@xfey/tutti 0.1.94 → 0.1.96

package/dist/providers/openai/app-server/session-store.js

@@ -0,0 +1,303 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+const SESSION_METADATA_FILE = "metadata.json";
+const SESSION_RECOVERY_EVIDENCE_FILE = "recovery-evidence.json";
+const SESSION_ARCHIVE_INCIDENT_FILE = "archive-incident.json";
+const SESSION_CODEX_HOME_DIRECTORY = "codex-home";
+const SESSION_LOCK_FILE = ".turn.lock";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function ensurePrivateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    chmodSync(path, 0o700);
+}
+function writePrivateJson(path, value) {
+    ensurePrivateDirectory(dirname(path));
+    const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    chmodSync(temporaryPath, 0o600);
+    renameSync(temporaryPath, path);
+    chmodSync(path, 0o600);
+}
+function readJson(path) {
+    if (!existsSync(path)) {
+        return null;
+    }
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+function parseMetadata(value) {
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        typeof value.session_ref !== "string" ||
+        (value.kind !== "formal_task_run" &&
+            value.kind !== "task_compile" &&
+            value.kind !== "project_context_bootstrap" &&
+            value.kind !== "context_sync") ||
+        typeof value.owner_ref !== "string" ||
+        (value.thread_id !== undefined && typeof value.thread_id !== "string") ||
+        typeof value.codex_version !== "string" ||
+        typeof value.model !== "string" ||
+        typeof value.provider_fingerprint !== "string" ||
+        (value.lifecycle !== "active" &&
+            value.lifecycle !== "archived" &&
+            value.lifecycle !== "incompatible") ||
+        typeof value.created_at !== "string" ||
+        typeof value.last_used_at !== "string") {
+        return null;
+    }
+    return value;
+}
+function codexSessionsRoot(tuttiHome, projectId) {
+    return join(tuttiHome, "projects", projectId, "codex-sessions");
+}
+function ownerIndexPath(tuttiHome, projectId, kind, ownerRef) {
+    return kind === "formal_task_run"
+        ? join(codexSessionsRoot(tuttiHome, projectId), "task-index", `${ownerRef}.json`)
+        : join(codexSessionsRoot(tuttiHome, projectId), "procedure-index", kind, `${ownerRef}.json`);
+}
+function sessionRoot(tuttiHome, projectId, sessionRef) {
+    return join(codexSessionsRoot(tuttiHome, projectId), sessionRef);
+}
+function compatible(metadata, expected) {
+    return (metadata.lifecycle !== "incompatible" &&
+        metadata.codex_version === expected.codexVersion &&
+        metadata.model === expected.model &&
+        metadata.provider_fingerprint === expected.providerFingerprint);
+}
+function createSession(input) {
+    const sessionRef = `codex-session-${randomUUID()}`;
+    const root = sessionRoot(input.tuttiHome, input.projectId, sessionRef);
+    const codexHome = join(root, SESSION_CODEX_HOME_DIRECTORY);
+    ensurePrivateDirectory(codexSessionsRoot(input.tuttiHome, input.projectId));
+    ensurePrivateDirectory(root);
+    ensurePrivateDirectory(codexHome);
+    const timestamp = input.now.toISOString();
+    const metadata = {
+        version: 1,
+        session_ref: sessionRef,
+        kind: input.kind,
+        owner_ref: input.ownerRef,
+        codex_version: input.compatibility.codexVersion,
+        model: input.compatibility.model,
+        provider_fingerprint: input.compatibility.providerFingerprint,
+        lifecycle: "active",
+        created_at: timestamp,
+        last_used_at: timestamp,
+    };
+    const metadataPath = join(root, SESSION_METADATA_FILE);
+    writePrivateJson(metadataPath, metadata);
+    writePrivateJson(ownerIndexPath(input.tuttiHome, input.projectId, input.kind, input.ownerRef), {
+        version: 1,
+        kind: input.kind,
+        owner_ref: input.ownerRef,
+        session_ref: sessionRef,
+    });
+    return {
+        root,
+        codexHome,
+        metadataPath,
+        metadata,
+        disposition: input.disposition,
+    };
+}
+export function createProviderFingerprint(input) {
+    const canonical = JSON.stringify({
+        provider_kind: input.providerKind,
+        api_base_url: input.apiBaseUrl?.trim() || "https://api.openai.com/v1",
+    });
+    return `sha256:${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+}
+export function openCodexDurableSession(input) {
+    const now = input.now ?? new Date();
+    const indexValue = readJson(ownerIndexPath(input.tuttiHome, input.projectId, input.kind, input.ownerRef));
+    if (isRecord(indexValue) &&
+        indexValue.version === 1 &&
+        indexValue.kind === input.kind &&
+        indexValue.owner_ref === input.ownerRef &&
+        typeof indexValue.session_ref === "string") {
+        const root = sessionRoot(input.tuttiHome, input.projectId, indexValue.session_ref);
+        const metadataPath = join(root, SESSION_METADATA_FILE);
+        const metadata = parseMetadata(readJson(metadataPath));
+        if (metadata !== null &&
+            metadata.kind === input.kind &&
+            metadata.owner_ref === input.ownerRef) {
+            if (compatible(metadata, input.compatibility)) {
+                ensurePrivateDirectory(root);
+                const codexHome = join(root, SESSION_CODEX_HOME_DIRECTORY);
+                ensurePrivateDirectory(codexHome);
+                const updatedMetadata = {
+                    ...metadata,
+                    last_used_at: now.toISOString(),
+                };
+                writePrivateJson(metadataPath, updatedMetadata);
+                return {
+                    root,
+                    codexHome,
+                    metadataPath,
+                    metadata: updatedMetadata,
+                    disposition: "resumed",
+                };
+            }
+            writePrivateJson(metadataPath, {
+                ...metadata,
+                lifecycle: "incompatible",
+                last_used_at: now.toISOString(),
+            });
+            return createSession({
+                ...input,
+                now,
+                disposition: "replaced_incompatible",
+            });
+        }
+    }
+    return createSession({ ...input, now, disposition: "created" });
+}
+export function openCodexTaskSession(input) {
+    return openCodexDurableSession({
+        tuttiHome: input.tuttiHome,
+        projectId: input.projectId,
+        kind: "formal_task_run",
+        ownerRef: input.taskId,
+        compatibility: input.compatibility,
+        ...(input.now === undefined ? {} : { now: input.now }),
+    });
+}
+const MAX_RECOVERY_EVIDENCE_BYTES = 64 * 1024;
+function recoveryEvidencePath(session) {
+    return join(session.root, SESSION_RECOVERY_EVIDENCE_FILE);
+}
+export function writeCodexSessionRecoveryEvidence(input) {
+    const serialized = JSON.stringify(input.evidence);
+    const exceedsLimit = Buffer.byteLength(serialized, "utf8") > MAX_RECOVERY_EVIDENCE_BYTES;
+    const record = {
+        version: 1,
+        owner_activity_ref: input.ownerActivityRef,
+        updated_at: (input.now ?? new Date()).toISOString(),
+        truncated: exceedsLimit,
+        evidence: exceedsLimit
+            ? {
+                bounded_original_json: Buffer.from(serialized, "utf8")
+                    .subarray(0, MAX_RECOVERY_EVIDENCE_BYTES)
+                    .toString("utf8"),
+                truncation_notice: "Recovery evidence exceeded the machine-local byte limit.",
+            }
+            : input.evidence,
+    };
+    writePrivateJson(recoveryEvidencePath(input.session), record);
+    return record;
+}
+export function readCodexSessionRecoveryEvidence(session) {
+    const value = readJson(recoveryEvidencePath(session));
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        typeof value.owner_activity_ref !== "string" ||
+        typeof value.updated_at !== "string" ||
+        typeof value.truncated !== "boolean" ||
+        !isRecord(value.evidence)) {
+        return null;
+    }
+    return value;
+}
+export function updateCodexTaskSession(session, update) {
+    const current = parseMetadata(readJson(session.metadataPath));
+    if (current === null || current.session_ref !== session.metadata.session_ref) {
+        throw new Error("Codex task session metadata is unavailable or invalid.");
+    }
+    const next = update(current);
+    if (next.session_ref !== current.session_ref ||
+        next.kind !== current.kind ||
+        next.owner_ref !== current.owner_ref) {
+        throw new Error("Codex task session identity cannot change.");
+    }
+    writePrivateJson(session.metadataPath, next);
+    return { ...session, metadata: next };
+}
+export function recordCodexTaskSessionThread(session, threadId, now = new Date()) {
+    return updateCodexTaskSession(session, (metadata) => {
+        if (metadata.thread_id !== undefined && metadata.thread_id !== threadId) {
+            throw new Error("Codex task session thread identity cannot change.");
+        }
+        return {
+            ...metadata,
+            thread_id: threadId,
+            lifecycle: "active",
+            last_used_at: now.toISOString(),
+        };
+    });
+}
+export function markCodexTaskSessionArchived(session, now = new Date()) {
+    return updateCodexTaskSession(session, (metadata) => ({
+        ...metadata,
+        lifecycle: "archived",
+        last_used_at: now.toISOString(),
+    }));
+}
+export function recordCodexSessionArchiveFailure(session, now = new Date()) {
+    const incident = {
+        version: 1,
+        kind: "thread_archive_failed",
+        occurred_at: now.toISOString(),
+    };
+    writePrivateJson(join(session.root, SESSION_ARCHIVE_INCIDENT_FILE), incident);
+    return incident;
+}
+export function readCodexSessionArchiveIncident(session) {
+    const value = readJson(join(session.root, SESSION_ARCHIVE_INCIDENT_FILE));
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        value.kind !== "thread_archive_failed" ||
+        typeof value.occurred_at !== "string") {
+        return null;
+    }
+    return value;
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function acquireCodexTaskSessionLock(session) {
+    const lockPath = join(session.root, SESSION_LOCK_FILE);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const descriptor = openSync(lockPath, "wx", 0o600);
+            writeFileSync(descriptor, `${JSON.stringify({ version: 1, owner_pid: process.pid, created_at: new Date().toISOString() })}\n`, "utf8");
+            closeSync(descriptor);
+            let released = false;
+            return () => {
+                if (released) {
+                    return;
+                }
+                released = true;
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch {
+                    // Releasing a process-local safety lock is best effort during shutdown.
+                }
+            };
+        }
+        catch (error) {
+            if (!existsSync(lockPath)) {
+                throw error;
+            }
+            const lockValue = readJson(lockPath);
+            const ownerPid = isRecord(lockValue) && typeof lockValue.owner_pid === "number" ? lockValue.owner_pid : null;
+            if (ownerPid !== null && isProcessAlive(ownerPid)) {
+                throw new Error("Codex task session already has an active turn owner.", { cause: error });
+            }
+            unlinkSync(lockPath);
+        }
+    }
+    throw new Error("Codex task session lock could not be acquired.");
+}
+//# sourceMappingURL=session-store.js.map

package/dist/providers/openai/app-server/workspace-write-run.d.ts

@@ -33,8 +33,18 @@ export type CodexAppServerWorkspaceWriteRunInput<TOutput> = {
     defaultModel?: string;
     workspaceRoot: string;
     prompt: string;
-    outputSchema: unknown;
-    validateOutput: (value: unknown) => value is TOutput;
+    outputSchema?: unknown;
+    validateOutput?: (value: unknown) => value is TOutput;
+    sandboxMode?: "workspace-write" | "read-only";
+    session?: {
+        codexHome: string;
+        threadId?: string;
+        unarchive?: boolean;
+        onThreadReady?: (threadId: string) => void | Promise<void>;
+        archiveAfterTurn?: (output: TOutput) => boolean;
+        onThreadArchived?: () => void | Promise<void>;
+        onThreadArchiveFailure?: () => void | Promise<void>;
+    };
     networkAccess?: boolean;
     webSearchMode?: "disabled" | "cached" | "live";
     approvalPolicy?: CodexAppServerApprovalPolicy;
@@ -63,6 +73,7 @@ export type CodexAppServerWorkspaceWriteRunInput<TOutput> = {
 };
 export type CodexAppServerWorkspaceWriteRunResult<TOutput> = {
     output: TOutput;
+    thread_id: string;
     model: string;
     turn_status: "completed";
     notification_count: number;
@@ -73,6 +84,7 @@ export type CodexAppServerWorkspaceWriteRunResult<TOutput> = {
     usage?: OpenAiTokenUsage;
 };
 export type CodexAppServerWorkspaceWriteRunErrorDetails = {
+    turn_start_state?: "not_started" | "start_requested" | "terminal";
     turn_status?: string;
     turn_error_message?: string;
     turn_error_code?: string;
@@ -83,12 +95,13 @@ export type CodexAppServerWorkspaceWriteRunErrorDetails = {
     server_request_methods?: string[];
     notification_methods?: string[];
     agent_message_excerpt?: string;
+    agent_output?: string;
     stderr_excerpt?: string;
 };
 export declare class CodexAppServerWorkspaceWriteRunError extends Error {
-    readonly code: "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "secret_leak_detected" | "process_lifecycle_failed" | "admission_unavailable";
+    readonly code: "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "secret_leak_detected" | "process_lifecycle_failed" | "admission_unavailable" | "session_unavailable";
     readonly details: CodexAppServerWorkspaceWriteRunErrorDetails;
-    constructor(code: "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "secret_leak_detected" | "process_lifecycle_failed" | "admission_unavailable", message: string, details?: CodexAppServerWorkspaceWriteRunErrorDetails);
+    constructor(code: "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "secret_leak_detected" | "process_lifecycle_failed" | "admission_unavailable" | "session_unavailable", message: string, details?: CodexAppServerWorkspaceWriteRunErrorDetails);
 }
 export declare function runCodexAppServerWorkspaceWriteRun<TOutput>(options: CodexAppServerWorkspaceWriteRunInput<TOutput>): Promise<CodexAppServerWorkspaceWriteRunResult<TOutput>>;
 //# sourceMappingURL=workspace-write-run.d.ts.map

package/dist/providers/openai/app-server/workspace-write-run.js

@@ -8,7 +8,7 @@ import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./jso
 import { CodexAppServerInvocation, CodexAppServerLifecycleError, createManagedProcess, } from "./invocation-lifecycle.js";
 import { CodexAppServerAdmissionError, } from "./invocation-coordinator.js";
 import { createCodexAppServerRuntimeObserver, } from "./runtime-telemetry.js";
-import { createWorkspaceWriteSandboxPolicy } from "./sandbox-policy.js";
+import { createReadOnlySandboxPolicy, createWorkspaceWriteSandboxPolicy, } from "./sandbox-policy.js";
 import { buildCodexAppServerProviderConfigOverrides, resolveCodexAppServerModelProvider, } from "./provider-config.js";
 import { buildCodexAppServerTurnInput, resolveCodexAppServerContextRuntimeHint, resolveCodexAppServerSkillsListWarmup, resolveCodexAppServerSkillInputs, CodexAppServerSkillSelectionError, } from "./skills.js";
 import { compactText, containsKnownSecret, createCodexSpawnEnv, extractAgentText, extractServerRequestMethod, findJsonObjectCandidates, isApiKeyAccount, readThreadId, readTurnError, readTurnStatus, redactWithKnownValues, } from "./runtime-helpers.js";
@@ -204,12 +204,14 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
     }
     const model = options.defaultModel ?? DEFAULT_OPENAI_MODEL;
     const tempRoot = mkdtempSync(join(tmpdir(), "tutti-codex-workspace-write-run-"));
-    const codexHome = join(tempRoot, "codex-home");
+    const codexHome = options.session?.codexHome ?? join(tempRoot, "codex-home");
     mkdirSync(codexHome, { recursive: true, mode: 0o700 });
     const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     const turnTimeoutMs = options.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
     const networkEnabled = options.networkAccess ?? true;
-    const approvalPolicy = options.approvalPolicy ?? DEFAULT_WORKSPACE_WRITE_APPROVAL_POLICY;
+    const sandboxMode = options.sandboxMode ?? "workspace-write";
+    const approvalPolicy = options.approvalPolicy ??
+        (sandboxMode === "read-only" ? "never" : DEFAULT_WORKSPACE_WRITE_APPROVAL_POLICY);
     const approvalsReviewer = resolveWorkspaceWriteApprovalsReviewer({
         ...(options.approvalsReviewer === undefined ? {} : { explicit: options.approvalsReviewer }),
         env: options.baseEnv ?? process.env,
@@ -269,6 +271,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
     let primaryError;
     let runResult;
     let lifecycleError;
+    let turnStartState = "not_started";
     try {
         await client.request("initialize", {
             clientInfo: {
@@ -291,22 +294,43 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         if (skillsListWarmup !== undefined) {
             await client.request("skills/list", skillsListWarmup, requestTimeoutMs);
         }
-        const threadStartResponse = await client.request("thread/start", {
-            cwd: options.workspaceRoot,
-            model,
-            modelProvider,
-            approvalPolicy,
-            approvalsReviewer,
-            sandbox: "workspace-write",
-            config: buildWorkspaceWriteThreadConfig(options),
-            ephemeral: true,
-            experimentalRawEvents: false,
-            persistExtendedHistory: false,
-        }, requestTimeoutMs);
-        const threadId = readThreadId(threadStartResponse);
+        let threadId;
+        if (options.session?.threadId === undefined) {
+            const threadStartResponse = await client.request("thread/start", {
+                cwd: options.workspaceRoot,
+                model,
+                modelProvider,
+                approvalPolicy,
+                approvalsReviewer,
+                sandbox: sandboxMode,
+                config: buildWorkspaceWriteThreadConfig(options),
+                ephemeral: options.session === undefined,
+                experimentalRawEvents: false,
+                persistExtendedHistory: false,
+            }, requestTimeoutMs);
+            threadId = readThreadId(threadStartResponse);
+        }
+        else {
+            if (options.session.unarchive === true) {
+                await client.request("thread/unarchive", { threadId: options.session.threadId }, requestTimeoutMs);
+            }
+            const threadResumeResponse = await client.request("thread/resume", {
+                threadId: options.session.threadId,
+                cwd: options.workspaceRoot,
+                model,
+                modelProvider,
+                approvalPolicy,
+                approvalsReviewer,
+                sandbox: sandboxMode,
+                config: buildWorkspaceWriteThreadConfig(options),
+            }, requestTimeoutMs);
+            threadId = readThreadId(threadResumeResponse) ?? options.session.threadId;
+        }
         if (threadId === null) {
             throw new CodexAppServerWorkspaceWriteRunError("thread_start_failed", "Codex app-server did not return a thread id.");
         }
+        await options.session?.onThreadReady?.(threadId);
+        turnStartState = "start_requested";
         await client.request("turn/start", {
             threadId,
             input: buildCodexAppServerTurnInput({
@@ -319,12 +343,14 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
             cwd: options.workspaceRoot,
             approvalPolicy,
             approvalsReviewer,
-            sandboxPolicy: createWorkspaceWriteSandboxPolicy(options.workspaceRoot, {
-                networkEnabled,
-            }),
+            sandboxPolicy: sandboxMode === "read-only"
+                ? createReadOnlySandboxPolicy({ networkEnabled })
+                : createWorkspaceWriteSandboxPolicy(options.workspaceRoot, {
+                    networkEnabled,
+                }),
             model,
             modelProvider,
-            outputSchema: options.outputSchema,
+            ...(options.outputSchema === undefined ? {} : { outputSchema: options.outputSchema }),
         }, requestTimeoutMs);
         const turnCompletedNotification = await waitForWorkspaceWriteTurnCompletion({
             client,
@@ -349,6 +375,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
                 sensitiveValues,
             },
         });
+        turnStartState = "terminal";
         if (client.serverRequests.length > 0) {
             const unresolved = client.serverRequests.find((request) => client.isServerRequestPending(request.id));
             if (unresolved !== undefined) {
@@ -385,17 +412,51 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         const agentText = client.notifications
             .map((notification) => extractAgentText(notification))
             .join("");
-        const parsed = parseWorkspaceWriteStructuredJson(agentText);
-        if (!options.validateOutput(parsed)) {
-            throw new CodexAppServerWorkspaceWriteRunError("output_validation_failed", "Codex app-server structured output did not match the expected schema.");
+        let output;
+        if (options.outputSchema === undefined && options.validateOutput === undefined) {
+            output = agentText;
+        }
+        else {
+            if (options.outputSchema === undefined || options.validateOutput === undefined) {
+                throw new CodexAppServerWorkspaceWriteRunError("output_validation_failed", "Codex app-server structured output configuration is incomplete.");
+            }
+            let parsed;
+            try {
+                parsed = parseWorkspaceWriteStructuredJson(agentText);
+            }
+            catch (error) {
+                if (error instanceof CodexAppServerWorkspaceWriteRunError) {
+                    throw new CodexAppServerWorkspaceWriteRunError(error.code, error.message, {
+                        ...error.details,
+                        agent_output: redactWithKnownValues(agentText, sensitiveValues).slice(0, 16_000),
+                    });
+                }
+                throw error;
+            }
+            if (!options.validateOutput(parsed)) {
+                throw new CodexAppServerWorkspaceWriteRunError("output_validation_failed", "Codex app-server structured output did not match the expected schema.", {
+                    agent_output: redactWithKnownValues(agentText, sensitiveValues).slice(0, 16_000),
+                });
+            }
+            output = parsed;
         }
         const rawOutput = `${client.rawStdout}\n${client.stderr}`;
         if (options.strictLeakCheck === true && containsKnownSecret(rawOutput, strictLeakCheckValues)) {
             throw new CodexAppServerWorkspaceWriteRunError("secret_leak_detected", "Codex app-server output contained a sensitive runtime value.");
         }
         const usage = extractCodexAppServerTokenUsage(client.notifications);
+        if (options.session?.archiveAfterTurn?.(output) === true) {
+            try {
+                await client.request("thread/archive", { threadId }, requestTimeoutMs);
+                await options.session.onThreadArchived?.();
+            }
+            catch {
+                await options.session.onThreadArchiveFailure?.();
+            }
+        }
         runResult = {
-            output: parsed,
+            output,
+            thread_id: threadId,
             model,
             turn_status: "completed",
             notification_count: client.notifications.length,
@@ -409,14 +470,17 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
     }
     catch (error) {
         if (error instanceof CodexAppServerWorkspaceWriteRunError) {
-            primaryError = error;
+            primaryError = new CodexAppServerWorkspaceWriteRunError(error.code, error.message, {
+                ...error.details,
+                turn_start_state: turnStartState,
+            });
         }
         else if (error instanceof CodexAppServerProtocolError) {
-            primaryError = new CodexAppServerWorkspaceWriteRunError("app_server_protocol_error", redactWithKnownValues(error.message, sensitiveValues));
+            primaryError = new CodexAppServerWorkspaceWriteRunError("app_server_protocol_error", redactWithKnownValues(error.message, sensitiveValues), { turn_start_state: turnStartState });
         }
         else {
             const message = error instanceof Error ? error.message : String(error);
-            primaryError = new CodexAppServerWorkspaceWriteRunError("app_server_protocol_error", redactWithKnownValues(message, sensitiveValues));
+            primaryError = new CodexAppServerWorkspaceWriteRunError("app_server_protocol_error", redactWithKnownValues(message, sensitiveValues), { turn_start_state: turnStartState });
         }
     }
     finally {
@@ -435,7 +499,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
     if (lifecycleError !== undefined) {
         throw new CodexAppServerWorkspaceWriteRunError("process_lifecycle_failed", lifecycleError instanceof CodexAppServerLifecycleError
             ? lifecycleError.message
-            : "Codex app-server process lifecycle did not close cleanly.");
+            : "Codex app-server process lifecycle did not close cleanly.", { turn_start_state: turnStartState });
     }
     return runResult;
 }

package/dist/providers/openai/codex-app-server.d.ts

@@ -1,3 +1,4 @@
+export declare const CODEX_APP_SERVER_VERSION: string;
 export declare const CODEX_APP_SERVER_ENTRYPOINT: string;
 export declare const CODEX_APP_SERVER_COMMAND: string;
 export declare const CODEX_APP_SERVER_LISTEN_URL: "stdio://";

package/dist/providers/openai/codex-app-server.js

@@ -2,6 +2,8 @@ import { createRequire } from "node:module";
 import { dirname, isAbsolute, join } from "node:path";
 import { DEFAULT_OPENAI_MODEL } from "./model-config.js";
 const require = createRequire(import.meta.url);
+const codexPackage = require("@openai/codex/package.json");
+export const CODEX_APP_SERVER_VERSION = codexPackage.version;
 export const CODEX_APP_SERVER_ENTRYPOINT = join(dirname(require.resolve("@openai/codex/package.json")), "bin", "codex.js");
 export const CODEX_APP_SERVER_COMMAND = process.execPath;
 export const CODEX_APP_SERVER_LISTEN_URL = "stdio://";

package/dist/run-pipeline/openai.d.ts

@@ -18,6 +18,7 @@ export type OpenAiRunPipelineRunnerOptions = {
     workspaceRoot: string;
     promptsRoot?: string;
     tuttiHome?: string;
+    projectId?: ProjectId;
     userSkillsRoot?: string;
     builtInSkillsRoot?: string;
     agentContext?: CodexAppServerAgentContextRuntime;