frizz 0.12.4 → 0.12.7

package/dist/dev-child.js

@@ -13671,7 +13671,7 @@ function parseGithubWakeSteer(text2) {
 function frizzRoute(path3) {
   return `${FRIZZ_ROUTE_PREFIX}${path3.startsWith("/") ? path3 : `/${path3}`}`;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, RETIRED_AWAITING_REPLACEMENT, AWAITING_KEY_RE, AWAITING_YAML_KEYS, AWAITING_SEQUENCE_KEYS, AWAITING_HINT_MAX, AWAITING_HINT_VALUE_MAX, AWAITING_TITLE_MAX, AWAITING_ITEM_KINDS, AWAITING_DURATION_RE, DURATION_UNIT_MS, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, INTERRUPT_MARKERS, ALLDONE_SENTINEL, OPT_OUT_NOTE, OVER_QUESTION_NOTE, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TIMER_MAX_ARMED, TimerPromptText, PR_WATCH_SPENT_TRAILER, PR_WATCH_ARMED_TRAILER, SHELL_DONE_TRAILER, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, PARK_CORRECTION_NAMES_LEAD, PARK_CORRECTION_RETIRED_LEAD, PARK_CORRECTION_QUESTION_LEAD, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PR_WATCH_MAX_ARMED, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, OWN_WATCH_MAX_ARMED, AskQuestionKind, ASK_MAX_DEPTH, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, BURIED_ANSWERS_HEADER, ANSWER_FOLLOW_UP_MARKER, DISMISSED_ANSWER, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GITHUB_DISPATCH_UI_BOUNDARY, WAKE_TIME_HEADER_TAIL, WAKE_TRAILERS, HUMAN_GAP_FLOOR_MS, HUMAN_GAP_NOTE_TAIL, WAKE_DELIVERY_TOKEN_TAIL, WAKE_DELIVERY_TOKEN_LINE, NOISE_PREFIXES, AGENT_MESSAGE_WRAPPER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REVIEW_LEAD, WAKE_BACKLOG_TAIL, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, WAKE_ITEM, WAKE_MORE, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, PROJECT_ICON_EXTENSIONS, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT, threadIdentityName;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, RETIRED_AWAITING_REPLACEMENT, AWAITING_KEY_RE, AWAITING_YAML_KEYS, AWAITING_SEQUENCE_KEYS, AWAITING_HINT_MAX, AWAITING_HINT_VALUE_MAX, AWAITING_TITLE_MAX, AWAITING_ITEM_KINDS, AWAITING_DURATION_RE, DURATION_UNIT_MS, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, INTERRUPT_MARKERS, ALLDONE_SENTINEL, OPT_OUT_NOTE, OVER_QUESTION_NOTE, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TIMER_MAX_ARMED, TimerPromptText, PR_WATCH_SPENT_TRAILER, PR_WATCH_ARMED_TRAILER, SHELL_DONE_TRAILER, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, PARK_CORRECTION_NAMES_LEAD, PARK_CORRECTION_RETIRED_LEAD, PARK_CORRECTION_QUESTION_LEAD, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PR_WATCH_MAX_ARMED, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, OWN_WATCH_MAX_ARMED, AskQuestionKind, ASK_MAX_DEPTH, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, BURIED_ANSWERS_HEADER, ANSWER_FOLLOW_UP_MARKER, DISMISSED_ANSWER, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GITHUB_DISPATCH_UI_BOUNDARY, WAKE_TIME_HEADER_TAIL, WAKE_TRAILERS, HUMAN_GAP_FLOOR_MS, HUMAN_GAP_NOTE_TAIL, WAKE_DELIVERY_TOKEN_TAIL, WAKE_DELIVERY_TOKEN_LINE, NOISE_PREFIXES, AGENT_MESSAGE_WRAPPER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REVIEW_LEAD, WAKE_BACKLOG_TAIL, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, WAKE_ITEM, WAKE_MORE, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, PROJECT_ICON_EXTENSIONS, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT, threadIdentityName;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -14429,6 +14429,13 @@ var init_src = __esm({
       // setting is off, the instant is unresolvable, or the pause is too old to safely resume.
       autoResume: external_exports.boolean()
     });
+    ProviderError = external_exports.object({
+      message: external_exports.string(),
+      code: external_exports.string().optional(),
+      details: external_exports.string().optional(),
+      retrying: external_exports.boolean().optional(),
+      at: external_exports.string().optional()
+    });
     ThreadView = external_exports.object({
       id: ThreadSlug,
       // slug; filename is <slug>.md
@@ -14539,6 +14546,7 @@ var init_src = __esm({
       // is to WAIT and continue — not to sign in. Same discipline as providerFault: only typed data
       // travels, never the provider's own error text. Optional so old snapshots/servers parse.
       limitPause: LimitPause.optional(),
+      providerError: ProviderError.optional(),
       // ---- Session-first fields (ALL optional: absent ⇒ a legacy .frizz-file row / pre-restart server;
       // the client treats such rows as Legacy-shelf material). Deliberately not zod-defaulted so server
       // constructors that predate the model still typecheck and old snapshots parse unchanged. ----
@@ -15498,6 +15506,7 @@ ${DISPATCH_TASK_BANNER}
       // search, and transcript logic; shared chat surfaces use this compact form for generated prompts
       // whose machine-facing tail would otherwise dominate the first user bubble.
       displayText: external_exports.string().optional(),
+      providerError: ProviderError.optional(),
       tools: external_exports.array(TranscriptToolCall),
       at: external_exports.string().optional(),
       // ISO8601
@@ -20752,6 +20761,180 @@ var init_dispatch_preferences = __esm({
   }
 });
 
+// packages/server/src/credential-redaction.ts
+function replacement(options, secretToken) {
+  const configured = options.replacement ?? DEFAULT_REPLACEMENT;
+  return typeof configured === "function" ? configured(secretToken) : configured;
+}
+function unquote(raw2) {
+  return raw2.length >= 2 && (raw2[0] === '"' || raw2[0] === "'") && raw2.at(-1) === raw2[0] ? raw2.slice(1, -1) : raw2;
+}
+function userInfoParts(raw2) {
+  const value = unquote(raw2);
+  const literal = value.indexOf(":");
+  const encodedMatch = /%3a/iu.exec(value);
+  const encoded = encodedMatch?.index ?? -1;
+  const index = literal === -1 ? encoded : encoded === -1 ? literal : Math.min(literal, encoded);
+  if (index <= 0) return null;
+  const delimiter2 = value.slice(index, index + (index === encoded ? 3 : 1));
+  return { username: value.slice(0, index), delimiter: delimiter2, password: value.slice(index + delimiter2.length) };
+}
+function redactUserInfoToken(raw2, options) {
+  const parts = userInfoParts(raw2);
+  if (!parts) return null;
+  return `${parts.username}${parts.delimiter}${replacement(options, parts.password)}`;
+}
+function hasCurlCommandContext(source, offset) {
+  const bounded = source.slice(Math.max(0, offset - 1024), offset);
+  const separator = Math.max(
+    bounded.lastIndexOf("\n"),
+    bounded.lastIndexOf("\r"),
+    bounded.lastIndexOf(";"),
+    bounded.lastIndexOf("&"),
+    bounded.lastIndexOf("|")
+  );
+  const segment = bounded.slice(separator + 1);
+  return segment.split(/[ \t]+/u).some((token) => CURL_EXECUTABLE_RE.test(unquote(token)));
+}
+function redactCredentialSyntax(raw2, options = {}) {
+  let value = raw2;
+  value = value.replace(
+    URL_USERINFO_RE,
+    (_whole, scheme, username, delimiter2, password) => `${scheme}${username}${delimiter2}${replacement(options, password)}@`
+  );
+  value = value.replace(
+    URL_ENCODED_USERINFO_RE,
+    (_whole, scheme, username, delimiter2, password) => `${scheme}${username}${delimiter2}${replacement(options, password)}@`
+  );
+  value = value.replace(
+    USER_FLAG_RE,
+    (whole, boundary, flag, separator, userInfo, offset, source) => {
+      if (unquote(flag).toLowerCase() === "-u" && !hasCurlCommandContext(source, offset)) return whole;
+      const safe = redactUserInfoToken(userInfo, options);
+      return safe === null ? whole : `${boundary}${flag}${separator}${safe}`;
+    }
+  );
+  value = value.replace(
+    ATTACHED_USER_FLAG_RE,
+    (whole, boundary, flag, userInfo, offset, source) => {
+      if (!hasCurlCommandContext(source, offset)) return whole;
+      const safe = redactUserInfoToken(userInfo, options);
+      return safe === null ? whole : `${boundary}${flag}${safe}`;
+    }
+  );
+  value = value.replace(
+    LONG_FLAG_RE,
+    (_whole, boundary, flag, separator, secret) => `${boundary}${flag}${separator}${replacement(options, secret)}`
+  );
+  return value;
+}
+function isCredentialFieldName(name) {
+  const normalized = name.replace(new RegExp("([\\p{Ll}\\d])(\\p{Lu})", "gu"), "$1-$2");
+  return EXACT_CREDENTIAL_NAME.test(normalized) || SUFFIX_CREDENTIAL_NAME.test(normalized);
+}
+function exactLongFlag(raw2) {
+  return EXACT_LONG_FLAG_RE.test(unquote(raw2));
+}
+function redactArgv(argv, options) {
+  const out = argv.map((part) => redactCredentialSyntax(part, options));
+  for (let index = 0; index < argv.length; index++) {
+    const flag = argv[index];
+    if (exactLongFlag(flag) && index + 1 < argv.length) {
+      out[index + 1] = replacement(options, argv[index + 1]);
+      index++;
+      continue;
+    }
+    const userFlag = unquote(flag).toLowerCase();
+    const curlContext = argv.slice(0, index).some((part) => CURL_EXECUTABLE_RE.test(unquote(part)));
+    if ((userFlag === "--user" || userFlag === "-u" && curlContext) && index + 1 < argv.length) {
+      const safe = redactUserInfoToken(argv[index + 1], options);
+      if (safe !== null) out[index + 1] = safe;
+      index++;
+    }
+  }
+  return out;
+}
+function redactCredentialStructure(input, options = {}) {
+  const seen = /* @__PURE__ */ new WeakMap();
+  const visit = (value, fieldName, credentialContext = false) => {
+    const sensitive = credentialContext || fieldName !== void 0 && isCredentialFieldName(fieldName);
+    if (typeof value === "string") {
+      if (sensitive) return replacement(options, value);
+      return redactCredentialSyntax(value, options);
+    }
+    if (!value || typeof value !== "object") return value;
+    const prior = seen.get(value);
+    if (prior) return prior;
+    if (Array.isArray(value)) {
+      const allStrings = value.every((entry) => typeof entry === "string");
+      const target2 = [];
+      seen.set(value, target2);
+      const source = allStrings && (fieldName === void 0 || ARGV_FIELD_NAME.test(fieldName)) ? redactArgv(value, options) : value;
+      for (const entry of source) target2.push(visit(entry, void 0, sensitive));
+      return target2;
+    }
+    const target = {};
+    seen.set(value, target);
+    for (const [key, entry] of Object.entries(value)) target[key] = visit(entry, key, sensitive);
+    return target;
+  };
+  return visit(input);
+}
+var DEFAULT_REPLACEMENT, FLAG_NAME, BOUNDARY, FLAG_TOKEN, FLAG_SEPARATOR, ESCAPED_SHELL_CHARACTER, QUOTED_OR_BARE_VALUE, LONG_FLAG_RE, USER_FLAG_RE, ATTACHED_USER_FLAG_RE, URL_USERINFO_RE, URL_ENCODED_USERINFO_RE, EXACT_CREDENTIAL_NAME, SUFFIX_CREDENTIAL_NAME, ARGV_FIELD_NAME, EXACT_LONG_FLAG_RE, CURL_EXECUTABLE_RE;
+var init_credential_redaction = __esm({
+  "packages/server/src/credential-redaction.ts"() {
+    "use strict";
+    DEFAULT_REPLACEMENT = "[redacted]";
+    FLAG_NAME = String.raw`(?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|token|secret|password|passwd|credential|private[-_]?key)`;
+    BOUNDARY = String.raw`(^|[\s;&|([{"'])`;
+    FLAG_TOKEN = String.raw`(?:(?:"|')?--?${FLAG_NAME}(?:"|')?)`;
+    FLAG_SEPARATOR = String.raw`(?:[ \t]*(?:=|:)[ \t]*|[ \t]*\\\r?\n[ \t]*|[ \t]+)`;
+    ESCAPED_SHELL_CHARACTER = String.raw`\\(?:\r?\n|[^\r\n])`;
+    QUOTED_OR_BARE_VALUE = String.raw`(?:"(?:${ESCAPED_SHELL_CHARACTER}|[^"\\]){0,4096}"|'[^']{0,4096}'|(?:${ESCAPED_SHELL_CHARACTER}|[^\\\s;&|"']){1,4096})`;
+    LONG_FLAG_RE = new RegExp(`${BOUNDARY}(${FLAG_TOKEN})(${FLAG_SEPARATOR})(${QUOTED_OR_BARE_VALUE})`, "gimu");
+    USER_FLAG_RE = new RegExp(
+      `${BOUNDARY}((?:(?:"|')?(?:-u|--user)(?:"|')?))(${FLAG_SEPARATOR})(${QUOTED_OR_BARE_VALUE})`,
+      "gimu"
+    );
+    ATTACHED_USER_FLAG_RE = new RegExp(`${BOUNDARY}(-u)(${QUOTED_OR_BARE_VALUE})`, "gimu");
+    URL_USERINFO_RE = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)([^\s/?#@"':]{1,512})(:)([^\s/?#@"']{0,4096})@/giu;
+    URL_ENCODED_USERINFO_RE = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)([^\s/?#@"']{1,512}?)(%3a)([^\s/?#@"']{0,4096})@/giu;
+    EXACT_CREDENTIAL_NAME = /^(?:authorization|proxy[-_]?authorization|api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|token|secret|password|passwd|credential|private[-_]?key|cookie)$/iu;
+    SUFFIX_CREDENTIAL_NAME = /(?:^|[._-])(?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|token|secret|password|passwd|credential|private[-_]?key)$/iu;
+    ARGV_FIELD_NAME = /^(?:argv|args|arguments|command|cmd)$/iu;
+    EXACT_LONG_FLAG_RE = new RegExp(`^--?${FLAG_NAME}$`, "iu");
+    CURL_EXECUTABLE_RE = /(?:^|[\\/])curl(?:\.exe)?$/iu;
+  }
+});
+
+// packages/server/src/backend/codex-error.ts
+function errorText(text2) {
+  const safe = redactCredentialSyntax(text2).replace(/\b((?:proxy-)?authorization\s*:\s*(?:bearer|basic)\s+)[^\s,;"']+/gi, "$1[redacted]").trim();
+  return safe.length > 32e3 ? `${safe.slice(0, 32e3)}
+[truncated]` : safe;
+}
+function codexProviderError(raw2, at, retrying = false) {
+  const error = raw2 && typeof raw2 === "object" ? raw2 : {};
+  const info = error.codex_error_info ?? error.codexErrorInfo;
+  const category = typeof info === "string" ? info : info && typeof info === "object" ? Object.keys(info)[0] : void 0;
+  const code = category?.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase().slice(0, 128);
+  const message = typeof raw2 === "string" ? raw2 : typeof error.message === "string" ? error.message : "";
+  const details = error.additional_details ?? error.additionalDetails;
+  return {
+    message: errorText(message) || "Codex reported an error without a message.",
+    ...code ? { code } : {},
+    ...typeof details === "string" && details.trim() ? { details: errorText(details) } : {},
+    ...retrying ? { retrying: true } : {},
+    ...at ? { at } : {}
+  };
+}
+var init_codex_error = __esm({
+  "packages/server/src/backend/codex-error.ts"() {
+    "use strict";
+    init_credential_redaction();
+  }
+});
+
 // packages/server/src/discover.ts
 import { readdirSync as readdirSync3, statSync as statSync4, openSync as openSync7, readSync, closeSync as closeSync6 } from "node:fs";
 import { dirname as dirname7, join as join11 } from "node:path";
@@ -23754,6 +23937,18 @@ function applyFinalText(state, text2) {
 function applyEvent(state, ev) {
   if ("at" in ev && typeof ev.at === "string" && ev.kind !== "context-usage") state.lastActivityAt = ev.at;
   switch (ev.kind) {
+    case "provider-error":
+      state.sawRecords = true;
+      if (ev.error.retrying) break;
+      state.turn = "idle";
+      state.apiFault = true;
+      state.providerError = ev.error;
+      state.lastAssistant = ev.error.message;
+      state.lastFence = void 0;
+      state.lastAssistantAllDone = false;
+      state.lastAssistantHasQuestion = false;
+      if (typeof ev.at === "string") state.lastAssistantAt = ev.at;
+      break;
     case "turn-start":
       state.sawRecords = true;
       state.turn = "in-flight";
@@ -23762,10 +23957,16 @@ function applyEvent(state, ev) {
       state.sawRecords = true;
       state.turn = "idle";
       if (typeof ev.at === "string") state.lastAssistantAt = ev.at;
+      if (ev.finalText !== void 0 || ev.successful) {
+        state.apiFault = void 0;
+        state.providerError = void 0;
+      }
       if (ev.finalText !== void 0) applyFinalText(state, ev.finalText);
       break;
     case "assistant-text":
       state.sawRecords = true;
+      state.apiFault = void 0;
+      state.providerError = void 0;
       if (ev.final) {
         if (typeof ev.at === "string") state.lastAssistantAt = ev.at;
         applyFinalText(state, ev.text);
@@ -25203,7 +25404,7 @@ ${detail2}
       if (!s) return void 0;
       const pendingQuestion = s.lastAssistantHasQuestion;
       const nowMs = now();
-      return { turn: s.turn, permPrompt: s.permPrompt, permPolicy: s.permPolicy, permDenies: s.permDenies, model: s.model, effort: s.effort, profileAt: s.profileAt, profileRevision: s.profileRevision, permissionMode: s.permissionMode, permissionModeAt: s.permissionModeAt, permissionModeRevision: s.permissionModeRevision, lastActivityAt: s.lastActivityAt, lastAssistantAt: s.lastAssistantAt, lastAssistant: s.lastAssistant, aiTitle: s.aiTitle, customTitle: s.customTitle, customTitleRevision: s.customTitleRevision, subAgents: subAgentViews(s, nowMs), droppedReports: [...s.queuedReports.values()], bgShells: [...bgShellViews(s), ...codexBgShellViews(s)], retiredShells: retiredShellViews(s), pendingAsk: s.pendingAsk, pendingQuestion, lastAssistantAllDone: s.lastAssistantAllDone, lastUserAt: s.lastUserAt, lastUserText: s.lastUserText, firstUserText: s.firstUserText, lastFence: s.lastFence, noTranscript: s.noTranscript, authFault: s.authFault, apiFault: s.apiFault, limitFault: s.limitFault, contextTokens: s.contextTokens, contextWindow: s.contextWindow, lastCompactionAt: s.lastCompactionAt };
+      return { turn: s.turn, permPrompt: s.permPrompt, permPolicy: s.permPolicy, permDenies: s.permDenies, model: s.model, effort: s.effort, profileAt: s.profileAt, profileRevision: s.profileRevision, permissionMode: s.permissionMode, permissionModeAt: s.permissionModeAt, permissionModeRevision: s.permissionModeRevision, lastActivityAt: s.lastActivityAt, lastAssistantAt: s.lastAssistantAt, lastAssistant: s.lastAssistant, aiTitle: s.aiTitle, customTitle: s.customTitle, customTitleRevision: s.customTitleRevision, subAgents: subAgentViews(s, nowMs), droppedReports: [...s.queuedReports.values()], bgShells: [...bgShellViews(s), ...codexBgShellViews(s)], retiredShells: retiredShellViews(s), pendingAsk: s.pendingAsk, pendingQuestion, lastAssistantAllDone: s.lastAssistantAllDone, lastUserAt: s.lastUserAt, lastUserText: s.lastUserText, firstUserText: s.firstUserText, lastFence: s.lastFence, noTranscript: s.noTranscript, authFault: s.authFault, apiFault: s.apiFault, providerError: s.providerError, limitFault: s.limitFault, contextTokens: s.contextTokens, contextWindow: s.contextWindow, lastCompactionAt: s.lastCompactionAt };
     },
     // The CURRENT fresh foreign session ids (mtime within FOREIGN_FRESH_MS, capped), mtime-desc. Kept
     // as the last scan's result — recomputed at most every FOREIGN_SCAN_EVERY ticks.
@@ -25536,8 +25737,15 @@ function parseCodexLine(line) {
         return [{ kind: "turn-start", at }];
       case "task_complete": {
         const finalText = typeof p.last_agent_message === "string" ? p.last_agent_message : void 0;
-        return [{ kind: "turn-end", at, finalText }];
+        if (p.error != null) return [
+          { kind: "provider-error", at, error: codexProviderError(p.error, at) },
+          { kind: "turn-end", at }
+        ];
+        return [{ kind: "turn-end", at, finalText, ...p.error === null ? { successful: true } : {} }];
       }
+      case "error":
+      case "stream_error":
+        return [{ kind: "provider-error", at, error: codexProviderError(p.error ?? p, at, pt === "stream_error" || p.will_retry === true || p.willRetry === true) }];
       // The OTHER closing bracket. An INTERRUPTED turn (`reason: "interrupted"` — what turn/interrupt
       // produces, now that stopping a Codex thread actually stops it) never reaches task_complete.
       // Without this the rollout's last word stays task_started, so the tailer holds the turn in-flight
@@ -26016,6 +26224,7 @@ var CODEX_FIRST_FINAL_TITLE_TRANSPORT, CODEX_FIRST_OUTPUT_TITLE_DEVELOPER_INSTRU
 var init_codex = __esm({
   "packages/server/src/backend/codex.ts"() {
     "use strict";
+    init_codex_error();
     init_tailer();
     CODEX_FIRST_FINAL_TITLE_TRANSPORT = 'FRIZZ TITLE TRANSPORT (required): your very first assistant message must begin with one concise `<!-- frizz title="Concise thread title" -->` comment before any commentary, acknowledgement, or tool call. Frizz removes that comment from chat and uses only its quoted title as this thread\'s automatic title.';
     CODEX_FIRST_OUTPUT_TITLE_DEVELOPER_INSTRUCTIONS = 'FRIZZ UI metadata protocol (mandatory): the very first assistant message in this new session, before any commentary, acknowledgement, tool call, or other action, MUST begin on its first line with exactly one `<!-- frizz title="..." -->` HTML comment. Replace `...` with a concise human-readable 3-8 word title for the user\'s task. Put no text before the comment. You may continue the message normally after it. Emit this title comment exactly once. Do not explain the protocol. Frizz removes the comment before displaying the conversation.';
@@ -26054,152 +26263,6 @@ var init_worker_env = __esm({
   }
 });
 
-// packages/server/src/credential-redaction.ts
-function replacement(options, secretToken) {
-  const configured = options.replacement ?? DEFAULT_REPLACEMENT;
-  return typeof configured === "function" ? configured(secretToken) : configured;
-}
-function unquote(raw2) {
-  return raw2.length >= 2 && (raw2[0] === '"' || raw2[0] === "'") && raw2.at(-1) === raw2[0] ? raw2.slice(1, -1) : raw2;
-}
-function userInfoParts(raw2) {
-  const value = unquote(raw2);
-  const literal = value.indexOf(":");
-  const encodedMatch = /%3a/iu.exec(value);
-  const encoded = encodedMatch?.index ?? -1;
-  const index = literal === -1 ? encoded : encoded === -1 ? literal : Math.min(literal, encoded);
-  if (index <= 0) return null;
-  const delimiter2 = value.slice(index, index + (index === encoded ? 3 : 1));
-  return { username: value.slice(0, index), delimiter: delimiter2, password: value.slice(index + delimiter2.length) };
-}
-function redactUserInfoToken(raw2, options) {
-  const parts = userInfoParts(raw2);
-  if (!parts) return null;
-  return `${parts.username}${parts.delimiter}${replacement(options, parts.password)}`;
-}
-function hasCurlCommandContext(source, offset) {
-  const bounded = source.slice(Math.max(0, offset - 1024), offset);
-  const separator = Math.max(
-    bounded.lastIndexOf("\n"),
-    bounded.lastIndexOf("\r"),
-    bounded.lastIndexOf(";"),
-    bounded.lastIndexOf("&"),
-    bounded.lastIndexOf("|")
-  );
-  const segment = bounded.slice(separator + 1);
-  return segment.split(/[ \t]+/u).some((token) => CURL_EXECUTABLE_RE.test(unquote(token)));
-}
-function redactCredentialSyntax(raw2, options = {}) {
-  let value = raw2;
-  value = value.replace(
-    URL_USERINFO_RE,
-    (_whole, scheme, username, delimiter2, password) => `${scheme}${username}${delimiter2}${replacement(options, password)}@`
-  );
-  value = value.replace(
-    URL_ENCODED_USERINFO_RE,
-    (_whole, scheme, username, delimiter2, password) => `${scheme}${username}${delimiter2}${replacement(options, password)}@`
-  );
-  value = value.replace(
-    USER_FLAG_RE,
-    (whole, boundary, flag, separator, userInfo, offset, source) => {
-      if (unquote(flag).toLowerCase() === "-u" && !hasCurlCommandContext(source, offset)) return whole;
-      const safe = redactUserInfoToken(userInfo, options);
-      return safe === null ? whole : `${boundary}${flag}${separator}${safe}`;
-    }
-  );
-  value = value.replace(
-    ATTACHED_USER_FLAG_RE,
-    (whole, boundary, flag, userInfo, offset, source) => {
-      if (!hasCurlCommandContext(source, offset)) return whole;
-      const safe = redactUserInfoToken(userInfo, options);
-      return safe === null ? whole : `${boundary}${flag}${safe}`;
-    }
-  );
-  value = value.replace(
-    LONG_FLAG_RE,
-    (_whole, boundary, flag, separator, secret) => `${boundary}${flag}${separator}${replacement(options, secret)}`
-  );
-  return value;
-}
-function isCredentialFieldName(name) {
-  const normalized = name.replace(new RegExp("([\\p{Ll}\\d])(\\p{Lu})", "gu"), "$1-$2");
-  return EXACT_CREDENTIAL_NAME.test(normalized) || SUFFIX_CREDENTIAL_NAME.test(normalized);
-}
-function exactLongFlag(raw2) {
-  return EXACT_LONG_FLAG_RE.test(unquote(raw2));
-}
-function redactArgv(argv, options) {
-  const out = argv.map((part) => redactCredentialSyntax(part, options));
-  for (let index = 0; index < argv.length; index++) {
-    const flag = argv[index];
-    if (exactLongFlag(flag) && index + 1 < argv.length) {
-      out[index + 1] = replacement(options, argv[index + 1]);
-      index++;
-      continue;
-    }
-    const userFlag = unquote(flag).toLowerCase();
-    const curlContext = argv.slice(0, index).some((part) => CURL_EXECUTABLE_RE.test(unquote(part)));
-    if ((userFlag === "--user" || userFlag === "-u" && curlContext) && index + 1 < argv.length) {
-      const safe = redactUserInfoToken(argv[index + 1], options);
-      if (safe !== null) out[index + 1] = safe;
-      index++;
-    }
-  }
-  return out;
-}
-function redactCredentialStructure(input, options = {}) {
-  const seen = /* @__PURE__ */ new WeakMap();
-  const visit = (value, fieldName, credentialContext = false) => {
-    const sensitive = credentialContext || fieldName !== void 0 && isCredentialFieldName(fieldName);
-    if (typeof value === "string") {
-      if (sensitive) return replacement(options, value);
-      return redactCredentialSyntax(value, options);
-    }
-    if (!value || typeof value !== "object") return value;
-    const prior = seen.get(value);
-    if (prior) return prior;
-    if (Array.isArray(value)) {
-      const allStrings = value.every((entry) => typeof entry === "string");
-      const target2 = [];
-      seen.set(value, target2);
-      const source = allStrings && (fieldName === void 0 || ARGV_FIELD_NAME.test(fieldName)) ? redactArgv(value, options) : value;
-      for (const entry of source) target2.push(visit(entry, void 0, sensitive));
-      return target2;
-    }
-    const target = {};
-    seen.set(value, target);
-    for (const [key, entry] of Object.entries(value)) target[key] = visit(entry, key, sensitive);
-    return target;
-  };
-  return visit(input);
-}
-var DEFAULT_REPLACEMENT, FLAG_NAME, BOUNDARY, FLAG_TOKEN, FLAG_SEPARATOR, ESCAPED_SHELL_CHARACTER, QUOTED_OR_BARE_VALUE, LONG_FLAG_RE, USER_FLAG_RE, ATTACHED_USER_FLAG_RE, URL_USERINFO_RE, URL_ENCODED_USERINFO_RE, EXACT_CREDENTIAL_NAME, SUFFIX_CREDENTIAL_NAME, ARGV_FIELD_NAME, EXACT_LONG_FLAG_RE, CURL_EXECUTABLE_RE;
-var init_credential_redaction = __esm({
-  "packages/server/src/credential-redaction.ts"() {
-    "use strict";
-    DEFAULT_REPLACEMENT = "[redacted]";
-    FLAG_NAME = String.raw`(?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|token|secret|password|passwd|credential|private[-_]?key)`;
-    BOUNDARY = String.raw`(^|[\s;&|([{"'])`;
-    FLAG_TOKEN = String.raw`(?:(?:"|')?--?${FLAG_NAME}(?:"|')?)`;
-    FLAG_SEPARATOR = String.raw`(?:[ \t]*(?:=|:)[ \t]*|[ \t]*\\\r?\n[ \t]*|[ \t]+)`;
-    ESCAPED_SHELL_CHARACTER = String.raw`\\(?:\r?\n|[^\r\n])`;
-    QUOTED_OR_BARE_VALUE = String.raw`(?:"(?:${ESCAPED_SHELL_CHARACTER}|[^"\\]){0,4096}"|'[^']{0,4096}'|(?:${ESCAPED_SHELL_CHARACTER}|[^\\\s;&|"']){1,4096})`;
-    LONG_FLAG_RE = new RegExp(`${BOUNDARY}(${FLAG_TOKEN})(${FLAG_SEPARATOR})(${QUOTED_OR_BARE_VALUE})`, "gimu");
-    USER_FLAG_RE = new RegExp(
-      `${BOUNDARY}((?:(?:"|')?(?:-u|--user)(?:"|')?))(${FLAG_SEPARATOR})(${QUOTED_OR_BARE_VALUE})`,
-      "gimu"
-    );
-    ATTACHED_USER_FLAG_RE = new RegExp(`${BOUNDARY}(-u)(${QUOTED_OR_BARE_VALUE})`, "gimu");
-    URL_USERINFO_RE = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)([^\s/?#@"':]{1,512})(:)([^\s/?#@"']{0,4096})@/giu;
-    URL_ENCODED_USERINFO_RE = /\b([a-z][a-z0-9+.-]{0,31}:\/\/)([^\s/?#@"']{1,512}?)(%3a)([^\s/?#@"']{0,4096})@/giu;
-    EXACT_CREDENTIAL_NAME = /^(?:authorization|proxy[-_]?authorization|api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|token|secret|password|passwd|credential|private[-_]?key|cookie)$/iu;
-    SUFFIX_CREDENTIAL_NAME = /(?:^|[._-])(?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|token|secret|password|passwd|credential|private[-_]?key)$/iu;
-    ARGV_FIELD_NAME = /^(?:argv|args|arguments|command|cmd)$/iu;
-    EXACT_LONG_FLAG_RE = new RegExp(`^--?${FLAG_NAME}$`, "iu");
-    CURL_EXECUTABLE_RE = /(?:^|[\\/])curl(?:\.exe)?$/iu;
-  }
-});
-
 // node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants = __commonJS({
   "node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js"(exports, module) {
@@ -31867,7 +31930,7 @@ function createCodexAppServerBridge(options) {
 function codexAppServerBridgeEnabled() {
   return true;
 }
-var CODEX_APP_SERVER_PROVIDER, CODEX_NATIVE_LISTEN_FLAG, CODEX_APP_SERVER_SUPPORTED_VERSION, CODEX_APP_SERVER_PROTOCOL_REVISION, aheadVersionWarned, PROTOCOL_FINGERPRINT, CLIENT_INFO, CLIENT_CAPABILITIES, CODEX_SANDBOX_MODES, CODEX_APPROVAL_POLICY, CODEX_DEFAULT_SANDBOX, SANDBOX_CONFIRM_TIMEOUT_MS, SANDBOX_NOOP_GRACE_MS, MAX_JSONL_BYTES, MAX_INBOUND_JSONL_BYTES, MAX_INBOUND_RECORDS, MAX_INBOUND_QUEUED_BYTES, MAX_OUTBOUND_REQUESTS, MAX_STDERR_BYTES, DEFAULT_REQUEST_TIMEOUT_MS, BRIDGE_DB_SCHEMA_VERSION, RpcIdSchema, Opaque, SafeTimestampMs, NullableString, CommandAction, NetworkApprovalContext, FileSystemSpecialPath, FileSystemPath, FileSystemSandboxEntry, NetworkPermissions, FileSystemPermissions, RequestedPermissions, NetworkPolicyAmendment, CommandApprovalParams, FileApprovalParams, PatchChangeKind, FileUpdateChange, FileChangeItem, CommandExecutionItem, ItemStartedNotification, ItemCompletedNotification, FileChangePatchUpdatedNotification, PermissionsApprovalParams, UserInputQuestion, UserInputParams, McpBase, McpElicitationParams, ResolvedNotification, RpcProtocolError, JsonlRpcConnection, BindingRowSchema, BridgeMetaRowSchema, DISPLAY_REDACTION, UNSAFE_DISPLAY_TEXT, SECRET_NAME, commandDecisionMap, InitializeResponse, ThreadResponse, TurnResponse, TurnSteerResponse, SkillsListResponse, ThreadResumeSandbox, ThreadResumeStatus, ThreadSettingsUpdated, TurnStarted, TurnCompleted, MAX_CORRELATED_FILE_ITEMS, CODEX_APP_SERVER_TABLES, CodexAppServerBridge;
+var CODEX_APP_SERVER_PROVIDER, CODEX_NATIVE_LISTEN_FLAG, CODEX_APP_SERVER_SUPPORTED_VERSION, CODEX_APP_SERVER_PROTOCOL_REVISION, aheadVersionWarned, PROTOCOL_FINGERPRINT, CLIENT_INFO, CLIENT_CAPABILITIES, CODEX_SANDBOX_MODES, CODEX_APPROVAL_POLICY, CODEX_DEFAULT_SANDBOX, SANDBOX_CONFIRM_TIMEOUT_MS, SANDBOX_NOOP_GRACE_MS, MAX_JSONL_BYTES, MAX_INBOUND_JSONL_BYTES, MAX_INBOUND_RECORDS, MAX_INBOUND_QUEUED_BYTES, MAX_OUTBOUND_REQUESTS, MAX_STDERR_BYTES, DEFAULT_REQUEST_TIMEOUT_MS, AUTH_REPLACEMENT_WAIT_MS, MAX_AUTH_REPLACEMENT_ATTEMPTS, BRIDGE_DB_SCHEMA_VERSION, RpcIdSchema, Opaque, SafeTimestampMs, NullableString, CommandAction, NetworkApprovalContext, FileSystemSpecialPath, FileSystemPath, FileSystemSandboxEntry, NetworkPermissions, FileSystemPermissions, RequestedPermissions, NetworkPolicyAmendment, CommandApprovalParams, FileApprovalParams, PatchChangeKind, FileUpdateChange, FileChangeItem, CommandExecutionItem, ItemStartedNotification, ItemCompletedNotification, FileChangePatchUpdatedNotification, PermissionsApprovalParams, UserInputQuestion, UserInputParams, McpBase, McpElicitationParams, ResolvedNotification, RpcProtocolError, JsonlRpcConnection, BindingRowSchema, BridgeMetaRowSchema, DISPLAY_REDACTION, UNSAFE_DISPLAY_TEXT, SECRET_NAME, commandDecisionMap, InitializeResponse, ThreadResponse, TurnResponse, TurnSteerResponse, SkillsListResponse, ThreadResumeSandbox, ThreadResumeStatus, ThreadSettingsUpdated, TurnStarted, TurnCompleted, MAX_CORRELATED_FILE_ITEMS, CODEX_APP_SERVER_TABLES, CodexAppServerBridge;
 var init_codex_app_server = __esm({
   "packages/server/src/backend/codex-app-server.ts"() {
     "use strict";
@@ -31881,6 +31944,7 @@ var init_codex_app_server = __esm({
     init_codex_app_server_native();
     init_auth_status();
     init_codex_mcp();
+    init_codex_error();
     init_logging();
     CODEX_APP_SERVER_PROVIDER = "codex-app-server";
     CODEX_NATIVE_LISTEN_FLAG = "FRIZZ_CODEX_NATIVE_LISTEN";
@@ -31932,6 +31996,8 @@ var init_codex_app_server = __esm({
     MAX_OUTBOUND_REQUESTS = 128;
     MAX_STDERR_BYTES = 16 * 1024;
     DEFAULT_REQUEST_TIMEOUT_MS = 2e4;
+    AUTH_REPLACEMENT_WAIT_MS = 2e4;
+    MAX_AUTH_REPLACEMENT_ATTEMPTS = 3;
     BRIDGE_DB_SCHEMA_VERSION = 1;
     RpcIdSchema = external_exports.union([external_exports.string().min(1).max(256), external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)]);
     Opaque = external_exports.string().min(1).max(256);
@@ -32451,6 +32517,7 @@ var init_codex_app_server = __esm({
       processAuthAccountId;
       /** Serializes account-driven replacement across concurrent session/turn starts. */
       authReplacement = null;
+      authReplacementWaitMs;
       turnIdleWaiters = /* @__PURE__ */ new Set();
       /**
        * The handshake a FRESHLY FORKED daemon already gave us and we already rejected — i.e. what the
@@ -32486,6 +32553,9 @@ var init_codex_app_server = __esm({
       // durable, and it must not be — a processId belongs to one app-server process, so a stale one
       // surviving a restart would offer an × that addresses a PTY that no longer exists.
       liveExecs = /* @__PURE__ */ new Map();
+      // Live notices fill the gap before task_complete reaches the durable rollout. Retry notices are
+      // not retained by Codex at all. Session keys and current-turn checks prevent cross-thread leakage.
+      providerErrors = /* @__PURE__ */ new Map();
       activeOperations = 0;
       operationWaiters = /* @__PURE__ */ new Set();
       shutdownPromise = null;
@@ -32495,6 +32565,7 @@ var init_codex_app_server = __esm({
         this.makeId = options.id ?? randomUUID11;
         this.codexBin = options.codexBin ?? "codex";
         this.timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+        this.authReplacementWaitMs = options.authReplacementWaitMs ?? AUTH_REPLACEMENT_WAIT_MS;
         const hostKind = selectCodexHostKind(process.env[CODEX_NATIVE_LISTEN_FLAG], process.platform, Boolean(options.spawn));
         this.host = options.host ?? (hostKind === "direct" ? directChildHost(options.spawn) : hostKind === "native" ? nativeListenCodexAppServerHost : daemonCodexAppServerHost);
         this.db = options.db;
@@ -32682,7 +32753,9 @@ var init_codex_app_server = __esm({
           }
           if (binding.current_turn_id !== null) throw new Error("Codex app-server session already has an active turn");
           const pendingKey = turnKey(binding);
+          this.providerErrors.delete(input.sessionId);
           this.pendingTurnStarts.add(pendingKey);
+          this.options.onStatusChange?.();
           try {
             const response = TurnResponse.parse(await connection.request("turn/start", {
               threadId: binding.codex_thread_id,
@@ -32939,7 +33012,8 @@ var init_codex_app_server = __esm({
         const onThisConnection = row.state === "active" && row.connection_epoch === this.connectionEpoch;
         return {
           bridgeTurn: onThisConnection && (row.current_turn_id !== null || this.pendingTurnStarts.has(turnKey(row))),
-          ownedSince: row.updated_at
+          ownedSince: row.updated_at,
+          providerError: onThisConnection ? this.providerErrors.get(sessionId) : void 0
         };
       }
       /**
@@ -32981,6 +33055,7 @@ var init_codex_app_server = __esm({
         if (this.closed || this.dbReleased) return false;
         const row = this.bindingForScope(threadSlug, sessionId);
         if (!row) return false;
+        this.providerErrors.delete(sessionId);
         const ownsCurrentProcess = row.connection_epoch === this.connectionEpoch || this.openingConnection !== null;
         try {
           this.forgetCorrelatedFileItems(row.codex_thread_id);
@@ -33139,12 +33214,27 @@ var init_codex_app_server = __esm({
        * keeps using the account it started with even after ccbroker atomically switches auth.json. Before
        * starting new model work, replace that stale process — but only after every turn already running
        * in the shared per-project process has reached its own completion event.
+       *
+       * THE WAIT IS BOUNDED, AND WHEN THE BOUND EXPIRES THE TURN GOES AHEAD ON THE ACCOUNT WE HAVE.
+       * "Every turn in this project is idle" is a whole-PROJECT condition and the app-server is shared, so
+       * on a board running several codex threads it can be a long time coming — and until it comes, this
+       * used to hold the operator's own `turn/start` open with no timeout, no error and no way to tell.
+       * Measured 2026-09-05: auth.json changed at 21:45Z, the thread's turn ended at 23:00Z, and every
+       * follow-up typed into it from then on hung inside this wait until the project happened to go
+       * quiet at 00:19Z — 1h 18m of an operator typing steers into a box that answered nothing (the
+       * browser then queued each one behind the last, so not even a reload's worth of them ever left).
+       *
+       * Running one turn on the previous account is a visible, recoverable outcome; hanging the send is
+       * neither. So the replacement stays armed and lands at the next real idle boundary, and every turn
+       * started after it picks up the new account. A replacement that FAILS outright still throws — that
+       * is a broken app-server, not a busy one.
        */
       async ensureCurrentAuth() {
-        for (; ; ) {
+        for (let attempt = 0; ; attempt++) {
           const desiredAccountId = (this.options.codexAuthAccountId ?? readCodexAccountId)();
           const connection = await this.ensureConnected();
           if (!desiredAccountId || this.processAuthAccountId === desiredAccountId) return connection;
+          if (attempt >= MAX_AUTH_REPLACEMENT_ATTEMPTS) return connection;
           if (!this.authReplacement) {
             const replacement2 = this.replaceAppServerForAuthChange();
             this.authReplacement = replacement2;
@@ -33152,7 +33242,23 @@ var init_codex_app_server = __esm({
               if (this.authReplacement === replacement2) this.authReplacement = null;
             }).catch(() => void 0);
           }
-          await this.authReplacement;
+          if (!await this.awaitAuthReplacement(this.authReplacement)) return connection;
+        }
+      }
+      /** Await an armed replacement for at most AUTH_REPLACEMENT_WAIT_MS. `false` = it is still waiting for
+       *  the project to go idle, so the caller should proceed rather than hang; a rejection propagates. */
+      async awaitAuthReplacement(replacement2) {
+        let timer;
+        const expired = new Promise((resolve12) => {
+          timer = setTimeout(() => resolve12(false), this.authReplacementWaitMs);
+          timer.unref?.();
+        });
+        const settled = replacement2.then(() => true);
+        try {
+          return await Promise.race([settled, expired]);
+        } finally {
+          if (timer) clearTimeout(timer);
+          void settled.catch(() => void 0);
         }
       }
       hasInFlightTurns() {
@@ -33314,6 +33420,7 @@ var init_codex_app_server = __esm({
         const epoch = this.connectionEpoch;
         this.connection = null;
         this.processAuthAccountId = void 0;
+        this.providerErrors.clear();
         this.forgetCorrelatedFileItems();
         this.releaseSettingsWaiters();
         if (this.closed || this.dbReleased) return;
@@ -34056,9 +34163,20 @@ var init_codex_app_server = __esm({
         });
       }
       async handleNotification(connection, method, rawParams) {
+        if (method === "error") {
+          const parsed = external_exports.object({ threadId: Opaque, turnId: Opaque, error: external_exports.unknown(), willRetry: external_exports.boolean() }).passthrough().safeParse(rawParams);
+          if (!parsed.success) return;
+          const binding = this.bindingForCodexThread(parsed.data.threadId);
+          if (!binding || binding.state !== "active" || binding.connection_epoch !== this.connectionEpoch || binding.current_turn_id !== parsed.data.turnId) return;
+          this.providerErrors.set(binding.frizz_session_id, codexProviderError(parsed.data.error, this.now().toISOString(), parsed.data.willRetry));
+          this.options.onStatusChange?.();
+          return;
+        }
         if (method === "item/started") {
           const envelope = ItemStartedNotification.safeParse(rawParams);
           if (!envelope.success) return;
+          const binding = this.bindingForCodexThread(envelope.data.threadId);
+          if (binding?.state === "active" && binding.connection_epoch === this.connectionEpoch && binding.current_turn_id === envelope.data.turnId && this.providerErrors.delete(binding.frizz_session_id)) this.options.onStatusChange?.();
           this.foldExecItem(envelope.data.threadId, envelope.data.item, envelope.data.startedAtMs);
           const item = FileChangeItem.safeParse(envelope.data.item);
           if (!item.success || item.data.status !== "inProgress") return;
@@ -34155,6 +34273,7 @@ var init_codex_app_server = __esm({
             return;
           }
           if (!this.pendingTurnStarts.has(turnKey(binding))) return;
+          this.providerErrors.delete(binding.frizz_session_id);
           this.scope.prepare(`
         UPDATE codex_app_server_session SET current_turn_id = ?, updated_at = ?
         WHERE project_id = @project_id AND codex_thread_id = ? AND connection_epoch = ? AND current_turn_id IS NULL
@@ -34164,6 +34283,14 @@ var init_codex_app_server = __esm({
         if (method === "turn/completed") {
           const parsed = TurnCompleted.safeParse(rawParams);
           if (!parsed.success) return;
+          const binding = this.bindingForCodexThread(parsed.data.threadId);
+          if (binding?.state === "active" && binding.connection_epoch === this.connectionEpoch && binding.current_turn_id === parsed.data.turn.id) {
+            if (parsed.data.turn.error != null || parsed.data.turn.status === "failed") {
+              this.providerErrors.set(binding.frizz_session_id, codexProviderError(parsed.data.turn.error, this.now().toISOString()));
+            } else {
+              this.providerErrors.delete(binding.frizz_session_id);
+            }
+          }
           for (const item of [...this.correlatedFileItems.values()]) {
             if (item.threadId !== parsed.data.threadId || item.turnId !== parsed.data.turn.id) continue;
             const active = await this.invalidateCorrelatedFileApproval(
@@ -34180,6 +34307,7 @@ var init_codex_app_server = __esm({
         WHERE project_id = @project_id AND codex_thread_id = ? AND connection_epoch = ? AND current_turn_id = ?
       `).run(this.now().toISOString(), parsed.data.threadId, this.connectionEpoch, parsed.data.turn.id);
           this.notifyTurnIdleWaiters();
+          this.options.onStatusChange?.();
         }
       }
       providerResponse(record, delivery2, input) {
@@ -37650,6 +37778,7 @@ function deriveNeedsYou(row, tele, runtime, hasActionableInteraction = false, no
   if (!atRest) return false;
   if (runtime === "exited" && tele?.turn === "in-flight") return true;
   if (hasFreshDelivery(row, deliveryProcessGone)) return false;
+  if (tele?.providerError && !tele.providerError.retrying) return true;
   if (tele?.pendingQuestion) return true;
   if (openQuestions > 0) return true;
   if (limitPause) return true;
@@ -37663,7 +37792,7 @@ function deriveNeedsYou(row, tele, runtime, hasActionableInteraction = false, no
 }
 function deriveAwaitingBackground(row, tele, runtime, hasActionableInteraction = false, nowMs = Date.now(), limitPause = void 0, deliveryProcessGone = false, github = {}, registeredPrWatches = /* @__PURE__ */ new Set(), armedTimerIds = /* @__PURE__ */ new Set(), armedWatches = [], openQuestions = 0) {
   if (runtime !== "turn-idle" || !hasDeclaredWait(tele, nowMs, armedTimerIds, registeredPrWatches, armedWatches)) return false;
-  if (limitPause) return false;
+  if (limitPause || tele?.providerError) return false;
   if (hasActionableInteraction || tele?.pendingAsk || tele?.pendingQuestion || openQuestions > 0) return false;
   if (tele?.lastFence?.kind === "done") return false;
   if (tele?.lastFence?.kind === "awaiting" && !hasParkedPrWatch(tele, registeredPrWatches) && !hasDeclaredBackgroundPark(tele, nowMs) && // A REGISTERED park is the same exception for the same reason. (A registration with no fence at all
@@ -37798,9 +37927,29 @@ function sessionThreadView(projectDir, storage, row, rawTele, registeredLegacyTe
     expiresAt: new Date(w.expires_at).toISOString()
   }));
   const supersededDone = questions.length > 0 || armedWatches.length > 0 || armedPrWatches.length > 0 || armedTimers.length > 0;
-  const done = supersededDone ? void 0 : registeredDoneFence(registries.done.get(row.slug), rawTele?.lastUserAt);
-  const tele = done && rawTele ? { ...rawTele, lastFence: done } : rawTele;
-  const headlessStalled = row.codex_runtime === "app-server" ? appServerTurnStalled(codexTurnLiveness(row.slug, row.session_id), tele?.lastActivityAt, nowMs) : isBrokerClaudeRow(row) ? !claudeBrokerDaemonAlive(row.session_id) : false;
+  const codexLive = row.codex_runtime === "app-server" ? codexTurnLiveness(row.slug, row.session_id) : void 0;
+  const nativeError = codexLive?.providerError;
+  const nativeFailure = nativeError && !nativeError.retrying && !codexLive?.bridgeTurn && (!rawTele?.lastActivityAt || nativeError.at !== void 0 && nativeError.at >= rawTele.lastActivityAt);
+  const sameError = rawTele?.providerError?.message === nativeError?.message && rawTele?.providerError?.code === nativeError?.code;
+  const providerError = nativeError?.retrying ? nativeError : nativeFailure ? sameError ? rawTele?.providerError : nativeError : rawTele?.providerError;
+  const failedTele = nativeFailure ? {
+    subAgents: [],
+    bgShells: [],
+    ...rawTele,
+    turn: "idle",
+    permPrompt: false,
+    pendingQuestion: false,
+    pendingAsk: void 0,
+    apiFault: true,
+    providerError,
+    lastAssistant: providerError?.message,
+    lastAssistantAt: providerError?.at,
+    lastFence: void 0,
+    lastAssistantAllDone: false
+  } : rawTele;
+  const done = supersededDone || providerError ? void 0 : registeredDoneFence(registries.done.get(row.slug), rawTele?.lastUserAt);
+  const tele = done && failedTele ? { ...failedTele, lastFence: done } : failedTele;
+  const headlessStalled = row.codex_runtime === "app-server" ? !nativeFailure && appServerTurnStalled(codexLive, tele?.lastActivityAt, nowMs) : isBrokerClaudeRow(row) ? !claudeBrokerDaemonAlive(row.session_id) : false;
   const headlessLostWork = isBrokerClaudeRow(row) && headlessStalled && hasUnretiredOwnAgents(tele);
   const deliveryProcessGone = isBrokerClaudeRow(row) && headlessStalled;
   const runtime = degradeIfAwaitingAnswer(
@@ -37865,6 +38014,7 @@ function sessionThreadView(projectDir, storage, row, rawTele, registeredLegacyTe
     // Subscription window exhausted mid-turn — the credential is fine, so this is a WAIT, not a
     // sign-in. Drives the pause card and (while an auto-resume is promised) the queue excusal above.
     limitPause,
+    providerError,
     kind: "session",
     foreign: false,
     lastFence: tele?.lastFence,
@@ -37979,6 +38129,7 @@ function foreignThreadView(sessionId, tele, backend) {
     questions: [],
     kind: "session",
     foreign: true,
+    providerError: tele.providerError,
     needsYou: false,
     awaitingBackground: false,
     crashed: false,
@@ -39450,6 +39601,7 @@ function createScheduler(deps) {
       return tele.turn === "idle" ? "current-idle" : "current-busy";
     }
     if (isStopHookFenceId(item.fenceId)) {
+      if (tele.authFault || tele.apiFault) return "superseded";
       const armed = armedRest(row);
       if (!armed || item.fenceId !== stopHookFenceId(armed.armedAt, tele.lastAssistantAt ?? "")) return "superseded";
       if (restMessageIsSignedOff(deps.storage, item.slug, tele, registeredPrWatchesOf(deps.storage, item.slug), armedTimerIdsOf(deps.storage, item.slug), armed.armedAt)) return "superseded";
@@ -39465,6 +39617,7 @@ function createScheduler(deps) {
       return tele.turn === "idle" ? "current-idle" : "current-busy";
     }
     if (isSignoffFenceId(item.fenceId)) {
+      if (tele.authFault || tele.apiFault) return "superseded";
       if (item.fenceId !== signoffFenceId(tele.lastAssistantAt ?? "")) return "superseded";
       if (tele.lastFence || tele.pendingQuestion) return "superseded";
       return tele.turn === "idle" ? "current-idle" : "current-busy";
@@ -41907,6 +42060,7 @@ function createContextUnchecked(opts, resources) {
     // fact. Before this the diagnostic sink was unset and every death — the six-sub-agent loss
     // included — was an unattributable "the thread went quiet." See codex-app-server-diagnostics.ts.
     diagnostic: createCodexDiagnosticSink(project.stateDir, project.id),
+    onStatusChange: () => board?.refresh(),
     // Never wake a thread the human has already put away: a restart-recovery nudge is only for a
     // thread that is still open and still theirs to come back to.
     shouldAutoResume: (slug) => {
@@ -46363,6 +46517,7 @@ function projectCodexTranscript(raw2, identityPrefix = "codex") {
   let sawFinalAnswer = false;
   let turnReasoning = null;
   let pendingCaption;
+  let lastProviderError;
   let prevEventAt;
   let lastContextTokens;
   let openCompaction = null;
@@ -46383,6 +46538,20 @@ function projectCodexTranscript(raw2, identityPrefix = "codex") {
     for (const ev of parseCodexLine(line)) {
       const sourceId = `${identityPrefix}:${lineOffset}:${eventOrdinal++}`;
       switch (ev.kind) {
+        case "provider-error": {
+          const fingerprint = JSON.stringify({ ...ev.error, at: void 0 });
+          if (fingerprint === lastProviderError?.fingerprint) {
+            lastProviderError.message.providerError = ev.error;
+            lastProviderError.message.at = ev.at;
+            break;
+          }
+          cur = null;
+          turnReasoning = null;
+          const message = { sourceId, role: "assistant", kind: "event", text: ev.error.message, providerError: ev.error, tools: [], parts: [], at: ev.at };
+          lastProviderError = { fingerprint, message };
+          out.push(message);
+          break;
+        }
         case "assistant-text": {
           let text2 = extractCodexFrizzTitle(ev.text, ev.final).text;
           if (text2) {
@@ -46578,6 +46747,7 @@ ${text2}`;
           break;
         }
         case "turn-start":
+          lastProviderError = void 0;
           sawFinalAnswer = false;
           turnReasoning = null;
           break;
@@ -53396,8 +53566,8 @@ var init_runtimes = __esm({
     "use strict";
     init_codex_app_server();
     init_frizz_paths();
-    CLAUDE_AGENT_SDK_VERSION = "0.3.261";
-    CLAUDE_CODE_VERSION = "2.1.261";
+    CLAUDE_AGENT_SDK_VERSION = "0.3.263";
+    CLAUDE_CODE_VERSION = "2.1.263";
     CODEX_VERSION = CODEX_APP_SERVER_SUPPORTED_VERSION;
     RUNTIMES_MODE_ENV = "FRIZZ_RUNTIMES";
     RUNTIMES_DIR_ENV = "FRIZZ_RUNTIMES_DIR";