@workerdeck/core 2.7.2 → 2.9.0

package/README.md

@@ -7,8 +7,8 @@ attach/replay; `AiSdkRunner` does the same for any provider the AI SDK supports.
 transport.
 
 Part of [WorkerDeck](https://github.com/workerdeck/workerdeck). A `SessionRunner`
-behaves like Claude Code launched in the session's directory — same skills, same `CLAUDE.md`, same
-permission system — and both runners emit
+behaves like Claude Code launched in the session's directory - same skills, same `CLAUDE.md`, same
+permission system - and both runners emit
 [`@workerdeck/protocol`](https://www.npmjs.com/package/@workerdeck/protocol) events.
 [`@workerdeck/server`](https://www.npmjs.com/package/@workerdeck/server) bridges runners to
 HTTP + WebSocket; use core directly when you want sessions in-process with no server.
@@ -24,8 +24,8 @@ Node ≥ 22 and a real filesystem. WorkerDeck implements no Anthropic auth: the
 credentials from the operator's environment (`ANTHROPIC_API_KEY`, Bedrock/Vertex, or a personal
 `claude login`).
 
-The provider engine additionally wants `ai` (AI SDK v7), your provider package, and — for
-`eval_script` — [`@workerdeck/sandbox`](https://www.npmjs.com/package/@workerdeck/sandbox);
+The provider engine additionally wants `ai` (AI SDK v7), your provider package, and - for
+`eval_script` - [`@workerdeck/sandbox`](https://www.npmjs.com/package/@workerdeck/sandbox);
 all optional, and unused if you only run Claude sessions.
 
 ## Usage
@@ -63,28 +63,28 @@ await done
 Other controls: `interrupt()`, `setPermissionMode(mode)`, `setModel(model?)`, `close(reason?)`,
 `fail(message)` for host-enforced policy, and `info()` for a protocol `SessionInfo` snapshot
 (status, cost, pending approval count, title). `runner.id` is the server-side id;
-`runner.sdkSessionId` is the Agent SDK's — the one you pass back as `resume`.
+`runner.sdkSessionId` is the Agent SDK's - the one you pass back as `resume`.
 
 ## Approvals, event log, resume
 
-- **Pending approvals** — the runner's `canUseTool` hook turns each uncovered tool call into a
+- **Pending approvals** - the runner's `canUseTool` hook turns each uncovered tool call into a
   `permission_requested` event and a `PendingApproval` that blocks the tool until
   `resolvePermission()` (or the timeout) settles it. Allowing echoes the tool input back as
-  `updatedInput` — the SDK requires a record even for an unmodified allow. `AskUserQuestion`
+  `updatedInput` - the SDK requires a record even for an unmodified allow. `AskUserQuestion`
   rides the same path; `questionBehavior: 'auto' | 'deny'` policy-resolves it for unattended runs.
-- **Event log** — every event gets a monotonic `seq`; `subscribe(listener, afterSeq)` replays the
+- **Event log** - every event gets a monotonic `seq`; `subscribe(listener, afterSeq)` replays the
   buffer past `afterSeq` before delivering live events, so late attachers always catch up.
-- **Resume** — pass `resume: sdkSessionId` (optionally `forkSession`). The SDK only re-streams
+- **Resume** - pass `resume: sdkSessionId` (optionally `forkSession`). The SDK only re-streams
   user messages, so the runner backfills the full prior transcript from the SDK's on-disk store
   as `replay: true` events before the query starts (`backfillHistory: false` to skip).
-- **Capabilities + usage** — after init (and eagerly for promptless sessions) the runner fetches
+- **Capabilities + usage** - after init (and eagerly for promptless sessions) the runner fetches
   supported models/slash commands and a context-window snapshot, emitting `capabilities` and
   `context_usage` events; context usage is re-polled after every turn.
 
 ## The second engine
 
 `AiSdkRunner` runs the same protocol against any provider the [AI SDK](https://ai-sdk.dev)
-supports — no CLI process, no config directory. `createEngineSession()` assembles one: the model,
+supports - no CLI process, no config directory. `createEngineSession()` assembles one: the model,
 the capability-scoped tool set, and the executor that runs tool calls.
 
 ```ts
@@ -93,7 +93,7 @@ import { loadEngine } from '@workerdeck/sandbox'
 import { createEngineSession, QuickJsExecutor } from '@workerdeck/core'
 
 // Server-side, the WASM guest is loaded once for the process and shared by every
-// session. The variant package is a peer dependency you install yourself — core
+// session. The variant package is a peer dependency you install yourself - core
 // does not pick one for you, because the browser build and the server build are
 // different artifacts and only you know which side this is.
 const executor = new QuickJsExecutor({ engine: await loadEngine(variant), defaultTimeoutMs: 15_000 })
@@ -118,7 +118,7 @@ Three seams matter here:
   with this process's authority and must declare `execute`; `sandboxed` means it rides the executor
   seam and must *not*. Both contradictions are refused at assembly rather than at runtime, because
   a sandboxed tool that quietly ran in-process would defeat the only thing sandboxing it was for.
-- **`ToolExecutor` decides where code runs**, and that is a real architectural choice — see below.
+- **`ToolExecutor` decides where code runs**, and that is a real architectural choice - see below.
 
 ### Which executor?
 
@@ -127,14 +127,14 @@ Three seams matter here:
 | Runs where | this Node process, WASM guest | the attached client | wherever you send it |
 | Needs a client attached | no | **yes** | no |
 | Data locality | data must reach the server | client-held data never leaves the tab | n/a |
-| Trust | you own both sides | results are **untrusted input** — the sandboxed party answers | depends |
+| Trust | you own both sides | results are **untrusted input** - the sandboxed party answers | depends |
 | Latency | in-process | a WS round trip | unbounded (the session parks) |
 
 The question to ask is **where the data the loop reasons over already lives**:
 
 - In your database or on your disk → in-process. Pushing execution into the tab buys nothing and
   hands an executor to the party you are sandboxing against.
-- In the user's browser — a document they are editing, a file they dropped, something you would
+- In the user's browser - a document they are editing, a file they dropped, something you would
   rather not receive at all → the bridge. This is the case it exists for.
 - Somewhere that answers in minutes or hours (a queue, a human, a build) → deferred, and let the
   session park.
@@ -151,7 +151,7 @@ session mix all three.
 
 `DeferredExecutor` dispatches a call and doesn't wait. The runner then **parks**: `park()` returns
 a `RunnerSnapshot`, the process can tear the runner down, and passing that snapshot back as
-`restore` rebuilds the session as itself — same id, same event log, same seq numbering, mid-turn,
+`restore` rebuilds the session as itself - same id, same event log, same seq numbering, mid-turn,
 scratch filesystem included.
 
 ```ts
@@ -162,12 +162,12 @@ selectExecutor: () => new DeferredExecutor({
 ```
 
 [`@workerdeck/server`](https://www.npmjs.com/package/@workerdeck/server) drives both halves
-for you — a `SessionStore` plus `POST /executions/:id/result` — but the mechanism is here, and works
+for you - a `SessionStore` plus `POST /executions/:id/result` - but the mechanism is here, and works
 with no server at all.
 
 `snapshot()` is the same value **without** the teardown: the runner stays live, attached and warm.
 That separation is what makes a provider session survive a process restart, since it has no
-engine-side store to resume from the way claude and codex do — the host writes the snapshot through
+engine-side store to resume from the way claude and codex do - the host writes the snapshot through
 after each turn and rebuilds from the last one. The gate differs from `park()`'s in one direction
 only: it refuses a turn in flight and pending *in-process* executions (whose results die with the
 process), and allows the idle case `park()` exists to refuse.
@@ -182,18 +182,18 @@ Things the compiler will not tell you, each of which has cost someone real time:
   the temptation to truncate into a snapshot: it would break the fetch for exactly the sessions
   most likely to be read late.
 
-- **Image refs happen there too — and on the live path as well.** `subscribe(..., { imageRefs })`
+- **Image refs happen there too - and on the live path as well.** `subscribe(..., { imageRefs })`
   replaces a `tool_result`'s base64 `image` parts with `image_ref` addresses, and unlike truncation
   it applies to live events as well as the replay, because a client's one render path is
   ref-then-fetch. The same "never at emit" rule holds for the same reason: `#events` keeps every
   byte, which is what the fetch route serves back. `SubscriberSet` (`src/lib/subscribers.ts`) is
-  where that per-subscriber decision lives — a subscriber is a listener *plus what it asked for*,
+  where that per-subscriber decision lives - a subscriber is a listener *plus what it asked for*,
   so the three runners no longer each own a copy of the answer. Consumers that subscribe with no
-  options — parking, notifications, the queue — see everything, as they do for every rule here.
+  options - parking, notifications, the queue - see everything, as they do for every rule here.
 
 - **A declared MCP server that never connected is refused, not degraded.** If a profile's
   `session.mcpServers` names a server and it isn't there, `createEngineSession` throws. The old
-  behaviour — start anyway, minus those tools — produced a session that reported perfectly healthy
+  behaviour - start anyway, minus those tools - produced a session that reported perfectly healthy
   while the agent apologised its way through every request that needed it. Pass
   `connectMcpTools(servers, { required: true })` to fail at connect time instead, and hand the
   resulting connection over as `mcp` (not just `mcp.tools`) so the check is exact.
@@ -201,7 +201,7 @@ Things the compiler will not tell you, each of which has cost someone real time:
   `GET` before it sends anything. Mounted under a framework's default 404, the whole connect fails
   with an error that names neither the method nor the route.
 - **Never seed the VFS by hand on a restore.** Use `seedVfs`, which is ignored when
-  `config.restore` is set. Building `config.vfs` yourself still works and still wins — and then
+  `config.restore` is set. Building `config.vfs` yourself still works and still wins - and then
   overwriting the files the parked turn wrote is yours to avoid.
 - **Forward the host's `id`.** `createEngineSession({ id })` is how a session comes back as
   *itself* across a gateway restart. Dropping it strands every client's route and unread mark, and
@@ -209,11 +209,11 @@ Things the compiler will not tell you, each of which has cost someone real time:
 - **`onClose` runs on park as well as close.** Parking releases the same resources; a disposer that
   assumes the session is over will close an MCP connection the woken session still needs to rebuild.
 - **Authoritative tools are never bridged.** `withMcpTools` marks everything authoritative by
-  construction. If you want a host tool the tab may run, declare it `sandboxed` in `tools` — and
+  construction. If you want a host tool the tab may run, declare it `sandboxed` in `tools` - and
   then treat its results as untrusted input, because the tab produced them.
 - **Never make a tool's operation depend on a field being absent.** "Create when `id` is missing,
-  overwrite when it is present" is the shape that breaks: models send `""` — and, observed live,
-  `" "` — rather than omitting, and some providers mark every property required so the model
+  overwrite when it is present" is the shape that breaks: models send `""` - and, observed live,
+  `" "` - rather than omitting, and some providers mark every property required so the model
   *cannot* omit. `z.string().min(1).optional()` does not save it (a space has length 1). Split it
   into two tools with required arguments, and trim-and-blank-check optional strings inside `run`.
 
@@ -222,9 +222,9 @@ Things the compiler will not tell you, each of which has cost someone real time:
 `InputQueue` (the push-based `AsyncIterable` bridging `sendMessage()` into the SDK's streaming
 prompt), `normalizeSdkMessage`/`toApiMessage` (SDKMessage → protocol event normalization),
 `connectMcpTools` for live MCP over http/sse, and `createWebFetch` with its SSRF guard
-(`isPrivateAddress`). Tests inject a fake `queryFn` — no real CLI spawn needed.
+(`isPrivateAddress`). Tests inject a fake `queryFn` - no real CLI spawn needed.
 
 ## License
 
-MIT © Tobias Strebitzer —
+MIT © Tobias Strebitzer -
 [LICENSE](https://github.com/workerdeck/workerdeck/blob/master/LICENSE)

package/build/index.d.mts

@@ -104,6 +104,7 @@ interface Runner {
   eventAt?(seq: number): SessionEvent | undefined;
   sendMessage(text: string, attachments?: readonly AttachmentInput[]): void;
   queueLocalCommand?(result: LocalCommandResult): void;
+  refreshUsage?(): Promise<void>;
   mcpServers?(): Promise<McpServerStatusInfo[] | undefined>;
   reconnectMcpServer?(name: string): Promise<void>;
   setMcpServerEnabled?(name: string, enabled: boolean): Promise<void>;
@@ -176,6 +177,7 @@ declare class SessionRunner implements Runner {
   close(reason?: 'client' | 'server' | 'error'): void;
   eventAt(seq: number): SessionEvent | undefined;
   subscribe(listener: SessionEventListener, afterSeq?: number, options?: SubscribeOptions): () => void;
+  refreshUsage(minIntervalMs?: number): Promise<void>;
 }
 //#endregion
 //#region src/lib/replay.d.ts

package/build/index.mjs

@@ -904,6 +904,7 @@ function toolUseBlocks(content) {
 }
 //#endregion
 //#region src/engines/claude/runner.ts
+const USAGE_REFRESH_MIN_MS = 6e4;
 var SessionRunner = class {
 	id;
 	createdAt;
@@ -929,8 +930,11 @@ var SessionRunner = class {
 	#idleWhileCompacting = false;
 	#query;
 	#capabilitiesEmitted = false;
+	#models;
+	#defaultModel;
 	#subscriptionType;
 	#engineTitle;
+	#lastRateLimitPoll = 0;
 	#started = false;
 	#closed = false;
 	#runPromise;
@@ -1254,6 +1258,10 @@ var SessionRunner = class {
 			else if (msg.state === "running") this.#setStatus("running");
 			return;
 		}
+		if (msg.type === "system" && msg.subtype === "commands_changed") {
+			if (this.#capabilitiesEmitted && !this.#closed) this.#emitCapabilities(msg.commands);
+			return;
+		}
 		if (msg.type === "system" && msg.subtype === "status") this.#handleCompactionStatus(msg);
 		if (msg.type === "system" && msg.subtype === "compact_boundary") {
 			const meta = msg.compact_metadata;
@@ -1330,19 +1338,24 @@ var SessionRunner = class {
 			const [models, commands] = await Promise.all([query.supportedModels(), query.supportedCommands()]);
 			if (this.#closed || this.#capabilitiesEmitted) return;
 			this.#capabilitiesEmitted = true;
-			this.#emit({
-				type: "capabilities",
-				models: modelOptionsFromSdk(models),
-				defaultModel: defaultModelFromSdk(models),
-				commands: commands.map((c) => ({
-					name: c.name,
-					description: c.description,
-					argumentHint: c.argumentHint,
-					aliases: c.aliases
-				}))
-			});
+			this.#models = modelOptionsFromSdk(models);
+			this.#defaultModel = defaultModelFromSdk(models);
+			this.#emitCapabilities(commands);
 		} catch {}
 	}
+	#emitCapabilities(commands) {
+		this.#emit({
+			type: "capabilities",
+			models: this.#models ?? [],
+			defaultModel: this.#defaultModel,
+			commands: commands.map((c) => ({
+				name: c.name,
+				description: c.description,
+				argumentHint: c.argumentHint,
+				aliases: c.aliases
+			}))
+		});
+	}
 	async #fetchEngineTitle() {
 		if (hostTitle(this.#config.meta)) return;
 		const sdkSessionId = this.#sdkSessionId;
@@ -1378,7 +1391,12 @@ var SessionRunner = class {
 			});
 		} catch {}
 	}
+	async refreshUsage(minIntervalMs = USAGE_REFRESH_MIN_MS) {
+		if (Date.now() - this.#lastRateLimitPoll < minIntervalMs) return;
+		await this.#fetchRateLimits();
+	}
 	async #fetchRateLimits() {
+		this.#lastRateLimitPoll = Date.now();
 		const query = this.#query;
 		const fetchUsage = query?.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET;
 		if (typeof fetchUsage !== "function") return;
@@ -1449,7 +1467,7 @@ var SessionRunner = class {
 			request
 		});
 		if (mode === "deny") {
-			const message = "Interactive questions are disabled for this session — choose the most reasonable option yourself and continue.";
+			const message = "Interactive questions are disabled for this session - choose the most reasonable option yourself and continue.";
 			this.#emit({
 				type: "permission_resolved",
 				requestId: request.id,
@@ -2924,8 +2942,8 @@ function withHostTools(context, hostTools, kind = "host tool") {
 	for (const [name, { tool: hostTool, trust, title }] of entries) {
 		if (name in tools) throw new Error(`${kind} '${name}' collides with an existing tool of the same name`);
 		const executes = typeof hostTool.execute === "function";
-		if (trust === "sandboxed" && executes) throw new Error(`${kind} '${name}' is declared sandboxed but has an \`execute\` — it would run in this process with full authority. Drop \`execute\` so it rides the ToolExecutor seam.`);
-		if (trust === "authoritative" && !executes) throw new Error(`${kind} '${name}' is declared authoritative but has no \`execute\` — nothing would ever answer its calls and the turn would stall.`);
+		if (trust === "sandboxed" && executes) throw new Error(`${kind} '${name}' is declared sandboxed but has an \`execute\` - it would run in this process with full authority. Drop \`execute\` so it rides the ToolExecutor seam.`);
+		if (trust === "authoritative" && !executes) throw new Error(`${kind} '${name}' is declared authoritative but has no \`execute\` - nothing would ever answer its calls and the turn would stall.`);
 		definitions.push({
 			name,
 			trust,
@@ -3429,7 +3447,7 @@ const claudeAdapter = {
 		if (status === "logged_in") return { available: true };
 		if (status === "logged_out") return {
 			available: false,
-			reason: `no usable Claude credentials for this profile's environment — log in under its config dir (CLAUDE_CONFIG_DIR=${profile.configDir ?? "~/.claude"} claude auth login) or set ANTHROPIC_API_KEY`
+			reason: `no usable Claude credentials for this profile's environment - log in under its config dir (CLAUDE_CONFIG_DIR=${profile.configDir ?? "~/.claude"} claude auth login) or set ANTHROPIC_API_KEY`
 		};
 		return { available: "unknown" };
 	},
@@ -3898,7 +3916,7 @@ function untrustedProjectNotice(options) {
 	if (ignored.length === 0) return;
 	const trustDir = gitRoot ?? cwd;
 	const configs = ignored.map((layer) => join(layer, ".codex", "config.toml"));
-	return `codex does not trust this directory, so ${configs.length === 1 ? `its project config (${configs[0]}) is` : `its project configs (${configs.join(", ")}) are`} being ignored — MCP servers and settings declared there will be missing from this session. To trust it, run codex once in ${trustDir} and accept the trust prompt, or add [projects."${trustDir}"] with trust_level = "trusted" to ${homeConfigPath}.`;
+	return `codex does not trust this directory, so ${configs.length === 1 ? `its project config (${configs[0]}) is` : `its project configs (${configs.join(", ")}) are`} being ignored - MCP servers and settings declared there will be missing from this session. To trust it, run codex once in ${trustDir} and accept the trust prompt, or add [projects."${trustDir}"] with trust_level = "trusted" to ${homeConfigPath}.`;
 }
 //#endregion
 //#region src/engines/codex/runner.ts
@@ -4193,6 +4211,10 @@ const APPROVAL_CHANNELS = {
 		deny: (_raw, interrupt) => ({ response: { action: interrupt ? "cancel" : "decline" } })
 	}
 };
+function steerUnsupported(error) {
+	if (!(error instanceof JsonRpcError)) return false;
+	return error.code === -32601 || error.code === -32600 && error.message.includes("unknown variant `turn/steer`");
+}
 function rateLimitWindowName(minutes) {
 	if (typeof minutes !== "number" || !Number.isFinite(minutes) || minutes <= 0) return;
 	if (minutes === 300) return "five_hour";
@@ -4237,6 +4259,8 @@ var CodexRunner = class {
 	#mcpStatus = /* @__PURE__ */ new Map();
 	#agents = new CodexAgentTracker();
 	#clearedThreads = /* @__PURE__ */ new Set();
+	#cannotSteer = /* @__PURE__ */ new WeakSet();
+	#clearsPending = 0;
 	constructor(config, id = randomUUID()) {
 		const mode = config.permissionMode ?? "default";
 		if (!ENGINE_CAPABILITIES.codex.permissionModes.includes(mode)) throw new Error(`permission mode '${mode}' is not supported by the codex engine`);
@@ -4372,9 +4396,52 @@ var CodexRunner = class {
 		});
 		if (this.#backfillPending) this.#turnChain = this.#turnChain.then(echo);
 		else echo();
+		this.#dispatch(input);
+	}
+	#dispatch(input) {
+		const active = this.#activeTurn;
+		if (!active || !this.#steerable(active)) {
+			this.#enqueueTurn(input);
+			return;
+		}
+		active.steerChain = active.steerChain.then(async () => {
+			await active.steerGate;
+			await this.#steer(active, input);
+		});
+	}
+	#steerable(active) {
+		if (active.settled || active.interrupted || this.#clearsPending > 0) return false;
+		return !this.#connection || !this.#cannotSteer.has(this.#connection);
+	}
+	async #steer(active, input) {
+		const connection = this.#connection;
+		const threadId = this.#sdkSessionId;
+		const turnId = active.turnId;
+		if (!connection || !threadId || !turnId || active.settled || active.interrupted || this.#cannotSteer.has(connection)) {
+			this.#enqueueTurn(input);
+			return;
+		}
+		try {
+			await connection.request("turn/steer", {
+				threadId,
+				expectedTurnId: turnId,
+				input
+			});
+		} catch (error) {
+			if (steerUnsupported(error)) this.#cannotSteer.add(connection);
+			this.#enqueueTurn(input);
+		}
+	}
+	#enqueueTurn(input) {
+		if (this.#closed) return;
 		this.#queue.push({ input });
 		this.#scheduleTurn();
 	}
+	#adoptTurnId(active, turnId) {
+		if (active.turnId || typeof turnId !== "string" || !turnId) return;
+		active.turnId = turnId;
+		active.openSteerGate();
+	}
 	#buildInput(text, attachments) {
 		const parts = [];
 		for (const attachment of attachments) {
@@ -4445,7 +4512,10 @@ var CodexRunner = class {
 	}
 	async clearContext() {
 		if (this.#closed) throw new Error("session is closed");
-		const run = this.#turnChain.then(() => this.#clearNow());
+		this.#clearsPending += 1;
+		const run = this.#turnChain.then(() => this.#clearNow()).finally(() => {
+			this.#clearsPending -= 1;
+		});
 		this.#turnChain = run.then(() => void 0, () => void 0);
 		await run;
 	}
@@ -4600,7 +4670,7 @@ var CodexRunner = class {
 			} catch (error) {
 				connection.close();
 				if (this.#connection === connection) this.#connection = void 0;
-				if (error instanceof JsonRpcError) throw new Error("codex app-server rejected initialize (capabilities.experimentalApi: true — required for the granular approval policy, and WorkerDeck has no non-experimental fallback): " + error.message, { cause: error });
+				if (error instanceof JsonRpcError) throw new Error("codex app-server rejected initialize (capabilities.experimentalApi: true is required for the granular approval policy, and WorkerDeck has no non-experimental fallback): " + error.message, { cause: error });
 				throw error;
 			}
 			connection.notify("initialized");
@@ -4709,7 +4779,7 @@ var CodexRunner = class {
 			}
 			if (partialReason) this.#emit({
 				type: "session_error",
-				message: `Resumed thread history is incomplete — older turns could not be loaded (${partialReason})`
+				message: `Resumed thread history is incomplete: older turns could not be loaded (${partialReason})`
 			});
 			this.#replayTurns(turns);
 		} catch {} finally {
@@ -4746,6 +4816,10 @@ var CodexRunner = class {
 		}
 	}
 	#newTurnState() {
+		let openSteerGate;
+		const steerGate = new Promise((resolve) => {
+			openSteerGate = resolve;
+		});
 		return {
 			nonce: randomUUID(),
 			interrupted: false,
@@ -4761,6 +4835,9 @@ var CodexRunner = class {
 			toolUseEmitted: /* @__PURE__ */ new Set(),
 			sectionIndex: /* @__PURE__ */ new Map(),
 			settled: false,
+			steerGate,
+			openSteerGate,
+			steerChain: Promise.resolve(),
 			resolve: () => {},
 			reject: () => {}
 		};
@@ -4776,11 +4853,13 @@ var CodexRunner = class {
 			active.resolve = (turnResult) => {
 				if (active.settled) return;
 				active.settled = true;
+				active.openSteerGate();
 				resolve(turnResult);
 			};
 			active.reject = (error) => {
 				if (active.settled) return;
 				active.settled = true;
+				active.openSteerGate();
 				reject(error);
 			};
 		});
@@ -4802,7 +4881,7 @@ var CodexRunner = class {
 			connection.request("turn/start", params).then((result) => {
 				const started = result?.turn;
 				if (!started) return;
-				active.turnId ??= started.id;
+				this.#adoptTurnId(active, started.id);
 				if (started.status && started.status !== "inProgress") active.resolve(started);
 			}, (error) => active.reject(error instanceof Error ? error : new Error(String(error))));
 			const result = await outcome;
@@ -4896,7 +4975,7 @@ var CodexRunner = class {
 		"turn/started": (params) => {
 			const active = this.#activeTurn;
 			const turn = params?.turn;
-			if (active && turn && !active.turnId) active.turnId = turn.id;
+			if (active && turn) this.#adoptTurnId(active, turn.id);
 		},
 		"turn/completed": (params) => {
 			const active = this.#activeTurn;
@@ -5039,7 +5118,7 @@ var CodexRunner = class {
 				requestId: request.id,
 				behavior: "deny",
 				resolvedBy: "policy",
-				message: "Interactive questions are disabled for this session — choose the most reasonable option yourself and continue."
+				message: "Interactive questions are disabled for this session: choose the most reasonable option yourself and continue."
 			});
 			return { answers: {} };
 		}
@@ -5068,7 +5147,7 @@ var CodexRunner = class {
 			else {
 				behavior = "deny";
 				resolvedBy = "policy";
-				message = "codex offered no plain accept for this request (only broader session/policy grants) — denied instead";
+				message = "codex offered no plain accept for this request (only broader session/policy grants), denied instead";
 				sent = pending.channel.deny(pending.params, false, pending.offered);
 			}
 		} else sent = pending.channel.deny(pending.params, decision.interrupt === true, pending.offered);
@@ -5224,7 +5303,7 @@ var CodexRunner = class {
 					agentThreadId: item.agentThreadId,
 					...item.agentPath ? { agentPath: item.agentPath } : {}
 				}, agent);
-				this.#emitToolResult(id, "(ran in its own thread — its work is not part of this thread's stored history)", false, void 0, agent?.toolUseId ?? null);
+				this.#emitToolResult(id, "(ran in its own thread, so its work is not part of this thread's stored history)", false, void 0, agent?.toolUseId ?? null);
 				return;
 			}
 			const record = this.#agents.get(item.agentThreadId) ?? this.#agents.open(item.agentThreadId, id, void 0, Date.now());
@@ -5246,6 +5325,13 @@ var CodexRunner = class {
 				}
 				return;
 			}
+			if (item.kind === "completed") {
+				if (record.status === "running") {
+					this.#agents.settle(record, "done");
+					this.#emitToolResult(record.toolUseId, "", false);
+				}
+				return;
+			}
 			if (item.kind !== "started" && record.status !== "running") this.#agents.revive(record);
 		},
 		collabAgentToolCall: (item, active, id, agent) => {
@@ -5546,7 +5632,7 @@ function connectAppServer(options) {
 }
 //#endregion
 //#region src/engines/codex/adapter.ts
-const NOT_INSTALLED = "@openai/codex is not installed — add it (an optional peer of @workerdeck/core) to run codex profiles";
+const NOT_INSTALLED = "@openai/codex is not installed - add it (an optional peer of @workerdeck/core) to run codex profiles";
 function resolveBundledCodexExecutable() {
 	const triple = targetTriple();
 	if (!triple) return;
@@ -5582,10 +5668,10 @@ async function checkCodexAvailability(profile, env, options = {}) {
 				return;
 			}
 			if (`${stdout}\n${stderr}`.includes("Not logged in")) {
-				const hint = childEnv.CODEX_API_KEY ? " CODEX_API_KEY is read only by `codex exec`, never by the app-server — run `codex login --with-api-key` under this profile’s CODEX_HOME to persist it." : childEnv.OPENAI_API_KEY ? " OPENAI_API_KEY is not used by codex — run `codex login --with-api-key` under this profile’s CODEX_HOME." : "";
+				const hint = childEnv.CODEX_API_KEY ? " CODEX_API_KEY is read only by `codex exec`, never by the app-server - run `codex login --with-api-key` under this profile’s CODEX_HOME to persist it." : childEnv.OPENAI_API_KEY ? " OPENAI_API_KEY is not used by codex - run `codex login --with-api-key` under this profile’s CODEX_HOME." : "";
 				resolve({
 					available: false,
-					reason: `codex is not logged in for this profile's environment — run \`codex login\`` + (profile.codexHome ? ` with CODEX_HOME=${profile.codexHome}` : "") + `.${hint}`
+					reason: `codex is not logged in for this profile's environment - run \`codex login\`` + (profile.codexHome ? ` with CODEX_HOME=${profile.codexHome}` : "") + `.${hint}`
 				});
 				return;
 			}