@zq-silk/yui 0.13.2 → 0.13.4

package/ARCHITECTURE.md

@@ -49,7 +49,8 @@ Session.
 - `WorkerProfile` is a versioned, provider-neutral behavior template containing
   instructions, Skills, a read/write behavior intent, and optional model/effort hints.
 - `TaskRole` is a mutable Worker instance inside one Task. Applying a Profile
-  copies its portable behavior. Its versioned desired launch configuration is
+  copies its portable behavior and the optional model/effort selections into
+  the active Agent binding. Its versioned desired launch configuration is
   next-launch-only. The Role may bind multiple Agents; every binding retains
   independent runtime configuration.
 - `AgentRun` records one managed dispatch and an immutable effective snapshot:
@@ -240,33 +241,38 @@ context.
 
 ## Runtime ownership
 
-tmux owns the persistent Agent Host lifetime and observable output. The
+Provider conversations remain user conversations. Yui adds the matching Role
+Skill and Session Manifest pointer, then uses provider-native requests for
+durable Task delivery; it does not own or mirror the full transcript. The
 Controller owns mailbox delivery, wakeups, Role liveness, recovery decisions,
-and a durable single-writer authority epoch. The Agent Host owns one structured
-Provider child process and mirrors its output to the pane. Managed prompts are
-never terminal bytes: both Controller and human takeover input become fenced
-Provider-native Turn requests.
+and exact receipts. tmux keeps Yui's client attachment observable where the
+provider path needs one.
 
 Run, Conversation, Activation, and Turn identities are independent. A
-Conversation can span Runs and Provider processes; one Activation identifies
-one live process; one Turn identifies one pre-recorded input attempt. A live
-Activation is retained when a later Run reuses the Conversation. Process exit
-ends that Activation, and a resumed process receives a new Activation and a
-higher authority epoch.
-
-Task observation uses `task role view`. Explicit takeover requires a live
-managed Run, atomically transfers authority to a human holder, synchronizes the
-same fence to the Host, and only then exposes the PTY input gateway. Detach
-releases authority; `task role release` is an idempotent repair path even after
-the Run has ended. Global interactive entry remains a native session-lifecycle
-operation outside this managed Provider contract.
-
-Codex uses a persistent App Server JSON-RPC transport. Claude uses a persistent
-stream-json transport with exact user-message replay acknowledgement. In both
-cases, Yui records Turn intent before writing, accepts only exact Provider
-evidence, and maps an uncertain write to `delivery-unknown` without automatic
-resubmission. Conversation replacement requires exact missing evidence and no
-unsettled input, Turn, Activation, or writer authority.
+Conversation can span Runs and client attachments; one Activation identifies
+Yui's current attachment, not exclusive ownership of the Provider thread. One
+Turn identifies one provider-native execution. Yui's authority epoch fences
+only Yui's own submissions and retries.
+
+Codex Task threads can be opened and used directly in Desktop as ordinary
+sessions; no Yui takeover is required. If a direct user Turn is active, Yui
+keeps its pending Run/message and retries after that Turn settles. The explicit
+tmux takeover gateway remains for providers whose managed conversation is
+attached to an independent process. Global interactive entry remains a native
+session-lifecycle operation outside the Task delivery contract.
+
+Codex uses `app-server proxy` to create or resume a normal thread on the shared
+App Server daemon. Role model, effort, permission, workspace, and shell settings are passed at
+`thread/start`/`thread/resume`, while the ordinary Task message points to the
+Session Manifest and matching Role Skill. Yui does not write either to global
+Codex config and may only ensure that the daemon is running; it never restarts
+or stops it for a thread error. A Codex native config profile is rejected for
+Managed Codex because the protocol cannot isolate it to one thread; a Yui Agent
+Profile supplies the per-Role behavior, Skills, model, and effort instead.
+Claude uses a persistent stream-json
+transport with exact user-message replay acknowledgement. In both cases, Yui
+records Turn intent before writing, accepts only exact Provider evidence, and
+maps an uncertain write to `delivery-unknown` without automatic resubmission.
 
 Role desired revisions and Run/Session effective snapshots keep configuration
 history explicit. Resume compares the complete effective snapshot and

package/README.md

@@ -252,7 +252,7 @@ Yui provides four reusable Worker Profile definitions through
 worker  explorer  implementer  reviewer
 ```
 
-Profiles are versioned, provider-neutral Worker behavior templates. They hold portable prompt instructions, Skills, access expectations, and optional model and effort hints, but do not bind an Agent or own a Session or workspace. A Task Role is the Task-bound Worker instance: applying a Profile copies its portable behavior into that mutable instance, while each Agent binding keeps its own runtime configuration.
+Profiles are versioned, provider-neutral Worker behavior templates. They hold portable prompt instructions, Skills, access expectations, and optional model and effort selections, but do not bind an Agent or own a Session or workspace. A Task Role is the Task-bound Worker instance: applying a Yui Agent Profile copies the behavior plus model/effort into that Role's active Agent binding; explicit Role options may override the copied values. This is separate from a Codex native config profile selected with `--profile`.
 
 ## Quick start
 
@@ -871,15 +871,20 @@ Task lifecycle completion/selection only suggests valid source states: Draft for
 ## Sessions and tmux
 
 Managed Task Agents use the [hybrid Provider runtime](docs/provider-runtime.md).
-The Controller and Agent Host send Provider-native structured requests; tmux
-and PTY keep the Host alive, show output, and provide an explicit human input
-gateway. Managed prompts are never delivered as terminal bytes.
-
-Codex uses a persistent App Server JSON-RPC process. Claude Code uses a
-persistent stream-json process with exact user-message replay acknowledgement.
-Both follow the same Conversation, Activation, Turn, and authority-epoch
-contract. A timeout or uncertain write becomes `delivery-unknown` and is never
-automatically retried.
+Provider conversations remain ordinary user conversations. Yui adds the Role
+Skill and Session Manifest pointer, then sends Task work through provider-native
+structured requests. Managed prompts are never delivered as terminal bytes.
+
+Codex uses `app-server proxy` to create or resume a normal thread on the shared
+App Server daemon. The thread is visible and directly usable in Desktop; Yui
+does not require takeover or install global Hook/config state. It may
+idempotently start an absent daemon, but never restarts or stops it for a thread
+error. When a user Turn is active, Yui keeps pending Task work and retries
+later. If Yui's proxy disconnects, the Host reattaches without ending the
+logical Activation and reconciles the exact owned Turn from native history.
+Claude Code keeps its independent stream-json process with exact
+user-message replay acknowledgement. A timeout or uncertain write becomes
+`delivery-unknown` and is never automatically retried.
 
 Task Role observation and takeover are explicit:
 
@@ -889,11 +894,10 @@ yui task role takeover <task-id> <role>
 yui task role release <task-id> <role>
 ```
 
-`view` is read-only. `takeover` transfers the durable writer authority to the
-human before enabling the Host PTY gateway and requires a live managed Run;
-detach returns it to the Controller. `release` remains available without a live
-Run and idempotently repairs a stranded or partially synchronized takeover.
-Authority cannot transfer while a Provider Turn or input delivery is unsettled.
+For Codex, open the Role's ordinary thread in Desktop for direct interaction;
+these commands are not required. `view`/`takeover`/`release` remain the explicit
+PTY gateway for providers whose managed conversation uses an independent
+process.
 
 Global Operator and global Role sessions remain native interactive CLIs:
 
@@ -941,8 +945,8 @@ thread identity from App Server responses. Managed Task Runs use structured
 Provider observations for both CLIs. Global interactive Codex sessions may
 still use its `notify` callback for conversation presentation.
 
-Automated lifecycle and delivery decisions use structured Hook payloads,
-persisted identities, usage snapshots, tmux process state, receipts, and pane
+Automated lifecycle and delivery decisions use structured Provider events or
+supported Hook payloads, persisted identities, usage snapshots, tmux process state, receipts, and pane
 fences. Yui never
 parses prompt glyphs, progress text, trust dialogs, or other Agent terminal
 output to infer readiness or success. `captureRole()` remains an explicit
@@ -956,9 +960,9 @@ not. A live tmux pane proves only that the host exists. Runtime activity and
 durable workflow progress use independent clocks, so token/tool/resource
 movement cannot conceal a workflow that is not advancing.
 
-Stable Role context is also launch metadata, never a bootstrap turn. Yui passes Role policy and `systemPrompt` through the Agent's native system/developer-instruction channel. Task execution Runs receive the generic Leader or Worker Skill, while review Runs receive the generic Reviewer Skill based on durable Run purpose rather than a configured Role name. These Yui-owned Role Skills define portable orchestration only. Project Skills remain ordinary versioned files in the Project and are discovered, selected, and loaded by the Agent through its native project mechanism; Yui does not scan, parse, copy, or inject them.
+Stable Role context never creates a separate bootstrap Turn. Task execution Runs use the generic Leader or Worker Skill, while review Runs use the generic Reviewer Skill based on durable Run purpose rather than a configured Role name. The provider either carries the Skill through a safe additive native context channel or points to it from the ordinary Task delivery. These Yui-owned Role Skills define portable orchestration only. Project Skills remain ordinary versioned files in the Project and are discovered, selected, and loaded by the Agent through its native project mechanism; Yui does not scan, parse, copy, or inject them.
 
-Native Codex developer instructions carry compact absolute references only for Yui-owned Role Skills, which Codex reads on demand. Yui applies this scalar as an invocation-local override, so existing user, profile, project, and system values do not make the Session unusable and the underlying config file is never mutated. A higher-precedence managed `developer_instructions` value remains a bounded launch blocker because Codex will not let invocation flags replace it. Interactive Codex Sessions apply the same rule to Yui's structured `notify` callback; Doctor reports ordinary overridden sources as context and rejects an effective managed conflict. Managed Runs instead use invocation-local Agent Driver Hooks as their sole lifecycle authority and do not claim `notify`. `skills.config` is not misused because it only enables or disables already-discovered Skills. Claude receives the same Yui-owned Role Skill content from a private `0600` managed context file rather than a large or sensitive argv value; retries and resumes reuse the purpose-specific Role path. Non-Operator global Roles stay neutral and receive no Task orchestration Skill. Operator therefore opens at an empty native composer, so the user's text remains its first user message. Leader wakeups and Worker or Reviewer Run assignments remain real mailbox-delivered work messages. An adapter without a native instruction channel must reject this context rather than silently converting it into a first user prompt.
+Managed Codex keeps the user's native developer instructions unchanged. The ordinary Task message includes a compact absolute Session Manifest pointer, and the manifest identifies the matching Yui-owned Role Skill for Codex to read on demand. Model, effort, permission, workspace, and shell settings selected for the Role are supplied as thread-scoped `thread/start` or `thread/resume` configuration through the shared App Server daemon. A Codex native config profile cannot be isolated to one shared-daemon thread, so Managed Codex rejects that setting and directs callers to a Yui Agent Profile; ordinary non-Yui and interactive Codex sessions remain unaffected. Unrelated Codex threads keep their existing user, profile, project, and system configuration and the underlying config file is never mutated. App Server notifications are the managed thread's lifecycle authority; Yui installs no managed Codex Hook and does not claim `notify`. Interactive Codex Sessions may still use Yui's structured `notify` callback, and Doctor reports any effective configuration conflict. `skills.config` is not misused because it only enables or disables already-discovered Skills. Claude receives the same Yui-owned Role Skill content from a private `0600` managed context file rather than a large or sensitive argv value; retries and resumes reuse the purpose-specific Role path. Non-Operator global Roles stay neutral and receive no Task orchestration Skill. Operator therefore opens at an empty native composer, so the user's text remains its first user message. Leader wakeups and Worker or Reviewer Run assignments remain real mailbox-delivered work messages.
 
 ## Controller and failure handling
 
@@ -994,7 +998,7 @@ Read-only commands and `upgrade --dry-run` do not start a Controller. `update`
 also replaces an already-running Controller only after the new binary passes its
 health checks.
 
-Its recovery reconciliation runs every 120 seconds by default. Normal durable state changes enqueue a Task, Role, or Operator key and return immediately; keys received in the same fixed 100 ms window trigger one non-overlapping targeted pass. Operator presentation has an independent lane, so a blocked Task workspace operation cannot delay a user question. Periodic Git/worktree work is limited to Tasks with durable Task-mailbox work, while active Role liveness uses one tmux inventory. Agent Driver Hooks write exact-fenced observations to the durable runtime inbox without starting or waiting for the Controller. A terminal Turn observation gives a legal yield/input/completion two seconds to win before a forgotten Run fails its workflow contract. Durable mailboxes freeze the current batch while new signals merge into the next batch. Task-orchestration failures retain the exact Controller-owned processing batch for two bounded fast retries and later periodic recovery; a successful retry completes that batch before newer pending work is claimed. Recommended InputRequest and pending Turn deadlines share one nearest-deadline selector and therefore do not wait for the recovery interval. Explicit `task reconcile` still requests an immediate recovery pass. The retained loop is:
+Its recovery reconciliation runs every 120 seconds by default. Normal durable state changes enqueue a Task, Role, or Operator key and return immediately; keys received in the same fixed 100 ms window trigger one non-overlapping targeted pass. Operator presentation has an independent lane, so a blocked Task workspace operation cannot delay a user question. Periodic Git/worktree work is limited to Tasks with durable Task-mailbox work, while active Role liveness uses one tmux inventory. Structured Agent Driver observations, whether received from native provider events or supported Hooks, are exact-fenced before they reach the durable runtime inbox. A terminal Turn observation gives a legal yield/input/completion two seconds to win before a forgotten Run fails its workflow contract. Durable mailboxes freeze the current batch while new signals merge into the next batch. Task-orchestration failures retain the exact Controller-owned processing batch for two bounded fast retries and later periodic recovery; a successful retry completes that batch before newer pending work is claimed. Recommended InputRequest and pending Turn deadlines share one nearest-deadline selector and therefore do not wait for the recovery interval. Explicit `task reconcile` still requests an immediate recovery pass. The retained loop is:
 
 1. dispatch pending Leader wakes whose Task workspaces are already ready;
 2. prepare active Project Task main worktrees with durable orchestration work;

package/dist/cli/commandCatalog.js

@@ -582,17 +582,17 @@ const taskChildren = [
             },
             {
                 name: "view",
-                summary: "Attach read-only to a managed Provider presentation surface.",
+                summary: "Attach read-only to an independent Provider presentation surface.",
                 usage: "yui task role view <task> <role>"
             },
             {
                 name: "takeover",
-                summary: "Acquire Provider writer authority and enter the PTY input gateway.",
+                summary: "Enter the PTY input gateway for an independent Provider process.",
                 usage: "yui task role takeover <task> <role>"
             },
             {
                 name: "release",
-                summary: "Return stranded human Provider authority to the Controller.",
+                summary: "Release an independent Provider PTY input gateway.",
                 usage: "yui task role release <task> <role>"
             }
         ]

package/dist/commands/taskCommands.js

@@ -20,7 +20,7 @@ import { renderRoleDetails } from "../output/rolePresentation.js";
 import { createTaskMessage, taskMessageAuthorLabel } from "../message/message.js";
 import { cancelInputRequest } from "../input/inputRequest.js";
 import { recoverExactAgentRun, retireExactActiveAgentRun, terminalizeExactTaskRun, validateExactRunReviewRound } from "../lifecycle/exactRunTerminalization.js";
-import { copyGlobalRoleToTaskRole, createRole, createRoleAgentBinding, switchActiveRoleAgent, unbindRoleAgent, updateRole, updateRoleStatus } from "../role/role.js";
+import { activeRoleAgentBinding, copyGlobalRoleToTaskRole, createRole, createRoleAgentBinding, switchActiveRoleAgent, unbindRoleAgent, updateRole, updateRoleStatus } from "../role/role.js";
 import { agentRunDeliveryReceiptId, createAgentRun, withAgentRunContextSnapshot } from "../run/agentRun.js";
 import { projectRunRecovery, readRunRecoveryFacts } from "../run/recoveryProjection.js";
 import { matchYieldReceipt } from "../run/yieldReceipt.js";
@@ -1441,7 +1441,7 @@ function addTaskRole(args, store, options) {
         let created = createTaskRole(tx, task, roleName, agentId, now);
         const profileId = parsed.one("--profile");
         if (profileId !== undefined) {
-            created = updateRole(created, workerProfileRolePatch(requireAgentProfile(tx, profileId)), now);
+            created = applyWorkerAgentProfile(created, requireAgentProfile(tx, profileId), now);
         }
         const profile = roleProfilePatch(parsed);
         if (Object.keys(profile).length > 0)
@@ -1558,20 +1558,20 @@ function updateTaskRole(args, store, options) {
                 roleName: role.name
             }, "desired launch configuration update");
         }
-        let bindings = role.agentBindings;
+        const profileId = parsed.one("--profile");
+        const withProfile = profileId === undefined
+            ? role
+            : applyWorkerAgentProfile(role, requireAgentProfile(tx, profileId), now);
+        let bindings = withProfile.agentBindings;
         if (changesAgentConfig) {
-            const agentId = parsed.one("--agent")?.trim() || role.activeAgentId;
+            const agentId = parsed.one("--agent")?.trim() || withProfile.activeAgentId;
             const agent = requireAgent(tx, agentId);
             const binding = bindings[agentId]
                 ?? createRoleAgentBinding({ id: agent.id, adapterId: agent.adapterId });
             bindings = { ...bindings, [agentId]: patchRoleAgentBinding(binding, parsed) };
         }
-        const profileId = parsed.one("--profile");
-        const withProfile = profileId === undefined
-            ? role
-            : updateRole(role, workerProfileRolePatch(requireAgentProfile(tx, profileId)), now);
         const next = updateRole(withProfile, {
-            ...(bindings === role.agentBindings ? {} : { agentBindings: bindings }),
+            ...(bindings === withProfile.agentBindings ? {} : { agentBindings: bindings }),
             ...roleProfilePatch(parsed)
         }, now);
         if (changesLaunchContext) {
@@ -6463,6 +6463,29 @@ function workerProfileRolePatch(profile) {
             : undefined
     };
 }
+function applyWorkerAgentProfile(role, profile, now) {
+    const binding = activeRoleAgentBinding(role);
+    const config = structuredClone(binding.config);
+    if (profile.model === undefined)
+        delete config.model;
+    else
+        config.model = profile.model;
+    if (profile.effort === undefined)
+        delete config.effort;
+    else
+        config.effort = profile.effort;
+    const profiledBinding = createRoleAgentBinding({
+        id: binding.agentId,
+        adapterId: binding.adapterId
+    }, config);
+    return updateRole(role, {
+        ...workerProfileRolePatch(profile),
+        agentBindings: {
+            ...role.agentBindings,
+            [binding.agentId]: profiledBinding
+        }
+    }, now);
+}
 function appendMessage(store, taskId, body, kind, author, now, context = {}) {
     const message = createTaskMessage(store.nextMessageId(taskId), taskId, body, kind, author, now, context);
     store.saveMessage(taskId, message);

package/dist/controller/controller.js

@@ -1515,7 +1515,8 @@ export class FileTaskController {
             else if (wakeup.reason === "writer-attached") {
                 writerBlocked.add(key);
             }
-            else if (wakeup.reason === "not-ready") {
+            else if (wakeup.reason === "not-ready"
+                || (wakeup.reason === "busy" && wakeup.runId !== undefined)) {
                 retry.set(key, { identity: wakeup.runId ?? key });
             }
             else if (wakeup.status === "dispatched")

package/dist/controller/fileSchedulerStoreAdapter.js

@@ -3111,6 +3111,17 @@ export class FileSchedulerStoreAdapter {
             current = rememberRoleAgentCompletedTurn(current, input.agentId, nativeSessionId, input.turnId, now);
             store.saveGlobalRoleSessionSet(current);
             completeRuntimeHookReservation(store, owner, input.launchId);
+            if (input.roleName === SYSTEM_OPERATOR_ROLE
+                && input.adapterId === "codex"
+                && completedStatus === "ready") {
+                const operatorMailbox = store.getWorkMailbox({ kind: "operator" });
+                // A completed foreground Codex Turn leaves its native TUI attached to
+                // the thread. Stop only that idle Role runtime so Desktop can become
+                // the writer; the durable nativeSessionId remains available to resume.
+                if (operatorMailbox === null || !mailboxHasWork(operatorMailbox)) {
+                    enqueueWork(store, runtimeLifecycleTarget(owner), RUNTIME_CLEANUP_REQUIRED_REASON, now);
+                }
+            }
             return current.sessions[input.agentId];
         });
     }
@@ -3588,7 +3599,7 @@ function nativeTransitionExisting(store, owner, existing, nativeSessionId, launc
     throw new Error(conflictMessage);
 }
 function globalCompletionNativeSessionId(existing, input) {
-    // Codex app-server and its notify Hook expose different native IDs for the
+    // Codex structured event sources can expose different native IDs for the
     // same launch. The launch generation remains the authoritative fence.
     return input.adapterId === "codex"
         && input.launchId !== undefined

package/dist/controller/runtimeLaunchCoordinator.js

@@ -446,6 +446,10 @@ function requireMatchingRuntimeBinding(raw, request, launchId) {
         && binding.initialTurnDeliveryUnknownRunId !== request.runId) {
         throw new RuntimeBindingContractError(`Session host returned a delivery-unknown initial structured Turn for another Run: ${request.owner.roleName}.`);
     }
+    if (binding.initialTurnBusyRunId !== undefined
+        && binding.initialTurnBusyRunId !== request.runId) {
+        throw new RuntimeBindingContractError(`Session host returned a busy initial structured Turn for another Run: ${request.owner.roleName}.`);
+    }
     if (binding.initialTurnRejectedRunId !== undefined
         && binding.initialTurnRejectedRunId !== request.runId) {
         throw new RuntimeBindingContractError(`Session host returned a rejected initial structured Turn for another Run: ${request.owner.roleName}.`);

package/dist/executor/agentAdapter.js

@@ -10,7 +10,7 @@ const SANDBOXES = ["read-only", "workspace-write", "danger-full-access"];
 const APPROVALS = ["untrusted", "on-request", "never"];
 const PROBE_TIMEOUT_MS = 2_000;
 const PROBE_MAX_BYTES = 1024 * 1024;
-const CODEX_TESTED_THROUGH_VERSION = "0.145.0";
+const CODEX_TESTED_THROUGH_VERSION = "0.150.1";
 class BaseAdapter {
     launchContextArgs(_input) {
         return [];
@@ -51,7 +51,7 @@ class BaseAdapter {
 class CodexAdapter extends BaseAdapter {
     id = "codex";
     label = "Codex";
-    supportedVersion = "0.144.1";
+    supportedVersion = "0.150.1";
     capabilities = {
         recover: true,
         interrupt: true,
@@ -149,21 +149,31 @@ class CodexAdapter extends BaseAdapter {
         return { ...launch, argv: [...launch.argv, "resume", nativeId(input.nativeSessionId)] };
     }
     compileManagedControl(input, _mode, _nativeSessionId) {
+        const config = this.canonicalizeConfig(input.config);
+        if (config.profile !== undefined) {
+            throw new Error("Managed Codex does not accept a Codex config profile because it cannot be scoped to one "
+                + "shared-daemon thread. Use a Yui Agent Profile for skills, model, and effort.");
+        }
         const launch = this.compileNew(input);
-        const argv = [...launch.argv];
-        if (input.config.model !== undefined) {
-            const modelFlag = argv.findIndex((value, index) => (value === "--model" && argv[index + 1] === input.config.model));
+        // A managed Codex thread is an ordinary user thread. Its Yui guidance is
+        // part of the durable Task message, not a developer_instructions override
+        // that would shadow the user's native project/developer configuration.
+        const argv = withoutCodexConfigOverride(launch.argv, "developer_instructions");
+        if (config.model !== undefined) {
+            const modelFlag = argv.findIndex((value, index) => (value === "--model" && argv[index + 1] === config.model));
             if (modelFlag < 0)
                 throw new Error("Managed Codex launch lost its selected model.");
             argv.splice(modelFlag, 2);
             // App Server thread/start reads the model from resolved configuration;
             // the interactive --model shortcut is not inherited by new threads.
-            argv.push("--config", `model=${tomlString(input.config.model)}`);
+            argv.push("--config", `model=${tomlString(config.model)}`);
         }
         return {
             ...launch,
-            argv: [...argv, "app-server", "--stdio"],
-            transport: "codex-app-server-stdio"
+            argv: [...argv, "app-server", "proxy"],
+            transport: "codex-app-server-proxy",
+            codexThread: codexThreadOptions(input, config),
+            codexDaemonStartArgs: [...input.agent.baseArgs, "app-server", "daemon", "start"]
         };
     }
 }
@@ -314,6 +324,50 @@ function tomlString(value) {
         throw new Error("Agent launch context cannot contain NUL bytes.");
     return JSON.stringify(value);
 }
+function codexThreadOptions(input, config) {
+    const roots = [...new Set([
+            resolve(input.workspace),
+            ...(config.additionalDirectories ?? []).map((path) => resolve(path))
+        ])];
+    const threadConfig = {
+        // Yui has already scoped and authorized this exact managed workspace.
+        // Keep the trust override on this thread instead of mutating global config.
+        projects: { [resolve(input.workspace)]: { trust_level: "trusted" } },
+        ...(config.effort === undefined ? {} : { model_reasoning_effort: config.effort }),
+        ...(config.search === true ? { web_search: "live" } : {})
+    };
+    const permission = config.permission.strategy === "bypass"
+        ? { approvalPolicy: "never", sandbox: "danger-full-access" }
+        : config.permission.strategy === "configured"
+            ? {
+                ...(config.permission.approval === undefined
+                    ? {}
+                    : { approvalPolicy: config.permission.approval }),
+                ...(config.permission.sandbox === undefined
+                    ? {}
+                    : { sandbox: config.permission.sandbox })
+            }
+            : {};
+    return {
+        ...(config.model === undefined ? {} : { model: config.model }),
+        ...permission,
+        runtimeWorkspaceRoots: roots,
+        ...(Object.keys(threadConfig).length === 0 ? {} : { config: threadConfig })
+    };
+}
+function withoutCodexConfigOverride(argv, key) {
+    const filtered = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if ((argument === "--config" || argument === "-c")
+            && argv[index + 1]?.startsWith(`${key}=`) === true) {
+            index += 1;
+            continue;
+        }
+        filtered.push(argument);
+    }
+    return filtered;
+}
 function sessionTitle(value) {
     if (typeof value !== "string" || value.includes("\0")) {
         throw new Error("Agent session title is invalid.");

package/dist/executor/executorRegistry.js

@@ -126,6 +126,10 @@ export class ExecutorRegistry {
                 && binding?.initialTurnDeliveryUnknownRunId === input.runId
                 ? { turnDeliveryUnknownDuringLaunch: true }
                 : {}),
+            ...(input.runId !== undefined
+                && binding?.initialTurnBusyRunId === input.runId
+                ? { turnBusyDuringLaunch: true }
+                : {}),
             ...(input.runId !== undefined
                 && binding?.initialTurnRejectedRunId === input.runId
                 ? { turnRejectedDuringLaunch: true }