humanish 0.106.1 → 0.107.0

package/dist/actors/codex/restricted-participant.d.ts

@@ -1,8 +1,13 @@
 import type { CuaProvider } from "../computer-use/loop.js";
 import { type RestrictedCodexSessionOptions } from "./restricted-session.js";
+import type { RestrictedCodexAnalysisErrorCode } from "./restricted-policy.js";
 import type { ReasoningEffort } from "../reasoning-effort.js";
 export type ParticipantProviderCloseResult = {
     status: "confirmed" | "unconfirmed";
+    /** Run warnings from the native session, such as notification methods humanish does not know. */
+    warnings?: string[];
+    /** A refusal after the last request, such as a disallowed item outside a turn. It fails the run. */
+    refusal?: RestrictedCodexAnalysisErrorCode;
 };
 export interface RestrictedParticipantOptions {
     session?: RestrictedCodexSessionOptions;
@@ -13,6 +18,31 @@ export interface RestrictedParticipantOptions {
     /** Admit speech actions and heard-speaker evidence for a speech-capable desktop only. */
     speechEnabled?: boolean;
 }
+/** What doctor's hosted-participant check found, before any turn. */
+export interface ParticipantReadiness {
+    ready: boolean;
+    errorCode: RestrictedCodexAnalysisErrorCode | null;
+    /** The release the launch admitted. */
+    cliVersion?: string;
+    /** How the release's schema differs from the fields humanish reads, when that refused it. */
+    protocolIncompatibilities?: readonly string[];
+    /** Schema values beyond the baseline, recorded by a launch that passed. */
+    protocolAdditions?: readonly string[];
+    /** The model thread/start resolved from the operator's configuration or the declared model. */
+    resolvedModel?: string;
+    authentication?: "chatgpt-account" | "api-key";
+}
+/**
+ * doctor's check for a hosted Codex participant: the operator-auth launch up to an ephemeral
+ * thread (the version check, initialize, config/read, account/read and thread/start). It sends no
+ * turn, so no model request is made, and its tool is never called.
+ */
+export declare function checkRestrictedCodexParticipantReadiness(options: {
+    session?: RestrictedCodexSessionOptions;
+    model?: string;
+    reasoningEffort?: ReasoningEffort;
+    timeoutMs?: number;
+}): Promise<ParticipantReadiness>;
 /** One native tool-calling conversation; the existing CUA loop owns every input. */
 export declare function createRestrictedCodexParticipant(options?: RestrictedParticipantOptions): {
     provider: CuaProvider;

package/dist/actors/codex/restricted-participant.js

@@ -4,6 +4,8 @@ import { CuaProviderError, isCuaProviderError, } from "../computer-use/provider-
 import { validateBrowserControlPng, validateHeardSpeech } from "../../browser-control/protocol.js";
 import { createRestrictedCodexSession, } from "./restricted-session.js";
 import { PARTICIPANT_PROFILE, PARTICIPANT_LIMITS as L, PARTICIPANT_FINAL_SCHEMA, participantToolSchema, parseParticipantTool, parseParticipantFinal, } from "./restricted-participant-policy.js";
+import { truncatedFrameWarning, unknownNotificationsWarning } from "./restricted-notifications.js";
+import { protocolAdditionsWarning, protocolIncompatibilityMessage } from "./protocol-compat.js";
 const codeOf = (code) => {
     if (code === "cancelled" || code === "timeout" || code === "refusal")
         return code === "refusal" ? "refused" : code;
@@ -37,7 +39,7 @@ function deferred() {
     return { promise, resolve, reject };
 }
 const toolDescription = (speechEnabled) => `Act on the participant's browser through humanish. Submit one to four UI actions${speechEnabled ? ", including speak when you need to reply aloud," : ""} and a short public comment; never private reasoning. humanish returns a JSON STRING with execution acknowledgments${speechEnabled ? ", speech heard from the actual participant speaker sink," : ""} and a fresh screenshot. In Code Mode use: const r = JSON.parse(await tools.humanish_ui({narration: "...", actions: [...]})); text({acknowledgments: r.acknowledgments${speechEnabled ? ", heardSpeech: r.heardSpeech" : ""}, contextHint: r.contextHint, closing: r.closing}); image(r.imageUrl). Call serially and inspect each returned screenshot${speechEnabled ? " and heardSpeech array" : ""} before deciding what to do next.${speechEnabled ? " Use speak only after the visible UI shows that you joined the call and your microphone is unmuted; it sends audio into that call." : ""} Acknowledged input does not prove an application outcome. If closing is true, stop calling tools and give your final account.`;
-const participantInstructions = (study, speechEnabled) => `${study}\n\nYou are the study participant throughout this conversation, including its closing account. Use only the supplied screenshots and humanish_ui tool to interact. The tool returns a JSON string: parse it, inspect acknowledgments${speechEnabled ? " and heardSpeech captured from the actual participant speaker sink" : ""}, and display imageUrl with Code Mode image(). Do not print the image data URL as text. Keep your persona and earlier observations throughout the session.${speechEnabled ? " A speak action plays into the participant microphone; use it only after the visible UI shows that you joined the call and the microphone is unmuted." : ""} Speak publicly about your experience, never reveal private reasoning. Completed inputs do not prove application outcomes; verify on the next screenshot. When the task ends, return only the required final JSON with outcome, summary and frictionReports. Report observed confusion and recovered mistakes as well as blockers. Do not invent observations.`;
+const participantInstructions = (prompt, speechEnabled) => `${prompt}\n\nYou are the study participant throughout this conversation, including its closing account. Use only the supplied screenshots and humanish_ui tool to interact. The tool returns a JSON string: parse it, inspect acknowledgments${speechEnabled ? " and heardSpeech captured from the actual participant speaker sink" : ""}, and display imageUrl with Code Mode image(). Do not print the image data URL as text. Keep your persona and earlier observations throughout the session.${speechEnabled ? " A speak action plays into the participant microphone; use it only after the visible UI shows that you joined the call and the microphone is unmuted." : ""} Speak publicly about your experience, never reveal private reasoning. Completed inputs do not prove application outcomes; verify on the next screenshot. When the task ends, return only the required final JSON with outcome, summary and frictionReports. Report observed confusion and recovered mistakes as well as blockers. Do not invent observations.`;
 /** Turns and failures from the native run, handed in order to the next provider request. */
 class ParticipantEvents {
     queued = [];
@@ -194,6 +196,43 @@ function participantSession(options, speechEnabled, effort, call) {
         },
     });
 }
+/**
+ * doctor's check for a hosted Codex participant: the operator-auth launch up to an ephemeral
+ * thread (the version check, initialize, config/read, account/read and thread/start). It sends no
+ * turn, so no model request is made, and its tool is never called.
+ */
+export async function checkRestrictedCodexParticipantReadiness(options) {
+    const session = participantSession({
+        authMode: "operator",
+        ...(options.session === undefined ? {} : { session: options.session }),
+    }, false, options.reasoningEffort ?? "low", async () => {
+        throw new Error("A readiness check makes no tool call");
+    });
+    const result = await session.run({
+        ...(options.model === undefined ? {} : { model: options.model }),
+        instructions: participantInstructions("Readiness check only.", false),
+        evidence: "",
+        images: [],
+        schema: PARTICIPANT_FINAL_SCHEMA,
+        maxOutputTokens: null,
+        timeoutMs: options.timeoutMs ?? 15_000,
+    }, true);
+    const closed = await session.close();
+    const errorCode = closed ? result.errorCode : (result.errorCode ?? "codex_cleanup_failed");
+    return {
+        ready: errorCode === null && result.status === "completed",
+        errorCode,
+        ...(session.cliVersion === undefined ? {} : { cliVersion: session.cliVersion }),
+        ...(session.protocolIncompatibilities === undefined
+            ? {}
+            : { protocolIncompatibilities: session.protocolIncompatibilities }),
+        ...(session.protocolAdditions === undefined || session.protocolAdditions.length === 0
+            ? {}
+            : { protocolAdditions: session.protocolAdditions }),
+        ...(session.resolvedModel === undefined ? {} : { resolvedModel: session.resolvedModel }),
+        ...(session.authentication === undefined ? {} : { authentication: session.authentication }),
+    };
+}
 /**
  * The profile a run records: the detected release, or the host default before the first launch.
  * An operator-auth session has one only once it resolved a model on a ChatGPT account.
@@ -244,6 +283,22 @@ function closeParticipantSession(state) {
         return confirmed;
     }));
 }
+/** What the closed native session reports beside cleanup: its run warnings and a late refusal. */
+function sessionReport(session) {
+    const warnings = [
+        session.protocolIncompatibilities === undefined
+            ? undefined
+            : protocolIncompatibilityMessage(session.cliVersion, session.protocolIncompatibilities),
+        protocolAdditionsWarning(session.cliVersion, session.protocolAdditions),
+        unknownNotificationsWarning(session.unknownNotifications, session.cliVersion),
+        truncatedFrameWarning(session.truncatedFrameBytes),
+    ].filter((warning) => warning !== undefined);
+    const refusal = session.policyRefusal;
+    return {
+        ...(warnings.length === 0 ? {} : { warnings }),
+        ...(refusal === undefined ? {} : { refusal }),
+    };
+}
 /** Stops the conversation: abort the native run, reject a waiting tool call, close the session. */
 function revokeParticipant(state) {
     state.closed = true;
@@ -424,7 +479,10 @@ export function createRestrictedCodexParticipant(options = {}) {
                 const work = Promise.all([state.nativeTask, closeParticipantSession(state)]).then(([, ok]) => ok);
                 if (!(await withinCleanupBudget(work, state.abortAt)))
                     state.failedCleanup = true;
-                return { status: state.failedCleanup ? "unconfirmed" : "confirmed" };
+                return {
+                    status: state.failedCleanup ? "unconfirmed" : "confirmed",
+                    ...sessionReport(state.session),
+                };
             })();
             return closing;
         },

package/dist/actors/codex/restricted-policy.d.ts

@@ -11,7 +11,7 @@ export declare const RESTRICTED_CODEX_ANALYSIS_IDENTITY: {
     readonly reasoningEffort: "low";
 };
 export declare const RESTRICTED_CODEX_ANALYSIS_MODELS: readonly ["gpt-6-astra"];
-export type RestrictedCodexAnalysisErrorCode = "invalid_request" | "cancelled" | "timeout" | "response_too_large" | "invalid_response" | "refusal" | "output_incomplete" | "codex_unavailable" | "codex_unsupported_version" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "codex_busy";
+export type RestrictedCodexAnalysisErrorCode = "invalid_request" | "cancelled" | "timeout" | "response_too_large" | "invalid_response" | "refusal" | "output_incomplete" | "codex_unavailable" | "codex_unsupported_version" | "codex_incompatible_release" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "codex_busy";
 export interface RestrictedCodexRequest {
     model?: string | undefined;
     instructions: string;
@@ -40,6 +40,14 @@ export interface RestrictedCodexResult {
     usageComplete: boolean;
     dispatched: boolean;
     errorCode: RestrictedCodexAnalysisErrorCode | null;
+    /** Notification methods this humanish does not know that carried no item, by count. */
+    unknownNotifications?: Readonly<Record<string, number>>;
+    /** How the release's app-server schema differs from the fields humanish reads (protocol-compat). */
+    protocolIncompatibilities?: readonly string[];
+    /** Schema values beyond the baseline humanish knows; recorded, and the launch continued. */
+    protocolAdditions?: readonly string[];
+    /** Bytes of a last frame cut off when humanish stopped the app-server. */
+    truncatedFrameBytes?: number;
 }
 export declare const CODEX_MAX_REQUEST_BYTES: number;
 export declare const CODEX_MAX_OUTPUT_BYTES: number;

package/dist/actors/codex/restricted-session.d.ts

@@ -14,7 +14,7 @@ export interface RestrictedCodexSessionOptions {
     /**
      * Bypasses qualification: replaces this host's admitted releases with any list. It exists only
      * so scripts/codex-qualify.mjs can launch an unqualified candidate. No library export, lab
-     * manifest, CLI flag, RunLabOptions field or cuaHooks entry reaches it
+     * manifest, CLI flag, RunLabOptions field or LabDeps seam reaches it
      * (tests/actors/codex/cli-versions-seam.test.ts).
      */
     cliVersions?: readonly string[];
@@ -40,6 +40,19 @@ export interface RestrictedCodexSession {
     readonly authentication?: "chatgpt-account" | "api-key" | undefined;
     /** The admitted release this session launched, once its version check has passed. */
     readonly cliVersion?: string | undefined;
+    /** Notification methods this humanish does not know that carried no item, by count. */
+    readonly unknownNotifications?: Readonly<Record<string, number>>;
+    /**
+     * The first policy refusal or unchecked output in the session, whether or not a request reported
+     * it. A participant's close fails the run with it.
+     */
+    readonly policyRefusal?: RestrictedCodexAnalysisErrorCode | undefined;
+    /** Bytes of last frames cut off after humanish stopped the app-server; a run warning. */
+    readonly truncatedFrameBytes?: number | undefined;
+    /** How the release's schema differs from the fields humanish reads, when that refused it. */
+    readonly protocolIncompatibilities?: readonly string[] | undefined;
+    /** Schema values beyond the baseline humanish knows, recorded at launch. */
+    readonly protocolAdditions?: readonly string[] | undefined;
     run(request: RestrictedCodexRequest, readinessOnly?: boolean): Promise<RestrictedCodexResult>;
     close(): Promise<boolean>;
 }

package/dist/actors/codex/restricted-session.js

@@ -5,9 +5,10 @@ import path from "node:path";
 import { admittedCodexCliVersions } from "./qualified-versions.js";
 import { launchAdmittedAppServer, } from "./restricted-launch.js";
 import { CODEX_IMAGE, CODEX_MAX_OUTPUT_BYTES, CODEX_MAX_REQUEST_BYTES, RESTRICTED_CODEX_ANALYSIS_MODELS, codexRecord, restrictedCodexFailure, restrictedCodexRequestError, } from "./restricted-policy.js";
-import { RestrictedCodexDeadline, RestrictedCodexStop, RestrictedCodexTransport, hasUnclosedChildren, retainUnclosedChild, } from "./restricted-transport.js";
+import { RestrictedCodexDeadline, RestrictedCodexStop, hasUnclosedChildren, retainUnclosedChild, } from "./restricted-transport.js";
 import { checkVersion, childEnvironment, resolveExecutable, restrictedCodexNpmTarget, } from "./restricted-executable.js";
 import { RestrictedCodexTurn } from "./restricted-turn.js";
+import { countUnknownNotification, detachTurn, idleNotifications, installSessionHandlers, notificationPolicyOf, refuseSession, } from "./restricted-notifications.js";
 function validParticipant(options) {
     if (!options)
         return true;
@@ -34,12 +35,29 @@ function validParticipant(options) {
 export async function runRestrictedCodexSession(request, options = {}, readinessOnly = false) {
     const session = createRestrictedCodexSession(options);
     const result = await session.run(request, readinessOnly);
-    return (await session.close())
-        ? result
-        : {
+    const closed = await session.close();
+    const unknownNotifications = session.unknownNotifications ?? {};
+    const truncatedFrameBytes = session.truncatedFrameBytes;
+    const { protocolIncompatibilities, protocolAdditions } = session;
+    const noted = {
+        ...(Object.keys(unknownNotifications).length === 0 ? {} : { unknownNotifications }),
+        ...(truncatedFrameBytes === undefined ? {} : { truncatedFrameBytes }),
+        ...(protocolIncompatibilities === undefined ? {} : { protocolIncompatibilities }),
+        ...(protocolAdditions === undefined || protocolAdditions.length === 0
+            ? {}
+            : { protocolAdditions }),
+    };
+    if (!closed)
+        return {
             ...restrictedCodexFailure("codex_cleanup_failed", result.dispatched, result.usage),
             failurePhase: "cleanup",
+            ...noted,
         };
+    // A disallowed item while the app-server shut down fails a request that had completed.
+    const refusal = session.policyRefusal;
+    return refusal !== undefined && result.errorCode === null
+        ? { ...restrictedCodexFailure(refusal, result.dispatched, result.usage), ...noted }
+        : { ...result, ...noted };
 }
 async function writeRecoveryMarker(work, sourceEnv, reason) {
     const cache = sourceEnv.XDG_CACHE_HOME ?? path.join(sourceEnv.HOME ?? homedir(), ".cache");
@@ -200,17 +218,12 @@ function newTurn(settings, state, deadline) {
         turnStarted: (turnId) => {
             state.interrupt = { threadId: state.threadId, turnId };
         },
+        policy: notificationPolicyOf(participant),
+        idle: (method, params) => idleNotifications(participant, state)(method, params),
+        recordUnknown: (method) => countUnknownNotification(state.unknownNotifications, method),
+        refuse: (code) => refuseSession(state, code),
     });
 }
-/** After a request: the turn's handlers come off the transport. */
-function detachTurn(transport) {
-    if (transport)
-        transport.onNotification = () => undefined;
-    if (transport)
-        transport.onRequest = undefined;
-    if (transport)
-        transport.onRequestComplete = undefined;
-}
 /** Request dispatch: launch on the first request, then one turn; a failed request tears down. */
 async function runTurn(settings, state, dispose, request, readinessOnly) {
     const participant = settings.participant;
@@ -228,13 +241,13 @@ async function runTurn(settings, state, dispose, request, readinessOnly) {
         if (!state.transport) {
             state.transport = await launchAdmittedAppServer(settings, state, request, deadline, frameLimit, (next) => {
                 phase = next;
-            });
+            }, (transport) => installSessionHandlers(participant, state, transport));
             selectedModel = state.identity.model;
         }
         else
             state.transport.beginRequest(deadline, frameLimit);
-        // onNotification ignores events before dispatch and onRequestComplete follows only a host
-        // callback, so wiring both after the first launch's handshake loses nothing.
+        // Before dispatch the turn passes notifications to the idle handler the launch installed,
+        // and onRequestComplete follows only a host callback, so wiring both here loses nothing.
         state.transport.onNotification = turn.onNotification;
         state.transport.onRequestComplete = turn.onRequestComplete;
         if (readinessOnly)
@@ -269,7 +282,7 @@ async function runTurn(settings, state, dispose, request, readinessOnly) {
         state.pendingInferenceUsage = undefined;
         deadline.close();
         state.activeDeadline = undefined;
-        detachTurn(state.transport);
+        detachTurn(participant, state);
         if (result.errorCode !== null) {
             if (result.errorCode === "codex_cleanup_failed")
                 state.cleanupTrusted = false;
@@ -335,10 +348,15 @@ export function createRestrictedCodexSession(options = {}) {
         resolvedModel: undefined,
         authentication: undefined,
         cliVersion: undefined,
+        unknownNotifications: new Map(),
+        protocolIncompatibilities: undefined,
+        protocolAdditions: undefined,
         activeDeadline: undefined,
         interrupt: undefined,
         closed: false,
         cleanupTrusted: true,
+        policyRefusal: undefined,
+        truncatedFrameBytes: undefined,
     };
     let pending, closing, disposing;
     const dispose = () => {
@@ -361,6 +379,21 @@ export function createRestrictedCodexSession(options = {}) {
         get cliVersion() {
             return state.cliVersion;
         },
+        get unknownNotifications() {
+            return Object.fromEntries(state.unknownNotifications);
+        },
+        get policyRefusal() {
+            return state.policyRefusal;
+        },
+        get truncatedFrameBytes() {
+            return state.truncatedFrameBytes;
+        },
+        get protocolIncompatibilities() {
+            return state.protocolIncompatibilities;
+        },
+        get protocolAdditions() {
+            return state.protocolAdditions;
+        },
         run(request, readinessOnly = false) {
             const refusal = refusedRun(settings, state, request, () => pending !== undefined);
             if (refusal)

package/dist/actors/codex/restricted-transport.d.ts

@@ -34,11 +34,21 @@ export declare class RestrictedCodexDeadline {
 }
 export declare function retainUnclosedChild(closed: Promise<void>): void;
 export declare const hasUnclosedChildren: () => boolean;
+/** How the process exited: its exit code, or the signal that ended it. */
+interface OwnedCodexExit {
+    code: number | null;
+    signal: NodeJS.Signals | null;
+}
 export interface OwnedCodexProcess {
     child: ChildProcessWithoutNullStreams;
     closed: Promise<void>;
     isClosed(): boolean;
     hasExited(): boolean;
+    /** Resolves with the 'exit' event's code and signal. */
+    readonly exit: Promise<OwnedCodexExit>;
+    /** The signals humanish delivered while the process was still running (signalOwnedChild). */
+    signalsSent(): readonly NodeJS.Signals[];
+    recordSignal(signal: NodeJS.Signals): void;
 }
 export declare function ownCodexProcess(child: ChildProcessWithoutNullStreams): OwnedCodexProcess;
 export declare function closeOwnedCodexProcess(owned: OwnedCodexProcess): Promise<boolean>;
@@ -55,11 +65,29 @@ export declare class RestrictedCodexTransport {
     private eventCount;
     private closing;
     onNotification: (method: string, params: Record<string, unknown>) => void;
+    /** Notifications after the deadline stopped or close began: no turn handles them, only the policy. */
+    onPolicyOnlyNotification: (method: string, params: Record<string, unknown>) => void;
+    /** A server request with no handler, or output that could not be checked (failUninspected). */
+    onPolicyFailure: (code: RestrictedCodexAnalysisErrorCode) => void;
+    /** The size of a last frame cut off after humanish stopped the process: a warning only. */
+    onTruncatedFrame: (bytes: number) => void;
     onRequest: ((method: string, params: Record<string, unknown>) => Promise<Record<string, unknown>>) | undefined;
     onRequestComplete: (() => void) | undefined;
     constructor(owned: OwnedCodexProcess, deadline: RestrictedCodexDeadline, frameLimit?: number);
     /** A completed turn releases its deadline and wire budget, not its conversation. */
     beginRequest(deadline: RestrictedCodexDeadline, frameLimit: number): void;
+    /** One line of output: a malformed line could not be checked. */
+    private frame;
+    /**
+     * Output that could not be checked: past a byte, frame or event limit, malformed, or cut off.
+     * The session records it through onPolicyFailure, whatever state the transport is in.
+     */
+    private failUninspected;
+    /**
+     * Refuses the session with `code`: stops the current deadline and rejects pending requests.
+     * Between requests the stopped deadline makes the next beginRequest throw the code.
+     */
+    refuse(code: RestrictedCodexAnalysisErrorCode): void;
     private fail;
     private message;
     private write;
@@ -71,3 +99,4 @@ export declare class RestrictedCodexTransport {
         turnId: string;
     }): Promise<boolean>;
 }
+export {};

package/dist/actors/codex/restricted-transport.js

@@ -91,8 +91,12 @@ export function retainUnclosedChild(closed) {
 export const hasUnclosedChildren = () => unclosedChildren.size > 0;
 export function ownCodexProcess(child) {
     let closed = false, exited = false;
-    child.once("exit", () => {
-        exited = true;
+    const sent = [];
+    const exit = new Promise((resolve) => {
+        child.once("exit", (code, signal) => {
+            exited = true;
+            resolve({ code, signal });
+        });
     });
     const completion = new Promise((resolve) => {
         child.once("close", () => {
@@ -100,7 +104,17 @@ export function ownCodexProcess(child) {
             resolve();
         });
     });
-    return { child, closed: completion, isClosed: () => closed, hasExited: () => exited };
+    return {
+        child,
+        closed: completion,
+        isClosed: () => closed,
+        hasExited: () => exited,
+        exit,
+        signalsSent: () => sent,
+        recordSignal: (signal) => {
+            sent.push(signal);
+        },
+    };
 }
 async function settlesWithin(promise, ms) {
     let timer;
@@ -122,7 +136,9 @@ function signalOwnedChild(owned, signal) {
     if (owned.hasExited() || owned.isClosed())
         return;
     try {
-        owned.child.kill(signal);
+        // kill() is true when the signal was delivered.
+        if (owned.child.kill(signal))
+            owned.recordSignal(signal);
     }
     catch {
         /* Closing is still checked below. */
@@ -142,6 +158,15 @@ export async function closeOwnedCodexProcess(owned) {
     owned.child.stderr.destroy();
     return closed;
 }
+function isJson(text) {
+    try {
+        JSON.parse(text);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export class RestrictedCodexTransport {
     owned;
     deadline;
@@ -155,6 +180,12 @@ export class RestrictedCodexTransport {
     eventCount = 0;
     closing = false;
     onNotification = () => undefined;
+    /** Notifications after the deadline stopped or close began: no turn handles them, only the policy. */
+    onPolicyOnlyNotification = () => undefined;
+    /** A server request with no handler, or output that could not be checked (failUninspected). */
+    onPolicyFailure = () => undefined;
+    /** The size of a last frame cut off after humanish stopped the process: a warning only. */
+    onTruncatedFrame = () => undefined;
     onRequest;
     onRequestComplete;
     constructor(owned, deadline, frameLimit = CODEX_MAX_OUTPUT_BYTES) {
@@ -165,38 +196,59 @@ export class RestrictedCodexTransport {
         child.on("error", () => this.fail("codex_process_failed"));
         child.stdin.on("error", () => this.fail("codex_process_failed"));
         child.on("close", () => this.fail("codex_process_failed"));
+        // Output is read until the process exits. Once the deadline stops or close begins, it is read
+        // for the item policy only (message); only the byte and frame limits stop reading, and they
+        // count as unchecked output.
         child.stdout.on("data", (chunk) => {
-            if ((!this.closing && this.deadline.code !== null) ||
-                (this.closing && this.pending.size === 0))
-                return;
             this.stdoutBytes += chunk.length;
             if (this.stdoutBytes >
                 Math.max(CODEX_MAX_STDOUT_BYTES, this.frameLimit * 2 + CODEX_MAX_OUTPUT_BYTES * 2)) {
-                this.fail("response_too_large");
+                this.failUninspected("response_too_large");
                 return;
             }
             this.line += this.decoder.write(chunk);
             if (Buffer.byteLength(this.line) > this.frameLimit) {
-                this.fail("response_too_large");
+                this.failUninspected("response_too_large");
                 return;
             }
             while (this.line.includes("\n")) {
-                const split = this.line.indexOf("\n"), line = this.line.slice(0, split);
+                const split = this.line.indexOf("\n");
+                const line = this.line.slice(0, split);
                 this.line = this.line.slice(split + 1);
-                if (line.length === 0) {
-                    this.fail("codex_protocol_error");
-                    return;
-                }
-                try {
-                    this.message(JSON.parse(line));
-                }
-                catch {
-                    this.fail("codex_protocol_error");
-                }
-                if (this.deadline.code !== null && !this.closing)
-                    return;
+                this.frame(line);
             }
         });
+        // A last frame without its newline is parsed when it is whole JSON. A cut-off frame is a
+        // warning with its size only when humanish's own signal cut it: the signal reached the running
+        // process before its output ended, and the process then exited by that signal or with a code.
+        // Any other cut-off frame (an exit on its own, a crash, a signal humanish did not send) went
+        // unchecked.
+        child.stdout.on("end", () => {
+            const rest = this.line + this.decoder.end();
+            this.line = "";
+            const lines = rest.split("\n").filter((line) => line.length > 0);
+            const last = lines.pop();
+            for (const line of lines)
+                this.frame(line);
+            if (last === undefined)
+                return;
+            if (isJson(last)) {
+                this.frame(last);
+                return;
+            }
+            if (this.owned.signalsSent().length === 0) {
+                this.failUninspected("codex_protocol_error");
+                return;
+            }
+            const bytes = Buffer.byteLength(last);
+            void this.owned.exit.then(({ code, signal }) => {
+                const ours = signal === null ? code !== null : this.owned.signalsSent().includes(signal);
+                if (ours)
+                    this.onTruncatedFrame(bytes);
+                else
+                    this.failUninspected("codex_protocol_error");
+            });
+        });
         child.stderr.on("data", (chunk) => {
             this.stderrBytes += chunk.length;
             if (this.stderrBytes > CODEX_MAX_OUTPUT_BYTES)
@@ -215,6 +267,41 @@ export class RestrictedCodexTransport {
         this.stderrBytes = 0;
         this.eventCount = 0;
     }
+    /** One line of output: a malformed line could not be checked. */
+    frame(line) {
+        let parsed;
+        try {
+            parsed = line.length === 0 ? undefined : JSON.parse(line);
+        }
+        catch {
+            parsed = undefined;
+        }
+        if (parsed === undefined) {
+            this.failUninspected("codex_protocol_error");
+            return;
+        }
+        try {
+            this.message(parsed);
+        }
+        catch {
+            this.fail("codex_protocol_error");
+        }
+    }
+    /**
+     * Output that could not be checked: past a byte, frame or event limit, malformed, or cut off.
+     * The session records it through onPolicyFailure, whatever state the transport is in.
+     */
+    failUninspected(code) {
+        this.onPolicyFailure(code);
+        this.fail(code);
+    }
+    /**
+     * Refuses the session with `code`: stops the current deadline and rejects pending requests.
+     * Between requests the stopped deadline makes the next beginRequest throw the code.
+     */
+    refuse(code) {
+        this.fail(code);
+    }
     fail(code) {
         if (!this.closing)
             this.deadline.stop(code);
@@ -225,13 +312,31 @@ export class RestrictedCodexTransport {
     message(raw) {
         const value = codexRecord(raw);
         if (Object.keys(value).length === 0) {
-            this.fail("codex_protocol_error");
+            this.failUninspected("codex_protocol_error");
             return;
         }
+        // After the deadline stopped or close began, output is read for the item policy only.
+        const policyOnly = this.closing || this.deadline.code !== null;
         if (value.id !== undefined && typeof value.method === "string") {
+            // A server request is then declined unhandled: its turn is over or being interrupted, so a
+            // tool call that crossed the stop runs nothing and is not a policy refusal.
+            if (policyOnly) {
+                try {
+                    this.write({
+                        id: value.id,
+                        error: { code: -32601, message: "Host request is disabled" },
+                    });
+                }
+                catch {
+                    /* The process is already closing. */
+                }
+                return;
+            }
             if (!this.onRequest || ++this.eventCount > CODEX_MAX_EVENTS) {
+                const code = this.eventCount > CODEX_MAX_EVENTS ? "response_too_large" : "codex_tool_call";
+                this.onPolicyFailure(code);
                 this.write({ id: value.id, error: { code: -32601, message: "Host request is disabled" } });
-                this.fail(this.eventCount > CODEX_MAX_EVENTS ? "response_too_large" : "codex_tool_call");
+                this.fail(code);
                 return;
             }
             const id = value.id;
@@ -263,7 +368,9 @@ export class RestrictedCodexTransport {
         if (typeof value.id === "number" && value.method === undefined) {
             const pending = this.pending.get(value.id);
             if (!pending) {
-                this.fail("codex_protocol_error");
+                // A late reply, such as an interrupt's after its wait, carries no item.
+                if (!policyOnly)
+                    this.fail("codex_protocol_error");
                 return;
             }
             this.pending.delete(value.id);
@@ -280,10 +387,12 @@ export class RestrictedCodexTransport {
         if (typeof value.method !== "string" ||
             value.id !== undefined ||
             ++this.eventCount > CODEX_MAX_EVENTS) {
-            this.fail(this.eventCount > CODEX_MAX_EVENTS ? "response_too_large" : "codex_protocol_error");
+            this.failUninspected(this.eventCount > CODEX_MAX_EVENTS ? "response_too_large" : "codex_protocol_error");
             return;
         }
-        if (!this.closing)
+        if (policyOnly)
+            this.onPolicyOnlyNotification(value.method, codexRecord(value.params));
+        else
             this.onNotification(value.method, codexRecord(value.params));
     }
     write(value) {
@@ -324,6 +433,9 @@ export class RestrictedCodexTransport {
     }
     async close(interrupt) {
         this.closing = true;
+        // Shutdown output gets its own byte and event budget.
+        this.stdoutBytes = 0;
+        this.eventCount = 0;
         if (interrupt && !this.owned.isClosed()) {
             const { id, result } = this.request("turn/interrupt", interrupt);
             await settlesWithin(result, 1000);