baychat 0.34.1 → 0.35.0

package/dist/relay/codex-app-server.js

@@ -13,6 +13,8 @@
 // as `turn/completed` rather than as a process exit. Verified against codex-cli
 // 0.114.0 on 2026-08-30: initialize → initialized → thread/resume → turn/start,
 // with the resumed thread's own MCP servers (BayChat included) started for it.
+// Approvals, `turn.status`, `turn/interrupt` and `thread/compact/start` follow the
+// official 0.160 schema (`openai/codex@rust-v0.160.0`, app-server-protocol).
 //
 // ONE PROCESS PER WAKE, NOT A HELD CONNECTION. The design note for this work
 // proposed keeping one app-server alive for the daemon's life. That buys a little
@@ -22,225 +24,700 @@
 // already has, and every win that mattered (an id we address explicitly, a
 // structured turn result, no shell) survives.
 //
-// `approvalPolicy: "never"` IS THE SECURITY BOUNDARY. A headless turn has no
-// human to ask, so the only safe policy is one that never prompts and never
-// escalates: a command needing approval fails inside the sandbox instead of
-// running because a chat message asked for it. The relay carries messages; it
-// does not acquire privileges on their behalf.
+// THE SECURITY BOUNDARY IS THE POLICY, AND A HUMAN. With no `policy` a turn runs
+// `approvalPolicy: "never"` exactly as it always has: nobody to ask, so a command
+// needing approval fails inside the sandbox instead of running because a chat
+// message asked for it. With a policy of `"on-request"` (2026-10-23, codex-runner.ts)
+// Codex ASKS — and every question goes through `onApproval`, which puts a card on
+// the owner's phone. Nothing is ever approved here by default: a request this
+// client cannot route to a person is answered with the refusal.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PausableTimer = void 0;
+exports.askingPolicy = askingPolicy;
+exports.readOnlyPolicy = readOnlyPolicy;
 exports.runCodexTurn = runCodexTurn;
+exports.runCodexCompact = runCodexCompact;
+exports.classifyMessage = classifyMessage;
+exports.refuseServerRequest = refuseServerRequest;
 exports.readCodexRateLimits = readCodexRateLimits;
 exports.parseCodexRateLimits = parseCodexRateLimits;
 const runtime_binary_1 = require("../runtime-binary");
+const codex_approvals_1 = require("./codex-approvals");
 const spawn_env_1 = require("./spawn-env");
-/** How long a whole wake may take — resume, turn, and completion. */
+/** How long a whole wake may take — resume, turn, and completion — not counting time a card is up. */
 const TURN_TIMEOUT_MS = 10 * 60_000;
 /** How long the handshake alone may take before we call the binary unusable. */
 const HANDSHAKE_TIMEOUT_MS = 30_000;
+/** After a card is answered, the turn always gets at least this long to use the answer. */
+const AFTER_CARD_MIN_MS = 2 * 60_000;
+/** How long an interrupted turn has to say `turn/completed` before its process is killed. */
+const INTERRUPT_GRACE_MS = 10_000;
 /**
- * Run one turn against an existing Codex thread and resolve with its outcome.
+ * Features a relay turn always runs with, whatever the user's config says. `exec_permission_approvals`
+ * (under development in 0.160, off by default) would add an approval path this relay has never
+ * seen and so cannot show on a card: kept off explicitly.
+ */
+const RELAY_FEATURES = { "features.exec_permission_approvals": false };
+/**
+ * Everyone who woke the turn may command the session: Codex asks before anything outside its
+ * sandbox, the sandbox writes only the workspace, and there is NO network unless a card allows it
+ * (a command's `networkApprovalContext`, or a permissions request).
+ */
+function askingPolicy() {
+    return {
+        approvalPolicy: "on-request",
+        sandbox: "workspace-write",
+        sandboxPolicy: { type: "workspaceWrite", networkAccess: false, writableRoots: [], excludeTmpdirEnvVar: false, excludeSlashTmp: false },
+        approvalsReviewer: "user",
+        config: { ...RELAY_FEATURES },
+    };
+}
+/**
+ * Somebody without command access woke the turn: it may read and answer, nothing else, and it
+ * never asks (no cards). Under `"never"` Codex 0.160 DENIES an MCP tool call that needs approval
+ * (core/src/mcp_tool_call.rs), which would include BayChat's own `send_message` — so BayChat's
+ * entry is set to approve its own tools for this wake, or the turn could not answer at all.
+ */
+function readOnlyPolicy(mcpEntry) {
+    return {
+        approvalPolicy: "never",
+        sandbox: "read-only",
+        sandboxPolicy: { type: "readOnly", networkAccess: false },
+        config: { ...RELAY_FEATURES, ...(mcpEntry ? { [`mcp_servers.${mcpEntry}.default_tools_approval_mode`]: "approve" } : {}) },
+    };
+}
+/**
+ * A timer that can be paused and resumed, remembering how long it had left.
+ *
+ * The turn's 10 minutes are Codex's, not the person's: a card can sit on a phone for its own
+ * 10 minutes, and a turn that timed out while its owner was reading the question would throw the
+ * answer away. So the clock stops while a card is up, and on resume the turn always has at least
+ * `minMs` to act on the answer.
+ */
+class PausableTimer {
+    fire;
+    timer;
+    remaining;
+    startedAt = 0;
+    done = false;
+    constructor(ms, fire) {
+        this.fire = fire;
+        this.remaining = ms;
+        this.arm();
+    }
+    get msLeft() {
+        return this.timer ? Math.max(0, this.remaining - (Date.now() - this.startedAt)) : this.remaining;
+    }
+    pause() {
+        if (!this.timer || this.done)
+            return;
+        this.remaining = this.msLeft;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+    }
+    resume(minMs = 0) {
+        if (this.timer || this.done)
+            return;
+        this.remaining = Math.max(this.remaining, minMs);
+        this.arm();
+    }
+    clear() {
+        this.done = true;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+    }
+    arm() {
+        this.startedAt = Date.now();
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            this.done = true;
+            this.fire();
+        }, this.remaining);
+    }
+}
+exports.PausableTimer = PausableTimer;
+/**
+ * Start `codex app-server` and frame its JSON-RPC: newline-delimited, our ids `bc-N`, server
+ * requests told apart by their method (`classifyMessage`). Returns the reason when there is no
+ * argv to run.
+ */
+function openAppServer(binaryPath, cwd, spawn, handlers) {
+    // A Windows .cmd needs its interpreter named, exactly as the plain-spawn
+    // path does. This was missed when that fix landed, and the result was
+    // `delivery failed for CodexTest: spawn EINVAL` on every wake — the
+    // transport failing before the handshake, on a machine where Codex was
+    // installed and working.
+    // `app-server` is a fixed word, so a plan always yields argv — `!ok` is unreachable here.
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform), ["app-server"]);
+    if (!run.ok)
+        return { error: run.reason };
+    const child = spawn(run.file, run.args, {
+        windowsHide: true,
+        windowsVerbatimArguments: run.verbatim,
+        cwd,
+        // Same reason as `runHeadless`: an npm-installed codex is a script with a
+        // `#!/usr/bin/env node` shebang and the daemon's PATH has no node. Both
+        // spawn sites need this — fixing only one leaves the other dying with
+        // exit 127 the moment it becomes the reachable path.
+        env: (0, spawn_env_1.headlessSpawnEnv)(),
+        // No shell, ever: the prompt carries message text written by other people
+        // in the room, and a shell string would make `$(…)` in a chat message run
+        // on this box. Nothing here is concatenated into a command line.
+        shell: false,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    let nextId = 0;
+    // OUR request ids are strings ("bc-0", "bc-1", …) and the server's are its own: a server
+    // REQUEST is told apart by its `method`, never by its id (see `classifyMessage`).
+    const pending = new Map();
+    let stdoutBuffer = "";
+    let stderrTail = "";
+    let ended = false;
+    const end = (info) => {
+        if (ended)
+            return;
+        ended = true;
+        handlers.onEnd(info);
+    };
+    const write = (obj) => {
+        if (ended)
+            return;
+        child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", ...obj })}\n`);
+    };
+    child.stdout?.on("data", (chunk) => {
+        stdoutBuffer += chunk.toString();
+        // Newline-delimited JSON. A partial line is kept for the next chunk;
+        // parsing one would be the classic framing bug.
+        let newline = stdoutBuffer.indexOf("\n");
+        while (newline >= 0) {
+            const line = stdoutBuffer.slice(0, newline).trim();
+            stdoutBuffer = stdoutBuffer.slice(newline + 1);
+            newline = stdoutBuffer.indexOf("\n");
+            if (line === "")
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                // Not our protocol. Ignored rather than fatal: the binary is entitled
+                // to print things, and a stray line must not lose a turn that is
+                // otherwise proceeding normally.
+                continue;
+            }
+            const kind = classifyMessage(message);
+            if (kind === "response") {
+                const waiting = pending.get(String(message.id));
+                if (!waiting)
+                    continue; // not ours, or answered already: never guessed at
+                pending.delete(String(message.id));
+                waiting(message);
+            }
+            else if (kind === "request") {
+                handlers.onServerRequest(message);
+            }
+            else if (kind === "notification") {
+                handlers.onNotification(message);
+            }
+        }
+    });
+    child.stderr?.on("data", (chunk) => {
+        // Bounded, and kept only to explain a failure. Codex logs freely here even
+        // on a healthy run, so it is never treated as a failure signal by itself.
+        stderrTail = `${stderrTail}${chunk.toString()}`.slice(-2_000);
+    });
+    // A child that died before reading: its stdin errors (EPIPE), which must not crash the relay.
+    // `close` follows and reports it.
+    child.stdin?.on("error", () => { });
+    child.on("error", (err) => end({ startError: err.message }));
+    child.on("close", (code) => end({ code }));
+    return {
+        request: (method, params) => new Promise((res) => {
+            const id = `bc-${nextId++}`;
+            pending.set(id, res);
+            write({ id, method, params });
+        }),
+        notify: (method, params) => write({ method, params }),
+        /** Answer a server request: its id VERBATIM (a number stays a number), and a result or an error. */
+        respond: (id, answer) => write({ id, ...answer }),
+        kill: () => {
+            ended = true;
+            child.kill("SIGTERM");
+            // A child that ignores the polite signal would otherwise outlive the relay
+            // and keep answering a room nobody is watching.
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref();
+        },
+        stderrTail: () => stderrTail,
+    };
+}
+/** The handshake every wake starts with. Resolves an error message, or undefined. */
+async function handshake(conn) {
+    const initialized = await conn.request("initialize", {
+        clientInfo: { name: "baychat-relay", title: "BayChat relay", version: CLIENT_VERSION },
+    });
+    if (initialized.error)
+        return initialized.error.message;
+    conn.notify("initialized", {});
+    return undefined;
+}
+/** `thread/resume` or `thread/start` params for a policy — undefined fields left out. */
+function threadParams(policy, cwd) {
+    // See the file header: with no policy, nothing may be approved.
+    if (!policy)
+        return { cwd, approvalPolicy: "never" };
+    return {
+        cwd,
+        approvalPolicy: policy.approvalPolicy,
+        sandbox: policy.sandbox,
+        ...(policy.approvalsReviewer ? { approvalsReviewer: policy.approvalsReviewer } : {}),
+        ...(policy.config ? { config: policy.config } : {}),
+    };
+}
+/** A `thread/resume` refusal, said so a person can act on it. */
+function resumeRefusal(threadId, message) {
+    // "already has an active writer" is not a fault — it is the interactive
+    // session being OPEN. A thread being written by a live Codex TUI cannot
+    // also be resumed from outside it, and that is the correct behaviour:
+    // two writers on one thread is the failure mode, not the refusal.
+    //
+    // It also names the remedy exactly. A live session is reachable through
+    // its `relay attach`, which is what attach is FOR; headless resume is
+    // for a session whose terminal has gone. Saying "could not resume" and
+    // stopping there sends someone hunting for a break that is not there.
+    if (/active writer/i.test(message)) {
+        return {
+            kind: "failed",
+            transportUnusable: false,
+            reason: `Codex session "${threadId}" is open in a terminal, so it cannot be resumed from ` +
+                `outside it — a live session is woken through \`baychat relay attach\`, which must be ` +
+                `running in that session. Close the terminal to make it headlessly resumable instead.`,
+        };
+    }
+    // The distinct failure `exec resume` could never report: the id does not
+    // name a thread on this machine. Worth saying plainly, because the usual
+    // cause is a Codex whose sessions live somewhere else — a snap install
+    // keeps them under ~/snap/codex/current/sessions.
+    return {
+        kind: "failed",
+        transportUnusable: false,
+        threadMissing: /no rollout|not found|unknown thread|does not exist/i.test(message),
+        reason: `codex could not resume thread ${threadId}: ${message}`,
+    };
+}
+/**
+ * Run one turn against a Codex thread and resolve with its outcome.
  *
  * Never throws and never rejects: every failure — a binary that will not start,
  * a thread id that names nothing, a protocol error, a timeout — is a `failed`
  * outcome carrying its reason. The caller's job is to record that, and a thrown
  * exception would only turn a describable state into a stack trace.
+ *
+ * Approval requests are answered ONE AT A TIME, in the order they arrived (a person reads one
+ * card at a time, and Codex's later requests usually depend on the earlier answer). While any is
+ * waiting, the turn's clock is paused. One Codex settled itself (`serverRequest/resolved`) is
+ * withdrawn and never answered. Only `turn.status: "completed"` counts as an answer:
+ * `interrupted` and `failed` are failures with their reason.
  */
 function runCodexTurn(req, deps) {
-    const spawn = deps.spawn;
     const turnTimeout = deps.turnTimeoutMs ?? TURN_TIMEOUT_MS;
     const handshakeTimeout = deps.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    const graceMs = deps.interruptGraceMs ?? INTERRUPT_GRACE_MS;
+    const afterCardMs = deps.afterCardMinMs ?? AFTER_CARD_MIN_MS;
+    const log = req.log ?? (() => { });
     return new Promise((resolve) => {
-        // A Windows .cmd needs its interpreter named, exactly as the plain-spawn
-        // path does. This was missed when that fix landed, and the result was
-        // `delivery failed for CodexTest: spawn EINVAL` on every wake — the
-        // transport failing before the handshake, on a machine where Codex was
-        // installed and working.
-        // `app-server` is a fixed word, so a plan always yields argv — `!ok` is unreachable here.
-        const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(req.binaryPath, process.platform), ["app-server"]);
-        if (!run.ok)
-            return resolve({ kind: "failed", transportUnusable: true, reason: run.reason });
-        const child = spawn(run.file, run.args, {
-            windowsHide: true,
-            windowsVerbatimArguments: run.verbatim,
-            cwd: req.cwd,
-            // Same reason as `runHeadless`: an npm-installed codex is a script with a
-            // `#!/usr/bin/env node` shebang and the daemon's PATH has no node. Both
-            // spawn sites need this — fixing only one leaves the other dying with
-            // exit 127 the moment it becomes the reachable path.
-            env: (0, spawn_env_1.headlessSpawnEnv)(),
-            // No shell, ever: the prompt carries message text written by other people
-            // in the room, and a shell string would make `$(…)` in a chat message run
-            // on this box. Nothing here is concatenated into a command line.
-            shell: false,
-            stdio: ["pipe", "pipe", "pipe"],
-        });
         let settled = false;
-        let nextId = 0;
-        const pending = new Map();
-        let stdoutBuffer = "";
-        let stderrTail = "";
-        /** Resolve once, and always leave no process behind. */
+        let threadId = req.threadId;
+        let startedThread = false;
+        let turnId;
+        let stopping = false;
+        let turnTimer;
+        let graceTimer;
+        /** Items an approval may refer to, by item id (a file change's diff is only here). */
+        const items = new Map();
+        /** Server requests Codex settled itself; key = String(id). */
+        const resolvedByServer = new Set();
+        /** The answer each in-flight request is waiting for, so it can be called off. */
+        const inFlight = new Map();
+        let approvals = Promise.resolve();
+        let asking = 0;
+        /** Resolve once, and always leave no process behind and no card up. */
         const finish = (outcome) => {
             if (settled)
                 return;
             settled = true;
-            clearTimeout(timer);
-            child.kill("SIGTERM");
-            // A child that ignores the polite signal would otherwise outlive the relay
-            // and keep answering a room nobody is watching.
-            setTimeout(() => child.kill("SIGKILL"), 5_000).unref();
+            clearTimeout(handshakeTimer);
+            clearTimeout(graceTimer);
+            turnTimer?.clear();
+            for (const ac of inFlight.values())
+                ac.abort();
+            req.signal?.removeEventListener("abort", onAbort);
+            conn.kill();
             resolve(outcome);
         };
-        let timer = setTimeout(() => finish({
+        const handshakeTimer = setTimeout(() => finish({
             kind: "failed",
             transportUnusable: true,
             reason: `codex app-server did not complete the handshake within ${Math.round(handshakeTimeout / 1000)}s`,
         }), handshakeTimeout);
-        const request = (method, params) => new Promise((res) => {
-            const id = nextId++;
-            pending.set(id, res);
-            child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
-        });
-        const notify = (method, params) => {
-            child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+        /** Turn ends that arrived before we knew our own turn's id (the answer to turn/start is a
+         *  response; the notification can overtake it). Settled once the id is known. */
+        const early = new Map();
+        const learnTurnId = (id) => {
+            if (turnId)
+                return;
+            turnId = id;
+            const waiting = early.get(id);
+            early.clear();
+            if (waiting)
+                onTurnCompleted(waiting);
         };
-        child.stdout?.on("data", (chunk) => {
-            stdoutBuffer += chunk.toString();
-            // Newline-delimited JSON. A partial line is kept for the next chunk;
-            // parsing one would be the classic framing bug.
-            let newline = stdoutBuffer.indexOf("\n");
-            while (newline >= 0) {
-                const line = stdoutBuffer.slice(0, newline).trim();
-                stdoutBuffer = stdoutBuffer.slice(newline + 1);
-                newline = stdoutBuffer.indexOf("\n");
-                if (line === "")
-                    continue;
-                let message;
-                try {
-                    message = JSON.parse(line);
-                }
-                catch {
-                    // Not our protocol. Ignored rather than fatal: the binary is entitled
-                    // to print things, and a stray line must not lose a turn that is
-                    // otherwise proceeding normally.
-                    continue;
-                }
-                if (typeof message.id === "number" && pending.has(message.id)) {
-                    const waiting = pending.get(message.id);
-                    pending.delete(message.id);
-                    waiting?.(message);
-                    continue;
+        const onTurnCompleted = (params) => {
+            const turn = (params.turn ?? null);
+            if (turn && typeof turn.id === "string") {
+                if (!turnId) {
+                    early.set(turn.id, params);
+                    return;
                 }
+                // Another turn's end (a compaction it ran first) is not ours.
+                if (turn.id !== turnId)
+                    return;
+            }
+            // A Codex older than `turn.status` (0.114 sent `{threadId}` alone) only ever said this for
+            // a finished turn, so a missing status reads as completed. A present one is believed.
+            const status = turn && typeof turn.status === "string" ? turn.status : "completed";
+            if (status === "completed") {
+                finish(startedThread && threadId ? { kind: "completed", threadId } : { kind: "completed" });
+                return;
+            }
+            const error = (turn?.error ?? null);
+            const detail = error && typeof error.message === "string" ? `: ${error.message}` : "";
+            if (status === "interrupted") {
+                finish({ kind: "failed", transportUnusable: false, stopped: stopping, reason: stopping ? "the turn was stopped from BayChat" : `Codex interrupted the turn${detail}` });
+                return;
+            }
+            finish({ kind: "failed", transportUnusable: false, reason: `the Codex turn ${status === "failed" ? "failed" : `ended as "${status}"`}${detail}` });
+        };
+        const onNotification = (message) => {
+            const method = message.method;
+            const params = (message.params ?? {});
+            try {
+                req.onNotification?.(method, params);
+            }
+            catch {
+                // The log is never worth a turn.
+            }
+            if (method === "item/started" || method === "item/completed") {
+                const item = (0, codex_approvals_1.cachedItemFrom)(params.item);
+                if (item)
+                    items.set(item.id, item);
+            }
+            else if (method === "item/fileChange/patchUpdated") {
+                const id = typeof params.itemId === "string" ? params.itemId : "";
+                if (id)
+                    items.set(id, { type: "fileChange", id, changes: (0, codex_approvals_1.fileChangesFrom)(params.changes) });
+            }
+            else if (method === "turn/started") {
+                const turn = (params.turn ?? {});
+                if (typeof turn.id === "string")
+                    learnTurnId(turn.id);
+            }
+            else if (method === "serverRequest/resolved") {
+                const key = String(params.requestId);
+                resolvedByServer.add(key);
+                inFlight.get(key)?.abort();
+            }
+            else if (method === "turn/completed") {
                 // `turn/completed` is the end of the wake — the whole reason this
                 // transport is better than an exit code.
-                if (message.method === "turn/completed")
-                    finish({ kind: "completed" });
+                onTurnCompleted(params);
             }
-        });
-        child.stderr?.on("data", (chunk) => {
-            // Bounded, and kept only to explain a failure. Codex logs freely here even
-            // on a healthy run, so it is never treated as a failure signal by itself.
-            const text = chunk.toString();
-            stderrTail = `${stderrTail}${text}`.slice(-2_000);
-        });
-        child.on("error", (err) => {
-            finish({
-                kind: "failed",
-                transportUnusable: true,
-                reason: `could not start codex app-server: ${err.message}`,
+        };
+        const onServerRequest = (message) => {
+            const id = message.id;
+            const method = message.method;
+            const params = (message.params ?? {});
+            if (stopping) {
+                // The turn is being stopped: nothing more is asked of anyone, and nothing is allowed from
+                // memory either — every question in the grace period is refused.
+                log(`codex asked ${method} while stopping — refused`);
+                conn.respond(id, refuseServerRequest(method));
+                return;
+            }
+            if (!(0, codex_approvals_1.isCodexApprovalMethod)(method) || !req.onApproval) {
+                // Codex is asking US something we do not route to a person. Every such question must
+                // be answered, or the turn waits on it until the timeout; the answer is the refusal.
+                log(`codex asked ${method} — refused (${req.onApproval ? "not something this relay asks a person" : "nobody to ask in this turn"})`);
+                conn.respond(id, refuseServerRequest(method));
+                return;
+            }
+            const key = String(id);
+            const itemId = typeof params.itemId === "string" ? params.itemId : "";
+            const ac = new AbortController();
+            inFlight.set(key, ac);
+            // Serialized: one card at a time, in the order Codex asked.
+            approvals = approvals.then(async () => {
+                let answer;
+                let asked = false;
+                const personAsked = () => {
+                    if (asked)
+                        return;
+                    asked = true;
+                    asking += 1;
+                    turnTimer?.pause();
+                };
+                try {
+                    if (settled || resolvedByServer.has(key))
+                        return;
+                    // A stop that came while this one waited its turn: refused, never asked.
+                    answer = stopping
+                        ? refuseServerRequest(method).result
+                        : await req.onApproval({ method, params, ...(items.get(itemId) ? { item: items.get(itemId) } : {}) }, ac.signal, { personAsked });
+                }
+                catch (err) {
+                    log(`approval for ${method} failed (${err instanceof Error ? err.message : String(err)}) — refused`);
+                    answer = refuseServerRequest(method).result;
+                }
+                finally {
+                    inFlight.delete(key);
+                    if (asked) {
+                        asking -= 1;
+                        if (asking === 0)
+                            turnTimer?.resume(afterCardMs);
+                    }
+                }
+                // Codex settled it while the card was up (or the turn is over): answering now would be
+                // an answer to nothing — or worse, to a request id it has since reused.
+                if (settled || resolvedByServer.has(key))
+                    return;
+                conn.respond(id, { result: answer });
             });
-        });
-        child.on("close", (code) => {
-            // Only meaningful if we have not already completed: an expected exit
-            // follows our own SIGTERM.
-            finish({
+        };
+        const opened = openAppServer(req.binaryPath, req.cwd, deps.spawn, {
+            onNotification,
+            onServerRequest,
+            onEnd: ({ startError, code }) => finish({
                 kind: "failed",
                 // Dying before the turn completed means the transport did not work,
-                // whatever the cause — worth one attempt down the older path.
-                transportUnusable: true,
-                reason: `codex app-server exited ${code ?? "on a signal"} before the turn completed${firstLine(stderrTail)}`,
-            });
+                // whatever the cause — worth one attempt down the older path. Unless
+                // WE stopped it: then there is nothing to retry.
+                transportUnusable: !stopping,
+                ...(stopping ? { stopped: true } : {}),
+                reason: startError !== undefined
+                    ? `could not start codex app-server: ${startError}`
+                    : `codex app-server exited ${code ?? "on a signal"} before the turn completed${firstLine(conn.stderrTail())}`,
+            }),
         });
+        if ("error" in opened) {
+            clearTimeout(handshakeTimer);
+            settled = true;
+            resolve({ kind: "failed", transportUnusable: true, reason: opened.error });
+            return;
+        }
+        const conn = opened;
+        /** `/stop`, End: ask Codex to stop the turn, and kill the process if it does not. */
+        const onAbort = () => {
+            if (settled || stopping)
+                return;
+            stopping = true;
+            for (const ac of inFlight.values())
+                ac.abort();
+            if (!turnId || !threadId) {
+                // No turn to interrupt yet: ending the process is the whole stop.
+                finish({ kind: "failed", transportUnusable: false, stopped: true, reason: "the turn was stopped from BayChat" });
+                return;
+            }
+            void conn.request("turn/interrupt", { threadId, turnId });
+            graceTimer = setTimeout(() => finish({ kind: "failed", transportUnusable: false, stopped: true, reason: "the turn was stopped from BayChat" }), graceMs);
+        };
+        if (req.signal?.aborted) {
+            clearTimeout(handshakeTimer);
+            settled = true;
+            resolve({ kind: "failed", transportUnusable: false, stopped: true, reason: "the turn was stopped from BayChat" });
+            conn.kill();
+            return;
+        }
+        req.signal?.addEventListener("abort", onAbort, { once: true });
         void (async () => {
-            const initialized = await request("initialize", {
-                clientInfo: {
-                    name: "baychat-relay",
-                    title: "BayChat relay",
-                    version: CLIENT_VERSION,
-                },
-            });
-            if (initialized.error) {
-                finish({
-                    kind: "failed",
-                    transportUnusable: true,
-                    reason: `codex app-server refused the handshake: ${initialized.error.message}`,
-                });
+            const refused = await handshake(conn);
+            if (settled)
+                return;
+            if (refused !== undefined) {
+                finish({ kind: "failed", transportUnusable: true, reason: `codex app-server refused the handshake: ${refused}` });
                 return;
             }
-            notify("initialized", {});
-            const resumed = await request("thread/resume", {
-                threadId: req.threadId,
-                cwd: req.cwd,
-                // See the file header: no human is present, so nothing may be approved.
-                approvalPolicy: "never",
-            });
-            if (resumed.error) {
-                // "already has an active writer" is not a fault — it is the interactive
-                // session being OPEN. A thread being written by a live Codex TUI cannot
-                // also be resumed from outside it, and that is the correct behaviour:
-                // two writers on one thread is the failure mode, not the refusal.
-                //
-                // It also names the remedy exactly. A live session is reachable through
-                // its `relay attach`, which is what attach is FOR; headless resume is
-                // for a session whose terminal has gone. Saying "could not resume" and
-                // stopping there sends someone hunting for a break that is not there.
-                if (/active writer/i.test(resumed.error.message)) {
-                    finish({
-                        kind: "failed",
-                        transportUnusable: false,
-                        reason: `Codex session "${req.threadId}" is open in a terminal, so it cannot be resumed from ` +
-                            `outside it — a live session is woken through \`baychat relay attach\`, which must be ` +
-                            `running in that session. Close the terminal to make it headlessly resumable instead.`,
-                    });
+            if (threadId) {
+                const resumed = await conn.request("thread/resume", { threadId, ...threadParams(req.policy, req.cwd) });
+                if (settled)
+                    return;
+                if (resumed.error)
+                    return finish(resumeRefusal(threadId, resumed.error.message));
+            }
+            else {
+                const started = await conn.request("thread/start", threadParams(req.policy, req.cwd));
+                if (settled)
                     return;
+                const id = (started.result ?? {}).thread?.id;
+                if (started.error || typeof id !== "string") {
+                    return finish({ kind: "failed", transportUnusable: false, reason: `codex could not start a new thread: ${started.error?.message ?? "no thread id in its answer"}` });
                 }
-                // The distinct failure `exec resume` could never report: the id does not
-                // name a thread on this machine. Worth saying plainly, because the usual
-                // cause is a Codex whose sessions live somewhere else — a snap install
-                // keeps them under ~/snap/codex/current/sessions.
-                finish({
-                    kind: "failed",
-                    transportUnusable: false,
-                    reason: `codex could not resume thread ${req.threadId}: ${resumed.error.message}`,
-                });
-                return;
+                threadId = id;
+                startedThread = true;
             }
             // The handshake is done; the clock is now the turn's, which is far longer.
-            clearTimeout(timer);
-            timer = setTimeout(() => finish({
+            clearTimeout(handshakeTimer);
+            turnTimer = new PausableTimer(turnTimeout, () => finish({
                 kind: "failed",
                 transportUnusable: false,
                 reason: `codex turn did not complete within ${Math.round(turnTimeout / 60_000)} minutes`,
-            }), turnTimeout);
-            const started = await request("turn/start", {
-                threadId: req.threadId,
+            }));
+            if (asking > 0)
+                turnTimer.pause();
+            const started = await conn.request("turn/start", {
+                threadId,
                 input: [{ type: "text", text: req.prompt }],
-                approvalPolicy: "never",
+                approvalPolicy: req.policy?.approvalPolicy ?? "never",
+                ...(req.policy ? { sandboxPolicy: req.policy.sandboxPolicy } : {}),
+                ...(req.policy?.approvalsReviewer ? { approvalsReviewer: req.policy.approvalsReviewer } : {}),
             });
+            if (settled)
+                return;
             if (started.error) {
                 finish({
                     kind: "failed",
                     transportUnusable: false,
                     reason: `codex refused the turn: ${started.error.message}`,
                 });
+                return;
             }
+            const id = (started.result ?? {}).turn?.id;
+            if (typeof id === "string")
+                learnTurnId(id);
+            else if (!turnId && early.size > 0)
+                onTurnCompleted([...early.values()][0]); // an answer with no id: the only turn there is
             // Success is NOT the response to turn/start — that only says the turn was
             // accepted. The wake ends at the `turn/completed` notification, handled above.
         })();
     });
 }
+/** How long a compaction may take before the relay gives up on it. */
+const COMPACT_TIMEOUT_MS = 5 * 60_000;
+/**
+ * A short exchange with one `codex app-server` process: handshake, `body`, kill. Every server
+ * request on the way is refused (nobody is asked during setup or a compaction). Resolves what
+ * `body` settles with, or a failure — never throws.
+ */
+function shortExchange(binaryPath, cwd, deps, timeoutMs, what, fail, body) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let handler;
+        const done = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            conn.kill();
+            resolve(value);
+        };
+        const opened = openAppServer(binaryPath, cwd, deps.spawn, {
+            onNotification: (m) => handler?.(m.method, (m.params ?? {})),
+            onServerRequest: (m) => conn.respond(m.id, refuseServerRequest(m.method)),
+            onEnd: ({ startError, code }) => done(fail(startError !== undefined ? `could not start codex app-server: ${startError}` : `codex app-server exited ${code ?? "on a signal"} before ${what} finished${firstLine(conn.stderrTail())}`, true)),
+        });
+        if ("error" in opened)
+            return resolve(fail(opened.error, true));
+        const conn = opened;
+        const timer = setTimeout(() => done(fail(`${what} did not finish within ${Math.round(timeoutMs / 1000)}s`, false)), timeoutMs);
+        void (async () => {
+            const refused = await handshake(conn);
+            if (settled)
+                return;
+            if (refused !== undefined)
+                return done(fail(`codex app-server refused the handshake: ${refused}`, true));
+            await body(conn, done, { on: (h) => (handler = h) });
+        })();
+    });
+}
+/**
+ * `/compact` for a relay-run Codex: resume the thread, ask it to compact (`thread/compact/start`,
+ * which answers `{}` at once), and wait for the compaction to end — `thread/compacted`, or the
+ * compaction turn's `turn/completed`. At most five minutes. Never throws.
+ */
+function runCodexCompact(req, deps) {
+    const fail = (reason, transportUnusable) => ({ kind: "failed", reason, transportUnusable });
+    if (req.signal?.aborted)
+        return Promise.resolve({ kind: "failed", reason: "the compaction was stopped", transportUnusable: false, stopped: true });
+    return shortExchange(req.binaryPath, req.cwd, deps, deps.compactTimeoutMs ?? COMPACT_TIMEOUT_MS, "the compaction", fail, async (conn, done, notifications) => {
+        req.signal?.addEventListener("abort", () => done({ kind: "failed", reason: "the compaction was stopped", transportUnusable: false, stopped: true }), { once: true });
+        notifications.on((method, params) => {
+            try {
+                req.onNotification?.(method, params);
+            }
+            catch {
+                // The log is never worth a compaction.
+            }
+            if (method === "thread/compacted")
+                return done({ kind: "completed" });
+            if (method === "turn/completed") {
+                const turn = (params.turn ?? null);
+                const status = turn && typeof turn.status === "string" ? turn.status : "completed";
+                const error = (turn?.error ?? null);
+                done(status === "completed" ? { kind: "completed" } : fail(`the compaction ended as "${status}"${error && typeof error.message === "string" ? `: ${error.message}` : ""}`, false));
+            }
+        });
+        const resumed = await conn.request("thread/resume", { threadId: req.threadId, ...threadParams(req.policy, req.cwd) });
+        if (resumed.error)
+            return done(resumeRefusal(req.threadId, resumed.error.message));
+        const compact = await conn.request("thread/compact/start", { threadId: req.threadId });
+        if (compact.error)
+            done(fail(`codex refused to compact: ${compact.error.message}`, false));
+    });
+}
 /** Reported to Codex as the client version. Kept in step with the package. */
 const CLIENT_VERSION = "0.12.0";
+/**
+ * What one line from `codex app-server` is.
+ *
+ * A line with a `method` AND an `id` is a REQUEST from the server — an approval it wants
+ * answered, an elicitation, a tool call. A line with an `id` and no `method` is a RESPONSE to one
+ * of ours. Before 2026-10-23 this client only looked at the id, so a server request whose id
+ * happened to equal one of our own numeric ids (both sides counted from 0) was taken as the
+ * answer to OUR request — `initialize` "answered" by an approval request — and the real answer
+ * was then dropped as unknown. The method decides, and our ids are strings besides.
+ */
+function classifyMessage(message) {
+    const hasId = message.id !== undefined && message.id !== null;
+    if (typeof message.method === "string")
+        return hasId ? "request" : "notification";
+    return hasId ? "response" : "other";
+}
+/** JSON-RPC "method not found": what a request this client does not handle is answered with. */
+const NOT_HANDLED = -32601;
+/**
+ * The answer to a server request when there is nobody to ask — every one a refusal.
+ *
+ * Shapes from the official 0.160 schema (`codex-rs/app-server-protocol/schema/json`): the v2
+ * approvals take `{decision}` with "decline" (the agent carries on without it); permissions are
+ * granted as an EMPTY profile; an MCP elicitation is declined; the legacy v1 approvals take
+ * `{decision: "denied"}`. Anything else — a request for user input, a dynamic tool call, an auth
+ * refresh — is not something this client does, and says so as a JSON-RPC error rather than
+ * leaving the turn waiting for an answer that never comes.
+ */
+function refuseServerRequest(method) {
+    switch (method) {
+        case "item/commandExecution/requestApproval":
+        case "item/fileChange/requestApproval":
+            return { result: { decision: "decline" } };
+        case "item/permissions/requestApproval":
+            return { result: { permissions: {}, scope: "turn" } };
+        case "mcpServer/elicitation/request":
+            return { result: { action: "decline" } };
+        case "execCommandApproval":
+        case "applyPatchApproval":
+            return { result: { decision: "denied" } };
+        default:
+            return { error: { code: NOT_HANDLED, message: `baychat-relay does not handle ${method}` } };
+    }
+}
 /** One line of captured stderr, for appending to a failure reason. */
 function firstLine(text) {
     for (const line of text.split("\n")) {
@@ -300,13 +777,16 @@ function readCodexRateLimits(binaryPath, deps) {
                 catch {
                     continue;
                 }
-                if (message.id === 0) {
+                // Only a RESPONSE can answer ours; a server request with a colliding id is not one.
+                if (classifyMessage(message) !== "response")
+                    continue;
+                if (message.id === "bc-0") {
                     if (message.error)
                         return finish(null);
                     send({ method: "initialized", params: {} });
-                    send({ id: 1, method: "account/rateLimits/read", params: {} });
+                    send({ id: "bc-1", method: "account/rateLimits/read", params: {} });
                 }
-                else if (message.id === 1) {
+                else if (message.id === "bc-1") {
                     return finish(message.error ? null : parseCodexRateLimits(message.result));
                 }
             }
@@ -317,7 +797,7 @@ function readCodexRateLimits(binaryPath, deps) {
         child.stderr?.on("data", () => { });
         child.on("error", () => finish(null));
         child.on("close", () => finish(null));
-        send({ id: 0, method: "initialize", params: { clientInfo: { name: "baychat-relay", title: "BayChat relay", version: CLIENT_VERSION } } });
+        send({ id: "bc-0", method: "initialize", params: { clientInfo: { name: "baychat-relay", title: "BayChat relay", version: CLIENT_VERSION } } });
     });
 }
 /**