humanish 0.106.1 → 0.108.0

package/dist/actors/codex/restricted-notifications.js

@@ -0,0 +1,277 @@
+// The policy every app-server notification passes, whenever it arrives: during the launch
+// handshake, before a turn is dispatched, during a turn, or between requests. A notification that
+// carries an item is checked against the item policy whatever its method, so a new method cannot
+// carry a native operation past it. A method this humanish does not know that carries no item is
+// counted and reported, not refused, so a release's new progress events do not break a run.
+import { codexRecord, toolPolicyViolation, } from "./restricted-policy.js";
+import { RestrictedCodexStop, } from "./restricted-transport.js";
+const rawCompactionTypes = ["compaction", "compaction_summary", "context_compaction"];
+/** Raw response item types an analyst turn may produce. */
+export const ANALYST_RAW_ITEM_TYPES = [
+    "message",
+    "reasoning",
+    ...rawCompactionTypes,
+];
+/** A participant also runs Code Mode: `exec` custom tool calls and `wait` function calls. */
+export const PARTICIPANT_RAW_ITEM_TYPES = [
+    ...ANALYST_RAW_ITEM_TYPES,
+    "custom_tool_call",
+    "custom_tool_call_output",
+    "function_call",
+    "function_call_output",
+];
+/** Thread item types an analyst turn may produce. */
+export const ANALYST_ITEM_TYPES = [
+    "userMessage",
+    "agentMessage",
+    "reasoning",
+    "contextCompaction",
+];
+/** A participant also has its one dynamic tool. */
+export const PARTICIPANT_ITEM_TYPES = [...ANALYST_ITEM_TYPES, "dynamicToolCall"];
+/**
+ * Server notification methods in Codex CLI 0.160.0's app-server schema
+ * (`codex app-server generate-json-schema --experimental`, ServerNotification), plus two it sends
+ * outside that union: rawResponseItem/completed, and rawResponse/completed, whose v2 definition
+ * (RawResponseCompletedNotification) carries only a response id and usage.
+ */
+export const KNOWN_CODEX_NOTIFICATIONS = new Set([
+    "account/gatewayOAuth/changed",
+    "account/login/completed",
+    "account/rateLimits/updated",
+    "account/updated",
+    "app/list/updated",
+    "autoApprovalReview/strictReviewRequired",
+    "command/exec/outputDelta",
+    "configWarning",
+    "deprecationNotice",
+    "error",
+    "externalAgentConfig/import/completed",
+    "externalAgentConfig/import/progress",
+    "fs/changed",
+    "fuzzyFileSearch/sessionCompleted",
+    "fuzzyFileSearch/sessionUpdated",
+    "guardianWarning",
+    "hook/completed",
+    "hook/started",
+    "item/agentMessage/delta",
+    "item/autoApprovalReview/completed",
+    "item/autoApprovalReview/started",
+    "item/commandExecution/outputDelta",
+    "item/commandExecution/terminalInteraction",
+    "item/completed",
+    "item/fileChange/outputDelta",
+    "item/fileChange/patchUpdated",
+    "item/mcpToolCall/progress",
+    "item/plan/delta",
+    "item/reasoning/summaryPartAdded",
+    "item/reasoning/summaryTextDelta",
+    "item/reasoning/textDelta",
+    "item/started",
+    "mcpServer/event/stream/notification",
+    "mcpServer/oauthLogin/completed",
+    "mcpServer/startupStatus/updated",
+    "model/rerouted",
+    "model/safetyBuffering/updated",
+    "model/verification",
+    "modelProvider/authRecoveryCompleted",
+    "modelProvider/authRecoveryStarted",
+    "process/exited",
+    "process/outputDelta",
+    "project/changed",
+    "rawResponse/completed",
+    "rawResponseItem/completed",
+    "remoteControl/status/changed",
+    "serverRequest/resolved",
+    "skills/changed",
+    "thread/archived",
+    "thread/attachment/updated",
+    "thread/closed",
+    "thread/compacted",
+    "thread/deleted",
+    "thread/environment/connected",
+    "thread/environment/disconnected",
+    "thread/goal/cleared",
+    "thread/goal/updated",
+    "thread/name/updated",
+    "thread/project/updated",
+    "thread/queue/changed",
+    "thread/realtime/closed",
+    "thread/realtime/error",
+    "thread/realtime/item/completed",
+    "thread/realtime/item/started",
+    "thread/realtime/item/transcript/delta",
+    "thread/realtime/itemAdded",
+    "thread/realtime/outputAudio/delta",
+    "thread/realtime/sdp",
+    "thread/realtime/started",
+    "thread/realtime/transcript/delta",
+    "thread/realtime/transcript/done",
+    "thread/reverted",
+    "thread/settings/updated",
+    "thread/started",
+    "thread/status/changed",
+    "thread/tokenUsage/updated",
+    "thread/unarchived",
+    "turn/completed",
+    "turn/diff/updated",
+    "turn/moderationMetadata",
+    "turn/plan/updated",
+    "turn/started",
+    "warning",
+    "windows/worldWritableWarning",
+    "windowsSandbox/setupCompleted",
+]);
+/** The item policy for a session: a participant's tool name is read at each use. */
+export function notificationPolicyOf(participant) {
+    return { participant: participant !== undefined, toolName: () => participant?.tool.name };
+}
+/** Adds one notification of `method` to a session's unknown-method counts. */
+export function countUnknownNotification(counts, method) {
+    counts.set(method, (counts.get(method) ?? 0) + 1);
+}
+const isItem = (value) => value !== null &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    typeof value.type === "string";
+/**
+ * The items a notification carries, each with the method whose policy it takes, or null when one
+ * is malformed. 0.160.0's schema puts a ThreadItem in `params.item` (item/started,
+ * item/completed), `params.turn.items` (turn/started, turn/completed) and
+ * `params.thread.turns[].items` (thread/started). An `item` array and an `items` array are read
+ * too, for a release that adds them. A nested ThreadItem takes the item/completed policy.
+ */
+export function notificationItems(method, params) {
+    const found = [];
+    let malformed = false;
+    const add = (value, itemMethod) => {
+        if (isItem(value))
+            found.push({ method: itemMethod, item: value });
+        else
+            malformed = true;
+    };
+    const addAll = (value, itemMethod) => {
+        if (Array.isArray(value))
+            for (const item of value)
+                add(item, itemMethod);
+    };
+    if (Array.isArray(params.item))
+        addAll(params.item, method);
+    else if (params.item !== undefined && params.item !== null)
+        add(params.item, method);
+    addAll(params.items, method);
+    addAll(codexRecord(params.turn).items, "item/completed");
+    const turns = codexRecord(params.thread).turns;
+    if (Array.isArray(turns))
+        for (const turn of turns)
+            addAll(codexRecord(turn).items, "item/completed");
+    return malformed ? null : found;
+}
+/**
+ * How a notification fares under the item policy: it carries no item, only allowed items, or a
+ * disallowed or malformed one.
+ */
+export function itemPolicyOf(method, params, policy) {
+    const found = notificationItems(method, params);
+    if (found === null)
+        return "violation";
+    if (found.length === 0)
+        return "none";
+    return found.some((entry) => itemPolicyViolation(entry.method, entry.item, policy))
+        ? "violation"
+        : "allowed";
+}
+/**
+ * True when an item breaks the item policy. rawResponseItem/completed, and an item of a raw type
+ * under any method other than item/started or item/completed, use the raw-item policy. Every
+ * other item uses the thread-item policy: an allowed type, the participant's one dynamic tool, and
+ * no agent message that delivers asynchronously or asks a question.
+ */
+export function itemPolicyViolation(method, item, policy) {
+    const rawTypes = policy.participant ? PARTICIPANT_RAW_ITEM_TYPES : ANALYST_RAW_ITEM_TYPES;
+    const threadItemMethod = method === "item/started" || method === "item/completed";
+    const type = String(item.type);
+    if (method === "rawResponseItem/completed" || (!threadItemMethod && rawTypes.includes(type)))
+        return toolPolicyViolation("rawResponseItem/completed", item, rawTypes);
+    const itemTypes = policy.participant ? PARTICIPANT_ITEM_TYPES : ANALYST_ITEM_TYPES;
+    if (!itemTypes.includes(type))
+        return true;
+    if (type === "dynamicToolCall" && (item.tool !== policy.toolName() || item.namespace !== null))
+        return true;
+    return toolPolicyViolation("item/completed", item, rawTypes);
+}
+/**
+ * The handler for notifications outside a dispatched turn: during the handshake, before
+ * turn/start, between requests and while closing. A disallowed or malformed item refuses; an
+ * unknown method without an item is counted; anything else is ignored, as there is no turn to
+ * apply it to.
+ */
+export function idleNotificationHandler(policy, recordUnknown, refuse) {
+    return (method, params) => {
+        const items = itemPolicyOf(method, params, policy);
+        if (items === "violation")
+            refuse("codex_tool_call");
+        else if (items === "none" && !KNOWN_CODEX_NOTIFICATIONS.has(method))
+            recordUnknown(method);
+    };
+}
+/** The run warning for unknown notification methods, or undefined when there were none. */
+export function unknownNotificationsWarning(counts, cliVersion) {
+    const entries = Object.entries(counts ?? {}).sort(([a], [b]) => a.localeCompare(b));
+    if (entries.length === 0)
+        return undefined;
+    const list = entries.map(([method, count]) => `${method} ×${count}`).join(", ");
+    return `Codex CLI${cliVersion === undefined ? "" : ` ${cliVersion}`} sent notification methods humanish does not know: ${list}. They carried no item and were ignored.`;
+}
+/** The run warning for a last frame cut off by humanish's own stop, or undefined when none was. */
+export function truncatedFrameWarning(bytes) {
+    return bytes === undefined
+        ? undefined
+        : `Codex output was cut off when humanish stopped the app-server: ${bytes} bytes of an unfinished last frame were not checked.`;
+}
+/**
+ * A policy refusal: it is recorded, the active request stops with `code`, pending RPCs are
+ * rejected, and between requests the next request fails with it.
+ */
+export function refuseSession(state, code) {
+    state.policyRefusal ??= code;
+    state.activeDeadline?.stop(code);
+    state.transport?.refuse(code);
+}
+/** The session's handler for notifications outside a dispatched turn, on its current transport. */
+export function idleNotifications(participant, state) {
+    return idleNotificationHandler(notificationPolicyOf(participant), (method) => countUnknownNotification(state.unknownNotifications, method), (code) => refuseSession(state, code));
+}
+/**
+ * Installs the session's handlers on a new transport, before its first request: notifications
+ * outside a turn, notifications once the transport stopped or is closing, and policy failures
+ * the transport finds itself.
+ */
+export function installSessionHandlers(participant, state, transport) {
+    transport.onNotification = idleNotifications(participant, state);
+    transport.onPolicyOnlyNotification = idleNotificationHandler(notificationPolicyOf(participant), (method) => countUnknownNotification(state.unknownNotifications, method), (code) => {
+        state.policyRefusal ??= code;
+    });
+    transport.onPolicyFailure = (code) => {
+        state.policyRefusal ??= code;
+    };
+    transport.onTruncatedFrame = (bytes) => {
+        state.truncatedFrameBytes = (state.truncatedFrameBytes ?? 0) + bytes;
+    };
+}
+/** A server request outside a turn is refused; the transport answers it and stops the request. */
+function idleRequests(state) {
+    return async () => {
+        state.policyRefusal ??= "codex_tool_call";
+        throw new RestrictedCodexStop("codex_tool_call");
+    };
+}
+/** After a request: the turn's handlers come off the transport, and the idle handlers go on. */
+export function detachTurn(participant, state) {
+    const transport = state.transport;
+    if (!transport)
+        return;
+    transport.onNotification = idleNotifications(participant, state);
+    transport.onRequest = idleRequests(state);
+    transport.onRequestComplete = undefined;
+}

package/dist/actors/codex/restricted-participant.d.ts

@@ -1,8 +1,13 @@
 import type { CuaProvider } from "../computer-use/loop.js";
 import { type RestrictedCodexSessionOptions } from "./restricted-session.js";
+import type { RestrictedCodexAnalysisErrorCode } from "./restricted-policy.js";
 import type { ReasoningEffort } from "../reasoning-effort.js";
 export type ParticipantProviderCloseResult = {
     status: "confirmed" | "unconfirmed";
+    /** Run warnings from the native session, such as notification methods humanish does not know. */
+    warnings?: string[];
+    /** A refusal after the last request, such as a disallowed item outside a turn. It fails the run. */
+    refusal?: RestrictedCodexAnalysisErrorCode;
 };
 export interface RestrictedParticipantOptions {
     session?: RestrictedCodexSessionOptions;
@@ -13,6 +18,31 @@ export interface RestrictedParticipantOptions {
     /** Admit speech actions and heard-speaker evidence for a speech-capable desktop only. */
     speechEnabled?: boolean;
 }
+/** What doctor's hosted-participant check found, before any turn. */
+export interface ParticipantReadiness {
+    ready: boolean;
+    errorCode: RestrictedCodexAnalysisErrorCode | null;
+    /** The release the launch admitted. */
+    cliVersion?: string;
+    /** How the release's schema differs from the fields humanish reads, when that refused it. */
+    protocolIncompatibilities?: readonly string[];
+    /** Schema values beyond the baseline, recorded by a launch that passed. */
+    protocolAdditions?: readonly string[];
+    /** The model thread/start resolved from the operator's configuration or the declared model. */
+    resolvedModel?: string;
+    authentication?: "chatgpt-account" | "api-key";
+}
+/**
+ * doctor's check for a hosted Codex participant: the operator-auth launch up to an ephemeral
+ * thread (the version check, initialize, config/read, account/read and thread/start). It sends no
+ * turn, so no model request is made, and its tool is never called.
+ */
+export declare function checkRestrictedCodexParticipantReadiness(options: {
+    session?: RestrictedCodexSessionOptions;
+    model?: string;
+    reasoningEffort?: ReasoningEffort;
+    timeoutMs?: number;
+}): Promise<ParticipantReadiness>;
 /** One native tool-calling conversation; the existing CUA loop owns every input. */
 export declare function createRestrictedCodexParticipant(options?: RestrictedParticipantOptions): {
     provider: CuaProvider;

package/dist/actors/codex/restricted-participant.js

@@ -1,9 +1,11 @@
-import { isRecordedCodexCliVersion, } from "../contract.js";
-import { defaultCodexCliVersion } from "./qualified-versions.js";
+import {} from "../contract.js";
+import { defaultCodexCliVersion, untestedOperatorReleaseWarning } from "./codex-admission.js";
 import { CuaProviderError, isCuaProviderError, } from "../computer-use/provider-error.js";
 import { validateBrowserControlPng, validateHeardSpeech } from "../../browser-control/protocol.js";
 import { createRestrictedCodexSession, } from "./restricted-session.js";
 import { PARTICIPANT_PROFILE, PARTICIPANT_LIMITS as L, PARTICIPANT_FINAL_SCHEMA, participantToolSchema, parseParticipantTool, parseParticipantFinal, } from "./restricted-participant-policy.js";
+import { truncatedFrameWarning, unknownNotificationsWarning } from "./restricted-notifications.js";
+import { protocolAdditionsWarning, protocolIncompatibilityMessage } from "./protocol-compat.js";
 const codeOf = (code) => {
     if (code === "cancelled" || code === "timeout" || code === "refusal")
         return code === "refusal" ? "refused" : code;
@@ -36,8 +38,9 @@ function deferred() {
     void promise.catch(() => undefined);
     return { promise, resolve, reject };
 }
+// prose-check: model prompt (Codex reads this tool description, not a person)
 const toolDescription = (speechEnabled) => `Act on the participant's browser through humanish. Submit one to four UI actions${speechEnabled ? ", including speak when you need to reply aloud," : ""} and a short public comment; never private reasoning. humanish returns a JSON STRING with execution acknowledgments${speechEnabled ? ", speech heard from the actual participant speaker sink," : ""} and a fresh screenshot. In Code Mode use: const r = JSON.parse(await tools.humanish_ui({narration: "...", actions: [...]})); text({acknowledgments: r.acknowledgments${speechEnabled ? ", heardSpeech: r.heardSpeech" : ""}, contextHint: r.contextHint, closing: r.closing}); image(r.imageUrl). Call serially and inspect each returned screenshot${speechEnabled ? " and heardSpeech array" : ""} before deciding what to do next.${speechEnabled ? " Use speak only after the visible UI shows that you joined the call and your microphone is unmuted; it sends audio into that call." : ""} Acknowledged input does not prove an application outcome. If closing is true, stop calling tools and give your final account.`;
-const participantInstructions = (study, speechEnabled) => `${study}\n\nYou are the study participant throughout this conversation, including its closing account. Use only the supplied screenshots and humanish_ui tool to interact. The tool returns a JSON string: parse it, inspect acknowledgments${speechEnabled ? " and heardSpeech captured from the actual participant speaker sink" : ""}, and display imageUrl with Code Mode image(). Do not print the image data URL as text. Keep your persona and earlier observations throughout the session.${speechEnabled ? " A speak action plays into the participant microphone; use it only after the visible UI shows that you joined the call and the microphone is unmuted." : ""} Speak publicly about your experience, never reveal private reasoning. Completed inputs do not prove application outcomes; verify on the next screenshot. When the task ends, return only the required final JSON with outcome, summary and frictionReports. Report observed confusion and recovered mistakes as well as blockers. Do not invent observations.`;
+const participantInstructions = (prompt, speechEnabled) => `${prompt}\n\nYou are the study participant throughout this conversation, including its closing account. Use only the supplied screenshots and humanish_ui tool to interact. The tool returns a JSON string: parse it, inspect acknowledgments${speechEnabled ? " and heardSpeech captured from the actual participant speaker sink" : ""}, and display imageUrl with Code Mode image(). Do not print the image data URL as text. Keep your persona and earlier observations throughout the session.${speechEnabled ? " A speak action plays into the participant microphone; use it only after the visible UI shows that you joined the call and the microphone is unmuted." : ""} Speak publicly about your experience, never reveal private reasoning. Completed inputs do not prove application outcomes; verify on the next screenshot. When the task ends, return only the required final JSON with outcome, summary and frictionReports. Report observed confusion and recovered mistakes as well as blockers. Do not invent observations.`;
 /** Turns and failures from the native run, handed in order to the next provider request. */
 class ParticipantEvents {
     queued = [];
@@ -194,13 +197,49 @@ function participantSession(options, speechEnabled, effort, call) {
         },
     });
 }
+/**
+ * doctor's check for a hosted Codex participant: the operator-auth launch up to an ephemeral
+ * thread (the version check, initialize, config/read, account/read and thread/start). It sends no
+ * turn, so no model request is made, and its tool is never called.
+ */
+export async function checkRestrictedCodexParticipantReadiness(options) {
+    const session = participantSession({
+        authMode: "operator",
+        ...(options.session === undefined ? {} : { session: options.session }),
+    }, false, options.reasoningEffort ?? "low", async () => {
+        throw new Error("A readiness check makes no tool call");
+    });
+    const result = await session.run({
+        ...(options.model === undefined ? {} : { model: options.model }),
+        instructions: participantInstructions("Readiness check only.", false),
+        evidence: "",
+        images: [],
+        schema: PARTICIPANT_FINAL_SCHEMA,
+        maxOutputTokens: null,
+        timeoutMs: options.timeoutMs ?? 15_000,
+    }, true);
+    const closed = await session.close();
+    const errorCode = closed ? result.errorCode : (result.errorCode ?? "codex_cleanup_failed");
+    return {
+        ready: errorCode === null && result.status === "completed",
+        errorCode,
+        ...(session.cliVersion === undefined ? {} : { cliVersion: session.cliVersion }),
+        ...(session.protocolIncompatibilities === undefined
+            ? {}
+            : { protocolIncompatibilities: session.protocolIncompatibilities }),
+        ...(session.protocolAdditions === undefined || session.protocolAdditions.length === 0
+            ? {}
+            : { protocolAdditions: session.protocolAdditions }),
+        ...(session.resolvedModel === undefined ? {} : { resolvedModel: session.resolvedModel }),
+        ...(session.authentication === undefined ? {} : { authentication: session.authentication }),
+    };
+}
 /**
  * The profile a run records: the detected release, or the host default before the first launch.
  * An operator-auth session has one only once it resolved a model on a ChatGPT account.
  */
 function participantExecutionProfile(session, operator, effort) {
-    const detected = session.cliVersion;
-    const cliVersion = isRecordedCodexCliVersion(detected) ? detected : defaultCodexCliVersion();
+    const cliVersion = session.cliVersion ?? defaultCodexCliVersion();
     if (!operator)
         return { ...PARTICIPANT_PROFILE, cliVersion };
     return session.authentication === "chatgpt-account" && session.resolvedModel
@@ -244,6 +283,24 @@ function closeParticipantSession(state) {
         return confirmed;
     }));
 }
+/** What the closed native session reports beside cleanup: its run warnings and a late refusal. */
+function sessionReport(session, operator) {
+    const warnings = [
+        // A resolved model means thread/start was admitted: the release actually launched.
+        untestedOperatorReleaseWarning(session.resolvedModel === undefined ? undefined : session.cliVersion, operator),
+        session.protocolIncompatibilities === undefined
+            ? undefined
+            : protocolIncompatibilityMessage(session.cliVersion, session.protocolIncompatibilities),
+        protocolAdditionsWarning(session.cliVersion, session.protocolAdditions),
+        unknownNotificationsWarning(session.unknownNotifications, session.cliVersion),
+        truncatedFrameWarning(session.truncatedFrameBytes),
+    ].filter((warning) => warning !== undefined);
+    const refusal = session.policyRefusal;
+    return {
+        ...(warnings.length === 0 ? {} : { warnings }),
+        ...(refusal === undefined ? {} : { refusal }),
+    };
+}
 /** Stops the conversation: abort the native run, reject a waiting tool call, close the session. */
 function revokeParticipant(state) {
     state.closed = true;
@@ -424,7 +481,10 @@ export function createRestrictedCodexParticipant(options = {}) {
                 const work = Promise.all([state.nativeTask, closeParticipantSession(state)]).then(([, ok]) => ok);
                 if (!(await withinCleanupBudget(work, state.abortAt)))
                     state.failedCleanup = true;
-                return { status: state.failedCleanup ? "unconfirmed" : "confirmed" };
+                return {
+                    status: state.failedCleanup ? "unconfirmed" : "confirmed",
+                    ...sessionReport(state.session, settings.operator),
+                };
             })();
             return closing;
         },

package/dist/actors/codex/restricted-policy.d.ts

@@ -1,8 +1,8 @@
 import type { ReasoningEffort } from "../reasoning-effort.js";
 /** Versioned, deliberately narrow profile qualified with an account-backed vision turn.
  * The CLI still advertises code-mode tools: disabling their host is the enforcement
- * boundary. Feature names alone are not proof that a tool has been removed. The admitted
- * CLI releases are per host, in qualified-versions.ts. */
+ * boundary. Feature names alone are not proof that a tool has been removed. Which CLI
+ * releases launch is decided in codex-admission.ts. */
 export declare const RESTRICTED_CODEX_ANALYSIS_IDENTITY: {
     readonly provider: "codex";
     readonly authMode: "chatgpt";
@@ -11,7 +11,7 @@ export declare const RESTRICTED_CODEX_ANALYSIS_IDENTITY: {
     readonly reasoningEffort: "low";
 };
 export declare const RESTRICTED_CODEX_ANALYSIS_MODELS: readonly ["gpt-6-astra"];
-export type RestrictedCodexAnalysisErrorCode = "invalid_request" | "cancelled" | "timeout" | "response_too_large" | "invalid_response" | "refusal" | "output_incomplete" | "codex_unavailable" | "codex_unsupported_version" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "codex_busy";
+export type RestrictedCodexAnalysisErrorCode = "invalid_request" | "cancelled" | "timeout" | "response_too_large" | "invalid_response" | "refusal" | "output_incomplete" | "codex_unavailable" | "codex_unsupported_version" | "codex_incompatible_release" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "codex_busy";
 export interface RestrictedCodexRequest {
     model?: string | undefined;
     instructions: string;
@@ -40,6 +40,14 @@ export interface RestrictedCodexResult {
     usageComplete: boolean;
     dispatched: boolean;
     errorCode: RestrictedCodexAnalysisErrorCode | null;
+    /** Notification methods this humanish does not know that carried no item, by count. */
+    unknownNotifications?: Readonly<Record<string, number>>;
+    /** How the release's app-server schema differs from the fields humanish reads (protocol-compat). */
+    protocolIncompatibilities?: readonly string[];
+    /** Schema values beyond the baseline humanish knows; recorded, and the launch continued. */
+    protocolAdditions?: readonly string[];
+    /** Bytes of a last frame cut off when humanish stopped the app-server. */
+    truncatedFrameBytes?: number;
 }
 export declare const CODEX_MAX_REQUEST_BYTES: number;
 export declare const CODEX_MAX_OUTPUT_BYTES: number;

package/dist/actors/codex/restricted-policy.js

@@ -1,7 +1,7 @@
 /** Versioned, deliberately narrow profile qualified with an account-backed vision turn.
  * The CLI still advertises code-mode tools: disabling their host is the enforcement
- * boundary. Feature names alone are not proof that a tool has been removed. The admitted
- * CLI releases are per host, in qualified-versions.ts. */
+ * boundary. Feature names alone are not proof that a tool has been removed. Which CLI
+ * releases launch is decided in codex-admission.ts. */
 export const RESTRICTED_CODEX_ANALYSIS_IDENTITY = {
     provider: "codex",
     authMode: "chatgpt",

package/dist/actors/codex/restricted-session.d.ts

@@ -12,9 +12,9 @@ export interface RestrictedCodexSessionOptions {
     /** The release a caller already recorded (an analysis identity); any other release is refused. */
     cliVersion?: string;
     /**
-     * Bypasses qualification: replaces this host's admitted releases with any list. It exists only
-     * so scripts/codex-qualify.mjs can launch an unqualified candidate. No library export, lab
-     * manifest, CLI flag, RunLabOptions field or cuaHooks entry reaches it
+     * Bypasses launch admission: admits exactly this list. It exists only so
+     * scripts/codex-qualify.mjs can launch a candidate admission would refuse. No library export, lab
+     * manifest, CLI flag, RunLabOptions field or LabDeps seam reaches it
      * (tests/actors/codex/cli-versions-seam.test.ts).
      */
     cliVersions?: readonly string[];
@@ -40,6 +40,19 @@ export interface RestrictedCodexSession {
     readonly authentication?: "chatgpt-account" | "api-key" | undefined;
     /** The admitted release this session launched, once its version check has passed. */
     readonly cliVersion?: string | undefined;
+    /** Notification methods this humanish does not know that carried no item, by count. */
+    readonly unknownNotifications?: Readonly<Record<string, number>>;
+    /**
+     * The first policy refusal or unchecked output in the session, whether or not a request reported
+     * it. A participant's close fails the run with it.
+     */
+    readonly policyRefusal?: RestrictedCodexAnalysisErrorCode | undefined;
+    /** Bytes of last frames cut off after humanish stopped the app-server; a run warning. */
+    readonly truncatedFrameBytes?: number | undefined;
+    /** How the release's schema differs from the fields humanish reads, when that refused it. */
+    readonly protocolIncompatibilities?: readonly string[] | undefined;
+    /** Schema values beyond the baseline humanish knows, recorded at launch. */
+    readonly protocolAdditions?: readonly string[] | undefined;
     run(request: RestrictedCodexRequest, readinessOnly?: boolean): Promise<RestrictedCodexResult>;
     close(): Promise<boolean>;
 }