ds-harness-remote 0.4.9 → 0.4.12

package/dist/index.js

@@ -4055,6 +4055,10 @@ var HARNESS_API_TRANSFER_CHUNK_BYTES = 512 * 1024;
 var CODEX_APP_TRANSFER_CHUNK_BYTES = 512 * 1024;
 var MAX_HARNESS_API_TRANSFER_BYTES = 288 * 1024 * 1024;
 var MAX_CODEX_APP_TRANSFER_BYTES = 288 * 1024 * 1024;
+var MAX_DEVICE_NAME_LENGTH = 128;
+var MAX_DEVICE_PLATFORM_LENGTH = 64;
+var MAX_DEVICE_VERSION_LENGTH = 64;
+var MAX_AUTH_TOKEN_LENGTH = 8 * 1024;
 var SECURE_FRAGMENT_MAGIC = new Uint8Array([68, 83, 72, 70]);
 var SECURE_FRAGMENT_VERSION = 1;
 var SECURE_FRAGMENT_HEADER_BYTES = 17;
@@ -4138,6 +4142,73 @@ var messageTypeSchema = external_exports.enum(messageTypes);
 var controlFrameTypeSchema = external_exports.enum(controlFrameTypes);
 var uniqueStrings = (values) => new Set(values).size === values.length;
 var uniqueNumbers = (values) => new Set(values).size === values.length;
+var utf8Length = (value) => new TextEncoder().encode(value).byteLength;
+var boundedUtf8Schema = (minimum, maximum) => external_exports.string().refine((value) => utf8Length(value) >= minimum && utf8Length(value) <= maximum);
+var deviceIdSchema = external_exports.string().refine((value) => /^[0-9A-HJKMNP-TV-Z]{26}$/iu.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value), "Device ID must be a ULID or UUID.");
+var deviceNameSchema = boundedUtf8Schema(1, MAX_DEVICE_NAME_LENGTH).refine((value) => value.trim().length > 0, "Device name must contain visible text.");
+var devicePlatformSchema = external_exports.string().min(1).max(MAX_DEVICE_PLATFORM_LENGTH).regex(/^[a-z0-9][a-z0-9._-]*$/u);
+var identityKeySchema = external_exports.string().regex(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/u);
+var deviceVersionSchema = boundedUtf8Schema(1, MAX_DEVICE_VERSION_LENGTH);
+var authTokenSchema = boundedUtf8Schema(16, MAX_AUTH_TOKEN_LENGTH);
+var expiresAtSchema = external_exports.number().int().positive().safe();
+var hostDeviceDescriptorSchema = external_exports.object({
+  deviceId: deviceIdSchema,
+  name: deviceNameSchema,
+  role: external_exports.literal("host"),
+  platform: devicePlatformSchema,
+  identityKey: identityKeySchema,
+  clientVersion: deviceVersionSchema,
+  harnessVersion: deviceVersionSchema.optional()
+}).strict();
+var clientDeviceDescriptorSchema = external_exports.object({
+  deviceId: deviceIdSchema,
+  name: deviceNameSchema,
+  role: external_exports.literal("client"),
+  platform: devicePlatformSchema,
+  identityKey: identityKeySchema,
+  clientVersion: deviceVersionSchema
+}).strict();
+var accountDeviceDescriptorSchema = external_exports.union([
+  hostDeviceDescriptorSchema,
+  clientDeviceDescriptorSchema
+]);
+var deviceRegistrationRequestSchema = external_exports.object({
+  v: external_exports.literal(PROTOCOL_VERSION),
+  device: accountDeviceDescriptorSchema
+}).strict();
+var hostRegistrationCodeRequestSchema = external_exports.object({
+  v: external_exports.literal(PROTOCOL_VERSION),
+  code: external_exports.string().regex(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/u),
+  device: hostDeviceDescriptorSchema
+}).strict();
+var deviceRefreshRequestSchema = external_exports.object({
+  deviceId: deviceIdSchema,
+  refreshToken: authTokenSchema
+}).strict();
+var deviceTokenPairSchema = external_exports.object({
+  accessToken: authTokenSchema,
+  accessTokenExpiresAt: expiresAtSchema,
+  refreshToken: authTokenSchema,
+  refreshTokenExpiresAt: expiresAtSchema
+}).strict();
+var browserAuthorizationExchangeRequestSchema = external_exports.object({
+  v: external_exports.literal(PROTOCOL_VERSION),
+  device: external_exports.object({
+    deviceId: deviceIdSchema,
+    name: deviceNameSchema,
+    role: external_exports.literal("client"),
+    platform: external_exports.literal("browser"),
+    identityKey: identityKeySchema,
+    clientVersion: deviceVersionSchema
+  }).strict()
+}).strict();
+var browserAuthorizationExchangeResponseSchema = external_exports.object({
+  accessToken: authTokenSchema,
+  accessTokenExpiresAt: expiresAtSchema,
+  refreshToken: authTokenSchema,
+  refreshTokenExpiresAt: expiresAtSchema,
+  account: boundedUtf8Schema(1, 254).refine((value) => value.trim().length > 0)
+}).strict();
 var remoteMessageSchema = external_exports.object({
   v: external_exports.literal(PROTOCOL_VERSION),
   id: external_exports.string().min(1),
@@ -13906,8 +13977,51 @@ function uuidV7(now = Date.now()) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
+// src/harness-version.ts
+import { readFile } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+var LEGACY_PLACEHOLDER_VERSION = "0.0.1";
+function normalizeHarnessVersion(value) {
+  if (typeof value !== "string") return void 0;
+  const version = value.trim();
+  if (version.length === 0 || version.length > 64 || /[\u0000-\u001f]/u.test(version)) return void 0;
+  return version;
+}
+function selectHarnessVersion(reportedVersion, distributionVersion) {
+  if (reportedVersion !== void 0 && reportedVersion !== LEGACY_PLACEHOLDER_VERSION) return reportedVersion;
+  return distributionVersion;
+}
+function harnessSessionGeneration(version) {
+  if (version === void 0) return "legacy";
+  const match = /^(?:dsh-)?v?(\d+)\.(\d+)\.(\d+)(?:-|$)/u.exec(version.trim());
+  if (match === null) return "legacy";
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  return major === 0 && minor === 1 && patch >= 5 ? "v3" : "legacy";
+}
+async function readHarnessDistributionVersion(entrypoint = process.argv[1]) {
+  if (entrypoint === void 0 || !isAbsolute(entrypoint)) return void 0;
+  let directory = dirname(entrypoint);
+  for (let depth = 0; depth < 8; depth += 1) {
+    try {
+      const manifest = JSON.parse(await readFile(join(directory, "package.json"), "utf8"));
+      if (manifest.name === "@deepseek-ai/dsh") return normalizeHarnessVersion(manifest.version);
+    } catch {
+    }
+    const parent = dirname(directory);
+    if (parent === directory) break;
+    directory = parent;
+  }
+  return void 0;
+}
+
 // src/remote-api-proxy.ts
 var DIRECT_API_CALL_BYTES = 2 * 1024 * 1024;
+var AGENT_PRESET_SETTINGS_NS = "agent-presets";
+var LEGACY_AGENT_PRESET_ALIASES = {
+  code: "ptc"
+};
 var RemoteHarnessApiProxy = class {
   constructor(client) {
     this.client = client;
@@ -13996,7 +14110,7 @@ var RemoteHarnessApiProxy = class {
     const params = {
       method,
       rpcId: String(request.rpcId),
-      payload: request.payload
+      payload: normalizeLegacyRequest(method, request.payload)
     };
     const encoded = new TextEncoder().encode(JSON.stringify(params));
     const response = method === "session.attachment" || encoded.byteLength > DIRECT_API_CALL_BYTES ? await this.callTransferred(encoded, signal) : await this.client.rpc("harness.api.call", params, signal);
@@ -14108,9 +14222,32 @@ function normalizeLegacyResponse(method, response) {
     }
   };
 }
+function normalizeLegacyRequest(method, payload) {
+  if (!isRecord2(payload)) return payload;
+  if (method === "agentPreset.read") return replaceAgentPreset(payload, "agentPreset");
+  if (method === "agentPreset.select") return replaceAgentPreset(payload, "agentPreset");
+  if (method === "agentPreset.copy") return replaceAgentPreset(payload, "from");
+  if (method === "settings.update" || method === "settings.replace" || method === "settings.mutate") {
+    return replaceAgentPresetSettings(payload);
+  }
+  return payload;
+}
+function replaceAgentPreset(payload, key) {
+  const value = payload[key];
+  const replacement = typeof value === "string" ? LEGACY_AGENT_PRESET_ALIASES[value] : void 0;
+  return replacement === void 0 ? payload : { ...payload, [key]: replacement };
+}
+function replaceAgentPresetSettings(payload) {
+  if (payload.ns !== AGENT_PRESET_SETTINGS_NS || !isRecord2(payload.patch)) return payload;
+  const patch = replaceAgentPreset(payload.patch, "default");
+  return patch === payload.patch ? payload : { ...payload, patch };
+}
 function isRemoteDisconnect(error) {
   return error instanceof RemoteClientError && (error.code === "TRANSPORT_CLOSED" || error.code === "CLIENT_CLOSED");
 }
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 var AsyncFrameQueue = class {
   values = [];
   waiters = [];
@@ -14345,16 +14482,16 @@ function routeStreamEvent2(event, streamId, queue) {
     queue.fail(remoteFailure({
       code: typeof failure2?.code === "string" ? failure2.code : "internal",
       message: typeof failure2?.message === "string" ? failure2.message : "The remote Harness stream failed.",
-      details: isRecord2(failure2?.details) ? failure2.details : {}
+      details: isRecord3(failure2?.details) ? failure2.details : {}
     }));
   } else {
     queue.close();
   }
 }
 function parseRpcResult(value) {
-  if (!isRecord2(value)) throw new Error("The remote Host returned an invalid Gateway result.");
+  if (!isRecord3(value)) throw new Error("The remote Host returned an invalid Gateway result.");
   if (value.ok === true) return Object.hasOwn(value, "value") ? { ok: true, value: value.value } : { ok: true };
-  if (value.ok !== false || !isRecord2(value.error) || typeof value.error.code !== "string" || typeof value.error.message !== "string" || !isRecord2(value.error.details)) {
+  if (value.ok !== false || !isRecord3(value.error) || typeof value.error.code !== "string" || typeof value.error.message !== "string" || !isRecord3(value.error.details)) {
     throw new Error("The remote Host returned an invalid Gateway failure.");
   }
   return {
@@ -14388,13 +14525,32 @@ function base64ToBytes3(value) {
   if (bytesToBase643(bytes) !== value) throw new Error("The remote Host returned non-canonical Harness Remote transfer data.");
   return bytes;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasErrorCode(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
 }
 
+// src/codex/permissions.ts
+function codexPermissionPresetFromResponse(value) {
+  const root = record(value);
+  for (const settings of [root, record(root.threadSettings)]) {
+    const sandbox = settings.sandbox ?? settings.sandboxPolicy;
+    const type = record(sandbox).type;
+    if (settings.approvalPolicy === "never" && (sandbox === "danger-full-access" || type === "dangerFullAccess")) {
+      return "danger-full-access";
+    }
+    if (settings.approvalPolicy === "on-request" && (sandbox === "workspace-write" || type === "workspaceWrite")) {
+      return "workspace-write";
+    }
+  }
+  return void 0;
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
 // src/codex/virtual-harness.ts
 var CODEX_SESSION_PREFIX = "codex:";
 var CODEX_WORKSPACE_PREFIX = "codex-workspace:";
@@ -14420,9 +14576,10 @@ async function discoverCodexVirtualWorkspaces(client, signal) {
   return (await loadCatalog(client, signal)).workspaces;
 }
 var CodexVirtualHarness = class _CodexVirtualHarness {
-  constructor(client, host) {
+  constructor(client, host, sessionGeneration = "legacy") {
     this.client = client;
     this.host = host;
+    this.sessionGeneration = sessionGeneration;
     this.api = this.createApiProxy();
   }
   api;
@@ -14446,8 +14603,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   commandSeq = 0;
   selectedWorkspaceId;
   closed = false;
-  static remote(core, host) {
-    return new _CodexVirtualHarness(new CodexRemoteClient(core), host);
+  static remote(core, host, sessionGeneration = "legacy") {
+    return new _CodexVirtualHarness(new CodexRemoteClient(core), host, sessionGeneration);
   }
   async workspaces(signal) {
     return (await this.refreshCatalog(signal)).workspaces;
@@ -14643,10 +14800,11 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     return this.selectedModels.get(sessionId) ?? directory?.default ?? modelSelection();
   }
   permissionSelection(sessionId) {
-    return this.selectedPermissions.get(sessionId) ?? CODEX_DEFAULT_PERMISSION;
+    return this.selectedPermissions.get(sessionId);
   }
   setPermissionSelection(sessionId, preset) {
-    this.selectedPermissions.set(sessionId, preset);
+    if (preset === void 0) this.selectedPermissions.delete(sessionId);
+    else this.selectedPermissions.set(sessionId, preset);
     this.publishProjection(sessionId, "permissions", codexPermissionsProjection(preset), this.nextProjectionSeq());
   }
   commandList(args) {
@@ -14670,17 +14828,22 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       result: { kind: "error", text: "CodeX Remote permission commands do not accept attachments." }
     };
     const requested = (match[1] ?? "").trim();
-    if (requested === "") return {
-      commandId,
-      result: { kind: "success", text: `current preset ${this.permissionSelection(sessionId)}` }
-    };
+    if (requested === "") {
+      await this.readHistoryPage(threadId, { maxMessages: 1 }, signal);
+      return {
+        commandId,
+        result: { kind: "success", text: `current preset ${this.permissionSelection(sessionId) ?? "Host settings (not reported)"}` }
+      };
+    }
     if (!isCodexPermissionPreset(requested)) return {
       commandId,
       result: { kind: "error", text: `unknown preset "${requested}" (available: workspace-write, danger-full-access)` }
     };
     const result = await this.client.request("thread/resume", { threadId, permissionPreset: requested }, signal);
-    const effective = codexPermissionPresetFromResponse(result) ?? requested;
+    const effective = codexPermissionPresetFromResponse(result);
+    if (effective === void 0) throw new Error("The Host did not confirm the CodeX permission preset.");
     this.setPermissionSelection(sessionId, effective);
+    if (effective !== requested) throw new Error("The Host did not apply the requested CodeX permission preset.");
     return { commandId, result: { kind: "success", text: `preset ${effective}` } };
   }
   sessionTitle(sessionId) {
@@ -14812,7 +14975,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     return queue.iterate(() => this.eventStreams.delete(clientId));
   }
   async sessionFollow(request, signal) {
-    const sessionId = sessionIdFromAddress(record(request.address));
+    const sessionId = sessionIdFromAddress(record2(request.address));
     const threadId = nativeThreadId(sessionId);
     const history = await this.readHistoryPage(threadId, {
       maxMessages: optionalPositiveInteger(request.maxMessages)
@@ -14831,6 +14994,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       streamedBlocks: /* @__PURE__ */ new Map(),
       nextBlockIndex: 0,
       streamActive: false,
+      assistantStreamRevision: 0,
       liveItems: /* @__PURE__ */ new Map(),
       liveToolOutput: /* @__PURE__ */ new Map(),
       liveToolResultSeq: /* @__PURE__ */ new Map(),
@@ -14854,7 +15018,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
           permissions: codexPermissionsProjection(this.permissionSelection(sessionId)),
           imageLimits: codexImageLimitsProjection()
         }
-      }
+      },
+      ...this.sessionGeneration === "v3" ? { assistantStream: { revision: 0 } } : {}
     });
     try {
       const stream = await this.client.subscribe(
@@ -14875,7 +15040,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     });
   }
   acceptCodexFrame(follow, frame) {
-    const params = record(frame.params);
+    const params = record2(frame.params);
     if (frame.method === "thread/name/updated") {
       const name2 = string(params.threadName);
       if (name2 === void 0) return;
@@ -14887,11 +15052,12 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     }
     if (frame.method === "thread/settings/updated") {
       const preset = codexPermissionPresetFromResponse(params);
-      if (preset !== void 0) this.setPermissionSelection(follow.sessionId, preset);
+      this.setPermissionSelection(follow.sessionId, preset);
       return;
     }
     if (frame.method === "turn/started") {
-      const turn = record(params.turn);
+      const turn = record2(params.turn);
+      this.endAssistantAttempt(follow, { kind: "abandoned" });
       this.resetLiveTurn(follow);
       follow.turn += 1;
       follow.activeTurnId = string(turn.id);
@@ -14900,11 +15066,11 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       this.pushEvent(follow, "turn/start", { turn: follow.turn });
       this.pushEvent(follow, "step/start", { turn: follow.turn, step: 1 });
       this.emitRemoteEvent("api-session/status", [follow.sessionId, true]);
-      for (const item of array(turn.items)) this.acceptCompletedItem(follow, record(item), false);
+      for (const item of array(turn.items)) this.acceptCompletedItem(follow, record2(item), false);
       return;
     }
     if (frame.method === "item/started" || frame.method === "item/completed") {
-      const item = record(params.item);
+      const item = record2(params.item);
       const itemId = string(item.id);
       if (frame.method === "item/started" && itemId !== void 0) {
         follow.startedItems.add(itemId);
@@ -14941,7 +15107,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     }
     if (frame.method === "turn/plan/updated") {
       const todos = array(params.plan).flatMap((value) => {
-        const item = record(value);
+        const item = record2(value);
         const content = string(item.step);
         if (content === void 0) return [];
         const status2 = item.status === "inProgress" ? "in_progress" : item.status === "completed" ? "completed" : "pending";
@@ -14975,7 +15141,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       return;
     }
     if (frame.method === "thread/status/changed") {
-      const status2 = record(params.status);
+      const status2 = record2(params.status);
       const running = status2.type === "active";
       this.emitRemoteEvent("api-session/status", [follow.sessionId, running]);
       if (status2.type === "systemError") {
@@ -15002,11 +15168,12 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       return;
     }
     if (frame.method === "turn/completed") {
-      const turn = record(params.turn);
-      for (const item of array(turn.items)) this.acceptCompletedItem(follow, record(item), true);
+      const turn = record2(params.turn);
+      for (const item of array(turn.items)) this.acceptCompletedItem(follow, record2(item), true);
       if (follow.stepOpen) {
         this.closeAllStreamBlocks(follow);
         if (follow.streamActive) this.finishStream(follow);
+        this.endAssistantAttempt(follow, { kind: "abandoned" });
         this.pushEvent(follow, "step/end", { turn: follow.turn, step: 1 });
         follow.stepOpen = false;
       }
@@ -15045,6 +15212,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     this.closeItemStreamBlocks(follow, itemId, itemText2(item));
     if (type === "agentMessage" && follow.streamActive && follow.streamedBlocks.size === 0) this.finishStream(follow);
     const supplementalImages = type === "agentMessage" ? follow.pendingToolImages : [];
+    let assistantMessageSeq;
     for (const event of itemEvents(
       item,
       follow.turn,
@@ -15056,7 +15224,17 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     )) {
       if (event.type === "tool/call" && follow.startedItems.has(itemId)) continue;
       if (event.type === "tool/result") this.pushToolResult(follow, itemId, event);
-      else this.pushEvent(follow, event.type, event.data, event.view);
+      else {
+        const seq = this.pushEvent(follow, event.type, event.data, event.view);
+        if (event.type === "assistant/message") assistantMessageSeq = seq;
+      }
+    }
+    if (type === "agentMessage" && assistantMessageSeq !== void 0) {
+      this.endAssistantAttempt(follow, {
+        kind: "committed",
+        eventType: "assistant/message",
+        seq: assistantMessageSeq
+      });
     }
     if (type === "agentMessage" && supplementalImages.length > 0) follow.pendingToolImages = [];
     else if (type !== void 0 && isToolItemType2(type)) {
@@ -15073,18 +15251,21 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       type,
       seq,
       time: Date.now(),
-      data,
+      data: adaptEventData(
+        type,
+        type === "assistant/message" && this.sessionGeneration === "v3" && follow.assistantAttempt !== void 0 ? { ...record2(data), stream: follow.assistantAttempt.stream } : data,
+        this.sessionGeneration
+      ),
       ...isSurfaceEvent(type) ? placement === void 0 ? { surfaceOp: "append" } : {
-        surfaceOp: { op: "replace", start: placement.replaceSeq, end: placement.replaceSeq },
+        surfaceOp: this.sessionGeneration === "v3" ? { op: "replace", startSeq: placement.replaceSeq, endSeq: placement.replaceSeq } : { op: "replace", start: placement.replaceSeq, end: placement.replaceSeq },
         sourceEventSeqs: [placement.replaceSeq]
       } : {}
     };
     this.cacheImageBlocks(follow.sessionId, event.data);
     if (!follow.rcOnly) {
-      const alphaEvent = typeof event.surfaceOp === "object" ? { ...event, surfaceOp: "replace" } : event;
       follow.queue.push({
         type: "event",
-        event: alphaEvent,
+        event,
         ...view === void 0 ? {} : { view }
       });
     }
@@ -15098,7 +15279,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   cacheImageBlocks(sessionId, value) {
     for (const block of collectImageBlocks(value)) {
-      const attachment = record(block.attachment);
+      const attachment = record2(block.attachment);
       const attachmentId = string(attachment.attachmentId);
       const data = string(block.data);
       if (attachmentId === void 0 || data === void 0 || !attachmentId.startsWith(CODEX_IMAGE_ATTACHMENT_PREFIX)) continue;
@@ -15111,52 +15292,105 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     const block = { itemId, index: follow.nextBlockIndex++, kind, text: "" };
     follow.streamedBlocks.set(key, block);
     follow.streamActive = true;
-    this.pushEvent(follow, "assistant/chunk", {
-      turn: follow.turn,
-      step: 1,
-      chunk: { type: "block-start", index: block.index, blockType: kind }
-    });
+    this.pushAssistantChunk(follow, { type: "block-start", index: block.index, blockType: kind });
     return block;
   }
   appendStreamDelta(follow, key, itemId, kind, delta) {
     const block = this.ensureStreamBlock(follow, key, itemId, kind);
     block.text = appendBoundedText(block.text, delta);
-    this.pushEvent(follow, "assistant/chunk", {
-      turn: follow.turn,
-      step: 1,
-      chunk: { type: kind === "reasoning" ? "reasoning-delta" : "text-delta", index: block.index, text: delta }
+    this.pushAssistantChunk(follow, {
+      type: kind === "reasoning" ? "reasoning-delta" : "text-delta",
+      index: block.index,
+      text: delta
     });
   }
   closeItemStreamBlocks(follow, itemId, fallback) {
     const matches = [...follow.streamedBlocks].filter(([, block]) => block.itemId === itemId);
     for (const [key, block] of matches) {
       const text = block.text || fallback || "";
-      this.pushEvent(follow, "assistant/chunk", {
-        turn: follow.turn,
-        step: 1,
-        chunk: { type: "block-end", index: block.index, block: { type: block.kind, text } }
+      this.pushAssistantChunk(follow, {
+        type: "block-end",
+        index: block.index,
+        block: { type: block.kind, text }
       });
       follow.streamedBlocks.delete(key);
     }
   }
   closeAllStreamBlocks(follow) {
     for (const block of follow.streamedBlocks.values()) {
-      this.pushEvent(follow, "assistant/chunk", {
-        turn: follow.turn,
-        step: 1,
-        chunk: { type: "block-end", index: block.index, block: { type: block.kind, text: block.text } }
+      this.pushAssistantChunk(follow, {
+        type: "block-end",
+        index: block.index,
+        block: { type: block.kind, text: block.text }
       });
     }
     follow.streamedBlocks.clear();
   }
   finishStream(follow) {
-    this.pushEvent(follow, "assistant/chunk", {
-      turn: follow.turn,
-      step: 1,
-      chunk: { type: "finish", reason: { kind: "stop" } }
-    });
+    this.pushAssistantChunk(follow, { type: "finish", reason: { kind: "stop" } });
     follow.streamActive = false;
   }
+  pushAssistantChunk(follow, chunk) {
+    if (this.sessionGeneration !== "v3" || follow.rcOnly === true) {
+      this.pushEvent(follow, "assistant/chunk", { turn: follow.turn, step: 1, chunk });
+      return;
+    }
+    let attempt = follow.assistantAttempt;
+    if (attempt === void 0) {
+      attempt = {
+        attemptId: `codex-attempt:${follow.activeTurnId ?? follow.turn}:${follow.nextSeq}`,
+        startedAfterSeq: follow.nextSeq - 1,
+        nextIndex: 0,
+        stream: []
+      };
+      follow.assistantAttempt = attempt;
+      follow.assistantStreamRevision += 1;
+      follow.queue.push({
+        type: "assistant-stream",
+        frame: {
+          type: "start",
+          attemptId: attempt.attemptId,
+          revision: follow.assistantStreamRevision,
+          startedAfterSeq: attempt.startedAfterSeq,
+          turn: follow.turn,
+          step: 1
+        }
+      });
+    }
+    const time = Date.now();
+    const index = attempt.nextIndex++;
+    attempt.stream.push({ time, chunk });
+    follow.assistantStreamRevision += 1;
+    follow.queue.push({
+      type: "assistant-stream",
+      frame: {
+        type: "chunk",
+        attemptId: attempt.attemptId,
+        revision: follow.assistantStreamRevision,
+        index,
+        time,
+        chunk
+      }
+    });
+  }
+  endAssistantAttempt(follow, outcome) {
+    const attempt = follow.assistantAttempt;
+    if (attempt === void 0) return;
+    follow.assistantAttempt = void 0;
+    follow.assistantStreamRevision += 1;
+    if (this.sessionGeneration === "v3" && follow.rcOnly !== true) {
+      follow.queue.push({
+        type: "assistant-stream",
+        frame: {
+          type: "end",
+          attemptId: attempt.attemptId,
+          revision: follow.assistantStreamRevision,
+          index: attempt.nextIndex,
+          outcome
+        }
+      });
+    }
+  }
   ensureToolStarted(follow, item) {
     const itemId = string(item.id);
     if (itemId === void 0) return;
@@ -15199,6 +15433,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     follow.streamedBlocks.clear();
     follow.nextBlockIndex = 0;
     follow.streamActive = false;
+    follow.assistantAttempt = void 0;
     follow.liveItems.clear();
     follow.liveToolOutput.clear();
     follow.liveToolResultSeq.clear();
@@ -15211,7 +15446,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       this.broadcastRcHost({ type: "host/session-status", sessionId, running: args[1] });
     } else if (event === "api-session/removed" && sessionId !== void 0) {
       this.broadcastRcHost({ type: "host/session-removed", sessionId });
-    } else if (event === "api-session/added" && isRecord3(args[0])) {
+    } else if (event === "api-session/added" && isRecord4(args[0])) {
       const summary = args[0];
       this.broadcastRcHost({
         type: "host/session-added",
@@ -15239,7 +15474,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   async answerRemoteEvent(args, signal) {
     const eventId = string(args.eventId);
-    const outcome = record(args.outcome);
+    const outcome = record2(args.outcome);
     if (eventId === void 0) throw new Error("The CodeX approval result is missing its event id.");
     const pending = this.pendingApprovals.get(eventId);
     if (pending === void 0) return void 0;
@@ -15290,7 +15525,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     if (!containsPath(workspace.path, path)) {
       return failure("workspace-not-found", "The selected directory is outside the current CodeX virtual Workspace.");
     }
-    const listing = record(await this.client.request("dsh/directoryList", { path }, signal));
+    const listing = record2(await this.client.request("dsh/directoryList", { path }, signal));
     if (!isCodexDirectoryListing(listing)) {
       return failure("internal", "CodeX Remote returned an invalid directory listing.");
     }
@@ -15324,13 +15559,13 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     const directory = await this.models(signal);
     const selection = directory.default;
     const requestedPreset = CODEX_DEFAULT_PERMISSION;
-    const result = record(await this.client.request("thread/start", {
+    const result = record2(await this.client.request("thread/start", {
       cwd,
       model: selection.model,
       permissionPreset: requestedPreset
     }, signal));
     const permissionPreset2 = codexPermissionPresetFromResponse(result) ?? requestedPreset;
-    const thread = { ...record(result.thread), cwd, turns: array(record(result.thread).turns) };
+    const thread = { ...record2(result.thread), cwd, turns: array(record2(result.thread).turns) };
     const projected = projectCodexThread(thread);
     if (projected === void 0) return failure("internal", "CodeX returned an invalid Thread.");
     this.pendingThreads.set(projected.nativeId, thread);
@@ -15350,16 +15585,14 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   async forkSession(request, signal) {
     const sessionId = requiredString(request.sessionId, "sessionId");
-    let permissionPreset2 = this.selectedPermissions.get(sessionId);
-    const result = record(await this.client.request("thread/fork", {
-      threadId: nativeThreadId(sessionId),
-      ...permissionPreset2 === void 0 ? {} : { permissionPreset: permissionPreset2 }
+    const result = record2(await this.client.request("thread/fork", {
+      threadId: nativeThreadId(sessionId)
     }, signal));
-    permissionPreset2 = codexPermissionPresetFromResponse(result) ?? permissionPreset2 ?? CODEX_DEFAULT_PERMISSION;
-    const projected = projectCodexThread(record(result.thread));
+    const permissionPreset2 = codexPermissionPresetFromResponse(result);
+    const projected = projectCodexThread(record2(result.thread));
     if (projected === void 0) return failure("internal", "CodeX returned an invalid forked Thread.");
     this.selectedModels.set(projected.id, this.modelSelection(sessionId, await this.models(signal)));
-    this.selectedPermissions.set(projected.id, permissionPreset2);
+    this.setPermissionSelection(projected.id, permissionPreset2);
     await this.refreshAndPublishWorkspaces();
     const seq = this.nextProjectionSeq();
     this.publishProjection(projected.id, "title", displayTitle(projected), seq);
@@ -15372,7 +15605,6 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     if (input2 === void 0) return failure("attachment-error", "CodeX virtual Sessions accept text and pasted PNG, JPEG, WebP, or GIF images only.");
     const threadId = nativeThreadId(sessionId);
     const selection = this.modelSelection(sessionId, await this.models(signal));
-    let permissionPreset2 = this.selectedPermissions.get(sessionId);
     const isFreshBlankThread = this.blankThreads.has(threadId) || this.pendingThreads.has(threadId);
     await this.ensureRcFollow(sessionId);
     if (!isFreshBlankThread) {
@@ -15381,8 +15613,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
         model: selection.model
       }, signal);
       const serverPreset = codexPermissionPresetFromResponse(resumeResult);
-      if (permissionPreset2 === void 0 && serverPreset !== void 0) {
-        permissionPreset2 = serverPreset;
+      if (serverPreset !== void 0) {
         this.setPermissionSelection(sessionId, serverPreset);
       }
     }
@@ -15396,8 +15627,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       await this.client.request(mode, {
         threadId,
         input: input2,
-        ...codexModelParams(selection),
-        ...permissionPreset2 === void 0 ? {} : { permissionPreset: permissionPreset2 }
+        ...codexModelParams(selection)
       }, signal);
     }
     this.blankThreads.delete(threadId);
@@ -15418,8 +15648,8 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   async hydrateImageAttachments(sessionId, signal) {
     const threadId = nativeThreadId(sessionId);
-    const result = record(await this.client.request("thread/read", { threadId, includeTurns: true }, signal));
-    const thread = record(result.thread);
+    const result = record2(await this.client.request("thread/read", { threadId, includeTurns: true }, signal));
+    const thread = record2(result.thread);
     if (string(thread.id) !== threadId) throw new Error("CodeX returned an invalid Thread history.");
     this.cacheHistoryImages(projectCodexNativeHistory(thread, sessionId));
   }
@@ -15441,7 +15671,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     return success({ title, seq });
   }
   async sessionPage(request, signal) {
-    const sessionId = sessionIdFromAddress(record(request.address));
+    const sessionId = sessionIdFromAddress(record2(request.address));
     const page = await this.readHistoryPage(nativeThreadId(sessionId), {
       beforeSeq: optionalNonNegativeInteger(request.beforeSeq),
       throughSeq: optionalInteger(request.throughSeq),
@@ -15454,15 +15684,15 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
     return void 0;
   }
   async fetchThread(threadId, signal) {
-    const result = record(await this.client.request("thread/read", { threadId, includeTurns: false }, signal));
-    const thread = record(result.thread);
+    const result = record2(await this.client.request("thread/read", { threadId, includeTurns: false }, signal));
+    const thread = record2(result.thread);
     if (string(thread.id) !== threadId) throw new Error("CodeX returned an invalid Thread history.");
     return thread;
   }
   async readHistoryPage(threadId, page, signal) {
     let value;
     try {
-      value = record(await this.client.request("dsh/sessionHistory", {
+      value = record2(await this.client.request("dsh/sessionHistory", {
         threadId,
         ...page.beforeSeq === void 0 ? {} : { beforeSeq: page.beforeSeq },
         ...page.throughSeq === void 0 ? {} : { throughSeq: page.throughSeq },
@@ -15470,11 +15700,11 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       }, signal));
     } catch (error) {
       if (!isLegacySessionHistoryUnsupported(error)) throw error;
-      const result = record(await this.client.request("thread/read", { threadId, includeTurns: true }, signal));
-      const thread = record(result.thread);
+      const result = record2(await this.client.request("thread/read", { threadId, includeTurns: true }, signal));
+      const thread = record2(result.thread);
       if (string(thread.id) !== threadId) throw new Error("CodeX returned an invalid Thread history.");
       value = paginateCodexNativeHistory(
-        projectCodexNativeHistory(thread, `codex:${threadId}`),
+        projectCodexNativeHistory(thread, `codex:${threadId}`, this.sessionGeneration),
         {
           beforeSeq: page.beforeSeq,
           throughSeq: page.throughSeq,
@@ -15482,9 +15712,14 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
         }
       );
     }
+    value = adaptCodexHistoryPage(value, this.sessionGeneration);
     if (!isCodexNativeHistoryPage(value, `codex:${threadId}`)) {
       throw new Error("CodeX Remote returned an invalid paginated History.");
     }
+    if (Object.hasOwn(value, "permissionPreset")) {
+      const preset = value.permissionPreset;
+      this.setPermissionSelection(`codex:${threadId}`, preset === "workspace-write" || preset === "danger-full-access" ? preset : void 0);
+    }
     this.cacheHistoryImages(value);
     return value;
   }
@@ -15545,6 +15780,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
       streamedBlocks: /* @__PURE__ */ new Map(),
       nextBlockIndex: 0,
       streamActive: false,
+      assistantStreamRevision: 0,
       liveItems: /* @__PURE__ */ new Map(),
       liveToolOutput: /* @__PURE__ */ new Map(),
       liveToolResultSeq: /* @__PURE__ */ new Map(),
@@ -15595,7 +15831,7 @@ var CodexVirtualHarness = class _CodexVirtualHarness {
   }
   createApiProxy() {
     const call = (endpoint) => async (request, signal) => {
-      const payload = endpoint === "session.prompt" && isRecord3(request.payload) ? { ...request.payload, requestId: String(request.rpcId) } : request.payload;
+      const payload = endpoint === "session.prompt" && isRecord4(request.payload) ? { ...request.payload, requestId: String(request.rpcId) } : request.payload;
       const result = await this.dispatch(rcEndpoint(endpoint), { args: { request: payload } }, signal ?? new AbortController().signal);
       return {
         rpcId: request.rpcId,
@@ -15692,7 +15928,7 @@ async function loadCatalog(client, signal, pendingThreads) {
   const threads = [];
   let cursor2;
   for (let page = 0; page < MAX_CODEX_PAGES; page += 1) {
-    const result = record(await client.request("thread/list", {
+    const result = record2(await client.request("thread/list", {
       limit: CODEX_PAGE_LIMIT,
       sortKey: "updated_at",
       sortDirection: "desc",
@@ -15700,7 +15936,7 @@ async function loadCatalog(client, signal, pendingThreads) {
       ...cursor2 === void 0 ? {} : { cursor: cursor2 }
     }, signal));
     for (const value of array(result.data)) {
-      const thread = record(value);
+      const thread = record2(value);
       if (string(thread.id) !== void 0) threads.push(thread);
     }
     cursor2 = typeof result.nextCursor === "string" && result.nextCursor.length > 0 ? result.nextCursor : void 0;
@@ -15752,7 +15988,7 @@ async function loadCodexProjects(client, signal) {
   let cursor2;
   try {
     for (let page = 0; page < MAX_CODEX_PAGES; page += 1) {
-      const result = record(await client.request("project/list", {
+      const result = record2(await client.request("project/list", {
         limit: CODEX_PAGE_LIMIT,
         ...cursor2 === void 0 ? {} : { cursor: cursor2 }
       }, signal));
@@ -15774,18 +16010,18 @@ async function loadModelDirectory(client, signal) {
   let defaultModelId;
   let cursor2;
   for (let page = 0; page < MAX_CODEX_PAGES; page += 1) {
-    const result = record(await client.request("model/list", {
+    const result = record2(await client.request("model/list", {
       limit: CODEX_PAGE_LIMIT,
       includeHidden: false,
       ...cursor2 === void 0 ? {} : { cursor: cursor2 }
     }, signal));
     for (const value of array(result.data)) {
-      const source = record(value);
+      const source = record2(value);
       if (source.hidden === true) continue;
       const id2 = string(source.model) ?? string(source.id);
       if (id2 === void 0 || models.has(id2)) continue;
       const efforts = array(source.supportedReasoningEfforts).map((value2) => {
-        const effort = record(value2);
+        const effort = record2(value2);
         const effortId = string(effort.reasoningEffort);
         if (effortId === void 0) return void 0;
         const description2 = string(effort.description);
@@ -15827,7 +16063,7 @@ async function loadModelDirectory(client, signal) {
     models
   };
 }
-function projectCodexNativeHistory(thread, sessionId) {
+function projectCodexNativeHistory(thread, sessionId, sessionGeneration = "legacy") {
   const entries = [];
   let seq = 0;
   let turnNumber = 0;
@@ -15840,7 +16076,7 @@ function projectCodexNativeHistory(thread, sessionId) {
         type,
         seq: eventSeq,
         time,
-        data,
+        data: adaptEventData(type, data, sessionGeneration),
         ...sourceEventSeqs === void 0 ? {} : { sourceEventSeqs },
         ...isSurfaceEvent(type) ? { surfaceOp: "append" } : {}
       },
@@ -15849,8 +16085,8 @@ function projectCodexNativeHistory(thread, sessionId) {
     return eventSeq;
   };
   for (const rawTurn of array(thread.turns)) {
-    const turn = record(rawTurn);
-    const turnItems = array(turn.items).map(record);
+    const turn = record2(rawTurn);
+    const turnItems = array(turn.items).map(record2);
     const toolImages = turnItems.flatMap(toolOutputImageBlocks);
     let imageOwner = -1;
     for (let index = 0; index < turnItems.length; index += 1) {
@@ -15893,10 +16129,11 @@ function projectCodexNativeHistory(thread, sessionId) {
   const projected = projectCodexThread(thread);
   return {
     header: {
-      version: 1,
+      version: sessionGeneration === "v3" ? 3 : 1,
       id: sessionId,
       createdAt: projected?.createdAt ?? Date.now(),
-      ...projected?.cwd === void 0 ? {} : { cwd: projected.cwd }
+      ...projected?.cwd === void 0 ? {} : { cwd: projected.cwd },
+      ...sessionGeneration === "v3" ? { isSeeded: false } : {}
     },
     entries,
     lastSeq: seq - 1,
@@ -15929,6 +16166,40 @@ function paginateCodexNativeHistory(history, request) {
     ...history.activeTurnId === void 0 ? {} : { activeTurnId: history.activeTurnId }
   };
 }
+function adaptEventData(type, data, sessionGeneration) {
+  if (sessionGeneration !== "v3" || type !== "assistant/message") return data;
+  const value = record2(data);
+  return Array.isArray(value.stream) ? value : { ...value, stream: [] };
+}
+function adaptCodexHistoryPage(value, sessionGeneration) {
+  if (sessionGeneration !== "v3") return value;
+  const page = record2(value);
+  const sourceHeader = record2(page.header);
+  const { seedLength: _seedLength, ...header } = sourceHeader;
+  const records = Array.isArray(page.records) ? page.records.map((raw) => {
+    const entry = record2(raw);
+    const sourceEvent = record2(entry.event);
+    const sourceSurfaceOp = record2(sourceEvent.surfaceOp);
+    const surfaceOp = sourceEvent.surfaceOp === "append" ? "append" : sourceSurfaceOp.op === "replace" && integer(sourceSurfaceOp.startSeq) !== void 0 && integer(sourceSurfaceOp.endSeq) !== void 0 ? sourceSurfaceOp : sourceSurfaceOp.op === "replace" && integer(sourceSurfaceOp.start) !== void 0 && integer(sourceSurfaceOp.end) !== void 0 ? {
+      op: "replace",
+      startSeq: sourceSurfaceOp.start,
+      endSeq: sourceSurfaceOp.end
+    } : sourceEvent.surfaceOp;
+    return {
+      ...entry,
+      event: {
+        ...sourceEvent,
+        data: adaptEventData(string(sourceEvent.type) ?? "", sourceEvent.data, sessionGeneration),
+        ...surfaceOp === void 0 ? {} : { surfaceOp }
+      }
+    };
+  }) : page.records;
+  return {
+    ...page,
+    header: { ...header, version: 3, isSeeded: sourceHeader.isSeeded === true },
+    records
+  };
+}
 function itemEvents(item, turn, step, requestId, selection = modelSelection(), sessionId = CODEX_SESSION_PREFIX, supplementalImages = []) {
   const type = string(item.type);
   const id2 = string(item.id) ?? `${turn}:${step}:${hashString(JSON.stringify(item))}`;
@@ -15999,15 +16270,15 @@ function messageContent(item, attachmentSeed, fallbackType, fallbackText, supple
 }
 function toolOutputImageBlocks(item) {
   const candidates = [
-    record(item.result).content,
-    record(item.output).content,
+    record2(item.result).content,
+    record2(item.output).content,
     item.contentItems,
     Array.isArray(item.output) ? item.output : void 0
   ];
   for (const candidate of candidates) {
     if (!Array.isArray(candidate)) continue;
     const images = candidate.flatMap((value) => {
-      const block = record(value);
+      const block = record2(value);
       return isImageContent2(block) && parseImageBlock(block) !== void 0 ? [block] : [];
     });
     if (images.length > 0) return images;
@@ -16024,7 +16295,7 @@ function contentBlocks(value, attachmentSeed) {
       blocks.push({ type: "text", text: raw });
       continue;
     }
-    const block = record(raw);
+    const block = record2(raw);
     const image = imageContentBlock(block, attachmentSeed, imageIndex);
     if (image !== void 0) {
       imageIndex += 1;
@@ -16063,7 +16334,7 @@ function isImageContent2(block) {
   return block.type === "image" || block.type === "input_image";
 }
 function parseImageBlock(block) {
-  const url = string(block.url) ?? string(block.image_url) ?? string(record(block.image_url).url);
+  const url = string(block.url) ?? string(block.image_url) ?? string(record2(block.image_url).url);
   const parsed = url === void 0 ? void 0 : parseDataImageUrl2(url);
   if (parsed !== void 0) return parsed;
   const data = string(block.data);
@@ -16085,7 +16356,7 @@ function collectImageBlocks(value, output = []) {
     for (const item of value) collectImageBlocks(item, output);
     return output;
   }
-  if (!isRecord3(value)) return output;
+  if (!isRecord4(value)) return output;
   if (value.type === "image") output.push(value);
   for (const [key, child] of Object.entries(value)) {
     if (key === "attachment") continue;
@@ -16220,10 +16491,10 @@ function toolResultEvent(item, turn, step, id2, resultText) {
   };
 }
 function toolResultContentReplacement(event) {
-  const data = record(event.data);
-  const message = record(data.message);
+  const data = record2(event.data);
+  const message = record2(data.message);
   const content = array(message.content);
-  const result = record(content[0]);
+  const result = record2(content[0]);
   if (result.isError === void 0) return event;
   const { isError: _isError, ...stableResult } = result;
   return {
@@ -16263,9 +16534,9 @@ function toolResultText(item, type, text) {
   if (type === "exitedReviewMode") return `Exited review mode${string(item.review) ? `: ${string(item.review)}` : "."}`;
   if (type === "sleep") return `Waited ${integer(item.durationMs) ?? 0} ms.`;
   if (type === "subAgentActivity") {
-    return [string(record(item.kind).type) ?? string(item.kind) ?? "Subagent activity", string(item.agentPath)].filter((value) => value !== void 0).join(": ");
+    return [string(record2(item.kind).type) ?? string(item.kind) ?? "Subagent activity", string(item.agentPath)].filter((value) => value !== void 0).join(": ");
   }
-  return text ?? itemText2(record(item.result)) ?? itemText2(record(item.output)) ?? string(item.status) ?? type;
+  return text ?? itemText2(record2(item.result)) ?? itemText2(record2(item.output)) ?? string(item.status) ?? type;
 }
 function isSurfaceEvent(type) {
   return type === "user/message" || type === "assistant/message" || type === "tool/result";
@@ -16337,10 +16608,10 @@ function toolResultView(item, type, resultText) {
   };
 }
 function toolDisplayName(item, type) {
-  return string(item.name) ?? string(item.tool) ?? string(record(item.tool).name) ?? (type === "mcpToolCall" ? "CodeX MCP tool" : humanizeItemType(type));
+  return string(item.name) ?? string(item.tool) ?? string(record2(item.tool).name) ?? (type === "mcpToolCall" ? "CodeX MCP tool" : humanizeItemType(type));
 }
 function fileLocations(item) {
-  return array(item.changes).map((value) => string(record(value).path)).filter((path) => path !== void 0 && path.length > 0).map((path) => ({ path }));
+  return array(item.changes).map((value) => string(record2(value).path)).filter((path) => path !== void 0 && path.length > 0).map((path) => ({ path }));
 }
 function nativeWorkspace(view) {
   const { sessionCount: _sessionCount, ...workspace } = view;
@@ -16362,10 +16633,10 @@ function projectWorkspace(project) {
   };
 }
 function projectCodexProject(value, fallbackPosition) {
-  const source = record(value);
+  const source = record2(value);
   const id2 = string(source.id);
   if (id2 === void 0) return void 0;
-  const roots = array(source.roots).map((root) => string(record(root).path)).filter((path) => path !== void 0 && path.length > 0).map((path) => ({ path }));
+  const roots = array(source.roots).map((root) => string(record2(root).path)).filter((path) => path !== void 0 && path.length > 0).map((path) => ({ path }));
   if (roots.length === 0) return void 0;
   return {
     id: id2,
@@ -16415,7 +16686,7 @@ function codexPromptInput(content) {
   if (content.length === 0 || content.length > MAX_CODEX_PROMPT_PARTS) return void 0;
   const input2 = [];
   for (const value of content) {
-    if (!isRecord3(value)) return void 0;
+    if (!isRecord4(value)) return void 0;
     if (value.type === "text") {
       if (typeof value.text !== "string" || value.text.length === 0 || value.text.length > MAX_CODEX_PROMPT_TEXT) return void 0;
       input2.push({ type: "text", text: value.text });
@@ -16436,7 +16707,7 @@ function isCanonicalBase642(value) {
 function modelSelectionProjection(selection) {
   return { lastUsed: selection, next: selection };
 }
-function codexPermissionsProjection(currentValue) {
+function codexPermissionsProjection(preset) {
   return {
     options: [
       {
@@ -16450,7 +16721,7 @@ function codexPermissionsProjection(currentValue) {
         description: "Full Host file access without approval prompts for subsequent turns in this virtual Session."
       }
     ],
-    currentValue
+    currentValue: preset ?? "Host settings (not reported)"
   };
 }
 function codexImageLimitsProjection() {
@@ -16466,22 +16737,6 @@ function codexImageLimitsProjection() {
 function isCodexPermissionPreset(value) {
   return value === "workspace-write" || value === "danger-full-access";
 }
-function codexPermissionPresetFromResponse(value) {
-  const root = record(value);
-  return codexPermissionPresetFromPolicyRecord(root) ?? codexPermissionPresetFromPolicyRecord(record(root.threadSettings));
-}
-function codexPermissionPresetFromPolicyRecord(value) {
-  const sandbox = value.sandbox ?? value.sandboxPolicy;
-  if (value.approvalPolicy === "never" && isDangerFullAccessSandbox(sandbox)) return "danger-full-access";
-  if (value.approvalPolicy === "on-request" && isWorkspaceWriteSandbox(sandbox)) return "workspace-write";
-  return void 0;
-}
-function isDangerFullAccessSandbox(value) {
-  return value === "danger-full-access" || record(value).type === "dangerFullAccess";
-}
-function isWorkspaceWriteSandbox(value) {
-  return value === "workspace-write" || record(value).type === "workspaceWrite";
-}
 function modelCatalog(directory) {
   return {
     default: directory.default,
@@ -16520,7 +16775,7 @@ function itemText2(value) {
   if (content !== void 0) {
     const text = content.map((part) => {
       if (typeof part === "string") return part;
-      const block = record(part);
+      const block = record2(part);
       return string(block.text) ?? string(block.content) ?? "";
     }).filter(Boolean).join("\n");
     if (text !== "") return text;
@@ -16534,8 +16789,8 @@ function toolArguments(item) {
   if (item.type === "commandExecution") return { command: commandText(item.command) ?? item.command ?? "" };
   if (item.type === "fileChange") return {
     changes: array(item.changes).map((value) => {
-      const change = record(value);
-      const kind = typeof change.kind === "string" ? change.kind : string(record(change.kind).type);
+      const change = record2(value);
+      const kind = typeof change.kind === "string" ? change.kind : string(record2(change.kind).type);
       return {
         ...typeof change.path === "string" ? { path: change.path } : {},
         ...kind === void 0 ? {} : { kind }
@@ -16556,7 +16811,7 @@ function toolArguments(item) {
   if (item.type === "subAgentActivity") return {
     agentThreadId: string(item.agentThreadId) ?? "",
     agentPath: string(item.agentPath) ?? "",
-    kind: string(record(item.kind).type) ?? string(item.kind) ?? "activity"
+    kind: string(record2(item.kind).type) ?? string(item.kind) ?? "activity"
   };
   if (item.type === "sleep") return { durationMs: integer(item.durationMs) ?? 0 };
   if (item.type === "enteredReviewMode" || item.type === "exitedReviewMode") return {
@@ -16567,19 +16822,19 @@ function toolArguments(item) {
 }
 function fileChangeSummary(item) {
   const changes = array(item.changes).map((value) => {
-    const change = record(value);
+    const change = record2(value);
     const path = string(change.path);
-    const kind = typeof change.kind === "string" ? change.kind : string(record(change.kind).type);
+    const kind = typeof change.kind === "string" ? change.kind : string(record2(change.kind).type);
     return [kind, path].filter((part) => part !== void 0 && part.length > 0).join(" ");
   }).filter(Boolean);
   return changes.length === 0 ? "File changes completed." : changes.join("\n");
 }
 function sanitizedFileChanges(value) {
   return array(value).flatMap((raw) => {
-    const change = record(raw);
+    const change = record2(raw);
     const path = string(change.path);
     if (path === void 0) return [];
-    const kind = typeof change.kind === "string" ? change.kind : string(record(change.kind).type);
+    const kind = typeof change.kind === "string" ? change.kind : string(record2(change.kind).type);
     return [{ path, ...kind === void 0 ? {} : { kind } }];
   });
 }
@@ -16609,7 +16864,7 @@ function humanizeItemType(type) {
 function commandText(value) {
   if (typeof value === "string") return value;
   if (Array.isArray(value)) return value.filter((item) => typeof item === "string").join(" ");
-  const source = record(value);
+  const source = record2(value);
   return string(source.command) ?? string(source.text);
 }
 function sessionIdFromAddress(address) {
@@ -16625,7 +16880,7 @@ function nativeThreadId(sessionId) {
 function activeTurnId(value) {
   if (!Array.isArray(value)) return void 0;
   for (let index = value.length - 1; index >= 0; index -= 1) {
-    const turn = record(value[index]);
+    const turn = record2(value[index]);
     if (isActiveCodexTurn(turn) && typeof turn.id === "string" && turn.id.length > 0) return turn.id;
   }
   return void 0;
@@ -16634,10 +16889,10 @@ function isActiveCodexTurn(turn) {
   return turn.status === "inProgress" || turn.status === "running";
 }
 function carrierArgs(payload) {
-  return record(record(payload).args);
+  return record2(record2(payload).args);
 }
 function requestArg(args) {
-  return record(args.request ?? args._request ?? args);
+  return record2(args.request ?? args._request ?? args);
 }
 function rcEndpoint(endpoint) {
   if (endpoint === "workspace.list") return "workspace/list";
@@ -16653,20 +16908,20 @@ function ok(value) {
   return value === void 0 ? { ok: true } : { ok: true, value };
 }
 function business(value) {
-  const result = record(value);
+  const result = record2(value);
   if (result.ok === true) return ok(result.value);
   if (result.ok === false) {
-    const error = record(result.error);
-    return fail(string(error.code) ?? "internal", string(error.message) ?? "CodeX virtual Harness rejected the request.", record(error.details));
+    const error = record2(result.error);
+    return fail(string(error.code) ?? "internal", string(error.message) ?? "CodeX virtual Harness rejected the request.", record2(error.details));
   }
   return ok(value);
 }
 function isCodexDirectoryListing(value) {
-  const listing = record(value);
+  const listing = record2(value);
   return typeof listing.path === "string" && typeof listing.home === "string" && Array.isArray(listing.crumbs) && listing.crumbs.every(isCodexDirectoryEntry) && Array.isArray(listing.entries) && listing.entries.every(isCodexDirectoryEntry) && typeof listing.truncated === "boolean";
 }
 function isCodexDirectoryEntry(value) {
-  const entry = record(value);
+  const entry = record2(value);
   return typeof entry.name === "string" && typeof entry.path === "string" && typeof entry.hidden === "boolean";
 }
 function fail(code, message, details = {}) {
@@ -16684,12 +16939,12 @@ function errorCode(error) {
   return "code" in error && typeof error.code === "string" ? error.code : void 0;
 }
 function errorDetails(error) {
-  return "details" in error && isRecord3(error.details) ? error.details : {};
+  return "details" in error && isRecord4(error.details) ? error.details : {};
 }
-function record(value) {
-  return isRecord3(value) ? value : {};
+function record2(value) {
+  return isRecord4(value) ? value : {};
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function array(value) {
@@ -16721,8 +16976,8 @@ function optionalPositiveInteger(value) {
   return parsed;
 }
 function isCodexNativeHistoryPage(value, sessionId) {
-  const page = record(value);
-  const header = record(page.header);
+  const page = record2(value);
+  const header = record2(page.header);
   return header.id === sessionId && integer(page.cursor) !== void 0 && integer(page.nextTurn) !== void 0 && Array.isArray(page.records) && typeof page.hasMore === "boolean" && (page.activeTurnId === void 0 || typeof page.activeTurnId === "string");
 }
 function truncateCodePoints(value, maximum) {
@@ -16903,7 +17158,7 @@ function normalizeServerUrl(value) {
 }
 
 // src/version.ts
-var PLUGIN_VERSION = "0.4.9";
+var PLUGIN_VERSION = "0.4.12";
 
 // src/server-api.ts
 var TERMINAL_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/u;
@@ -17218,10 +17473,11 @@ var ServerApiError = class extends Error {
   }
 };
 function validateTokens(value) {
-  if (typeof value.accessToken !== "string" || value.accessToken.length < 16 || typeof value.refreshToken !== "string" || value.refreshToken.length < 16 || !Number.isSafeInteger(value.accessTokenExpiresAt) || !Number.isSafeInteger(value.refreshTokenExpiresAt)) {
+  const parsed = deviceTokenPairSchema.safeParse(value);
+  if (!parsed.success) {
     throw new ServerApiError("INVALID_MESSAGE", "The Server returned invalid device credentials.", false);
   }
-  return value;
+  return parsed.data;
 }
 function validateWebLogin(value) {
   const item = requireRecord(value, "account login");
@@ -17421,7 +17677,7 @@ var TypertGatewaySwitch = class {
     if (normalized !== void 0) return normalized;
     const source = error instanceof Error ? error : new Error("The Harness Gateway rejected the request.");
     const code = "code" in source && typeof source.code === "string" ? source.code : "internal";
-    const details = "details" in source && isRecord4(source.details) ? source.details : {};
+    const details = "details" in source && isRecord5(source.details) ? source.details : {};
     return { code, message: source.message, details };
   }
 };
@@ -17430,7 +17686,7 @@ function requestFromCarrier(endpoint, payload, signal) {
   if (segments.length !== 2 || segments.some((segment) => segment.length === 0)) {
     throw new Error("The Harness Gateway endpoint is invalid.");
   }
-  if (!isRecord4(payload) || !isRecord4(payload.args)) {
+  if (!isRecord5(payload) || !isRecord5(payload.args)) {
     throw new Error("The Harness Gateway payload is invalid.");
   }
   return { namespace: segments[0], method: segments[1], args: payload.args, signal };
@@ -17445,7 +17701,7 @@ function isLocalOnlyEndpoint(endpoint) {
 function isRemoteCommandMethod(method) {
   return REMOTE_COMMAND_METHODS.includes(method);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -17456,7 +17712,7 @@ import { networkInterfaces } from "node:os";
 // src/native-rtc-helper.ts
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { delimiter, dirname, join } from "node:path";
+import { delimiter, dirname as dirname2, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var cachedExternalFactory;
 var cachedExternalFactoryResolved = false;
@@ -17507,21 +17763,21 @@ function nodeBinaryCandidates() {
   add3(process.env.DSH_REMOTE_NODE);
   add3(process.env.NODE);
   add3(process.execPath);
-  for (const part of (process.env.PATH ?? "").split(delimiter)) add3(join(part, process.platform === "win32" ? "node.exe" : "node"));
+  for (const part of (process.env.PATH ?? "").split(delimiter)) add3(join2(part, process.platform === "win32" ? "node.exe" : "node"));
   add3("/opt/homebrew/bin/node");
   add3("/usr/local/bin/node");
   add3("/usr/bin/node");
-  add3(join(process.env.HOME ?? "", ".volta", "bin", process.platform === "win32" ? "node.exe" : "node"));
-  add3(join(process.env.HOME ?? "", ".asdf", "shims", process.platform === "win32" ? "node.exe" : "node"));
-  add3(join(process.env.HOME ?? "", ".local", "bin", process.platform === "win32" ? "node.exe" : "node"));
+  add3(join2(process.env.HOME ?? "", ".volta", "bin", process.platform === "win32" ? "node.exe" : "node"));
+  add3(join2(process.env.HOME ?? "", ".asdf", "shims", process.platform === "win32" ? "node.exe" : "node"));
+  add3(join2(process.env.HOME ?? "", ".local", "bin", process.platform === "win32" ? "node.exe" : "node"));
   for (const nvmNode of nvmNodeCandidates()) add3(nvmNode);
   return candidates;
 }
 function nvmNodeCandidates() {
-  const root = join(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const root = join2(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (root === "" || !existsSync(root)) return [];
   try {
-    return readdirSync(root).map((version) => join(root, version, "bin", process.platform === "win32" ? "node.exe" : "node")).sort((left, right) => right.localeCompare(left, "en", { numeric: true }));
+    return readdirSync(root).map((version) => join2(root, version, "bin", process.platform === "win32" ? "node.exe" : "node")).sort((left, right) => right.localeCompare(left, "en", { numeric: true }));
   } catch {
     return [];
   }
@@ -17543,7 +17799,7 @@ function isUsableExternalNode(candidate, requireFrom) {
       "console.log(`node:${process.versions.node}`);"
     ].join("")
   ], {
-    cwd: dirname(requireFrom),
+    cwd: dirname2(requireFrom),
     env,
     encoding: "utf8",
     timeout: 3e3
@@ -17565,7 +17821,7 @@ var ExternalNativePeerConnection = class {
     this.nodeBinary = nodeBinary;
     this.requireFrom = requireFrom;
     this.child = spawn(this.nodeBinary, ["--input-type=module", "--eval", HELPER_SOURCE], {
-      cwd: dirname(this.requireFrom),
+      cwd: dirname2(this.requireFrom),
       env: { ...process.env, DSH_REMOTE_RTC_HELPER_REQUIRE_FROM: this.requireFrom },
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -18516,6 +18772,7 @@ function isPrivate(ip) {
 var REMOTE_COMMAND_LIST_MIN_VERSION = [0, 3, 16];
 var REMOTE_FILE_VIEWER_MIN_VERSION = [0, 3, 17];
 var DIRECT_WEBRTC_NEGOTIATE_TIMEOUT_MS = 12e3;
+var DIRECT_LAN_PROGRESS_DISPLAY_MS = 1400;
 var ClientModeRuntime = class {
   constructor(config, identities, server, apiProxy, typertGateway, logger, host, rtcFactoryProvider = loadNodeRtcFactory) {
     this.config = config;
@@ -18774,7 +19031,7 @@ var ClientModeRuntime = class {
     const virtual = CodexVirtualHarness.remote(remote.client, {
       deviceId: remote.target.deviceId,
       name: remote.target.name
-    });
+    }, harnessSessionGeneration(this.host?.localHarnessVersion?.()));
     let workspace;
     try {
       workspace = await virtual.selectWorkspace(workspaceId, signal);
@@ -18804,12 +19061,12 @@ var ClientModeRuntime = class {
       throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The selected Host does not provide CodeX workspaces.");
     }
     this.assertRemoteCompatible(remote);
-    const result = record2(await new CodexRemoteClient(remote.client).request("project/create", {
+    const result = record3(await new CodexRemoteClient(remote.client).request("project/create", {
       name: remoteWorkspaceTitle(trimmedPath),
       roots: [{ path: trimmedPath }],
       idempotencyKey: uuidV7()
     }, signal));
-    const project = record2(result.project);
+    const project = record3(result.project);
     if (typeof project.id !== "string" || project.id.length === 0) {
       throw new ClientModeError("INVALID_MESSAGE", "The Host returned an invalid CodeX project.");
     }
@@ -18859,7 +19116,7 @@ var ClientModeRuntime = class {
   }
   async openCodexStream(payload, signal) {
     const remote = this.activeCodexRemote();
-    const value = record2(payload);
+    const value = record3(payload);
     if (typeof value.streamId !== "string" || value.streamId.length === 0 || value.streamId.length > 128 || typeof value.threadId !== "string" || value.threadId.length === 0) {
       throw new ClientModeError("INVALID_MESSAGE", "A Codex stream and thread are required.");
     }
@@ -18891,10 +19148,10 @@ var ClientModeRuntime = class {
       }
     }
     stream.unsubscribe = remote.client.onEvent((event) => {
-      if (event.event === "codex.app.frame" && isRecord5(event.data) && event.data.streamId === value.streamId) {
+      if (event.event === "codex.app.frame" && isRecord6(event.data) && event.data.streamId === value.streamId) {
         this.appendCodexFrame(stream, event.data);
       }
-      if (event.event === "codex.app.stream.closed" && isRecord5(event.data) && event.data.streamId === value.streamId) {
+      if (event.event === "codex.app.stream.closed" && isRecord6(event.data) && event.data.streamId === value.streamId) {
         stream.closed = typeof event.data.reason === "string" ? event.data.reason : "closed";
         stream.wake();
       }
@@ -18921,7 +19178,7 @@ var ClientModeRuntime = class {
     stream.wake();
   };
   appendCodexFrame(stream, data) {
-    if (!isRecord5(data) || !isRecord5(data.frame) || typeof data.frame.method !== "string") return;
+    if (!isRecord6(data) || !isRecord6(data.frame) || typeof data.frame.method !== "string") return;
     if (stream.frames.length >= 256) {
       stream.closed = "overflow";
     } else {
@@ -18944,7 +19201,7 @@ var ClientModeRuntime = class {
     };
   }
   async nextCodexFrames(payload, signal) {
-    const value = record2(payload);
+    const value = record3(payload);
     if (typeof value.streamId !== "string") throw new ClientModeError("INVALID_MESSAGE", "A Codex stream is required.");
     const stream = this.codexStreams.get(value.streamId);
     if (stream === void 0) throw new ClientModeError("STREAM_NOT_FOUND", "The Codex stream is not open.");
@@ -18958,7 +19215,7 @@ var ClientModeRuntime = class {
     };
   }
   async closeCodexStream(payload) {
-    const value = record2(payload);
+    const value = record3(payload);
     if (typeof value.streamId !== "string") throw new ClientModeError("INVALID_MESSAGE", "A Codex stream is required.");
     const stream = this.codexStreams.get(value.streamId);
     if (stream === void 0) return { closed: false, streamId: value.streamId };
@@ -19006,7 +19263,16 @@ var ClientModeRuntime = class {
   }
   assertRemoteCompatible(remote) {
     const localRemoteGateway = this.gatewaySwitch.supportsCarrier();
-    if (localRemoteGateway && remote.features.remoteGateway || !localRemoteGateway && this.proxySwitch !== void 0 && remote.features.apiProxy) return;
+    if (localRemoteGateway && remote.features.remoteGateway) {
+      const localSessionGeneration = harnessSessionGeneration(this.host?.localHarnessVersion?.());
+      const remoteSessionGeneration = remote.features.sessionFormat === 3 ? "v3" : "legacy";
+      if (localSessionGeneration === remoteSessionGeneration) return;
+      throw new ClientModeError(
+        "HARNESS_VERSION_INCOMPATIBLE",
+        `The local and remote Harness Session formats differ (${localSessionGeneration} vs ${remoteSessionGeneration}).`
+      );
+    }
+    if (!localRemoteGateway && this.proxySwitch !== void 0 && remote.features.apiProxy) return;
     throw new ClientModeError(
       "HARNESS_VERSION_INCOMPATIBLE",
       localRemoteGateway ? "The selected Host does not provide the Harness v0.1.2 Typert Remote Gateway transport." : "The selected Host does not provide the legacy Harness ApiProxy transport."
@@ -19069,11 +19335,15 @@ var ClientModeRuntime = class {
       let transport;
       for (const attempt of attempts) {
         webRtcFallback = false;
-        this.updateConnectionProgress(progressRunId, "probing", activeTransportsForAttempt(attempt));
-        transport = createTransport(attempt);
-        client = new RemoteClientCore(new ClientSecureTransport(transport, identity, target), 6e4);
-        await client.connect();
-        signal?.throwIfAborted();
+        const stopProgressTimer = this.beginAttemptProgress(progressRunId, attempt);
+        try {
+          transport = createTransport(attempt);
+          client = new RemoteClientCore(new ClientSecureTransport(transport, identity, target), 6e4);
+          await client.connect();
+          signal?.throwIfAborted();
+        } finally {
+          stopProgressTimer();
+        }
         if (attempt === "relay" || !webRtcFallback) break;
         await client.close();
         client = void 0;
@@ -19131,7 +19401,8 @@ var ClientModeRuntime = class {
         transport: connectedTransport,
         features,
         progressRunId,
-        ...serverDevice.clientVersion === void 0 ? {} : { clientVersion: serverDevice.clientVersion }
+        ...serverDevice.clientVersion === void 0 ? {} : { clientVersion: serverDevice.clientVersion },
+        ...serverDevice.harnessVersion === void 0 ? {} : { harnessVersion: serverDevice.harnessVersion }
       };
     } catch (error) {
       this.clearConnectionProgress(progressRunId);
@@ -19148,6 +19419,19 @@ var ClientModeRuntime = class {
     await previous?.client.close().catch(() => void 0);
     return next;
   }
+  beginAttemptProgress(runId, attempt) {
+    if (attempt !== "direct") {
+      this.updateConnectionProgress(runId, "probing", [attempt]);
+      return () => void 0;
+    }
+    this.updateConnectionProgress(runId, "probing", ["lan"]);
+    const timer = setTimeout(() => {
+      if (this.connectionProgress?.runId === runId && this.connectionProgress.phase === "probing") {
+        this.updateConnectionProgress(runId, "probing", ["p2p"]);
+      }
+    }, DIRECT_LAN_PROGRESS_DISPLAY_MS);
+    return () => clearTimeout(timer);
+  }
   updateConnectionProgress(runId, phase, activeTransports) {
     if (this.connectionProgress?.runId !== runId) return;
     this.connectionProgress = {
@@ -19165,14 +19449,14 @@ var ClientModeRuntime = class {
       if (endpoint === "status") return ok2(await this.detailedStatus());
       if (endpoint === "devices") return ok2(await this.devices());
       if (endpoint === "client.account.login") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.email !== "string" || typeof value.password !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "Email and password are required.");
         }
         return ok2(await this.authorizeClientWithAccount(value.email, value.password));
       }
       if (endpoint === "client.account.qr.start") {
-        const value = record2(payload);
+        const value = record3(payload);
         const provider = value.provider ?? "zhihu";
         if (provider !== "zhihu" && provider !== "github") {
           throw new ClientModeError("INVALID_MESSAGE", "A supported OAuth provider is required.");
@@ -19180,14 +19464,14 @@ var ClientModeRuntime = class {
         return ok2(await this.startClientOAuthQrLogin(provider));
       }
       if (endpoint === "client.account.qr.poll") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.qrId !== "string" || value.qrId.length < 20) {
           throw new ClientModeError("INVALID_MESSAGE", "A QR login session is required.");
         }
         return ok2(await this.pollClientOAuthQrLogin(value.qrId));
       }
       if (endpoint === "directory.list") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string") throw new ClientModeError("INVALID_MESSAGE", "A Host is required.");
         return ok2(await this.listRemoteDirectory(
           value.targetDeviceId,
@@ -19196,38 +19480,38 @@ var ClientModeRuntime = class {
         ));
       }
       if (endpoint === "workspaces.list") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string") throw new ClientModeError("INVALID_MESSAGE", "A Host is required.");
         return ok2(await this.listRemoteWorkspaces(value.targetDeviceId, signal));
       }
       if (endpoint === "codex.workspaces.list") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string") throw new ClientModeError("INVALID_MESSAGE", "A Host is required.");
         return ok2(await this.listCodexWorkspaces(value.targetDeviceId, signal));
       }
       if (endpoint === "workspace.open") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string" || typeof value.path !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "A Host and working directory are required.");
         }
         return ok2(await this.openRemoteWorkspace(value.targetDeviceId, value.path, signal));
       }
       if (endpoint === "codex.workspace.open") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string" || typeof value.workspaceId !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "A Host and CodeX Workspace are required.");
         }
         return ok2(await this.openCodexWorkspace(value.targetDeviceId, value.workspaceId, signal));
       }
       if (endpoint === "codex.workspace.create") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string" || typeof value.path !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "A Host and CodeX project directory are required.");
         }
         return ok2(await this.createCodexWorkspace(value.targetDeviceId, value.path, signal));
       }
       if (endpoint === "workspace.selection.consume") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.targetDeviceId !== "string" || typeof value.workspaceId !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "A Host and Workspace are required.");
         }
@@ -19243,7 +19527,7 @@ var ClientModeRuntime = class {
         return ok2(await this.callRemoteFileViewer(method, payload, signal));
       }
       if (endpoint === "codex.call") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.method !== "string" || !("params" in value)) {
           throw new ClientModeError("INVALID_MESSAGE", "A Codex method and params are required.");
         }
@@ -19267,7 +19551,7 @@ var ClientModeRuntime = class {
         return ok2({ supported: local || remoteSupported, local, remote: remoteSupported });
       }
       if (endpoint === "codex.respond") {
-        const value = record2(payload);
+        const value = record3(payload);
         const remote = this.activeCodexRemote();
         if (remote !== void 0) return ok2(await remote.client.rpc("codex.app.respond", value, signal));
         const host = this.requireLocalCodex();
@@ -19278,14 +19562,14 @@ var ClientModeRuntime = class {
       if (endpoint === "codex.stream.close") return ok2(await this.closeCodexStream(payload));
       if (endpoint === "host.account.login") {
         if (this.host === void 0) throw new ClientModeError("METHOD_NOT_ALLOWED", "This plugin is not running as a Host.");
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.email !== "string" || typeof value.password !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "Email and password are required.");
         }
         return ok2(await this.host.authorizeHostWithAccount(value.email, value.password));
       }
       if (endpoint === "host.authorization.set") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.enabled !== "boolean") {
           throw new ClientModeError("INVALID_MESSAGE", "Host authorization state is required.");
         }
@@ -19293,14 +19577,14 @@ var ClientModeRuntime = class {
       }
       if (endpoint === "host.registration-code.submit") {
         if (this.host === void 0) throw new ClientModeError("METHOD_NOT_ALLOWED", "This plugin is not running as a Host.");
-        const value = record2(payload);
+        const value = record3(payload);
         if (typeof value.code !== "string" || value.code.trim() === "") {
           throw new ClientModeError("INVALID_MESSAGE", "A Host registration code is required.");
         }
         return ok2(await this.host.authorizeHostWithCode(value.code));
       }
       if (endpoint === "mode.set") {
-        const value = record2(payload);
+        const value = record3(payload);
         if (value.mode !== "local" && value.mode !== "remote") throw new ClientModeError("INVALID_MESSAGE", "Mode must be local or remote.");
         return ok2(await this.setMode(value.mode, typeof value.targetDeviceId === "string" ? value.targetDeviceId : void 0, signal));
       }
@@ -19364,13 +19648,13 @@ function webrtcDiagnosticsLogFields(diagnostics) {
     ...diagnostics.selectedPath === void 0 ? {} : { rtcSelectedPath: diagnostics.selectedPath }
   };
 }
-function record2(value) {
+function record3(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
   }
   return value;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function ok2(value) {
@@ -19395,11 +19679,11 @@ async function readRemoteWorkspaceBaseline(gateway, signal) {
   const iterator = source[Symbol.asyncIterator]();
   try {
     const first = await iterator.next();
-    if (first.done || !isRecord5(first.value) || first.value.type !== "baseline" || !isRecord5(first.value.value) || !Array.isArray(first.value.value.items)) {
+    if (first.done || !isRecord6(first.value) || first.value.type !== "baseline" || !isRecord6(first.value.value) || !Array.isArray(first.value.value.items)) {
       throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid Workspace baseline.");
     }
     return first.value.value.items.map((item) => {
-      if (!isRecord5(item) || typeof item.workspaceId !== "string" || typeof item.path !== "string" || typeof item.title !== "string") {
+      if (!isRecord6(item) || typeof item.workspaceId !== "string" || typeof item.path !== "string" || typeof item.title !== "string") {
         throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned an invalid Workspace row.");
       }
       return { workspaceId: item.workspaceId, path: item.path, title: item.title };
@@ -19464,12 +19748,18 @@ async function probeRemoteHostFeatures(client, clientVersion) {
     if (error instanceof Error && "code" in error && error.code === "METHOD_NOT_FOUND") return fallback;
     throw error;
   }
-  if (!isRecord5(value) || !Array.isArray(value.capabilities) || value.capabilities.some((capability) => typeof capability !== "string")) {
+  if (!isRecord6(value) || !Array.isArray(value.capabilities) || value.capabilities.some((capability) => typeof capability !== "string")) {
     throw new ClientModeError("INVALID_MESSAGE", "The remote Host returned invalid transport capabilities.");
   }
   const capabilities = new Set(value.capabilities);
   const apiProxy = capabilities.has("harness.api.v1");
-  const remoteGateway = capabilities.has("harness.remote.v1");
+  const remoteV1 = capabilities.has("harness.remote.v1");
+  const remoteV3 = capabilities.has("harness.remote.v3");
+  if (remoteV1 && remoteV3) {
+    throw new ClientModeError("INVALID_MESSAGE", "The remote Host advertised conflicting Harness Session formats.");
+  }
+  const sessionFormat = remoteV3 ? 3 : void 0;
+  const remoteGateway = remoteV3 || remoteV1;
   if (!apiProxy && !remoteGateway) {
     throw new ClientModeError("FEATURE_NOT_SUPPORTED", "The remote Host exposes no supported Harness transport.");
   }
@@ -19478,6 +19768,7 @@ async function probeRemoteHostFeatures(client, clientVersion) {
     fileViewer: capabilities.has("fileviewer.read.v1"),
     apiProxy,
     remoteGateway,
+    ...sessionFormat === void 0 ? {} : { sessionFormat },
     codex: capabilities.has("codex.appserver.v1")
   };
 }
@@ -19528,10 +19819,6 @@ function preferredTransportsForAttempt(attempt) {
   if (attempt === "turn") return ["turn", "relay"];
   return ["relay"];
 }
-function activeTransportsForAttempt(attempt) {
-  if (attempt === "direct") return ["lan", "p2p"];
-  return [attempt];
-}
 function transportPreferenceForMode(mode) {
   if (mode === "LAN") return "lan";
   if (mode === "P2P") return "p2p";
@@ -19548,9 +19835,9 @@ import { hostname as hostname2 } from "node:os";
 
 // src/identity-store.ts
 import { createHash } from "node:crypto";
-import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile as readFile2, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { dirname as dirname3, join as join3 } from "node:path";
 var identitySchema = external_exports.object({
   schemaVersion: external_exports.literal(1),
   deviceId: external_exports.string().uuid(),
@@ -19579,38 +19866,38 @@ var IdentityStore = class {
   peers = /* @__PURE__ */ new Map();
   constructor(options = {}) {
     const env = options.env ?? process.env;
-    const dshHome = env.DSH_HOME || join2(options.homeDirectory ?? homedir(), ".dsh");
-    this.directory = options.directory ?? join2(dshHome, "remote");
+    const dshHome = env.DSH_HOME || join3(options.homeDirectory ?? homedir(), ".dsh");
+    this.directory = options.directory ?? join3(dshHome, "remote");
   }
   async loadOrCreate(deviceName) {
     await mkdir(this.directory, { recursive: true, mode: 448 });
     await chmod(this.directory, 448);
-    const devicePath = join2(this.directory, "device.json");
-    const keyPath = join2(this.directory, "device.key");
+    const devicePath = join3(this.directory, "device.json");
+    const keyPath = join3(this.directory, "device.key");
     const [hasDevice, hasKey] = await Promise.all([exists(devicePath), exists(keyPath)]);
     if (hasDevice !== hasKey) {
       throw new IdentityInvalidError("device identity is incomplete; repair it explicitly before reconnecting");
     }
     if (!hasDevice) {
       const keys = generateKeyPair();
-      const record5 = { schemaVersion: 1, deviceId: uuidV7(), name: deviceName, publicKey: keys.publicKey };
-      await atomicJsonWrite(devicePath, record5, 384);
+      const record6 = { schemaVersion: 1, deviceId: uuidV7(), name: deviceName, publicKey: keys.publicKey };
+      await atomicJsonWrite(devicePath, record6, 384);
       await atomicTextWrite(keyPath, `${keys.privateKey}
 `, 384);
     }
     await assertPrivateMode(keyPath);
     try {
-      let record5 = identitySchema.parse(JSON.parse(await readFile(devicePath, "utf8")));
-      const privateKey = (await readFile(keyPath, "utf8")).trim();
+      let record6 = identitySchema.parse(JSON.parse(await readFile2(devicePath, "utf8")));
+      const privateKey = (await readFile2(keyPath, "utf8")).trim();
       const regenerated = generateKeyPair(fromBase64Url2(privateKey));
-      if (regenerated.publicKey !== record5.publicKey) {
+      if (regenerated.publicKey !== record6.publicKey) {
         throw new IdentityInvalidError("device public and private keys do not match");
       }
-      if (record5.name !== deviceName) {
-        record5 = { ...record5, name: deviceName };
-        await atomicJsonWrite(devicePath, record5, 384);
+      if (record6.name !== deviceName) {
+        record6 = { ...record6, name: deviceName };
+        await atomicJsonWrite(devicePath, record6, 384);
       }
-      this.identity = { ...record5, privateKey, fingerprint: fingerprint(record5.publicKey) };
+      this.identity = { ...record6, privateKey, fingerprint: fingerprint(record6.publicKey) };
       await this.loadPeers();
       return this.identity;
     } catch (error) {
@@ -19655,11 +19942,11 @@ var IdentityStore = class {
     return removed;
   }
   async loadPeers() {
-    const path = join2(this.directory, "trusted-peers.json");
+    const path = join3(this.directory, "trusted-peers.json");
     if (!await exists(path)) {
       await atomicJsonWrite(path, { schemaVersion: 1, peers: [] }, 384);
     }
-    const parsed = trustedPeersSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    const parsed = trustedPeersSchema.parse(JSON.parse(await readFile2(path, "utf8")));
     const peers = /* @__PURE__ */ new Map();
     for (const peer of parsed.peers) {
       if (peer.fingerprint !== fingerprint(peer.publicKey)) {
@@ -19671,7 +19958,7 @@ var IdentityStore = class {
     this.peers = peers;
   }
   async savePeers() {
-    await atomicJsonWrite(join2(this.directory, "trusted-peers.json"), {
+    await atomicJsonWrite(join3(this.directory, "trusted-peers.json"), {
       schemaVersion: 1,
       peers: [...this.peers.values()]
     }, 384);
@@ -19680,7 +19967,7 @@ var IdentityStore = class {
 function serverStorageDirectory(root, serverUrl, role) {
   const origin = new URL(serverUrl).origin;
   const scope = createHash("sha256").update(origin).digest("hex").slice(0, 24);
-  return join2(root, "servers", scope, role);
+  return join3(root, "servers", scope, role);
 }
 function fingerprint(publicKey) {
   const compact = createHash("sha256").update(fromBase64Url2(publicKey)).digest("hex").slice(0, 12).toUpperCase();
@@ -19698,7 +19985,7 @@ async function atomicJsonWrite(path, value, mode) {
 `, mode);
 }
 async function atomicTextWrite(path, value, mode) {
-  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  await mkdir(dirname3(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.${uuidV7()}.tmp`;
   await writeFile(temporary, value, { encoding: "utf8", mode, flag: "wx" });
   await chmod(temporary, mode);
@@ -19722,8 +20009,8 @@ function safeErrorMessage(error) {
 }
 
 // src/server-credentials.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname3, join as join3 } from "node:path";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile3, rename as rename2, rm as rm2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname4, join as join4 } from "node:path";
 var credentialSchema = external_exports.object({
   schemaVersion: external_exports.literal(1),
   serverUrl: external_exports.string().url(),
@@ -19738,24 +20025,24 @@ var credentialSchema = external_exports.object({
 var ServerCredentialStore = class {
   path;
   constructor(directory) {
-    this.path = join3(directory, "server-credentials.json");
+    this.path = join4(directory, "server-credentials.json");
   }
   async load(serverUrl, deviceId) {
     if (!await exists2(this.path)) return void 0;
     await assertPrivateMode2(this.path);
     let parsed;
     try {
-      parsed = credentialSchema.parse(JSON.parse(await readFile2(this.path, "utf8")));
+      parsed = credentialSchema.parse(JSON.parse(await readFile3(this.path, "utf8")));
     } catch (error) {
       throw new ServerCredentialsInvalidError(`server credentials are invalid: ${safeMessage(error)}`);
     }
     return parsed.serverUrl === serverUrl && parsed.deviceId === deviceId ? parsed : void 0;
   }
   async save(credentials) {
-    const record5 = credentialSchema.parse({ schemaVersion: 1, ...credentials });
-    await atomicWrite(this.path, `${JSON.stringify(record5, null, 2)}
+    const record6 = credentialSchema.parse({ schemaVersion: 1, ...credentials });
+    await atomicWrite(this.path, `${JSON.stringify(record6, null, 2)}
 `);
-    return record5;
+    return record6;
   }
   async clear() {
     await rm2(this.path, { force: true });
@@ -19765,7 +20052,7 @@ var ServerCredentialsInvalidError = class extends Error {
   code = "SERVER_CREDENTIALS_INVALID";
 };
 async function atomicWrite(path, contents) {
-  await mkdir2(dirname3(path), { recursive: true, mode: 448 });
+  await mkdir2(dirname4(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.${uuidV7()}.tmp`;
   await writeFile2(temporary, contents, { encoding: "utf8", mode: 384, flag: "wx" });
   await chmod2(temporary, 384);
@@ -19822,7 +20109,7 @@ var PluginControlRuntime = class {
       if (endpoint === "devices") return ok3([]);
       if (endpoint === "host.account.login") {
         if (this.host === void 0) throw new ClientModeError("METHOD_NOT_ALLOWED", "This plugin is not running as a Host.");
-        const value = record3(payload);
+        const value = record4(payload);
         if (typeof value.email !== "string" || typeof value.password !== "string") {
           throw new ClientModeError("INVALID_MESSAGE", "Email and password are required.");
         }
@@ -19830,13 +20117,13 @@ var PluginControlRuntime = class {
       }
       if (endpoint === "host.registration-code.submit") {
         if (this.host === void 0) throw new ClientModeError("METHOD_NOT_ALLOWED", "This plugin is not running as a Host.");
-        const value = record3(payload);
+        const value = record4(payload);
         if (typeof value.code !== "string" || value.code.trim() === "") {
           throw new ClientModeError("INVALID_MESSAGE", "A Host registration code is required.");
         }
         return ok3(await this.host.authorizeHostWithCode(value.code));
       }
-      if (endpoint === "mode.set" && record3(payload).mode === "local") return ok3(this.hostOnlyStatus());
+      if (endpoint === "mode.set" && record4(payload).mode === "local") return ok3(this.hostOnlyStatus());
       throw new ClientModeError("METHOD_NOT_ALLOWED", "Remote Client mode is disabled by the plugin role.");
     } catch (error) {
       return fail3(error);
@@ -19846,7 +20133,7 @@ var PluginControlRuntime = class {
     if (this.settings === void 0) {
       throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
     }
-    const value = record3(payload);
+    const value = record4(payload);
     if (value.role !== "host" && value.role !== "client") {
       throw new ClientModeError("INVALID_MESSAGE", "Role must be Host or Client.");
     }
@@ -19881,7 +20168,7 @@ var PluginControlRuntime = class {
     if (this.settings === void 0) {
       throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
     }
-    const value = record3(payload);
+    const value = record4(payload);
     if (typeof value.serverUrl !== "string") {
       throw new ClientModeError("INVALID_MESSAGE", "Server URL is required.");
     }
@@ -19894,7 +20181,7 @@ var PluginControlRuntime = class {
     if (this.settings === void 0) {
       throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
     }
-    const role = record3(payload).role;
+    const role = record4(payload).role;
     if (role !== "host" && role !== "client") {
       throw new ClientModeError("INVALID_MESSAGE", "Role must be Host or Client.");
     }
@@ -19910,7 +20197,7 @@ var PluginControlRuntime = class {
     if (this.settings === void 0) {
       throw new ClientModeError("SETTINGS_UNAVAILABLE", "DSH user settings are unavailable in this profile.");
     }
-    const enabled = record3(payload).enabled;
+    const enabled = record4(payload).enabled;
     if (typeof enabled !== "boolean") {
       throw new ClientModeError("INVALID_MESSAGE", "Codex Remote enabled must be a boolean.");
     }
@@ -20016,11 +20303,11 @@ function editableConfig(config) {
     }
   };
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function record3(value) {
-  if (!isRecord6(value)) throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
+function record4(value) {
+  if (!isRecord7(value)) throw new ClientModeError("INVALID_MESSAGE", "The control request payload is invalid.");
   return value;
 }
 function ok3(value) {
@@ -20243,36 +20530,6 @@ function shortId2(value) {
   return value.length <= 12 ? value : `${value.slice(0, 8)}\u2026${value.slice(-4)}`;
 }
 
-// src/harness-version.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute, join as join4 } from "node:path";
-var LEGACY_PLACEHOLDER_VERSION = "0.0.1";
-function normalizeHarnessVersion(value) {
-  if (typeof value !== "string") return void 0;
-  const version = value.trim();
-  if (version.length === 0 || version.length > 64 || /[\u0000-\u001f]/u.test(version)) return void 0;
-  return version;
-}
-function selectHarnessVersion(reportedVersion, distributionVersion) {
-  if (reportedVersion !== void 0 && reportedVersion !== LEGACY_PLACEHOLDER_VERSION) return reportedVersion;
-  return distributionVersion;
-}
-async function readHarnessDistributionVersion(entrypoint = process.argv[1]) {
-  if (entrypoint === void 0 || !isAbsolute(entrypoint)) return void 0;
-  let directory = dirname4(entrypoint);
-  for (let depth = 0; depth < 8; depth += 1) {
-    try {
-      const manifest = JSON.parse(await readFile3(join4(directory, "package.json"), "utf8"));
-      if (manifest.name === "@deepseek-ai/dsh") return normalizeHarnessVersion(manifest.version);
-    } catch {
-    }
-    const parent = dirname4(directory);
-    if (parent === directory) break;
-    directory = parent;
-  }
-  return void 0;
-}
-
 // src/safe-error.ts
 var RpcError = class extends Error {
   constructor(code, message, details, retryable = false) {
@@ -22626,14 +22883,14 @@ function needsDirectoryFallback(result) {
   return code.includes("capability") || code === "directory-picker/unavailable" || code === "directory-picker-unavailable" || message.includes("browse capability") || message.includes("browser capability") || message.includes("brower capability") || message.includes("directory-picker-unavailable");
 }
 function requestArgs(payload) {
-  const root = record4(payload);
-  const args = isRecord7(root.args) ? root.args : root;
-  return record4(args.request ?? args._request ?? args);
+  const root = record5(payload);
+  const args = isRecord8(root.args) ? root.args : root;
+  return record5(args.request ?? args._request ?? args);
 }
-function record4(value) {
-  return isRecord7(value) ? value : {};
+function record5(value) {
+  return isRecord8(value) ? value : {};
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -22827,7 +23084,7 @@ var CodexAppServerClient = class {
       this.handleProcessFailure("CODEX_INVALID_RESPONSE", new Error("Codex App Server emitted invalid JSON."));
       return;
     }
-    if (!isRecord8(value)) {
+    if (!isRecord9(value)) {
       this.handleProcessFailure("CODEX_INVALID_RESPONSE", new Error("Codex App Server emitted an invalid message."));
       return;
     }
@@ -22872,12 +23129,12 @@ var CodexAppServerClient = class {
   }
 };
 function safeUpstreamError(value) {
-  if (!isRecord8(value) || typeof value.message !== "string") return "Codex App Server rejected the request.";
+  if (!isRecord9(value) || typeof value.message !== "string") return "Codex App Server rejected the request.";
   const message = value.message.toLowerCase();
   if (message.includes("active writer")) return "Codex thread already has an active writer.";
   return message.includes("not initialized") ? "Codex App Server is not initialized." : "Codex App Server rejected the request.";
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -23247,15 +23504,15 @@ function decodeCanonicalBase643(value) {
   }
   return decoded;
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function safeErrorCode2(error) {
-  if (isRecord9(error) && typeof error.code === "string") return error.code;
+  if (isRecord10(error) && typeof error.code === "string") return error.code;
   return "UNKNOWN";
 }
 function safeMethod(input2) {
-  return isRecord9(input2) && typeof input2.method === "string" ? input2.method : "invalid";
+  return isRecord10(input2) && typeof input2.method === "string" ? input2.method : "invalid";
 }
 function concatChunks3(chunks, totalBytes) {
   const output = new Uint8Array(totalBytes);
@@ -23289,6 +23546,7 @@ var CodexRemoteDomain = class {
   peerDeviceIds = /* @__PURE__ */ new Map();
   turnOwners = /* @__PURE__ */ new Map();
   approvals = /* @__PURE__ */ new Map();
+  permissionPresets = /* @__PURE__ */ new Map();
   approvalExpiryTimer;
   restartTimer;
   restartAttempt = 0;
@@ -23367,6 +23625,7 @@ var CodexRemoteDomain = class {
       if (extractThread(result)?.id === void 0) {
         throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread.");
       }
+      this.rememberPermission(extractThread(result).id, result);
       return result;
     }
     const threadId = threadIdFromParams(call.params);
@@ -23381,12 +23640,23 @@ var CodexRemoteDomain = class {
         }
       );
       const activeTurnId2 = typeof page.activeTurnId === "string" ? page.activeTurnId : this.turnOwners.get(threadId)?.turnId;
-      return activeTurnId2 === void 0 ? page : { ...page, activeTurnId: activeTurnId2 };
+      return {
+        ...page,
+        ...activeTurnId2 === void 0 ? {} : { activeTurnId: activeTurnId2 },
+        permissionPreset: this.permissionPresets.get(threadId) ?? null
+      };
     }
     if (call.method === "dsh/directoryList") {
       return this.listCodexDirectory(call.params.path);
     }
     const allowedThread = threadId === void 0 ? void 0 : await this.readKnownThread(threadId);
+    if (call.method === "thread/resume" && call.params.permissionPreset !== void 0) {
+      const owner = this.turnOwners.get(threadId);
+      if (owner !== void 0 && owner.connectionId !== connectionId) {
+        throw new RpcError("CODEX_THREAD_BUSY", "Another Remote client is writing to this CodeX thread.");
+      }
+      return this.changeThreadPermission(threadId, call.params, allowedThread);
+    }
     if (call.method === "thread/read") {
       return this.callUpstream(call.method, call.params);
     }
@@ -23436,8 +23706,18 @@ var CodexRemoteDomain = class {
       if (call.method === "thread/resume" || call.method === "thread/fork" || call.method === "thread/unarchive") {
         await this.assertResultThreadAllowed(result);
       }
+      if (call.method === "thread/resume" || call.method === "thread/fork") {
+        const resultId = extractThread(result)?.id;
+        if (typeof resultId === "string") {
+          this.rememberPermission(resultId, result);
+          if (call.params.permissionPreset !== void 0) await this.publishPermission(resultId, result);
+        }
+      }
       if (call.method === "turn/start" && threadId !== void 0) {
         this.rememberTurnId(threadId, connectionId, extractTurnId(result));
+        if (call.params.permissionPreset !== void 0) {
+          await this.publishPermission(threadId, codexTurnPermissionParams(permission, allowedThread?.cwd));
+        }
       }
       return result;
     } catch (error) {
@@ -23486,6 +23766,7 @@ var CodexRemoteDomain = class {
     this.peers.clear();
     this.peerDeviceIds.clear();
     this.turnOwners.clear();
+    this.permissionPresets.clear();
     if (this.approvalExpiryTimer !== void 0) clearTimeout(this.approvalExpiryTimer);
     this.approvalExpiryTimer = void 0;
     this.approvals.clear();
@@ -23548,6 +23829,7 @@ var CodexRemoteDomain = class {
     this.state = "restarting";
     this.unavailableCode = code;
     this.turnOwners.clear();
+    this.permissionPresets.clear();
     this.approvals.clear();
     if (this.approvalExpiryTimer !== void 0) clearTimeout(this.approvalExpiryTimer);
     this.approvalExpiryTimer = void 0;
@@ -23603,6 +23885,10 @@ var CodexRemoteDomain = class {
       return;
     }
     const threadId = extractThreadId(message.params);
+    if (message.method === "thread/settings/updated" && threadId !== void 0) {
+      this.rememberPermission(threadId, message.params);
+    }
+    if (message.method === "thread/closed" && threadId !== void 0) this.permissionPresets.delete(threadId);
     if (message.method === "turn/completed" && threadId !== void 0) this.turnOwners.delete(threadId);
     if (message.method === "turn/started" && threadId !== void 0) {
       const owner = this.turnOwners.get(threadId);
@@ -23618,6 +23904,42 @@ var CodexRemoteDomain = class {
       params: message.params
     })));
   }
+  rememberPermission(threadId, value) {
+    const preset = codexPermissionPresetFromResponse(value);
+    if (preset === void 0) this.permissionPresets.delete(threadId);
+    else this.permissionPresets.set(threadId, preset);
+  }
+  async changeThreadPermission(threadId, params, allowed) {
+    const permission = codexPermission(params);
+    const settings = {
+      ...codexTurnPermissionParams(permission, allowed.cwd),
+      ...params.model === void 0 ? {} : { model: params.model }
+    };
+    let result;
+    try {
+      await this.callUpstream("thread/settings/update", { threadId, ...settings });
+      result = { thread: allowed.thread, ...settings, sandbox: settings.sandboxPolicy };
+    } catch {
+      result = await this.callUpstream("thread/resume", {
+        ...permission.params,
+        ...allowed.cwd === void 0 ? {} : { cwd: allowed.cwd },
+        ...codexThreadPermissionParams(permission),
+        excludeTurns: true
+      });
+      await this.assertResultThreadAllowed(result);
+      if (codexPermissionPresetFromResponse(result) !== params.permissionPreset) {
+        await this.callUpstream("thread/settings/update", { threadId, ...settings });
+        result = { ...isRecord11(result) ? result : {}, ...settings, sandbox: settings.sandboxPolicy };
+      }
+    }
+    await this.publishPermission(threadId, result);
+    return result;
+  }
+  async publishPermission(threadId, value) {
+    const source = isRecord11(value) ? value : {};
+    const threadSettings = { approvalPolicy: source.approvalPolicy, sandboxPolicy: source.sandboxPolicy ?? source.sandbox };
+    await this.handleInbound({ kind: "notification", method: "thread/settings/updated", params: { threadId, threadSettings } });
+  }
   async handleServerRequest(message) {
     const appServer = this.requireAppServer();
     await this.expireApprovals();
@@ -23710,9 +24032,9 @@ var CodexRemoteDomain = class {
         itemsView,
         ...cursor2 === void 0 ? {} : { cursor: cursor2 }
       });
-      const pageResult = isRecord10(result) ? result : {};
+      const pageResult = isRecord11(result) ? result : {};
       for (const rawTurn of array2(pageResult.data)) {
-        if (!isRecord10(rawTurn)) continue;
+        if (!isRecord11(rawTurn)) continue;
         const turnId = typeof rawTurn.id === "string" ? rawTurn.id : void 0;
         const items = rawTurn.itemsView === "full" || turnId === void 0 ? array2(rawTurn.items) : await this.readThreadItems(connectionId, threadId, turnId, array2(rawTurn.items));
         turns.push({ ...rawTurn, items });
@@ -23734,9 +24056,9 @@ var CodexRemoteDomain = class {
           sortDirection: "asc",
           ...cursor2 === void 0 ? {} : { cursor: cursor2 }
         });
-        const pageResult = isRecord10(result) ? result : {};
+        const pageResult = isRecord11(result) ? result : {};
         for (const entry of array2(pageResult.data)) {
-          if (isRecord10(entry) && entry.item !== void 0) items.push(entry.item);
+          if (isRecord11(entry) && entry.item !== void 0) items.push(entry.item);
         }
         cursor2 = typeof pageResult.nextCursor === "string" && pageResult.nextCursor.length > 0 ? pageResult.nextCursor : void 0;
         if (cursor2 === void 0) break;
@@ -23800,7 +24122,7 @@ var CodexRemoteDomain = class {
     return [...this.peers.values()].some((peer) => peer.hasThreadSubscription(threadId));
   }
   resolveUpstreamApproval(params) {
-    if (!isRecord10(params) || typeof params.requestId !== "string" && typeof params.requestId !== "number") return;
+    if (!isRecord11(params) || typeof params.requestId !== "string" && typeof params.requestId !== "number") return;
     for (const [handle, approval] of this.approvals) {
       if (approval.upstreamId === params.requestId) this.approvals.delete(handle);
     }
@@ -24017,24 +24339,24 @@ function codexBinaryCandidates(configured, hostPlatform = process.platform, user
   ])];
 }
 function parseCallEnvelope(input2) {
-  if (!isRecord10(input2) || typeof input2.method !== "string" || !("params" in input2) || Object.keys(input2).some((key) => key !== "method" && key !== "params")) {
+  if (!isRecord11(input2) || typeof input2.method !== "string" || !("params" in input2) || Object.keys(input2).some((key) => key !== "method" && key !== "params")) {
     throw new RpcError("INVALID_MESSAGE", "The Codex call envelope is invalid.");
   }
   return { method: input2.method, params: input2.params };
 }
 function parseRespond(input2) {
-  if (!isRecord10(input2) || typeof input2.requestHandle !== "string" || !["accept", "decline", "cancel"].includes(String(input2.decision)) || Object.keys(input2).some((key) => key !== "requestHandle" && key !== "decision")) {
+  if (!isRecord11(input2) || typeof input2.requestHandle !== "string" || !["accept", "decline", "cancel"].includes(String(input2.decision)) || Object.keys(input2).some((key) => key !== "requestHandle" && key !== "decision")) {
     throw new RpcError("INVALID_MESSAGE", "The Codex approval response is invalid.");
   }
   return input2;
 }
 function accountCanRun(result) {
-  if (!isRecord10(result) || typeof result.requiresOpenaiAuth !== "boolean") return false;
-  return result.requiresOpenaiAuth === false || isRecord10(result.account);
+  if (!isRecord11(result) || typeof result.requiresOpenaiAuth !== "boolean") return false;
+  return result.requiresOpenaiAuth === false || isRecord11(result.account);
 }
 function sanitizeAccount(result) {
-  if (!isRecord10(result)) throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned invalid account state.");
-  const account = isRecord10(result.account) ? result.account : void 0;
+  if (!isRecord11(result)) throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned invalid account state.");
+  const account = isRecord11(result.account) ? result.account : void 0;
   return {
     authenticated: account !== void 0 || result.requiresOpenaiAuth === false,
     requiresOpenaiAuth: result.requiresOpenaiAuth === true,
@@ -24047,11 +24369,11 @@ function sanitizeAccount(result) {
   };
 }
 function sanitizeThreadList(result) {
-  if (!isRecord10(result) || !Array.isArray(result.data)) {
+  if (!isRecord11(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   const data = result.data.flatMap((value) => {
-    if (!isRecord10(value) || typeof value.id !== "string") return [];
+    if (!isRecord11(value) || typeof value.id !== "string") return [];
     return [{
       id: value.id,
       ...typeof value.sessionId === "string" ? { sessionId: value.sessionId } : {},
@@ -24063,7 +24385,7 @@ function sanitizeThreadList(result) {
       ...typeof value.updatedAt === "number" && Number.isFinite(value.updatedAt) ? { updatedAt: value.updatedAt } : {},
       ...typeof value.archived === "boolean" ? { archived: value.archived } : {},
       ...typeof value.isPinned === "boolean" ? { isPinned: value.isPinned } : {},
-      ...isRecord10(value.status) ? { status: value.status } : {}
+      ...isRecord11(value.status) ? { status: value.status } : {}
     }];
   });
   return {
@@ -24073,18 +24395,18 @@ function sanitizeThreadList(result) {
   };
 }
 function filterThreadListByWorkspaceAuthority(result, authority) {
-  if (!isRecord10(result) || !Array.isArray(result.data)) {
+  if (!isRecord11(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid thread list.");
   }
   return {
     ...result,
-    data: result.data.map((record5) => isRecord10(record5) ? record5 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
+    data: result.data.map((record6) => isRecord11(record6) ? record6 : void 0).filter((thread) => thread !== void 0 && isThreadAllowedByWorkspaceAuthority(thread, authority))
   };
 }
 function sanitizeProject(value) {
-  if (!isRecord10(value) || typeof value.id !== "string" || typeof value.name !== "string") return void 0;
+  if (!isRecord11(value) || typeof value.id !== "string" || typeof value.name !== "string") return void 0;
   const roots = Array.isArray(value.roots) ? value.roots.flatMap((root) => {
-    const path = isRecord10(root) && typeof root.path === "string" && root.path.length > 0 ? root.path : void 0;
+    const path = isRecord11(root) && typeof root.path === "string" && root.path.length > 0 ? root.path : void 0;
     return path === void 0 || !isAbsolute3(path) ? [] : [{ path }];
   }) : [];
   if (roots.length === 0) return void 0;
@@ -24098,7 +24420,7 @@ function sanitizeProject(value) {
   };
 }
 function sanitizeProjectList(result) {
-  if (!isRecord10(result) || !Array.isArray(result.data)) {
+  if (!isRecord11(result) || !Array.isArray(result.data)) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid project list.");
   }
   const data = result.data.flatMap((value) => sanitizeProject(value) ?? []);
@@ -24108,7 +24430,7 @@ function sanitizeProjectList(result) {
   };
 }
 function sanitizeProjectCreate(result) {
-  const project = isRecord10(result) ? sanitizeProject(result.project) : void 0;
+  const project = isRecord11(result) ? sanitizeProject(result.project) : void 0;
   if (project === void 0) {
     throw new RpcError("CODEX_INVALID_RESPONSE", "Codex App Server returned an invalid created project.");
   }
@@ -24140,19 +24462,19 @@ function codexDirectoryCrumbs(root, path) {
   return crumbs2;
 }
 function extractThread(result) {
-  return isRecord10(result) && isRecord10(result.thread) ? result.thread : void 0;
+  return isRecord11(result) && isRecord11(result.thread) ? result.thread : void 0;
 }
 function extractTurnId(result) {
-  if (!isRecord10(result)) return void 0;
+  if (!isRecord11(result)) return void 0;
   if (typeof result.turnId === "string" && result.turnId.length > 0) return result.turnId;
-  if (isRecord10(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
+  if (isRecord11(result.turn) && typeof result.turn.id === "string" && result.turn.id.length > 0) return result.turn.id;
   return void 0;
 }
 function extractThreadId(params) {
-  if (!isRecord10(params)) return void 0;
+  if (!isRecord11(params)) return void 0;
   if (typeof params.threadId === "string") return params.threadId;
-  if (isRecord10(params.thread) && typeof params.thread.id === "string") return params.thread.id;
-  if (isRecord10(params.turn) && typeof params.turn.threadId === "string") return params.turn.threadId;
+  if (isRecord11(params.thread) && typeof params.thread.id === "string") return params.thread.id;
+  if (isRecord11(params.turn) && typeof params.turn.threadId === "string") return params.turn.threadId;
   return void 0;
 }
 function optionalInteger2(value) {
@@ -24194,13 +24516,13 @@ function mapCodexImageInputs(params) {
   return {
     ...params,
     input: params.input.map((value) => {
-      if (!isRecord10(value) || value.type !== "image" || typeof value.mediaType !== "string" || typeof value.data !== "string") return value;
+      if (!isRecord11(value) || value.type !== "image" || typeof value.mediaType !== "string" || typeof value.data !== "string") return value;
       return { type: "image", url: `data:${value.mediaType};base64,${value.data}` };
     })
   };
 }
 function sanitizeApprovalParams(params, requestHandle) {
-  if (!isRecord10(params)) return { requestHandle };
+  if (!isRecord11(params)) return { requestHandle };
   const safe = { ...params };
   delete safe.proposedExecpolicyAmendment;
   delete safe.additionalPermissions;
@@ -24231,7 +24553,7 @@ function isProjectListFallbackError(error) {
 function canTryNextBinary(error) {
   return !(error instanceof RpcError) || !["CODEX_AUTH_REQUIRED", "CODEX_CLOSED"].includes(error.code);
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function array2(value) {
@@ -24339,6 +24661,9 @@ var HostPluginRuntime = class {
       accountRequired: error === "ACCOUNT_AUTH_REQUIRED" || error === "AUTH_INVALID" || error === "TOKEN_EXPIRED"
     };
   }
+  localHarnessVersion() {
+    return this.harnessVersion;
+  }
   reconnectHost() {
     if (this.closed) throw new Error("remote runtime is closed");
     if (this.serverConnection === void 0) {
@@ -24508,9 +24833,13 @@ var HostPluginRuntime = class {
   }
   hostCapabilities() {
     const capabilities = [];
-    if (this.apiProxy !== void 0) capabilities.push("harness.api.v1", "harness.api.transfer.v1");
     if (this.localGateway?.supportsCarrier === true) {
-      capabilities.push("harness.remote.v1", "harness.remote.transfer.v1");
+      capabilities.push(
+        harnessSessionGeneration(this.harnessVersion) === "v3" ? "harness.remote.v3" : "harness.remote.v1",
+        "harness.remote.transfer.v1"
+      );
+    } else if (this.apiProxy !== void 0) {
+      capabilities.push("harness.api.v1", "harness.api.transfer.v1");
     }
     if (this.fileViewerHost?.() !== void 0) capabilities.push("fileviewer.read.v1");
     if (this.codex.isAvailable()) capabilities.push("codex.appserver.v1", "codex.appserver.transfer.v1");