if (array && path.value[0] === "projects") return;
 			section = path.value;
 			continue;
 		}
 		const key = parseKeyPath(line, start);
-		if (!key) return void 0;
-		if (line[key.end] !== "=") return void 0;
+		if (!key) return;
+		if (line[key.end] !== "=") return;
 		const scanned = scanValueLine(line, key.end + 1, 0);
-		if (!scanned) return void 0;
+		if (!scanned) return;
 		carryDepth = scanned.depth;
 		const full = [...section, ...key.value];
 		if (full[0] !== "projects") continue;
-		if (full.length < 3) return void 0;
+		if (full.length < 3) return;
 		if (full.length === 3 && full[2] === "trust_level") {
-			if (carryDepth !== 0 || scanned.value === void 0) return void 0;
+			if (carryDepth !== 0 || scanned.value === void 0) return;
 			const project = full[1];
 			const existing = entries.get(project);
-			if (existing !== void 0 && existing !== scanned.value) return void 0;
+			if (existing !== void 0 && existing !== scanned.value) return;
 			entries.set(project, scanned.value);
 		}
 	}
-	if (carryDepth > 0) return void 0;
+	if (carryDepth > 0) return;
 	return entries;
 }
-/**
-* A linked worktree inherits trust from its main repository's entry (measured:
-* trusting the main repo path loads the worktree's project config). The
-* worktree's `.git` is a FILE whose `gitdir:` line names
-* `<main>/.git/worktrees/<name>`; the directory owning that `.git` is the
-* anchor to look up. Anything unreadable or shaped differently resolves false
-* — this route can only ADD trust, i.e. silence, never a false notice.
-*/
 function mainRepositoryTrusted(gitRootDir, canonical) {
 	const gitPath = join(gitRootDir, ".git");
 	try {
@@ -4453,15 +3556,6 @@ function mainRepositoryTrusted(gitRootDir, canonical) {
 		return false;
 	}
 }
-/**
-* The notice for a codex session about to run on a cwd whose
-* `.codex/config.toml` codex will ignore, or undefined when there is nothing
-* to say — no project config anywhere codex would look, the project is
-* trusted, or the situation cannot be established with certainty. Read-only
-* throughout: WorkerDeck never writes trust entries (adjacent to the auth red
-* lines — trusting a directory is the operator's decision, made in codex's
-* own prompt or by their own hand).
-*/
 function untrustedProjectNotice(options) {
 	let cwd;
 	try {
@@ -4492,17 +3586,17 @@ function untrustedProjectNotice(options) {
 			return false;
 		}
 	});
-	if (layers.length === 0) return void 0;
+	if (layers.length === 0) return;
 	const homeConfigPath = join(options.codexHome, "config.toml");
 	let source = "";
 	try {
 		source = readFileSync(homeConfigPath, "utf8");
 	} catch (error) {
-		if (error.code !== "ENOENT") return void 0;
+		if (error.code !== "ENOENT") return;
 	}
 	const entries = parseProjectTrustEntries(source);
-	if (!entries) return void 0;
-	for (const value of entries.values()) if (value !== "trusted" && value !== "untrusted") return void 0;
+	if (!entries) return;
+	for (const value of entries.values()) if (value !== "trusted" && value !== "untrusted") return;
 	const canonical = /* @__PURE__ */ new Map();
 	for (const [key, value] of entries) {
 		let path = key;
@@ -4518,59 +3612,25 @@ function untrustedProjectNotice(options) {
 		if (entry !== void 0) return entry !== "trusted";
 		return !rootTrusted;
 	});
-	if (ignored.length === 0) return void 0;
+	if (ignored.length === 0) return;
 	const trustDir = gitRoot ?? cwd;
 	const configs = ignored.map((layer) => join(layer, ".codex", "config.toml"));
 	return `codex does not trust this directory, so ${configs.length === 1 ? `its project config (${configs[0]}) is` : `its project configs (${configs.join(", ")}) are`} being ignored — MCP servers and settings declared there will be missing from this session. To trust it, run codex once in ${trustDir} and accept the trust prompt, or add [projects."${trustDir}"] with trust_level = "trusted" to ${homeConfigPath}.`;
 }
 //#endregion
 //#region src/engines/codex/runner.ts
-/**
-* thread/start's sandbox axis (string form) — our permission modes as codex
-* sandbox modes: `default` → read-only (reads run; any mutation is refused by
-* the OS sandbox and — with the ask policy below — escalates to a real
-* question), `acceptEdits` → workspace-write (in-workspace writes sail
-* through, the acceptEdits grant), `bypassPermissions` → danger-full-access.
-* `auto` rides the SAME sandbox as acceptEdits — it is not a wider grant, it
-* only moves *who answers* the approvals (see {@link APPROVALS_REVIEWER_BY_MODE}).
-*/
 const THREAD_SANDBOX_BY_MODE = {
 	default: "read-only",
 	acceptEdits: "workspace-write",
 	auto: "workspace-write",
 	bypassPermissions: "danger-full-access"
 };
-/**
-* turn/start's sandboxPolicy axis (object form — same policy, second shape).
-*
-* The `workspaceWrite` entries here are a SHAPE, not the whole policy: every
-* unstated field of that variant is serde-defaulted by the app-server, so
-* sending it bare silently overrides the operator's `[sandbox_workspace_write]`
-* — `network_access` back to false, `writable_roots` back to empty — on every
-* turn. {@link CodexRunner.#turnSandboxPolicy} restates those fields from
-* `config/read`; nothing else may send this map's `workspaceWrite` entries
-* directly.
-*/
 const TURN_SANDBOX_BY_MODE = {
 	default: { type: "readOnly" },
 	acceptEdits: { type: "workspaceWrite" },
 	auto: { type: "workspaceWrite" },
 	bypassPermissions: { type: "dangerFullAccess" }
 };
-/**
-* The approval axis, stated as the GRANULAR object on both thread/start and
-* turn/start — never the string vocabulary, deliberately and unconditionally:
-* measured against 0.146.0, plain `'untrusted'` never asked anything (a
-* sandbox-violating write was silently refused, a safe echo auto-approved),
-* while the granular flags make a blocked action a real server→client
-* question. Granular policies are gated on `capabilities.experimentalApi` at
-* initialize; WorkerDeck declares it always and keeps NO non-experimental
-* fallback — a future binary that rejects either gate fails loudly (see
-* {@link CodexRunner.#ensureThread}) instead of quietly not asking.
-*
-* `default`/`acceptEdits` ask (all flags on — the sandbox axis above already
-* decides *what needs asking*); `bypassPermissions` asks nothing, same shape.
-*/
 const GRANULAR_ASK = { granular: {
 	sandbox_approval: true,
 	rules: true,
@@ -4585,11 +3645,6 @@ const GRANULAR_NEVER = { granular: {
 	request_permissions: false,
 	skill_approval: false
 } };
-/**
-* Notifications whose meaning is scoped to ONE thread, and which are therefore
-* only ever read off the session's own. Everything else (items, deltas) is
-* accepted from any thread on the connection — see `#handleNotification`.
-*/
 const THREAD_SCOPED_NOTIFICATIONS = new Set([
 	"turn/started",
 	"turn/completed",
@@ -4601,62 +3656,20 @@ const APPROVAL_POLICY_BY_MODE = {
 	auto: GRANULAR_ASK,
 	bypassPermissions: GRANULAR_NEVER
 };
-/**
-* The THIRD approval axis — *who reviews*, independent of the sandbox axis and
-* the ask axis above. Codex's `approvalsReviewer` (thread/start and turn/start,
-* present since 0.146.0) routes every approval request either to the user
-* (`'user'`, codex's own default) or to `'auto_review'`: a prompted subagent
-* that gathers context and applies a risk framework before allowing or denying.
-* That is codex's "Approve for me" preset, and our `auto` mode is exactly it.
-*
-* Sent explicitly for EVERY mode rather than omitted for the default — a thread
-* inherits `approvalsReviewer` across turns ("this turn and subsequent turns"),
-* so leaving it unset would let a stale reviewer from an earlier turn survive a
-* mode switch back to a user-reviewed mode. Stating it every time makes the
-* mode the single source of truth.
-*
-* NOTE the asymmetry with the Claude engine's `auto`: that classifier is
-* operator-configurable (`autoMode.environment`, allow/soft_deny/hard_deny);
-* this reviewer has no configuration surface at all.
-*/
 const APPROVALS_REVIEWER_BY_MODE = {
 	default: "user",
 	acceptEdits: "user",
 	auto: "auto_review",
 	bypassPermissions: "user"
 };
-/** Fallback timeout for a pending approval nobody answers — the SessionRunner
-* default, so unattended codex sessions land the same way Claude ones do. */
 const DEFAULT_APPROVAL_TIMEOUT_MS = 3e5;
-/**
-* Tool name for codex's built-in `image_gen`. A stable string because it is a
-* rendering contract: both clients key an icon (and, where they can reach the
-* host filesystem, an inline preview) off it.
-*/
 const CODEX_IMAGE_TOOL = "CodexImageGeneration";
-/**
-* Tool name for a spawned agent's anchor `tool_use` — the claude engine's
-* `Task` in this engine's vocabulary. Codex never sends such a call: the model's
-* `spawn_agent` surfaces only as the `subAgentActivity` marker item, so the
-* runner authors the call itself, because everything downstream is built on a
-* top-level `tool_use` existing — `terminalBlocks` absorbs a sidechain into the
-* call whose id its events carry as `parentToolUseId`, the takeover frames by
-* it, and `taskIdentity` labels it from the input's `subagent_type`. Not a new
-* wire idea, just a row: the same shape every other codex tool card uses.
-*/
 const CODEX_AGENT_TOOL = "CodexAgent";
-/** Tool name for the model's collab-agent calls (`wait`, `sendInput`, …), the
-* `tool` field carried in the input. One name for the whole open axis rather
-* than a name per verb, so a future verb renders instead of vanishing. */
 const CODEX_COLLAB_TOOL = "CodexCollab";
-/** An agent's name is its path's basename: '/root/date_one' → 'date_one'. */
 function agentName(agentPath) {
-	if (typeof agentPath !== "string") return void 0;
+	if (typeof agentPath !== "string") return;
 	return agentPath.split("/").filter(Boolean).at(-1) || void 0;
 }
-/** The collab card's input: the verb always, the rich fields only when codex
-* actually filled them (measured against 0.146.0 they arrive empty — the card
-* must not render five null columns to say 'wait'). */
 function collabInput(item) {
 	return {
 		tool: item.tool,
@@ -4665,9 +3678,6 @@ function collabInput(item) {
 		...item.model ? { model: item.model } : {}
 	};
 }
-/** A completed turn's answer, from its summary `items` page — the last
-* `agentMessage` text. For a sub-agent's thread this is the agent's report,
-* which is exactly what belongs in the anchor's `tool_result`. */
 function turnReport(turn) {
 	const items = Array.isArray(turn.items) ? turn.items : [];
 	for (let index = items.length - 1; index >= 0; index--) {
@@ -4675,29 +3685,13 @@ function turnReport(turn) {
 		if (item?.type === "agentMessage" && typeof item.text === "string" && item.text) return item.text;
 	}
 }
-/** Longest `result` worth putting in a tool card. The field is free-form and
-* undocumented; anything past this is assumed to be an encoded image rather
-* than a sentence, and encoded images do not go in the event log. */
 const MAX_IMAGE_RESULT_CHARS = 512;
-const shortResult = (result) => result.length > 0 && result.length <= MAX_IMAGE_RESULT_CHARS && !result.startsWith("data:");
-/**
-* `file_produced.fileId` — derived from the path, not minted fresh.
-*
-* Two properties fall out of that and both are load-bearing: codex reports the
-* same `savedPath` on the progress item and again on the completed one, so a
-* derived id makes the second emission a no-op instead of a duplicate row; and
-* a session rebuilt from a snapshot re-derives the same ids, so a client's
-* cached URL still resolves after a park/restore.
-*/
+function shortResult(result) {
+	return result.length > 0 && result.length <= MAX_IMAGE_RESULT_CHARS && !result.startsWith("data:");
+}
 function producedFileId(path) {
 	return createHash("sha256").update(path).digest("hex").slice(0, 32);
 }
-/** Media type from the extension, for the handful a client renders inline.
-* Undefined for everything else — the route sniffs, and guessing here is how a
-* text file ends up labelled `image/png`. */
-function producedMediaType(path) {
-	return PRODUCED_MEDIA_TYPES[path.slice(path.lastIndexOf(".") + 1).toLowerCase()];
-}
 const PRODUCED_MEDIA_TYPES = {
 	png: "image/png",
 	jpg: "image/jpeg",
@@ -4707,12 +3701,9 @@ const PRODUCED_MEDIA_TYPES = {
 	svg: "image/svg+xml",
 	pdf: "application/pdf"
 };
-/**
-* Codex's `SkillMetadata` as the protocol states it. `interface.shortDescription`
-* beats the legacy top-level one (codex's own comment says to prefer it), and
-* `enabled` defaults to true — an entry codex listed without the field is one it
-* considers live, and defaulting to false would hide working skills.
-*/
+function producedMediaType(path) {
+	return PRODUCED_MEDIA_TYPES[path.slice(path.lastIndexOf(".") + 1).toLowerCase()];
+}
 function skillInfo(skill) {
 	return {
 		name: skill.name,
@@ -4724,19 +3715,6 @@ function skillInfo(skill) {
 		enabled: skill.enabled !== false
 	};
 }
-/**
-* Codex's MCP status → the protocol's, which is Claude Code's vocabulary
-* ('connected' | 'failed' | 'needs-auth' | 'pending' | 'disabled').
-*
-* Two inputs, and the auth one wins where it applies: a server that started
-* fine but has no credential is *needs-auth*, not connected, because that is
-* the thing the operator has to act on. `notLoggedIn` is the only auth value
-* that means "unusable" — `unsupported` is the normal answer for a stdio server
-* that has no auth concept at all.
-*
-* A server with no startup notification yet is 'pending', not 'connected':
-* `mcpServerStatus/list` alone only proves it is *configured*.
-*/
 function mcpStatusOf(authStatus, update, hasTools) {
 	if (update?.status === "failed") return update.failureReason === "reauthenticationRequired" ? "needs-auth" : "failed";
 	if (update?.status === "cancelled") return "failed";
@@ -4745,7 +3723,6 @@ function mcpStatusOf(authStatus, update, hasTools) {
 	if (hasTools) return "connected";
 	return "pending";
 }
-/** One `mcpServerStatus/list` entry as the protocol states it. */
 function mcpServerInfo(server, update) {
 	const tools = Object.entries(server.tools ?? {}).flatMap(([key, tool]) => {
 		if (!tool) return [];
@@ -4772,55 +3749,26 @@ function mcpServerInfo(server, update) {
 		...tools.length > 0 ? { tools } : {}
 	};
 }
-/** What the card shows while the picture is being made, and after. `savedPath`
-* only exists once it lands — a client keys its preview off it, so it is a
-* field rather than a sentence in the result text. */
 function imageGenerationInput(item) {
 	return {
 		...item.revisedPrompt ? { prompt: item.revisedPrompt } : {},
 		...item.savedPath ? { savedPath: item.savedPath } : {}
 	};
 }
-/**
-* The experimental per-request decision list, normalized to names: a string
-* entry is its own name, a structured entry (`{acceptWithExecpolicyAmendment:
-* …}`) is named by its key. Undefined = the request stated no list and the
-* channel's schema enum applies. Present only under `experimentalApi: true` —
-* which WorkerDeck always declares.
-*/
 function offeredDecisions(params) {
 	const raw = params?.availableDecisions;
-	if (!Array.isArray(raw)) return void 0;
+	if (!Array.isArray(raw)) return;
 	const names = /* @__PURE__ */ new Set();
 	for (const entry of raw) if (typeof entry === "string") names.add(entry);
 	else if (entry && typeof entry === "object") for (const key of Object.keys(entry)) names.add(key);
 	return names.size > 0 ? names : void 0;
 }
-/**
-* Decision picking for the `{decision: …}` channels (commandExecution,
-* fileChange), honoring the request's own `availableDecisions`:
-*
-* - allow → 'accept' when offered (or when no list was stated). A request
-*   offering only the broader accepts ('acceptForSession',
-*   'acceptWithExecpolicyAmendment') yields undefined: a one-shot allow must
-*   not be silently widened into a session-wide or persistent policy grant, so
-*   the caller answers with the denial and says why.
-* - deny → 'decline', always: the response schema declares it unconditionally,
-*   and it was verified live against 0.146.0 answering a request whose
-*   availableDecisions omitted it — the turn completed cleanly. The list's job
-*   is to gate the accept variants, not to take "no, but keep going" away
-*   (its own alternative, 'cancel', would interrupt the whole turn).
-* - deny+interrupt → 'cancel' (codex's deny-and-interrupt) when offered;
-*   otherwise 'decline', and the caller interrupts the turn itself.
-*/
 function pickDecision(behavior, interrupt, offered) {
 	const has = (name) => !offered || offered.has(name);
 	if (behavior === "allow") return has("accept") ? "accept" : void 0;
 	if (interrupt && has("cancel")) return "cancel";
 	return "decline";
 }
-/** Codex `requestUserInput` questions in the AskUserQuestion wire shape both
-* clients already render (QuestionPrompt / QuestionPromptView). */
 function userQuestionsFromCodex(questions) {
 	return questions.map((question) => ({
 		question: question.question,
@@ -4831,18 +3779,6 @@ function userQuestionsFromCodex(questions) {
 		}))
 	}));
 }
-/**
-* The text of a history `userMessage` item: its content entries' text parts
-* joined.
-*
-* Image parts have no replayable representation — the bytes went to the model,
-* not into the rollout we can render from — so they are named rather than
-* dropped. A prompt that was *only* an image used to produce an empty string,
-* which the caller read as "nothing to replay" and skipped: the turn lost its
-* user row and, with it, the prompt mark the scrubber navigates by, so a resumed
-* thread had answers with no visible question. A word in place of the picture is
-* a smaller lie than a turn that never happened.
-*/
 function historyUserText(item) {
 	if (!Array.isArray(item.content)) return "";
 	let images = 0;
@@ -4855,9 +3791,6 @@ function historyUserText(item) {
 	if (text) return text;
 	return images > 0 ? `[${images === 1 ? "image" : `${images} images`}]` : "";
 }
-/** The AskUserQuestion answer convention (question text → chosen label(s),
-* comma-joined) mapped back to codex's id-keyed shape. Questions the client
-* did not answer are absent, not empty. */
 function codexAnswers(questions, answers) {
 	const out = {};
 	for (const question of questions) {
@@ -4866,7 +3799,6 @@ function codexAnswers(questions, answers) {
 	}
 	return out;
 }
-/** The two channels whose response is `{decision: …}` share their pick logic. */
 function decisionChannel(describe, itemId) {
 	return {
 		describe,
@@ -4887,11 +3819,6 @@ function decisionChannel(describe, itemId) {
 		}
 	};
 }
-/**
-* The ask channels, wired to the permission surface. Anything not listed here
-* still gets a JSON-RPC -32601 — never a hang (an unanswered server request
-* wedges the turn).
-*/
 const APPROVAL_CHANNELS = {
 	"item/commandExecution/requestApproval": decisionChannel((raw) => {
 		const params = raw;
@@ -4982,129 +3909,48 @@ const APPROVAL_CHANNELS = {
 		deny: (_raw, interrupt) => ({ response: { action: interrupt ? "cancel" : "decline" } })
 	}
 };
-/**
-* Name a subscription window by its measured length, so codex's positional
-* windows land in the protocol's named vocabulary. The two names clients
-* already understand are exact matches for codex's durations (300 min = 5h,
-* 10080 min = 7d); anything else keeps a self-describing key rather than
-* borrowing a name that would size it wrongly.
-*/
 function rateLimitWindowName(minutes) {
-	if (typeof minutes !== "number" || !Number.isFinite(minutes) || minutes <= 0) return void 0;
+	if (typeof minutes !== "number" || !Number.isFinite(minutes) || minutes <= 0) return;
 	if (minutes === 300) return "five_hour";
 	if (minutes === 10080) return "seven_day";
 	return `window_${minutes}m`;
 }
-/**
-* The Codex engine, over the binary's `app-server` JSON-RPC surface: ONE
-* `codex app-server` child per *session* (spawned lazily, held across turns),
-* streaming `item/agentMessage/delta` and the reasoning deltas token-by-token
-* (`streaming: 'token'`). Follows `SessionRunner`'s event-log/seq/status
-* discipline with `AiSdkRunner`'s turn-chain (one turn at a time; sendMessage
-* queues). The first codex transport was `codex exec --experimental-json` (one
-* child per turn) — retired because its JSONL carries no partial messages, so
-* a turn could never stream.
-*
-* A dead child is a failed *turn*, not a failed session: the thread persists
-* on disk, the connection is dropped, and the next message spawns a fresh
-* child that `thread/resume`s the same thread id.
-*/
 var CodexRunner = class {
 	id;
 	createdAt;
 	#config;
-	/** {@link CodexRunnerConfig.cwd}, checked once in the constructor. */
 	#cwd;
-	#events = [];
+	#log = new EventLog();
 	#subscribers = new SubscriberSet();
-	#seq = 0;
-	/**
-	* Latest context-window reading, retained from the last `context_usage` this
-	* runner emitted so `GET /sessions` can answer it without an attach — see
-	* `SessionInfo.contextUsage`. Folded in the emit path, so it is by
-	* construction the same number the transcript last drew.
-	*/
-	#contextUsage;
-	#activityCount = 0;
-	/**
-	* Seq of the latest `conversation_reset` event, 0 when none. The log itself is
-	* never truncated — it still carries the state-bearing events (`capabilities`,
-	* `system_init`, …) a fresh attacher depends on and which are not re-emitted —
-	* but `subscribe()` skips transcript *content* strictly below this mark, so a
-	* replay does not resurrect a cleared conversation. A later reset supersedes
-	* an earlier one by overwriting it.
-	*/
-	#resetSeq = 0;
 	#status = "starting";
+	#statusDetail;
 	#sdkSessionId;
 	#model;
 	#permissionMode;
 	#reasoningEffort;
-	/** What the binary said the profile's defaults resolve to (thread/start
-	* response) — lets `setModel(undefined)` mean "back to the default" even
-	* though a turn/start override persists for subsequent turns. */
 	#resolvedModel;
-	/** Last reported ChatGPT plan, so `plan_info` is emitted once per change. */
 	#planType;
 	#resolvedEffort;
 	#queue = [];
 	#turnChain = Promise.resolve();
 	#activeTurn;
 	#connection;
-	/** Per-child, from `config/read`; undefined = read failed, send the bare shape. */
 	#workspaceWrite;
 	#threadLoaded = false;
 	#numTurns = 0;
 	#totalCostUsd;
-	#lastActivityAt;
 	#started = false;
 	#closed = false;
-	/** Session temp dir for image attachments (`localImage` takes host paths). */
 	#imageDir;
-	/** Pending server→client approvals, keyed by the surfaced request id. */
 	#approvals = /* @__PURE__ */ new Map();
-	/** True from start() until the resume backfill (the turn chain's first link)
-	* settles — while set, sendMessage defers its user_message echo behind the
-	* chain so a new turn can never precede or interleave the replayed history. */
 	#backfillPending = false;
-	/** The resumed thread's prior turns, stashed by {@link #ensureThread} from
-	* the ONE thread/resume the backfill consumes (`partial` = the response's
-	* turnsBackwardsCursor said older turns exist beyond this page). A mid-life
-	* reconnect also goes through thread/resume, but with no backfill pending
-	* nothing is stashed — history is never replayed twice. */
 	#resumedHistory;
-	/** Set around history replay: {@link #emit} stamps `replay: true` onto the
-	* message events the live item mapping produces. */
 	#replayingHistory = false;
-	/** Last `skills` payload emitted, serialized — the comparison that keeps a
-	* `skills/changed` storm (the watcher fires per touched file) from filling
-	* the event log with identical lists. */
 	#skillsFingerprint;
-	/** In-flight `skills/list`, so a burst of `skills/changed` makes one call.
-	* The pending promise is reused rather than queued: the request has no
-	* arguments, so a second one would ask the same question. */
 	#skillsRefresh;
-	/** Host paths already announced via `file_produced`, so the same picture
-	* reported on both the progress and the completed item registers once. */
 	#producedPaths = /* @__PURE__ */ new Set();
-	/** Per-server liveness, accumulated from `mcpServer/startupStatus/updated`.
-	* `mcpServerStatus/list` does not carry a status field at all, so without
-	* this every server would read as "configured" and never as up or down. */
 	#mcpStatus = /* @__PURE__ */ new Map();
-	/** The spawned agents, keyed by their thread ids — the attribution table
-	* behind `parentToolUseId` and the rollup behind `info().subagents`. Runner-
-	* level, not per-turn: an agent's thread outlives the root turn that spawned
-	* it, and only the child process dying (or the session closing) ends them
-	* all — see the module doc in `subagents.ts`. */
 	#agents = new CodexAgentTracker();
-	/** Threads that belonged to a conversation this session has cleared — the
-	* agents that were still running when it happened. Their notifications keep
-	* arriving on the same connection (a clear does not interrupt them and does
-	* not drop the child), and without this {@link CodexRunner.#agentFor} would
-	* mint them a fresh anchor and stream the cleared conversation's agent work
-	* into the new one. Never pruned: it is a handful of uuids for the session's
-	* life, and a late report from a long-dead agent is exactly what it exists to
-	* catch. */
 	#clearedThreads = /* @__PURE__ */ new Set();
 	constructor(config, id = randomUUID()) {
 		const mode = config.permissionMode ?? "default";
@@ -5120,15 +3966,8 @@ var CodexRunner = class {
 		this.id = id;
 		this.createdAt = Date.now();
 	}
-	/** The complete child environment — spawn env replaces process.env wholesale,
-	* so this must carry everything a shell would, with the profile's CODEX_HOME
-	* pin winning over operator env. */
 	#childEnv() {
-		const base = this.#config.env ?? process.env;
-		const env = {};
-		for (const [key, value] of Object.entries(base)) if (value !== void 0) env[key] = value;
-		if (this.#config.codexHome) env.CODEX_HOME = this.#config.codexHome;
-		return env;
+		return codexChildEnv(this.#config.env ?? process.env, this.#config.codexHome);
 	}
 	get status() {
 		return this.#status;
@@ -5137,7 +3976,7 @@ var CodexRunner = class {
 		return this.#sdkSessionId;
 	}
 	get lastSeq() {
-		return this.#seq;
+		return this.#log.seq;
 	}
 	get pendingApprovals() {
 		return [...this.#approvals.values()].map((pending) => pending.request);
@@ -5155,36 +3994,22 @@ var CodexRunner = class {
 			permissionMode: this.#permissionMode,
 			canBypassPermissions: true,
 			createdAt: this.createdAt,
-			lastSeq: this.#seq,
-			activityCount: this.#activityCount,
-			contextUsage: this.#contextUsage,
+			lastSeq: this.#log.seq,
+			activityCount: this.#log.activityCount,
+			proseCount: this.#log.proseCount,
+			contextUsage: this.#log.contextUsage,
 			pendingPermissionCount: this.#approvals.size,
 			meta: this.#config.meta,
 			scope: this.#config.scope,
-			title: this.#title(),
+			title: sessionTitle(this.#config),
 			totalCostUsd: this.#totalCostUsd,
 			numTurns: this.#numTurns || void 0,
-			lastActivityAt: this.#lastActivityAt,
+			lastActivityAt: this.#log.lastActivityAt,
 			subagents: this.#agents.list()
 		};
 	}
-	#title() {
-		const metaTitle = this.#config.meta?.title;
-		if (typeof metaTitle === "string" && metaTitle.length > 0) return metaTitle;
-		const prompt = this.#config.prompt;
-		if (!prompt) return void 0;
-		return prompt.length > 80 ? prompt.slice(0, 77) + "…" : prompt;
-	}
-	/** Host-facing rename: writes `meta.title`, which `#title()` prefers. Clearing
-	* it (undefined) restores the derived title. The engine is never told. */
 	setTitle(title) {
-		const meta = { ...this.#config.meta };
-		if (title) meta.title = title;
-		else delete meta.title;
-		this.#config = {
-			...this.#config,
-			meta
-		};
+		this.#config = withTitle(this.#config, title);
 	}
 	start() {
 		if (this.#started) return this.#turnChain;
@@ -5198,20 +4023,6 @@ var CodexRunner = class {
 		if (!this.#config.prompt && !this.#config.resume) this.#probeSkills();
 		return this.#turnChain;
 	}
-	/**
-	* One-time transcript notice for the codex trust gap: a `default`-mode
-	* session (read-only sandbox) on an untrusted cwd has its
-	* `.codex/config.toml` — MCP servers included — silently ignored, and the
-	* app-server surface has no trust prompt to say so (the TUI's prompt is
-	* where the entry normally gets written). `acceptEdits`/`bypassPermissions`
-	* sessions are exempt because their `thread/start` (workspace-write /
-	* danger-full-access sandbox) writes the trust entry itself and loads the
-	* config — measured against 0.146.0 and 0.149.0; a notice there would be
-	* false. Emitted as `session_error`, which both clients render as an inline
-	* notice while the session keeps running (the backfill-history precedent),
-	* so nothing new rides the wire. Every degrade path is silence: a false
-	* warning on a trusted project is worse than a missed one.
-	*/
 	#warnUntrustedProject() {
 		if (this.#permissionMode !== "default") return;
 		try {
@@ -5229,20 +4040,6 @@ var CodexRunner = class {
 			});
 		} catch {}
 	}
-	/**
-	* List skills over a **throwaway** connection, for a session with nothing else
-	* to do yet.
-	*
-	* `skills/list` needs a live child but not a thread, so this spawns one, asks,
-	* and closes it — rather than bringing up the session's own child early and
-	* leaving a codex process parked behind every session someone created and
-	* never typed into. The session's real connection re-lists when it arrives;
-	* the fingerprint compare in {@link #refreshSkills} makes that a no-op.
-	*
-	* Entirely best-effort and never awaited: a missing binary, a failed spawn or
-	* a rejected handshake here must not turn a session that has not started into
-	* a session that failed.
-	*/
 	async #probeSkills() {
 		let connection;
 		try {
@@ -5253,28 +4050,10 @@ var CodexRunner = class {
 			connection?.close();
 		}
 	}
-	/**
-	* A handshaken child that is **not** the session's — for the questions a
-	* client can ask before the session has anything to run (its skills, its MCP
-	* servers). The caller owns it and must close it.
-	*
-	* No onNotification/onRequest/onClose wiring on purpose: this child answers
-	* one question and goes away, so its notifications are noise and its death is
-	* not the session's problem. The alternative — bringing the session's real
-	* child up early — would park a codex process behind every session someone
-	* created and never typed into.
-	*/
 	async #openScratchConnection() {
 		const connection = this.#config.connectFn({ env: this.#childEnv() });
 		try {
-			await connection.request("initialize", {
-				clientInfo: {
-					name: "workerdeck",
-					title: "WorkerDeck",
-					version: `protocol-${PROTOCOL_VERSION}`
-				},
-				capabilities: { experimentalApi: true }
-			});
+			await connection.request("initialize", INITIALIZE_PARAMS);
 			connection.notify("initialized");
 			return connection;
 		} catch (error) {
@@ -5309,12 +4088,6 @@ var CodexRunner = class {
 		this.#queue.push({ input });
 		this.#scheduleTurn();
 	}
-	/**
-	* App-server input for a message with attachments: images land in a session
-	* temp dir and travel as `localImage` host paths, text files inline into the
-	* prompt in the shared named envelope, PDF has no representation (the
-	* gateway's 415 normally refuses it first).
-	*/
 	#buildInput(text, attachments) {
 		const parts = [];
 		for (const attachment of attachments) {
@@ -5347,8 +4120,6 @@ var CodexRunner = class {
 		});
 		return parts;
 	}
-	/** Resolve a pending approval. Returns false if the id is unknown (e.g.
-	* timed out, or already settled by codex itself). */
 	resolvePermission(requestId, decision) {
 		const pending = this.#approvals.get(requestId);
 		if (!pending) return false;
@@ -5364,42 +4135,12 @@ var CodexRunner = class {
 		await this.#interruptTurn();
 		await this.#turnChain;
 	}
-	/**
-	* Reset the conversation: a **fresh thread on the same session**.
-	*
-	* Codex has no clear/reset RPC — `thread/compact/start` summarises and
-	* continues, `thread/fork` makes a second thread, and neither is "same
-	* session, empty context". So the analog is to stop resuming the old thread
-	* and start a new one, which is the path a dead child already takes minus the
-	* resume. The old thread is NOT deleted: it stays in CODEX_HOME and stays
-	* resumable from `GET /sdk-sessions`.
-	*
-	* Two things it does on the way through, both mirroring the Claude engine's
-	* SDK-driven reset (`engines/claude/runner.ts`):
-	*
-	* 1. **The new thread id is adopted before `conversation_reset` is emitted**,
-	*    whenever a child is already up — the eager `thread/start` costs no
-	*    tokens and no model call, and it is what keeps the dormant record from
-	*    ever naming the conversation that was just cleared. With no child there
-	*    is nothing to start against and the id is simply dropped; the parking
-	*    service treats a resumable session with no engine session id as one with
-	*    nothing to come back to, and forgets the stale record.
-	* 2. **The context reading is retired**, in `#emit`'s `conversation_reset`
-	*    arm. Codex cannot re-poll it the way Claude does — the only source is
-	*    `thread/tokenUsage/updated`, which arrives *during* a turn — so there is
-	*    no reading at all until the next turn runs, and the protocol's rule
-	*    applies: render nothing rather than a stale ring or a 0%.
-	*
-	* The turn counter stays monotonic across this, on purpose (it is an unread
-	* cursor, not an item count), and so does `activityCount` — `#emit` owns both.
-	*/
 	async clearContext() {
 		if (this.#closed) throw new Error("session is closed");
 		const run = this.#turnChain.then(() => this.#clearNow());
 		this.#turnChain = run.then(() => void 0, () => void 0);
 		await run;
 	}
-	/** The clear itself, only ever called as a turn-chain link. */
 	async #clearNow() {
 		if (this.#closed) throw new Error("session is closed");
 		const previousThread = this.#sdkSessionId;
@@ -5424,8 +4165,6 @@ var CodexRunner = class {
 			sdkSessionId: this.#sdkSessionId
 		});
 	}
-	/** Address the in-flight turn only (no approval sweep) — also the follow-up
-	* for a deny+interrupt whose wire decision couldn't carry the interrupt. */
 	async #interruptTurn() {
 		const active = this.#activeTurn;
 		const connection = this.#connection;
@@ -5494,37 +4233,15 @@ var CodexRunner = class {
 		});
 		this.#setStatus("closed");
 	}
-	/** See `Runner.eventAt`. A linear scan: the one caller is a reader pressing
-	* "show everything" on one row, so a per-runner seq index would be a map
-	* maintained on every emit to save a walk nobody makes twice a minute. */
 	eventAt(seq) {
-		return this.#events.find((event) => event.seq === seq);
+		return this.#log.at(seq);
 	}
 	subscribe(listener, afterSeq = 0, options) {
-		return this.#subscribers.subscribe(this.#events, listener, afterSeq, options, this.#resetSeq);
+		return this.#subscribers.subscribe(this.#log.events, listener, afterSeq, options, this.#log.resetSeq);
 	}
 	#scheduleTurn() {
 		this.#turnChain = this.#turnChain.then(() => this.#runTurn());
 	}
-	/**
-	* Read `[sandbox_workspace_write]` as codex resolves it for this session's
-	* cwd, once per child, so {@link CodexRunner.#turnSandboxPolicy} can restate
-	* it verbatim.
-	*
-	* Why this exists at all: `turn/start`'s object-form sandbox policy is
-	* serde-defaulted field by field, so `{type: 'workspaceWrite'}` bare means
-	* `networkAccess: false, writableRoots: []` NO MATTER what the operator
-	* configured — and we must keep sending the object every turn, because
-	* restating it is what makes a between-turns permission-mode switch take
-	* effect. Measured against 0.149.0 with `network_access = true` set: the
-	* bare object produced `curl: (6) Could not resolve host`, the fully-stated
-	* object and an omitted policy both produced `200`. `read-only` is not
-	* affected — the setting is scoped to workspace-write, as its name says, and
-	* a read-only sandbox has no network either way.
-	*
-	* A failure here is not fatal: `#workspaceWrite` stays undefined and we send
-	* the bare shape, which is exactly the behaviour that shipped before.
-	*/
 	async #readWorkspaceWrite(connection) {
 		this.#workspaceWrite = void 0;
 		try {
@@ -5539,7 +4256,6 @@ var CodexRunner = class {
 			};
 		} catch {}
 	}
-	/** The mode's turn-level sandbox policy, with the operator's workspace-write settings intact. */
 	#turnSandboxPolicy() {
 		const policy = TURN_SANDBOX_BY_MODE[this.#permissionMode];
 		if (policy?.type !== "workspaceWrite" || !this.#workspaceWrite) return policy;
@@ -5548,13 +4264,6 @@ var CodexRunner = class {
 			...this.#workspaceWrite
 		};
 	}
-	/**
-	* The session's live connection with its thread loaded, (re)building both as
-	* needed: spawn + `initialize`/`initialized` on a fresh child, then
-	* `thread/start` (new) or `thread/resume` (a create-request `resume`, or a
-	* thread orphaned by a dead child). The response's resolved model/effort are
-	* kept so per-turn overrides can name "the profile default" explicitly.
-	*/
 	async #ensureThread() {
 		if (this.#closed) throw new Error("session is closed");
 		let connection = this.#connection;
@@ -5577,18 +4286,11 @@ var CodexRunner = class {
 				this.#activeTurn?.reject(new Error(message));
 			});
 			try {
-				await connection.request("initialize", {
-					clientInfo: {
-						name: "workerdeck",
-						title: "WorkerDeck",
-						version: `protocol-${PROTOCOL_VERSION}`
-					},
-					capabilities: { experimentalApi: true }
-				});
+				await connection.request("initialize", INITIALIZE_PARAMS);
 			} catch (error) {
 				connection.close();
 				if (this.#connection === connection) this.#connection = void 0;
-				if (error instanceof JsonRpcError) throw new Error("codex app-server rejected initialize (capabilities.experimentalApi: true — required for the granular approval policy, and WorkerDeck has no non-experimental fallback): " + error.message);
+				if (error instanceof JsonRpcError) throw new Error("codex app-server rejected initialize (capabilities.experimentalApi: true — required for the granular approval policy, and WorkerDeck has no non-experimental fallback): " + error.message, { cause: error });
 				throw error;
 			}
 			connection.notify("initialized");
@@ -5619,21 +4321,6 @@ var CodexRunner = class {
 		this.#refreshSkills(connection);
 		return connection;
 	}
-	/**
-	* Re-read `skills/list` and publish it, if it changed.
-	*
-	* **`cwds` is passed explicitly, and must be.** The schema documents the empty
-	* case as "the current session working directory", which reads like the
-	* thread's — it is not. Measured against 0.146.0: with no `cwds`, and *after*
-	* a `thread/start` carrying this session's cwd, the response comes back keyed
-	* to the app-server child's own process directory (for WorkerDeck, wherever
-	* the gateway was launched) and reports no repo-scoped skills at all. So a
-	* project's own `.codex/skills/**` were invisible until this argument existed.
-	*
-	* Best-effort throughout. A binary too old to know the method, a broken
-	* manifest, a child that died mid-call — none of that is worth failing a
-	* session over, and the panel simply stays absent.
-	*/
 	async #refreshSkills(connection) {
 		if (this.#skillsRefresh) return this.#skillsRefresh;
 		const run = (async () => {
@@ -5663,33 +4350,8 @@ var CodexRunner = class {
 		this.#skillsRefresh = run;
 		return run;
 	}
-	/**
-	* The session's MCP servers, live from the binary.
-	*
-	* Two sources merged, because codex splits them: `mcpServerStatus/list` says
-	* what is configured and what each server exposes (including every tool's
-	* full JSON Schema, which the Agent SDK does not give us), and the
-	* `mcpServer/startupStatus/updated` notifications say which of them are
-	* actually up.
-	*
-	* Answers **before the session has connected**, over a throwaway child, for
-	* the same reason the skill list does: a codex session spawns nothing until
-	* it has work, and a panel that said "no MCP servers configured" until the
-	* first turn would be stating something false about the operator's config.
-	* The request blocks until the servers are enumerated (measured: complete on
-	* the very first call), so there is no half-populated answer to race.
-	*
-	* Resolves undefined only when there is genuinely nothing to say — the
-	* session is closed, or the child could not be spoken to. The route turns
-	* that into a 501.
-	*
-	* **Listing only.** There is no per-server reconnect or toggle on this
-	* transport — hence no `reconnectMcpServer`/`setMcpServerEnabled` here, and
-	* `ENGINE_CAPABILITIES.codex.mcpServerActions: false` so clients render the
-	* panel read-only instead of offering buttons that cannot work.
-	*/
 	async mcpServers() {
-		if (this.#closed) return void 0;
+		if (this.#closed) return;
 		const live = this.#connection;
 		let scratch;
 		try {
@@ -5700,15 +4362,6 @@ var CodexRunner = class {
 			scratch?.close();
 		}
 	}
-	/**
-	* Announce a file the ENGINE wrote on the host, so a client can fetch it
-	* without the operator having declared its directory as a host-file root.
-	*
-	* Deliberately narrow: only paths codex reports as *written by its own tool*
-	* belong here. A path the model merely read (`imageView`) is an agent-chosen
-	* claim, and those keep going through `/fs/*` and its root allowlist — see
-	* the note on `file_produced` in the protocol.
-	*/
 	#emitFileProduced(path, toolUseId) {
 		if (this.#producedPaths.has(path)) return;
 		this.#producedPaths.add(path);
@@ -5726,16 +4379,6 @@ var CodexRunner = class {
 			toolUseId
 		});
 	}
-	/**
-	* On resume, replay the thread's prior turns as `replay: true` events,
-	* seq'd before any live turn — the SessionRunner backfill contract, fed
-	* from `thread/resume`'s own `thread.turns`. When the resume response says
-	* that page is partial (`turnsBackwardsCursor`), the FULL rollout history
-	* is fetched via `thread/read {includeTurns: true}` instead — and if even
-	* that fails, the partial page is replayed under a visible notice rather
-	* than silently posing as the whole thread. Best-effort like the Claude
-	* backfill: an unreadable history never blocks the resume itself.
-	*/
 	async #backfillHistory() {
 		try {
 			if (this.#closed) return;
@@ -5764,7 +4407,6 @@ var CodexRunner = class {
 			this.#setStatus("idle");
 		}
 	}
-	/** Replay historical turns through the SAME item mapping the live path uses. */
 	#replayTurns(turns) {
 		for (const turn of turns) {
 			if (this.#closed) return;
@@ -5793,8 +4435,6 @@ var CodexRunner = class {
 			}
 		}
 	}
-	/** Fresh per-turn state — one per live turn, and one per REPLAYED turn (the
-	* nonce is the item-id namespace, and its per-turn-ness is the invariant). */
 	#newTurnState() {
 		return {
 			nonce: randomUUID(),
@@ -5883,10 +4523,6 @@ var CodexRunner = class {
 		}
 		this.#notifications[method]?.(params);
 	}
-	/** Whether a notification is about the session's own thread. A notification
-	* with no `threadId` counts as the root's: every thread-scoped method the
-	* schema defines carries one, so an absent id means an older or narrower
-	* shape, not a sub-agent. */
 	#isRootThread(params) {
 		const threadId = this.#threadIdOf(params);
 		if (threadId === void 0) return true;
@@ -5896,42 +4532,18 @@ var CodexRunner = class {
 		const threadId = params?.threadId;
 		return typeof threadId === "string" ? threadId : void 0;
 	}
-	/**
-	* The agent behind a notification's `threadId` — the attribution every item
-	* and delta handler asks before emitting, so two agents streaming
-	* concurrently into this one connection come apart again by the id each
-	* frame carries, never by any mutable "current agent".
-	*
-	* A non-root thread with no record still gets one: a thread emitting items on
-	* this connection *is* an agent, whatever announced it (codex runs threads of
-	* its own for review/compact, and a `subAgentActivity` could in principle be
-	* missed) — the claude tracker's nested-event fallback, on a stronger signal.
-	* The minted record is label-less and its anchor is authored here, because an
-	* attributed event whose parent id matches no top-level `tool_use` would
-	* render inline rather than as a frame; a late `started` edge fills the name
-	* in. Root-thread traffic — and, defensively, the pre-thread shapes with no
-	* id at all — stays unattributed (`undefined`).
-	*/
 	#agentFor(params) {
 		const threadId = this.#threadIdOf(params);
-		if (threadId === void 0 || threadId === this.#sdkSessionId) return void 0;
+		if (threadId === void 0 || threadId === this.#sdkSessionId) return;
 		const known = this.#agents.get(threadId);
 		if (known) return known;
-		if (this.#clearedThreads.has(threadId)) return void 0;
+		if (this.#clearedThreads.has(threadId)) return;
 		const nonce = this.#activeTurn?.nonce ?? "codex";
 		const record = this.#agents.open(threadId, `${nonce}:agent:${threadId}`, void 0, Date.now());
 		record.anchored = true;
 		this.#emitToolUse(record.toolUseId, CODEX_AGENT_TOOL, { agentThreadId: threadId });
 		return record;
 	}
-	/**
-	* A child thread's `turn/completed` is that AGENT's completion — the one
-	* codex sends (`subAgentActivity` has no 'completed' kind, verified live).
-	* The verdict is the turn's own status, and the report is the completed
-	* turn's final message, delivered as the anchor's `tool_result` so the row
-	* settles exactly the way a claude `Task`'s does. Deliberately not gated on
-	* `#activeTurn`: an agent finishing between root turns still finished.
-	*/
 	#settleAgentTurn(params) {
 		const threadId = this.#threadIdOf(params);
 		const record = threadId ? this.#agents.get(threadId) : void 0;
@@ -5942,11 +4554,6 @@ var CodexRunner = class {
 		const report = (turn ? turnReport(turn) : void 0) ?? turn?.error?.message ?? (status === "done" ? "" : turn?.status ?? "failed");
 		this.#emitToolResult(record.toolUseId, report, status === "failed");
 	}
-	/** Reasoning deltas arrive on two methods that differ only in which section
-	* counter they advance; the section key carries the method so the two streams
-	* never share a boundary (and item ids are per-thread, so two agents' streams
-	* never share one either). Section boundaries (a new summary/content entry)
-	* render as paragraph breaks — the completed item joins sections with '\n\n'. */
 	#reasoningDelta(method) {
 		return (params) => {
 			const active = this.#activeTurn;
@@ -5954,26 +4561,23 @@ var CodexRunner = class {
 			const payload = params;
 			if (typeof payload?.delta !== "string" || !payload.delta) return;
 			const index = payload.contentIndex ?? payload.summaryIndex ?? 0;
-			const key = `${payload.itemId ?? ""}:${method}`;
+			const agent = this.#agentFor(params);
+			const key = `${agent?.toolUseId ?? ""}:${payload.itemId ?? ""}:${method}`;
 			const previous = active.sectionIndex.get(key);
 			active.sectionIndex.set(key, index);
 			const separator = previous !== void 0 && index > previous ? "\n\n" : "";
 			this.#emitDelta({
 				type: "thinking_delta",
 				thinking: separator + payload.delta
-			}, this.#agentFor(params)?.toolUseId ?? null);
+			}, agent?.toolUseId ?? null);
 		};
 	}
-	/** One item-progress handler serves `item/started` and `item/updated`. */
 	#itemProgress = (params) => {
 		const active = this.#activeTurn;
 		if (!active) return;
 		const item = params?.item;
 		if (item) this.#handleItemProgress(item, active, this.#agentFor(params));
 	};
-	/** The notification dispatch table — every method the child emits that this
-	* runner maps, in one place. Handlers read `this.#activeTurn` themselves:
-	* dispatch is synchronous, so the read is the same one the old switch made. */
 	#notifications = {
 		"thread/started": (params) => {
 			const thread = params?.thread;
@@ -6068,26 +4672,17 @@ var CodexRunner = class {
 				return;
 			}
 		},
-		"error": (params) => {
+		error: (params) => {
 			const active = this.#activeTurn;
 			const error = params?.error;
 			if (active && typeof error?.message === "string") active.lastError = error.message;
 		}
 	};
-	/** Answer a server→client request: the ask channels become pending
-	* permission requests; anything else gets a JSON-RPC -32601 rather than a
-	* hang (an unanswered server request wedges the turn). */
 	async #answerServerRequest(method, params, wireId) {
 		const channel = APPROVAL_CHANNELS[method];
 		if (channel) return this.#requestApproval(channel, method, params, wireId);
 		throw new JsonRpcError(-32601, `workerdeck does not handle server request '${method}'`);
 	}
-	/**
-	* Surface one ask-channel request as a pending {@link PermissionRequest};
-	* the returned promise is the JSON-RPC response, resolved when a
-	* `permission_decision` lands — or by the timeout, an interrupt, turn end,
-	* session close, or codex resolving it itself. Never left hanging.
-	*/
 	#requestApproval(channel, method, params, wireId) {
 		if (method === "item/tool/requestUserInput") {
 			const behavior = this.#config.questionBehavior ?? "ask";
@@ -6126,9 +4721,6 @@ var CodexRunner = class {
 			if (this.#activeTurn) this.#setStatus("awaiting_approval");
 		});
 	}
-	/** 'auto'/'deny' sessions settle codex questions synchronously instead of
-	* pending. Request/resolved events still fire so transcripts and job
-	* webhooks show what was chosen. */
 	#resolveQuestionByPolicy(channel, params, mode) {
 		const itemId = channel.itemId(params);
 		const request = {
@@ -6163,13 +4755,6 @@ var CodexRunner = class {
 		});
 		return { answers };
 	}
-	/**
-	* Settle one pending approval: pick the channel's wire response for the
-	* decision, answer the JSON-RPC request, and emit `permission_resolved`.
-	* An allow the request offered no plain accept for becomes the channel's
-	* denial, said out loud — never a silently widened grant, and never a
-	* decision the request didn't offer.
-	*/
 	#settleApproval(id, pending, decision, resolvedBy) {
 		clearTimeout(pending.timer);
 		this.#approvals.delete(id);
@@ -6197,9 +4782,6 @@ var CodexRunner = class {
 		if (behavior === "deny" && decision.behavior === "deny" && decision.interrupt && sent.decision !== "cancel") this.#interruptTurn();
 		if (!this.#closed && this.#approvals.size === 0 && this.#status === "awaiting_approval") this.#setStatus("running");
 	}
-	/** Tool calls surface as tool_use when they start; text and reasoning stream
-	* natively via the delta notifications. `agent` is the sub-agent whose thread
-	* the item arrived on — undefined for the session's own. */
 	#handleItemProgress(item, active, agent) {
 		const id = `${active.nonce}:${item.id}`;
 		if (item.type === "subAgentActivity") {
@@ -6243,14 +4825,6 @@ var CodexRunner = class {
 			}
 		});
 	}
-	/**
-	* The completed-item mapping, one handler per member of the {@link AppServerItem}
-	* union. The mapped type is the invariant made checkable: model a new item
-	* type in `types.ts` and this table fails to compile until it says what the
-	* item becomes on the wire — the old switch silently fell through to the
-	* unknown-item passthrough instead. (The runtime still receives types the
-	* union has never heard of; those take the passthrough above.)
-	*/
 	#itemCompleted = {
 		userMessage: (item, active, _id, agent) => {
 			if (!agent) return;
@@ -6390,10 +4964,6 @@ var CodexRunner = class {
 			uuid
 		});
 	}
-	/** `agent` (rather than a bare parent id) because a nested call is also the
-	* agent's progress reading: `SubagentInfo.toolCount` ticks here, once per
-	* card — the `counted` set is what keeps an upserted re-emission (the
-	* finished imageGeneration input) from counting one picture twice. */
 	#emitToolUse(id, name, input, agent) {
 		if (agent && !agent.counted.has(id)) {
 			agent.counted.add(id);
@@ -6433,14 +5003,6 @@ var CodexRunner = class {
 			uuid: `${toolUseId}-result`
 		});
 	}
-	/**
-	* Per-turn usage re-mapped to the Anthropic accounting convention the whole
-	* stack assumes (GOTCHAS §Codex engine): OpenAI's `inputTokens` includes the
-	* cached share, so input excludes it (else queue token budgets double-count
-	* cache-heavy runs); reasoning tokens are billed output; `totalCostUsd: 0` =
-	* unknown, the AiSdkRunner precedent. Usage is summed from the turn's
-	* `thread/tokenUsage/updated` notifications — `turn/completed` carries none.
-	*/
 	#finishTurn(kind, startedAt, active, errors) {
 		for (const [id, pending] of this.#approvals) this.#settleApproval(id, pending, {
 			behavior: "deny",
@@ -6468,23 +5030,6 @@ var CodexRunner = class {
 		this.#emitContextUsage(active);
 		this.#setStatus("idle");
 	}
-	/**
-	* Subscription windows, mapped onto the protocol's named vocabulary.
-	*
-	* The shapes disagree: codex reports windows *positionally* (`primary` /
-	* `secondary`) with a length in minutes, while `RateLimitInfo.rateLimitType`
-	* is a name whose meaning clients already know — iOS labels `seven_day` as
-	* "Weekly" and derives the pace marker's denominator from it. Naming the
-	* window by its measured duration is therefore the honest mapping rather
-	* than a borrowed one: codex's primary window is 10080 minutes, which *is*
-	* seven days. A duration we have no name for keeps an explicit
-	* `window_<n>m` key — clients render it verbatim and simply draw no pace
-	* marker, which beats mislabeling it as a week.
-	*
-	* `status` is 'allowed' by construction (the session is running), matching
-	* `rateLimitEventsFromUsage`; codex's `rateLimitReachedType` is the one
-	* signal that a limit is actually biting, so it becomes 'rejected'.
-	*/
 	#emitRateLimits(limits) {
 		if (!limits) return;
 		const status = limits.rateLimitReachedType ? "rejected" : "allowed";
@@ -6508,16 +5053,6 @@ var CodexRunner = class {
 			});
 		}
 	}
-	/**
-	* Context occupancy, after the turn — the same cadence the Claude runner
-	* polls `getContextUsage()` on, so clients need nothing new.
-	*
-	* Emitted only when the binary gave BOTH numbers: the protocol is explicit
-	* that a client renders nothing rather than a 0% ring, and a window of
-	* `null` (which app-server does send) would otherwise divide into a
-	* meaningless percentage. `categories` is empty because codex publishes no
-	* breakdown — clients must not render an empty "Breakdown" section for it.
-	*/
 	#emitContextUsage(active) {
 		const totalTokens = active.contextTokens;
 		const maxTokens = active.contextWindow;
@@ -6534,9 +5069,10 @@ var CodexRunner = class {
 		});
 	}
 	#setStatus(status, detail) {
-		if (this.#status === status) return;
+		if (this.#status === status && this.#statusDetail === detail) return;
 		if (this.#status === "closed" || this.#status === "failed") return;
 		this.#status = status;
+		this.#statusDetail = detail;
 		this.#emit({
 			type: "status_changed",
 			status,
@@ -6548,32 +5084,26 @@ var CodexRunner = class {
 			...body,
 			replay: true
 		};
-		const event = {
-			...body,
-			seq: ++this.#seq,
-			ts: Date.now()
-		};
-		this.#lastActivityAt = event.ts;
-		this.#activityCount += transcriptActivity(body);
-		this.#contextUsage = contextReading(body) ?? this.#contextUsage;
-		if (body.type === "conversation_reset") {
-			this.#resetSeq = event.seq;
-			this.#contextUsage = void 0;
-		}
-		this.#events.push(event);
-		this.#subscribers.emit(event);
+		this.#subscribers.emit(this.#log.append(body));
 	}
 };
 //#endregion
 //#region src/engines/codex/catalog.ts
 /**
-* The Codex engine's model catalog, seeded from the binary's own embedded
-* presets — `@openai/codex@0.146.0` ships its model table inside the
-* executable, and that table (not the SDK's stale `ModelReasoningEffort`
-* union) is the truth about which reasoning efforts each model takes.
+* The Codex engine's model catalog, seeded from the binary's own embedded model
+* table (see `provenance` for the version) — that table, not the SDK's stale
+* `ModelReasoningEffort` union, is the truth about which reasoning efforts each
+* model takes. Mapping decisions: the internal `codex-auto-review` row is dropped
+* (the codex analogue of the CLI's `default` sentinel), `primary` mirrors the
+* binary's own `visibility` field so both UIs group the way codex's picker does,
+* and `reasoningEfforts` carries `supported_reasoning_levels` verbatim — `max`
+* and `ultra` go beyond the SDK union, so trust the binary and keep strings open.
 *
-* **Refresh procedure** (release checklist): extract the embedded JSON from
-* the platform binary and diff —
+* **Refresh procedure** (release checklist): extract the embedded JSON from the
+* platform binary and diff. The two-hop resolve is NOT optional — under pnpm's
+* strict layout the platform package is a dependency of `@openai/codex` and
+* resolves only from that wrapper's location (MODULE_NOT_FOUND otherwise), the
+* same two hops `resolveBundledCodexExecutable` makes.
 *
 *   node -e 'const d=require("fs").readFileSync(process.argv[1]);
 *     const s=d.indexOf(`{\n  "models": [`);
@@ -6585,20 +5115,6 @@ var CodexRunner = class {
 *       const w=require.resolve("@openai/codex/package.json");
 *       createRequire(w).resolve("@openai/codex-darwin-arm64/package.json")
 *         .replace("package.json","vendor/aarch64-apple-darwin/bin/codex")')"
-*
-* The two-hop resolve is NOT optional: under pnpm's strict layout the platform
-* package is a dependency of `@openai/codex`, so it resolves only from that
-* wrapper's location, never from the repo root. Resolving it directly throws
-* MODULE_NOT_FOUND — the same two hops `resolveBundledCodexExecutable` makes.
-*
-* Mapping decisions:
-* - the internal `codex-auto-review` row is dropped (the codex analogue of
-*   dropping the CLI's `default` sentinel);
-* - `primary` mirrors the binary's own `visibility` field ('list' = shown in
-*   its picker, 'hide' = its "older models"), so both UIs group the way
-*   codex's own picker does;
-* - `reasoningEfforts` carries `supported_reasoning_levels` verbatim — note
-*   `max`/`ultra` beyond the SDK union; trust the binary, keep strings open.
 */
 const CODEX_CATALOG = {
 	provenance: "embedded model presets of @openai/codex@0.149.0 (darwin-arm64 binary), extracted 2026-08-22",
@@ -6701,19 +5217,7 @@ const CODEX_CATALOG = {
 };
 //#endregion
 //#region src/engines/codex/process.ts
-/** How much stderr to keep for the exit diagnostic. The binary logs startup
-* noise there; only the tail explains a death. */
 const STDERR_TAIL_BYTES = 4096;
-/**
-* Spawn one `codex app-server` child and frame JSON-RPC over its stdio — the
-* real {@link AppServerConnectFn}. The child's env is passed **complete**
-* (a provided spawn env replaces process.env, never merges with it), with the
-* profile's CODEX_HOME pin already applied by the runner.
-*
-* No spawn cwd: the working directory is a thread/turn parameter, and a cwd
-* that doesn't exist should fail the *turn* with codex's own error, not the
-* spawn.
-*/
 function connectAppServer(options) {
 	const child = spawn(options.executable, ["app-server"], {
 		env: options.env,
@@ -6762,17 +5266,9 @@ function connectAppServer(options) {
 //#endregion
 //#region src/engines/codex/adapter.ts
 const NOT_INSTALLED = "@openai/codex is not installed — add it (an optional peer of @workerdeck/core) to run codex profiles";
-/**
-* The codex binary sessions will run: the per-platform package installed next
-* to `@openai/codex`, `vendor/<target-triple>/bin/codex` — the same file the
-* npm wrapper's own `bin/codex.js` launcher execs. Probing this binary rather
-* than whatever `codex` is on PATH means the availability answer is about the
-* executable sessions will actually run. Undefined when it can't be found;
-* callers degrade to 'unknown'.
-*/
 function resolveBundledCodexExecutable() {
 	const triple = targetTriple();
-	if (!triple) return void 0;
+	if (!triple) return;
 	try {
 		const path = createRequire(createRequire(import.meta.url).resolve("@openai/codex/package.json")).resolve(`@openai/codex-${platformPackageSuffix()}/package.json`).replace(/package\.json$/, `vendor/${triple}/bin/codex`);
 		if (existsSync(path)) return path;
@@ -6787,34 +5283,13 @@ function targetTriple() {
 function platformPackageSuffix() {
 	return `${process.platform}-${process.arch}`;
 }
-/**
-* Availability, mirroring **the app-server surface's actual credential chain**
-* (verified 2026-08-05 against 0.146.0 by driving the raw binary): auth comes
-* solely from the CODEX_HOME auth store (`codex login`, file or keyring). The
-* env-key routes are dead ends here — `CODEX_API_KEY` is read only by
-* `codex exec` (a turn goes out with no credential at all: "Missing bearer"),
-* and `OPENAI_API_KEY` was never read by either surface. So, in order:
-*
-* 1. Binary resolvable, else unavailable with the install reason;
-* 2. `codex login status` under the profile's complete session env:
-*    exit 0 → available; the "Not logged in" verdict → unavailable, with an
-*    exact remedy when a stranded env key explains the misconfiguration;
-*    anything else (a stray CODEX_ACCESS_TOKEN JWT error, a crashed spawn) →
-*    'unknown' — the checkClaudeAuth never-overclaim discipline.
-*
-* Only the exit code and the fixed verdict line are consulted — never
-* surfaced: `login status` output includes a masked key fragment. The
-* `smoke:codex --canary` run is the drift alarm for all of this.
-*/
 async function checkCodexAvailability(profile, env, options = {}) {
 	const executable = resolveBundledCodexExecutable();
 	if (!executable) return {
 		available: false,
 		reason: NOT_INSTALLED
 	};
-	const childEnv = {};
-	for (const [key, value] of Object.entries(env)) if (value !== void 0) childEnv[key] = value;
-	if (profile.codexHome) childEnv.CODEX_HOME = profile.codexHome;
+	const childEnv = codexChildEnv(env, profile.codexHome);
 	return new Promise((resolve) => {
 		execFile(executable, ["login", "status"], {
 			env: childEnv,
@@ -6836,13 +5311,8 @@ async function checkCodexAvailability(profile, env, options = {}) {
 		});
 	});
 }
-/** `thread/list` page size (its own default is 25) and a hard page bound so a
-* misbehaving cursor can never spin the listing forever. */
 const LIST_PAGE_SIZE = 100;
 const MAX_LIST_PAGES = 40;
-/** thread/list's `cwd` filter is an EXACT path match (measured, 0.146.0), so
-* offer both the spelled and canonical forms — macOS listings would otherwise
-* miss `/tmp/...` threads recorded under `/private/tmp/...`. */
 function cwdFilter(dir) {
 	const forms = new Set([dir]);
 	try {
@@ -6850,10 +5320,9 @@ function cwdFilter(dir) {
 	} catch {}
 	return [...forms];
 }
-const secondsToMs = (value) => typeof value === "number" && Number.isFinite(value) ? value * 1e3 : void 0;
-/** One thread row in the protocol's browser-safe summary shape. `id` is what
-* `CreateSessionRequest.resume` feeds `thread/resume` — the row's separate
-* `sessionId` field is not it. */
+function secondsToMs(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value * 1e3 : void 0;
+}
 function summarizeThread(row) {
 	const name = typeof row.name === "string" && row.name.length > 0 ? row.name : void 0;
 	const preview = typeof row.preview === "string" && row.preview.length > 0 ? row.preview : void 0;
@@ -6868,30 +5337,12 @@ function summarizeThread(row) {
 		cwd: typeof row.cwd === "string" ? row.cwd : void 0
 	};
 }
-/**
-* CODEX_HOME's threads over ONE short-lived `codex app-server` child: the
-* runner's own handshake (`experimentalApi` and all — one code path, no
-* second vocabulary to drift), `thread/list` pages walked by cursor, child
-* closed before returning. Requires no live session and costs no tokens —
-* it is how "resume" is offered before anything is running. The `connectFn`
-* seam exists for the scripted-peer tests; the adapter passes the real
-* spawn.
-*/
 async function listCodexSessions(options) {
-	const childEnv = {};
-	for (const [key, value] of Object.entries(options.env)) if (value !== void 0) childEnv[key] = value;
-	if (options.profile?.codexHome) childEnv.CODEX_HOME = options.profile.codexHome;
+	const childEnv = codexChildEnv(options.env, options.profile?.codexHome);
 	const connection = options.connectFn({ env: childEnv });
 	const rows = [];
 	try {
-		await connection.request("initialize", {
-			clientInfo: {
-				name: "workerdeck",
-				title: "WorkerDeck",
-				version: `protocol-${PROTOCOL_VERSION}`
-			},
-			capabilities: { experimentalApi: true }
-		});
+		await connection.request("initialize", INITIALIZE_PARAMS);
 		connection.notify("initialized");
 		const base = {
 			limit: LIST_PAGE_SIZE,
@@ -6918,15 +5369,6 @@ async function listCodexSessions(options) {
 	const start = options.offset ?? 0;
 	return options.limit === void 0 ? summaries.slice(start) : summaries.slice(start, start + options.limit);
 }
-/**
-* OpenAI Codex as an engine: the codex CLI binary driven over its `app-server`
-* JSON-RPC surface — structurally the Claude engine's sibling (a local agent
-* binary with sessions, sandboxing and resume, resolving its own credentials
-* from the operator's environment). `@openai/codex` — the npm package that
-* carries the binary — is an **optional peer**: absent, every codex profile
-* reports unavailable and createRunner throws the same message, and no
-* consumer downloads a ~40 MB per-platform binary it never uses.
-*/
 const codexAdapter = {
 	engine: "codex",
 	capabilities: ENGINE_CAPABILITIES.codex,
@@ -6959,17 +5401,6 @@ const codexAdapter = {
 };
 //#endregion
 //#region src/engines/provider/adapter.ts
-/**
-* The model-agnostic provider engine as a pseudo-adapter: capabilities and an
-* env-var probe live here, but its runners are assembled by the host's
-* `createEngineRunner` hook (which is where provider credentials are resolved
-* and model SDKs are imported — neither belongs in this repo's import graph).
-* The server routes provider creates to the hook; `createRunner` here throws
-* so a mis-routed call fails loudly instead of quietly building nothing.
-*
-* The catalog is empty by the same token: provider model ids are operator-
-* declared per profile (`provider.models`), not shipped with releases.
-*/
 const providerAdapter = {
 	engine: "provider",
 	capabilities: ENGINE_CAPABILITIES.provider,
@@ -6998,7 +5429,6 @@ const ADAPTERS = {
 	codex: codexAdapter,
 	provider: providerAdapter
 };
-/** The in-repo adapter for an engine. An absent `engine` means 'claude'. */
 function getEngineAdapter(engine) {
 	return ADAPTERS[engine ?? "claude"];
 }