orkestrator 2.27.0-beta → 2.28.0-beta

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orkestrator",
-  "version": "2.27.0-beta",
+  "version": "2.28.0-beta",
   "description": "Run the Orkestrator backend service without the desktop application",
   "homepage": "https://orkestrator.dev",
   "repository": {
@@ -34,13 +34,13 @@
     "typecheck": "bunx tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.296",
+    "@anthropic-ai/claude-agent-sdk": "0.3.309",
     "playwright-core": "1.64.0",
     "sharp": "0.35.5"
   },
   "devDependencies": {
-    "@orkestrator/protocol": "2.27.0-beta",
-    "@orkestrator/toolchain": "2.27.0-beta"
+    "@orkestrator/protocol": "2.28.0-beta",
+    "@orkestrator/toolchain": "2.28.0-beta"
   },
   "engines": {
     "bun": ">=1.4.3"

package/resources/claude-bridge/dist/index.js

@@ -3344,6 +3344,24 @@ function createStructuredUsageRefreshCoordinator(session, queryControl) {
     }
   };
 }
+var CLAUDE_CONTEXT_CATEGORY_IDS = {
+  system_prompt: "system-prompt",
+  system_tools: "tools",
+  system_tools_deferred: "deferred-tools",
+  mcp_tools: "mcp-tools",
+  mcp_tools_deferred: "deferred-mcp-tools",
+  mcp_instructions: "mcp-instructions",
+  custom_agents: "agents",
+  memory_files: "memory",
+  skills: "skills",
+  messages: "messages",
+  autocompact_buffer: "reserved",
+  compact_buffer: "reserved",
+  free_space: "free-space"
+};
+function claudeContextCategoryId(value) {
+  return typeof value === "string" && Object.hasOwn(CLAUDE_CONTEXT_CATEGORY_IDS, value) ? CLAUDE_CONTEXT_CATEGORY_IDS[value] : undefined;
+}
 function parseClaudeContextUsage(raw) {
   if (!raw || typeof raw !== "object")
     return;
@@ -3361,8 +3379,10 @@ function parseClaudeContextUsage(raw) {
       const tokens = parseTokenValue(item.tokens);
       if (!name || tokens === undefined)
         return [];
+      const id = claudeContextCategoryId(item.id);
       return [
         {
+          ...id ? { id } : {},
           name,
           tokens,
           color: typeof item.color === "string" ? item.color : undefined
@@ -3502,6 +3522,7 @@ async function buildClaudeUsageSnapshot(session, result, queryControl, fallbackM
   const turnId = typeof result.user_message_uuid === "string" && result.user_message_uuid.trim() || typeof result.uuid === "string" && result.uuid.trim() || `claude-turn-${session.latestTurnGeneration ?? updatedAt}`;
   const turn = {
     turnId,
+    at: updatedAt,
     costUsd: totals.cost,
     inputTokens: totals.input,
     outputTokens: totals.output,
@@ -4392,6 +4413,15 @@ var OPTIONAL_PROJECTION_FIELD_SET = new Set([
   "slashCommandCatalogue"
 ]);
 
+// ../../bridges/claude-bridge/src/services/mcp-tool-prefix.ts
+function claudeMcpToolPrefix(name) {
+  let normalized = name.replace(/[^a-zA-Z0-9_-]/g, "_");
+  if (name.startsWith("claude.ai ")) {
+    normalized = normalized.replace(/_+/g, "_").replace(/^_|_$/g, "");
+  }
+  return `mcp__${normalized}__`;
+}
+
 // ../../bridges/claude-bridge/src/services/read-only-policy.ts
 var CAPABILITY_TOOLS = new Map([
   ["file.write", ["Write", "NotebookEdit"]],
@@ -4417,8 +4447,7 @@ var WAITING_TOOLS = new Set([
   "CronCreate",
   "CronList",
   "CronDelete",
-  "SendMessage",
-  "TaskOutput"
+  "SendMessage"
 ]);
 var READ_ONLY_COMMANDS = Object.freeze(new Set([
   "awk",
@@ -4607,8 +4636,8 @@ function claudeReadOnlyAllowedTools(options) {
   return [
     ...READ_ONLY_TOOLS,
     ...options.policy && !nativeAgentPolicyDeniesWebSearch(options.policy) ? ["WebSearch"] : [],
-    ...(options.agentMcpServerNames ?? []).map((name) => `mcp__${name}__*`),
-    ...(options.researchMcpServerNames ?? []).map((name) => `mcp__${name}__*`)
+    ...(options.agentMcpServerNames ?? []).map((name) => `${claudeMcpToolPrefix(name)}*`),
+    ...(options.researchMcpServerNames ?? []).map((name) => `${claudeMcpToolPrefix(name)}*`)
   ];
 }
 function claudeReadOnlySandbox(policy) {
@@ -4679,8 +4708,8 @@ function deny(reason) {
 function createCoordinatorReadOnlyHook(policy, researchMcpServerNames = coordinatorResearchMcpServersFromEnv(process.env).map((server) => server.name)) {
   const deniedTools = new Set(claudeDeniedTools(policy));
   const allowedMcpPrefixes = [
-    "mcp__orkestrator__",
-    ...researchMcpServerNames.map((name) => `mcp__${name}__`)
+    claudeMcpToolPrefix("orkestrator"),
+    ...researchMcpServerNames.map(claudeMcpToolPrefix)
   ];
   return async (input) => {
     if (input.hook_event_name !== "PreToolUse")
@@ -13651,9 +13680,6 @@ function reportedStaleServers(mcp) {
     return;
   return Array.from(mcp.stale).sort().slice(0, MAX_REPORTED_STALE_SERVERS);
 }
-function claudeMcpToolPrefix(name) {
-  return `mcp__${name.replace(/[^a-zA-Z0-9_-]/g, "_")}__`;
-}
 function staleMcpServerFor(mcp, toolName, toolInput) {
   if (!mcp.stale.size)
     return;

package/resources/codex-bridge/dist/index.js

@@ -10826,6 +10826,7 @@ var STRONG_REFUSAL_MARKERS = [
   "read-only file system"
 ];
 var SCRIPT_FAILED = "script failed";
+var INTERRUPTED_CELL = /^aborted by user\b/i;
 var MAX_PENDING_CELLS = 256;
 var MAX_CELL_TEXT_CHARS = 64 * 1024;
 var ROLLOUT_POLL_INTERVAL_MS = 200;
@@ -10857,7 +10858,12 @@ function reportsRefusal(output) {
 }
 function codeModeCellOutcome(output) {
   const refused = reportsRefusal(output);
-  return { refused, failed: refused || output.trimStart().toLowerCase().startsWith(SCRIPT_FAILED) };
+  const trimmed = output.trimStart();
+  return {
+    refused,
+    failed: refused || trimmed.toLowerCase().startsWith(SCRIPT_FAILED),
+    interrupted: !refused && INTERRUPTED_CELL.test(trimmed)
+  };
 }
 function defaultWatch(_path, onChange) {
   const timer = setInterval(onChange, ROLLOUT_POLL_INTERVAL_MS);
@@ -10986,7 +10992,9 @@ class RefusedCellTail {
     this.pending.delete(callId);
     const output = cellOutputText(payload.output);
     const completedAtMs = recordTimeMs(record, payload);
-    const { refused, failed } = codeModeCellOutcome(output);
+    const { refused, failed, interrupted } = codeModeCellOutcome(output);
+    if (interrupted)
+      return;
     const unseen = !Number.isFinite(cell.startedAtMs) || !Number.isFinite(completedAtMs) || !this.options.itemStartedBetween(cell.startedAtMs, completedAtMs);
     if (!refused && !unseen)
       return;
@@ -11003,6 +11011,7 @@ class RefusedCellTail {
 }
 
 // ../../bridges/codex-bridge/src/app-server/item-adapter.ts
+import { isAbsolute as isAbsolute5 } from "node:path";
 function isRecord5(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -11015,6 +11024,20 @@ function durationMs(value) {
 function strArray(value) {
   return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
+var MAX_IMAGE_GENERATION_INPUTS = 8;
+function imageGenerationInputPaths(value) {
+  if (!Array.isArray(value))
+    return [];
+  const paths = new Set;
+  for (const entry of value) {
+    if (paths.size >= MAX_IMAGE_GENERATION_INPUTS)
+      break;
+    const path = isRecord5(entry) ? str(entry.path) : undefined;
+    if (path && isAbsolute5(path))
+      paths.add(path);
+  }
+  return [...paths];
+}
 var MAX_ASYNC_QUESTIONS = 16;
 var MAX_ASYNC_OPTIONS = 32;
 var MAX_ASYNC_TEXT_LENGTH = 16384;
@@ -11276,13 +11299,15 @@ function adaptAppServerItem(raw) {
     }
     case "imageGeneration": {
       const path = str(raw.savedPath);
+      const inputPaths = imageGenerationInputPaths(raw.inputImages);
       return {
         item: {
           id,
           type: "image",
           text: str(raw.revisedPrompt) ?? "Generated image",
           ...path ? { path } : {},
-          source: "generated"
+          source: "generated",
+          ...inputPaths.length > 0 ? { input_paths: inputPaths } : {}
         }
       };
     }
@@ -12085,6 +12110,13 @@ async function itemToParts(item, cwd, fileChangeContext) {
       return [];
     case "image":
       return [
+        ...(item.input_paths ?? []).map((path) => ({
+          type: "image",
+          content: path.split(/[\\/]/).pop() || "Image",
+          fileUrl: `file://${path}`,
+          filename: path,
+          imageSource: "viewed"
+        })),
         {
           type: "image",
           content: item.text,
@@ -12381,11 +12413,8 @@ async function walkJsonlFiles(dir) {
   }
   return files;
 }
-async function listTranscriptPaths() {
-  const searchRoots = [
-    join8(getCodexHomeDir(), "sessions"),
-    join8(getCodexHomeDir(), "archived_sessions")
-  ];
+async function listTranscriptPaths(codexHome = getCodexHomeDir()) {
+  const searchRoots = [join8(codexHome, "sessions"), join8(codexHome, "archived_sessions")];
   return (await Promise.all(searchRoots.map((root) => walkJsonlFiles(root)))).flat();
 }
 var cachedTranscriptPaths = new Map;
@@ -13010,6 +13039,18 @@ async function replayPersistedRollout(threadId, snapshot, meta, structuredTurns)
   const settleCodeModeCell = (cell, output) => {
     openCells.delete(cell.callId);
     const outcome = output === undefined ? undefined : codeModeCellOutcome(cellOutputText(output));
+    if (outcome?.interrupted) {
+      const { toolState: _claimed, ...stopped } = cell.message.parts[cell.execPartIndex];
+      cell.message.parts[cell.execPartIndex] = stopped;
+      if (!cell.keepExecRow) {
+        dropPart(cell.message, cell.execPartIndex);
+        for (const call of cell.sourceCalls) {
+          if (!call.replaced)
+            dropPart(cell.message, call.partIndex);
+        }
+        return;
+      }
+    }
     if (cell.sawMcpRecord) {
       for (const call of cell.sourceCalls) {
         if (!call.replaced)
@@ -14098,9 +14139,9 @@ var ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME = "orkestrator-artifacts";
 var ORKESTRATOR_ARTIFACT_MCP_PATH = "/artifact-mcp";
 
 // ../../bridges/codex-bridge/src/engine/app-server-engine.ts
-import { open as open5 } from "node:fs/promises";
+import { open as open6 } from "node:fs/promises";
 import { createHash as createHash8 } from "node:crypto";
-import { isAbsolute as isAbsolute6, join as join13 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join13 } from "node:path";
 
 // ../../bridges/codex-bridge/src/app-server/process-supervisor.ts
 import { execFile as execFile3, spawn as spawn3 } from "node:child_process";
@@ -16735,6 +16776,7 @@ var IGNORED_METHODS = new Set([
   "thread/project/updated",
   "thread/queue/changed",
   "thread/prediction/updated",
+  "thread/readState/changed",
   "autoApprovalReview/strictReviewRequired",
   "mcpServer/event/stream/notification",
   "thread/reverted",
@@ -16839,6 +16881,7 @@ function reduceNotification(notification, generation, handle) {
               turns: [
                 {
                   turnId,
+                  at: new Date().toISOString(),
                   inputTokens: num(last.inputTokens),
                   outputTokens: num(last.outputTokens),
                   cacheReadTokens: num(last.cachedInputTokens),
@@ -18030,7 +18073,7 @@ function coordinatorCapabilityPolicy(mode) {
 
 // ../../bridges/codex-bridge/src/codex-config.ts
 import { realpathSync } from "node:fs";
-import { isAbsolute as isAbsolute5 } from "node:path";
+import { isAbsolute as isAbsolute6 } from "node:path";
 var CODEX_MAX_CONCURRENT_THREADS_ENV = "CODEX_MAX_CONCURRENT_THREADS_PER_SESSION";
 var DEFAULT_CODEX_MAX_CONCURRENT_THREADS = 5;
 var ORKESTRATOR_AGENT_MCP_URL_ENV = "ORKESTRATOR_AGENT_MCP_URL";
@@ -18050,7 +18093,7 @@ function codexNetworkDeniedConfig(policy) {
   };
 }
 function codexProjectTrustConfig(policy, cwd) {
-  if (!policy || policy.projectResources || !cwd || !isAbsolute5(cwd))
+  if (!policy || policy.projectResources || !cwd || !isAbsolute6(cwd))
     return {};
   const roots = new Set([cwd]);
   try {
@@ -18073,7 +18116,7 @@ function codexProjectSkillsConfig(listed) {
       const { path, scope, enabled } = skill ?? {};
       if (enabled === true && typeof scope === "string" && KEPT_SKILL_SCOPES.has(scope))
         continue;
-      if (typeof path !== "string" || !isAbsolute5(path)) {
+      if (typeof path !== "string" || !isAbsolute6(path)) {
         throw new Error("Codex listed a project skill without a path it can be disabled by");
       }
       disabled.add(path);
@@ -18100,6 +18143,14 @@ function codexReadOnlyTurnPolicy(policy) {
   const denied = base.capabilityPolicy?.deny ?? [];
   return { ...base, capabilityPolicy: { deny: [...denied, "network"] } };
 }
+function codexToolHistoryGaps(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    return ["config/read returned no configuration"];
+  }
+  const features = config.features;
+  const value = features && typeof features === "object" && !Array.isArray(features) ? features.incremental_tools : undefined;
+  return value === false ? [] : [`features.incremental_tools is ${JSON.stringify(value ?? null)}, not false`];
+}
 function codexHostedNetworkLockGaps(config, expected = "disabled") {
   if (!config || typeof config !== "object" || Array.isArray(config)) {
     return ["config/read returned no configuration"];
@@ -18113,6 +18164,7 @@ function codexHostedNetworkLockGaps(config, expected = "disabled") {
   if (features && typeof features === "object" && features.standalone_web_search === true) {
     gaps.push("features.standalone_web_search is on");
   }
+  gaps.push(...codexToolHistoryGaps(config));
   return gaps;
 }
 function isCoordinatorReadOnlyEnvironment(env) {
@@ -18139,7 +18191,8 @@ function codexAppServerConfigOverrides(env = process.env) {
   const childLimit = resolveCodexMaxConcurrentThreads(env[CODEX_MAX_CONCURRENT_THREADS_ENV]);
   const overrides = {
     "agents.max_concurrent_threads_per_session": String(childLimit),
-    "features.multi_agent_v2.max_concurrent_threads_per_session": String(childLimit + 1)
+    "features.multi_agent_v2.max_concurrent_threads_per_session": String(childLimit + 1),
+    "features.incremental_tools": "false"
   };
   const rawUrl = env[ORKESTRATOR_AGENT_MCP_URL_ENV]?.trim();
   const token = env[ORKESTRATOR_AGENT_MCP_TOKEN_ENV]?.trim();
@@ -18148,11 +18201,11 @@ function codexAppServerConfigOverrides(env = process.env) {
     const readableRuntimeRoot = env.CODEX_BRIDGE_READABLE_RUNTIME_ROOT?.trim();
     const projectRoot = env.CWD?.trim();
     const attachmentRoot = env[BRIDGE_ATTACHMENT_ROOT_ENV]?.trim();
-    if (!permissionProfile || !/^[A-Za-z0-9_-]+$/.test(permissionProfile) || !readableRuntimeRoot || !isAbsolute5(readableRuntimeRoot) || !projectRoot || !isAbsolute5(projectRoot)) {
+    if (!permissionProfile || !/^[A-Za-z0-9_-]+$/.test(permissionProfile) || !readableRuntimeRoot || !isAbsolute6(readableRuntimeRoot) || !projectRoot || !isAbsolute6(projectRoot)) {
       throw new Error("Coordinator Codex permission profile configuration is invalid");
     }
     overrides.default_permissions = JSON.stringify(permissionProfile);
-    overrides[`permissions.${permissionProfile}.filesystem`] = `{ ":root" = "deny", ":minimal" = "read", ":tmpdir" = "deny", ` + `":slash_tmp" = "deny", ${JSON.stringify(readableRuntimeRoot)} = "read", ` + (attachmentRoot && isAbsolute5(attachmentRoot) ? `${JSON.stringify(attachmentRoot)} = "read", ` : "") + `":workspace_roots" = { "." = "read" } }`;
+    overrides[`permissions.${permissionProfile}.filesystem`] = `{ ":root" = "deny", ":minimal" = "read", ":tmpdir" = "deny", ` + `":slash_tmp" = "deny", ${JSON.stringify(readableRuntimeRoot)} = "read", ` + (attachmentRoot && isAbsolute6(attachmentRoot) ? `${JSON.stringify(attachmentRoot)} = "read", ` : "") + `":workspace_roots" = { "." = "read" } }`;
     overrides[`permissions.${permissionProfile}.network.enabled`] = "false";
     overrides.web_search = JSON.stringify(codexNetworkDeniedSearchMode(codexCoordinatorPolicy(env)));
     overrides["features.standalone_web_search"] = "false";
@@ -18218,6 +18271,106 @@ function codexAppServerConfigOverrides(env = process.env) {
   return overrides;
 }
 
+// ../../bridges/codex-bridge/src/sessions/tool-history-guard.ts
+import { open as open5 } from "node:fs/promises";
+var TOOL_HISTORY_MARKER = '"type":"additional_tools"';
+var MAX_TOOL_HISTORY_LINEAGE_DEPTH = 32;
+async function rolloutDeclaresToolHistory(path, end) {
+  const handle = await open5(path, "r");
+  try {
+    const size = (await handle.stat()).size;
+    const limit = end === undefined ? size : Math.min(end, size);
+    const marker = Buffer.from(TOOL_HISTORY_MARKER);
+    const buffer = Buffer.allocUnsafe(ROLLOUT_CHUNK_BYTES + marker.length);
+    let carried = 0;
+    for (let position = 0;position < limit; ) {
+      const length = Math.min(ROLLOUT_CHUNK_BYTES, limit - position);
+      const { bytesRead } = await handle.read(buffer, carried, length, position);
+      if (bytesRead <= 0)
+        break;
+      const filled = carried + bytesRead;
+      if (buffer.subarray(0, filled).includes(marker))
+        return true;
+      position += bytesRead;
+      carried = Math.min(marker.length - 1, filled);
+      buffer.copy(buffer, 0, filled - carried, filled);
+    }
+    return false;
+  } finally {
+    await handle.close();
+  }
+}
+async function historyBase(path) {
+  const handle = await open5(path, "r");
+  try {
+    const chunks = [];
+    let filled = 0;
+    let complete = false;
+    while (filled < MAX_ROLLOUT_RECORD_BYTES) {
+      const chunk = Buffer.allocUnsafe(ROLLOUT_CHUNK_BYTES);
+      const { bytesRead } = await handle.read(chunk, 0, chunk.length, filled);
+      if (bytesRead <= 0) {
+        complete = true;
+        break;
+      }
+      const newline = chunk.subarray(0, bytesRead).indexOf(10);
+      chunks.push(chunk.subarray(0, newline >= 0 ? newline : bytesRead));
+      filled += bytesRead;
+      if (newline >= 0) {
+        complete = true;
+        break;
+      }
+    }
+    if (!complete)
+      return "unreadable";
+    const line = Buffer.concat(chunks).toString("utf8");
+    if (!line.trim())
+      return null;
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      return "unreadable";
+    }
+    if (record.type !== "session_meta" || !record.payload)
+      return null;
+    const base = record.payload.history_base;
+    if (base && typeof base === "object") {
+      if (typeof base.thread_id !== "string")
+        return "unreadable";
+      return {
+        threadId: base.thread_id,
+        ...typeof base.end_byte_offset === "number" ? { endByte: base.end_byte_offset } : {}
+      };
+    }
+    return null;
+  } finally {
+    await handle.close();
+  }
+}
+async function threadToolHistoryVerdict(rolloutPath, resolveRollout) {
+  let path = rolloutPath;
+  let end;
+  for (let depth = 0;depth <= MAX_TOOL_HISTORY_LINEAGE_DEPTH; depth += 1) {
+    if (!path)
+      return "unknown";
+    try {
+      if (await rolloutDeclaresToolHistory(path, end))
+        return "declares";
+      const base = await historyBase(path);
+      if (base === "unreadable")
+        return "unknown";
+      if (!base)
+        return "clean";
+      end = base.endByte;
+      path = await resolveRollout(base.threadId);
+    } catch {
+      return "unknown";
+    }
+  }
+  return "unknown";
+}
+
 // ../../bridges/codex-bridge/src/engine/mcp-tool-availability.ts
 var MCP_TOOL_AVAILABILITY_TIMEOUT_MS = 5000;
 var MCP_TOOL_AVAILABILITY_POLL_MS = 100;
@@ -18638,7 +18791,7 @@ function signedOutAccountRead(error) {
 }
 async function readStoredLoginFingerprint(codexHome) {
   try {
-    const file = await open5(join13(codexHome, "auth.json"), "r");
+    const file = await open6(join13(codexHome, "auth.json"), "r");
     let raw;
     try {
       const bytes = Buffer.alloc(65537);
@@ -18687,6 +18840,9 @@ var MAX_UNKNOWN_METHODS = 16;
 var MAX_UNKNOWN_METHOD_LENGTH = 128;
 var MAX_ACCOUNT_PROOF_TURNS = 1024;
 var MAX_ACCOUNT_PROOF_ID_LENGTH = 256;
+function deniesHostedSearch(config) {
+  return Object.keys(codexNetworkDeniedConfig(config.policy)).length > 0 && codexNetworkDeniedSearchMode(config.policy) === "disabled";
+}
 
 class AppServerEngine {
   options;
@@ -18713,6 +18869,7 @@ class AppServerEngine {
   accountProofInvalidatedSequence = 0;
   accountProofTurns = new Map;
   hostedNetworkLockVerifiedGeneration = null;
+  toolHistoryLockVerifiedGeneration = null;
   accountReloadFingerprint;
   pendingAccountReloadFingerprint;
   accountCheckSequence = 0;
@@ -18753,6 +18910,7 @@ class AppServerEngine {
         this.clearPendingSignIn();
         this.loginSequence++;
         this.hostedNetworkLockVerifiedGeneration = null;
+        this.toolHistoryLockVerifiedGeneration = null;
         this.rejectAllWaiters();
         this.router.abandonGeneration(generation);
       }
@@ -19190,8 +19348,47 @@ class AppServerEngine {
     this.hostedNetworkLockVerifiedGeneration = generation;
     return generation;
   }
+  async assertToolHistoryLock(generation, config) {
+    if (!deniesHostedSearch(config) || config.permissionProfile)
+      return;
+    if (this.toolHistoryLockVerifiedGeneration === generation)
+      return;
+    const result = await this.supervisor.requestOnGeneration(generation, "config/read", { cwd: config.cwd ?? this.options.cwd });
+    const gaps = codexToolHistoryGaps(result?.config);
+    if (gaps.length > 0) {
+      throw new Error(`Codex did not confirm that tool declarations stay out of thread history (${gaps.join("; ")}), so this session, which has web search off, was refused`);
+    }
+    if (!this.supervisor.isReady() || this.supervisor.getGeneration() !== generation) {
+      throw new Error("Codex exited during tool history verification");
+    }
+    this.toolHistoryLockVerifiedGeneration = generation;
+  }
+  async assertNoToolHistory(threadId, config, release) {
+    if (!deniesHostedSearch(config))
+      return;
+    const verdict = await (this.options.toolHistoryVerdict ?? ((id) => this.readToolHistory(id)))(threadId).catch(() => "unknown");
+    if (verdict === "clean")
+      return;
+    if (release) {
+      for (const [handle, binding] of this.bindings) {
+        if (binding.threadId === threadId)
+          this.bindings.delete(handle);
+      }
+      await this.supervisor.request("thread/unsubscribe", { threadId }).catch(() => {
+        return;
+      });
+    }
+    throw new Error(verdict === "declares" ? "This Codex thread was offered web search in an earlier turn and still declares it in its history, so a turn with web search off was refused. Start a new session for it." : "Could not confirm that this Codex thread's history declares no web search, so a turn with web search off was refused.");
+  }
+  async readToolHistory(threadId) {
+    const codexHome = this.options.codexHome;
+    const resolve = async (id) => this.rolloutPaths.get(id) ?? findTranscriptPath(id, () => listTranscriptPaths(codexHome), { allowNegativeCache: false });
+    const path = await resolve(threadId);
+    return path ? threadToolHistoryVerdict(path, resolve) : "unknown";
+  }
   async startThread(options) {
     const generation = await this.assertHostedNetworkLock(options.config);
+    await this.assertToolHistoryLock(generation, options.config);
     const extra = await this.projectResourceThreadConfig(generation, options.config);
     const response = await this.supervisor.requestOnGeneration(generation, "thread/start", this.toThreadParams(options.config, extra));
     this.assertPermissionProfile(response.activePermissionProfile, options.config);
@@ -19199,10 +19396,12 @@ class AppServerEngine {
   }
   async resumeThread(threadId, options) {
     const generation = await this.assertHostedNetworkLock(options.config);
+    await this.assertToolHistoryLock(generation, options.config);
     const extra = await this.projectResourceThreadConfig(generation, options.config);
     const response = await this.supervisor.requestOnGeneration(generation, "thread/resume", { threadId, ...this.toThreadParams(options.config, extra) });
     this.assertPermissionProfile(response.activePermissionProfile, options.config);
     const thread = this.bindThread(response.thread, options.config, response.model);
+    await this.assertNoToolHistory(thread.id ?? threadId, options.config, true);
     thread.turns = this.extractTurns(response.thread);
     return thread;
   }
@@ -19218,6 +19417,8 @@ class AppServerEngine {
   }
   async forkThread(threadId, config, lastTurnId) {
     const generation = await this.assertHostedNetworkLock(config);
+    await this.assertToolHistoryLock(generation, config);
+    await this.assertNoToolHistory(threadId, config, false);
     const extra = await this.projectResourceThreadConfig(generation, config);
     const response = await this.supervisor.requestOnGeneration(generation, "thread/fork", {
       threadId,
@@ -19495,7 +19696,7 @@ class AppServerEngine {
       thread.model = confirmedModel.trim();
     }
     if (thread.id) {
-      if (typeof raw.path === "string" && isAbsolute6(raw.path)) {
+      if (typeof raw.path === "string" && isAbsolute7(raw.path)) {
         this.rolloutPaths.set(thread.id, raw.path);
       }
       this.bindings.set(thread.id, {
@@ -21453,7 +21654,7 @@ function parseCommandToken(text, sigils = ["/"]) {
 
 // ../../bridges/codex-bridge/src/prompts/template-discovery.ts
 import { createHash as createHash10 } from "node:crypto";
-import { open as open6, readdir as readdir3, stat as stat7 } from "node:fs/promises";
+import { open as open7, readdir as readdir3, stat as stat7 } from "node:fs/promises";
 import { join as join14 } from "node:path";
 
 // ../../bridges/codex-bridge/src/prompts/template-format.ts
@@ -21608,7 +21809,7 @@ function isReservedName(name) {
 var metadataCache = new Map;
 var METADATA_CACHE_MAX = 1024;
 async function readBounded(absolutePath, maxBytes) {
-  const handle = await open6(absolutePath, "r");
+  const handle = await open7(absolutePath, "r");
   try {
     const info = await handle.stat();
     if (!info.isFile())
@@ -21855,7 +22056,7 @@ async function loadTemplateBody(entry, limits = TEMPLATE_LIMITS) {
 }
 
 // ../../bridges/codex-bridge/src/commands/skill-inventory.ts
-import { isAbsolute as isAbsolute7 } from "node:path";
+import { isAbsolute as isAbsolute8 } from "node:path";
 var SKILL_INVENTORY_LIMITS = Object.freeze({
   maxSkills: 512,
   maxDescriptionBytes: 1000,
@@ -21905,7 +22106,7 @@ function normalizeSkillsList(raw, context) {
       }
       const name = nonEmpty(candidate.name);
       const path = typeof candidate.path === "string" ? candidate.path : undefined;
-      if (!name || !usableSkillName(name) || !path || !isAbsolute7(path)) {
+      if (!name || !usableSkillName(name) || !path || !isAbsolute8(path)) {
         truncated = true;
         continue;
       }