orkestrator 2.29.0-beta → 2.30.0-beta

package/resources/codex-bridge/dist/index.js

@@ -4161,7 +4161,8 @@ var NATIVE_AGENT_COMMAND_CATALOGUE_ERROR_CODES = [
   "rejected",
   "malformed",
   "too-large",
-  "provider-error"
+  "provider-error",
+  "outdated-bridge"
 ];
 var DEFAULT_NATIVE_AGENT_LIVE_WINDOW = {
   messages: 100,
@@ -10805,18 +10806,11 @@ async function deriveTranscriptSubagentPartsForTurn({
 }
 
 // ../../bridges/codex-bridge/src/history/rollout.ts
+import { createHash as createHash7 } from "node:crypto";
 import { readFile as readFile4, readdir, stat as stat4 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, join as join8 } from "node:path";
 
-// ../../bridges/codex-bridge/src/messages/types.ts
-function createMessageId() {
-  return `msg-${crypto.randomUUID()}`;
-}
-function createSessionId() {
-  return `session-${crypto.randomUUID()}`;
-}
-
 // ../../bridges/codex-bridge/src/sessions/refused-cell-tail.ts
 import { open as open2, stat as stat3 } from "node:fs/promises";
 var STRONG_REFUSAL_MARKERS = [
@@ -11415,6 +11409,7 @@ class TurnAccumulator {
   turnId;
   phase = "starting";
   cancelRequested = false;
+  stoppedByShutdown = false;
   error;
   finalDiff;
   completedAt;
@@ -11427,9 +11422,15 @@ class TurnAccumulator {
   changedFrozenRows = new Set;
   steerFloor = 0;
   modelToolCalled = false;
+  pendingResponseBoundaries = 0;
   noteModelToolCall() {
     this.modelToolCalled = true;
   }
+  noteModelResponseCompleted() {
+    if (this.isTerminal())
+      return;
+    this.pendingResponseBoundaries += 1;
+  }
   clientToolItemStartedBetween(fromMs, toMs) {
     for (const accumulator of this.items.values()) {
       const item = accumulator.item;
@@ -11767,6 +11768,7 @@ class TurnAccumulator {
   startAssistantSegment(assistantMessageId, boundary, startedAt = new Date().toISOString()) {
     this.assistantMessageId = assistantMessageId;
     this.modelToolCalled = false;
+    this.pendingResponseBoundaries = Math.max(0, this.pendingResponseBoundaries - 1);
     const segment = {
       assistantMessageId,
       startIndex: boundary,
@@ -11779,11 +11781,13 @@ class TurnAccumulator {
   opensModelStep(event) {
     let itemId;
     let type;
+    let toolCall = false;
     switch (event.kind) {
       case "item.started":
       case "item.completed":
         itemId = event.item.id;
         type = event.item.type;
+        toolCall = isClientToolCall(event.item) && !isCodeModeCell(event.item);
         break;
       case "item.text.delta":
         itemId = event.itemId;
@@ -11796,7 +11800,8 @@ class TurnAccumulator {
       default:
         return false;
     }
-    if (type !== "reasoning" && type !== "agent_message")
+    const opensResponse = type === "reasoning" || type === "agent_message";
+    if (!opensResponse && !(toolCall && this.pendingResponseBoundaries > 0))
       return false;
     if (this.items.has(itemId) || this.isTerminal())
       return false;
@@ -12975,6 +12980,10 @@ var NON_TOOL_TURN_ITEM_TYPES = new Set([
   "Plan"
 ]);
 var MAX_OPEN_CODE_MODE_CELLS = 256;
+function replayedRowId(threadId, scope, kind, ordinal) {
+  const digest = createHash7("sha256").update(`${threadId}\x00${scope}\x00${kind}\x00${ordinal}`).digest("hex");
+  return `msg-r-${digest.slice(0, 32)}`;
+}
 async function replayPersistedRollout(threadId, snapshot, meta, structuredTurns) {
   const finalAssistantRecordByTurn = new Map;
   if (structuredTurns.size > 0) {
@@ -13002,19 +13011,29 @@ async function replayPersistedRollout(threadId, snapshot, meta, structuredTurns)
   let currentTurnModel;
   let currentAssistantMessage;
   let currentRowCalledTool = false;
+  let responseCompletedInRow = false;
   let nextRowStartedAt;
   let lastTimestamp;
   let unreadableRun;
+  const rowOrdinals = new Map;
+  const nextRowId = (kind) => {
+    const scope = currentTurnId ?? "";
+    const key = `${kind}\x00${scope}`;
+    const ordinal = rowOrdinals.get(key) ?? 0;
+    rowOrdinals.set(key, ordinal + 1);
+    return replayedRowId(threadId, scope, kind, ordinal);
+  };
   const closeAssistantRow = () => {
     currentAssistantMessage = undefined;
     currentRowCalledTool = false;
+    responseCompletedInRow = false;
     nextRowStartedAt = undefined;
   };
   const ensureAssistantMessage = (timestamp) => {
     if (currentAssistantMessage)
       return currentAssistantMessage;
     currentAssistantMessage = {
-      id: createMessageId(),
+      id: nextRowId("assistant"),
       role: "assistant",
       content: "",
       parts: [],
@@ -13161,7 +13180,7 @@ async function replayPersistedRollout(threadId, snapshot, meta, structuredTurns)
       } else {
         unreadableRun = {
           message: {
-            id: createMessageId(),
+            id: replayedRowId(threadId, currentTurnId ?? "", "unreadable", unreadable.offset),
             role: "assistant",
             content: "",
             parts: [],
@@ -13200,11 +13219,16 @@ async function replayPersistedRollout(threadId, snapshot, meta, structuredTurns)
       visitCompletedItem(record.payload.item, timestamp);
       return;
     }
+    if (record.type === "token_usage_record" || record.type === "event_msg" && record.payload?.type === "token_count") {
+      if (currentRowCalledTool)
+        responseCompletedInRow = true;
+      return;
+    }
     if (record.type !== "response_item" || !record.payload) {
       return;
     }
     const payload = record.payload;
-    if (currentRowCalledTool && (payload.type === "reasoning" || payload.type === "message" && payload.role === "assistant")) {
+    if (currentRowCalledTool && (payload.type === "reasoning" || payload.type === "message" && payload.role === "assistant" || responseCompletedInRow && ROLLOUT_TOOL_CALL_TYPES.has(String(payload.type)))) {
       closeAssistantRow();
       nextRowStartedAt = timestamp;
     }
@@ -13273,7 +13297,7 @@ async function replayPersistedRollout(threadId, snapshot, meta, structuredTurns)
     }
     closeAssistantRow();
     messages.push({
-      id: createMessageId(),
+      id: nextRowId("user"),
       role,
       content: text,
       parts: [...text ? [{ type: "text", content: text }] : [], ...attachments],
@@ -13798,6 +13822,14 @@ async function renderTurn(turn, options) {
   };
 }
 
+// ../../bridges/codex-bridge/src/messages/types.ts
+function createMessageId() {
+  return `msg-${crypto.randomUUID()}`;
+}
+function createSessionId() {
+  return `session-${crypto.randomUUID()}`;
+}
+
 // ../../bridges/codex-bridge/src/app-server-runtime-rows.ts
 function patchCommandChangePart(part, itemId, change) {
   if (part.type === "tool-invocation" && part.toolUseId === itemId) {
@@ -14076,7 +14108,7 @@ async function publishAssistantRows(context, state, turn, options) {
 }
 
 // ../../bridges/codex-bridge/src/app-server-runtime-sessions.ts
-import { createHash as createHash9, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID6 } from "node:crypto";
 
 // ../protocol/src/agent-mail.ts
 var AGENT_MAIL_MAX_BODY_BYTES = 32 * 1024;
@@ -14140,7 +14172,7 @@ var ORKESTRATOR_ARTIFACT_MCP_PATH = "/artifact-mcp";
 
 // ../../bridges/codex-bridge/src/engine/app-server-engine.ts
 import { open as open6 } from "node:fs/promises";
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { isAbsolute as isAbsolute7, join as join13 } from "node:path";
 
 // ../../bridges/codex-bridge/src/app-server/process-supervisor.ts
@@ -16780,8 +16812,6 @@ var IGNORED_METHODS = new Set([
   "autoApprovalReview/strictReviewRequired",
   "mcpServer/event/stream/notification",
   "thread/reverted",
-  "modelProvider/authRecoveryStarted",
-  "modelProvider/authRecoveryCompleted",
   "thread/status/changed",
   "thread/archived",
   "thread/unarchived",
@@ -16853,6 +16883,25 @@ function reduceNotification(notification, generation, handle) {
         ]
       };
     }
+    case "modelProvider/authRecoveryStarted":
+    case "modelProvider/authRecoveryCompleted": {
+      if (!threadId || !isRecord9(params))
+        return { events: [] };
+      const message = str3(params.message)?.trim().slice(0, 300);
+      const provider = str3(params.provider)?.trim().slice(0, 64);
+      return {
+        events: [
+          {
+            kind: "thread.authRecovery",
+            threadId,
+            phase: notification.method === "modelProvider/authRecoveryStarted" ? "started" : "completed",
+            ...message ? { message } : {},
+            ...provider ? { provider } : {},
+            ...base
+          }
+        ]
+      };
+    }
     case "thread/tokenUsage/updated": {
       if (!isRecord9(params) || !threadId || !turnId || !isRecord9(params.tokenUsage)) {
         return { events: [] };
@@ -16895,7 +16944,8 @@ function reduceNotification(notification, generation, handle) {
               updatedAt: new Date().toISOString()
             },
             ...base
-          }
+          },
+          { kind: "model.response.completed", threadId, turnId, ...base }
         ]
       };
     }
@@ -17289,7 +17339,7 @@ import { mkdir as mkdir7, open as open4, rename as rename5, rm as rm7, writeFile
 import { join as join12 } from "node:path";
 
 // ../../bridges/codex-bridge/src/sessions/persistence.ts
-import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
 import {
   chmod,
   link as link2,
@@ -17383,7 +17433,7 @@ function isPersistedSessionTombstone(value) {
   return tombstone.deleted === true && typeof tombstone.bridgeSessionId === "string" && tombstone.bridgeSessionId.length > 0 && typeof tombstone.deletedAt === "string" && Number.isFinite(Date.parse(tombstone.deletedAt));
 }
 function hashCwd(cwd) {
-  return createHash7("sha256").update(cwd).digest("hex").slice(0, 16);
+  return createHash8("sha256").update(cwd).digest("hex").slice(0, 16);
 }
 var DEFAULT_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 var TEMP_FILE_GRACE_MS = 60 * 60 * 1000;
@@ -17412,7 +17462,7 @@ class BridgeSessionStore {
     return join11(this.dir(), `bridge-sessions-${this.cwdHash}`);
   }
   recordKey(bridgeSessionId) {
-    return createHash7("sha256").update(bridgeSessionId).digest("hex");
+    return createHash8("sha256").update(bridgeSessionId).digest("hex");
   }
   recordPath(bridgeSessionId) {
     return join11(this.recordsDir(), `${this.recordKey(bridgeSessionId)}.json`);
@@ -18808,7 +18858,7 @@ async function readStoredLoginFingerprint(codexHome) {
     const apiKey = typeof root.OPENAI_API_KEY === "string" ? root.OPENAI_API_KEY : "";
     if (!refreshToken && !apiKey)
       return;
-    return createHash8("sha256").update(JSON.stringify([refreshToken, apiKey])).digest("hex");
+    return createHash9("sha256").update(JSON.stringify([refreshToken, apiKey])).digest("hex");
   } catch {
     return;
   }
@@ -18863,7 +18913,9 @@ class AppServerEngine {
   pendingSignIn = null;
   pendingSignInTimer;
   completedLoginId = null;
+  activeLoginId = null;
   loginSequence = 0;
+  loginStart;
   accountServingGeneration;
   notificationSequence = 0;
   accountProofInvalidatedSequence = 0;
@@ -18907,7 +18959,7 @@ class AppServerEngine {
       }),
       onGenerationReady: (generation, previous) => this.handleGenerationChange(generation, previous),
       onGenerationExit: (generation) => {
-        this.clearPendingSignIn();
+        this.forgetSignIn();
         this.loginSequence++;
         this.hostedNetworkLockVerifiedGeneration = null;
         this.toolHistoryLockVerifiedGeneration = null;
@@ -18975,7 +19027,7 @@ class AppServerEngine {
     return this.info();
   }
   async stop() {
-    this.clearPendingSignIn();
+    this.forgetSignIn();
     await this.supervisor.stop();
     this.bindings.clear();
     this.rejectAllWaiters();
@@ -19059,6 +19111,8 @@ class AppServerEngine {
         this.completedLoginId = loginId;
         if (this.pendingSignIn?.loginId === loginId)
           this.clearPendingSignIn();
+        if (this.activeLoginId === loginId)
+          this.activeLoginId = null;
       }
     }
     if (notification.method === "account/login/completed" && objectRecord(notification.params).success === true || notification.method === "account/updated") {
@@ -19603,6 +19657,10 @@ class AppServerEngine {
     this.pendingSignInTimer = undefined;
     this.pendingSignIn = null;
   }
+  forgetSignIn() {
+    this.clearPendingSignIn();
+    this.activeLoginId = null;
+  }
   async readAccount() {
     const sequence = ++this.accountCheckSequence;
     const generation = this.supervisor.getGeneration();
@@ -19612,7 +19670,7 @@ class AppServerEngine {
       console.warn("[codex-bridge] Account connector recovery failed:", redactSecrets(error instanceof Error ? error.message : String(error)));
     });
     if (loginSequence === this.loginSequence && objectRecord(response).account)
-      this.clearPendingSignIn();
+      this.forgetSignIn();
     const pendingSignIn = normalizePendingSignIn(this.pendingSignIn?.display);
     if (!pendingSignIn)
       this.clearPendingSignIn();
@@ -19628,15 +19686,26 @@ class AppServerEngine {
   }
   async beginAccountLogin(method = "browser") {
     const sequence = ++this.loginSequence;
-    this.clearPendingSignIn();
-    const response = await this.supervisor.request("account/login/start", method === "device-code" ? {
+    this.forgetSignIn();
+    const start = this.supervisor.requestWithGeneration("account/login/start", method === "device-code" ? {
       type: "chatgptDeviceCode"
     } : {
       type: "chatgpt",
       codexStreamlinedLogin: true,
       useHostedLoginSuccessPage: true
     });
+    this.loginStart = start;
+    let response;
+    try {
+      response = (await start).result;
+    } finally {
+      if (this.loginStart === start)
+        this.loginStart = undefined;
+    }
     const raw = objectRecord(response);
+    if (sequence === this.loginSequence && typeof raw.loginId === "string" && raw.loginId.length > 0 && raw.loginId.length <= 512 && raw.loginId !== this.completedLoginId) {
+      this.activeLoginId = raw.loginId;
+    }
     const display = normalizePendingSignIn({
       url: raw.verificationUrl,
       code: raw.userCode,
@@ -19644,13 +19713,46 @@ class AppServerEngine {
     });
     if (sequence === this.loginSequence && typeof raw.loginId === "string" && raw.loginId.length > 0 && raw.loginId.length <= 512 && raw.loginId !== this.completedLoginId && display) {
       this.pendingSignIn = { loginId: raw.loginId, display };
-      this.pendingSignInTimer = setTimeout(() => this.clearPendingSignIn(), Math.max(0, display.expiresAt - Date.now()));
+      this.pendingSignInTimer = setTimeout(() => void this.cancelAccountLogin().catch(() => {
+        return;
+      }), Math.max(0, display.expiresAt - Date.now()));
       this.pendingSignInTimer.unref?.();
     }
     return response;
   }
+  async cancelAccountLogin() {
+    let loginId = this.activeLoginId;
+    const start = this.loginStart;
+    let generation = this.supervisor.getGeneration();
+    const sequence = ++this.loginSequence;
+    if (!loginId && start) {
+      const started = await start;
+      generation = started.generation;
+      if (generation !== this.supervisor.getGeneration())
+        return "none";
+      const raw = objectRecord(started.result);
+      if (typeof raw.loginId === "string" && raw.loginId.length > 0 && raw.loginId.length <= 512 && raw.loginId !== this.completedLoginId) {
+        loginId = raw.loginId;
+        if (sequence === this.loginSequence) {
+          this.activeLoginId = loginId;
+          this.pendingSignInTimer = setTimeout(() => void this.cancelAccountLogin().catch(() => {
+            return;
+          }), NATIVE_AGENT_PENDING_SIGN_IN_TTL_MS);
+          this.pendingSignInTimer.unref?.();
+        }
+      }
+    }
+    if (!loginId)
+      return "none";
+    const response = await this.supervisor.requestOnGeneration(generation, "account/login/cancel", {
+      loginId
+    });
+    if (sequence === this.loginSequence && this.activeLoginId === loginId && generation === this.supervisor.getGeneration())
+      this.forgetSignIn();
+    return objectRecord(response).status === "canceled" ? "canceled" : "none";
+  }
   async logoutAccount() {
-    this.clearPendingSignIn();
+    this.forgetSignIn();
     this.loginSequence++;
     await this.supervisor.request("account/logout", undefined);
   }
@@ -20319,7 +20421,7 @@ class CodexRuntimeSessions {
   }
   createSession(body) {
     const clientSessionKey = typeof body.clientSessionKey === "string" && body.clientSessionKey.trim().length > 0 && body.clientSessionKey.length <= 512 ? body.clientSessionKey : undefined;
-    const sessionId = clientSessionKey ? `session-client-${createHash9("sha256").update(this.ctx.options.cwd).update("\x00").update(clientSessionKey).digest("hex").slice(0, 32)}` : createSessionId();
+    const sessionId = clientSessionKey ? `session-client-${createHash10("sha256").update(this.ctx.options.cwd).update("\x00").update(clientSessionKey).digest("hex").slice(0, 32)}` : createSessionId();
     const existing = this.ctx.registry.getSession(sessionId);
     if (existing) {
       this.ctx.registry.touch(sessionId);
@@ -20605,7 +20707,7 @@ class CodexRuntimeSessions {
       return "not-found";
     if (this.sessionAdmissionClosed(session))
       return "closing";
-    const inputDigest = createHash9("sha256").update(input).digest("hex");
+    const inputDigest = createHash10("sha256").update(input).digest("hex");
     const previous = this.ctx.steerRequests.get(requestId);
     if (previous) {
       if (previous.threadId !== session.threadId || previous.turnId !== expectedTurnId || previous.inputDigest !== inputDigest) {
@@ -20922,6 +21024,9 @@ class CodexRuntimeSessions {
   logoutAuth() {
     return this.ctx.options.engine.logoutAccount();
   }
+  cancelAuthLogin() {
+    return this.ctx.options.engine.cancelAccountLogin();
+  }
   async rewindMessages(sessionId, messageId) {
     const session = this.ctx.registry.getSession(sessionId);
     if (!session)
@@ -21133,6 +21238,7 @@ class CodexRuntimeSessions {
       messageRevision: session.messageRevision,
       contentEpoch: session.contentEpoch,
       ...this.ctx.commandCatalogue.revision > 0 ? { commandRevision: this.ctx.commandCatalogue.revision } : {},
+      ...context?.authNotice ? { authNotice: context.authNotice } : {},
       ...this.ctx.options.engine.isAccountSignInRequired() ? {
         readiness: {
           state: "authentication-required",
@@ -21653,7 +21759,7 @@ function parseCommandToken(text, sigils = ["/"]) {
 }
 
 // ../../bridges/codex-bridge/src/prompts/template-discovery.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import { open as open7, readdir as readdir3, stat as stat7 } from "node:fs/promises";
 import { join as join14 } from "node:path";
 
@@ -21794,7 +21900,7 @@ function templateBindingRevision(origin, relativePath) {
   return commandBindingRevision(["template", origin, relativePath]);
 }
 function fingerprintOf(bytes) {
-  return createHash10("sha256").update(bytes).digest("hex").slice(0, 32);
+  return createHash11("sha256").update(bytes).digest("hex").slice(0, 32);
 }
 function nameFromRelativePath(relativePath) {
   return `/${relativePath.replace(/\.md$/i, "")}`;
@@ -22061,7 +22167,9 @@ var SKILL_INVENTORY_LIMITS = Object.freeze({
   maxSkills: 512,
   maxDescriptionBytes: 1000,
   ttlMs: 30000,
-  refreshDebounceMs: 250
+  refreshDebounceMs: 250,
+  coldSettleMs: 1000,
+  maxSettleReads: 5
 });
 var SKILL_ID_PREFIX = "codex-skill:";
 var SKILL_ALIAS_PREFIX = "/skill:";
@@ -22149,6 +22257,10 @@ function normalizeSkillsList(raw, context) {
     fetchedAt: context.now
   };
 }
+function snapshotSignature(snapshot) {
+  return snapshot.bindings.map((binding) => `${binding.bindingRevision}:${binding.enabled}:${binding.ambiguous}`).join(`
+`);
+}
 function skillUnavailability(binding, projectResources = true) {
   if (!projectResources && !["user", "system", "admin"].includes(binding.scope)) {
     return {
@@ -22195,8 +22307,12 @@ class SkillInventory {
   invalidationSerial = 0;
   inflight = null;
   refreshTimer = null;
+  settledGeneration = null;
+  settling = null;
+  answeredGeneration = null;
+  settleTimer = null;
   disposed = false;
-  stats = { invalidations: 0, reads: 0, scheduledRefreshes: 0 };
+  stats = { invalidations: 0, reads: 0, scheduledRefreshes: 0, settlingReads: 0 };
   constructor(deps) {
     this.deps = deps;
   }
@@ -22228,7 +22344,7 @@ class SkillInventory {
     const snapshot = this.current();
     const ttl = this.deps.ttlMs ?? SKILL_INVENTORY_LIMITS.ttlMs;
     if (!options.forceReload && snapshot && !this.dirty && this.deps.now() - snapshot.fetchedAt < ttl) {
-      return { snapshot, fresh: !snapshot.partial };
+      return { snapshot, fresh: !snapshot.partial, settled: this.isSettled(snapshot.generation) };
     }
     if (this.inflight && (this.inflight.forced || !options.forceReload)) {
       return this.inflight.promise;
@@ -22243,7 +22359,8 @@ class SkillInventory {
   }
   async refresh(forceReload) {
     const read = await this.fetch(forceReload);
-    this.deps.onRefreshed?.(read);
+    if (!this.disposed)
+      this.deps.onRefreshed?.(read);
     return read;
   }
   async fetch(forceReload) {
@@ -22263,18 +22380,93 @@ class SkillInventory {
       this.dirty = this.invalidationSerial !== serial;
       const live = this.current();
       if (!live)
-        return { snapshot: null, fresh: false, error: "Codex restarted while listing skills" };
-      return { snapshot: live, fresh: !live.partial };
+        return {
+          snapshot: null,
+          fresh: false,
+          settled: false,
+          error: "Codex restarted while listing skills"
+        };
+      this.noteSettlingAnswer(live, serial);
+      this.noteAnswer(live);
+      return { snapshot: live, fresh: !live.partial, settled: this.isSettled(live.generation) };
     } catch {
       this.dirty = true;
-      return { snapshot: this.current(), fresh: false, error: "Codex skills could not be listed" };
+      const retained = this.current();
+      return {
+        snapshot: retained,
+        fresh: false,
+        settled: retained ? this.isSettled(retained.generation) : false,
+        error: "Codex skills could not be listed"
+      };
+    }
+  }
+  isSettled(generation) {
+    return this.coldSettleMs() <= 0 || this.settledGeneration === generation;
+  }
+  coldSettleMs() {
+    return this.deps.coldSettleMs ?? SKILL_INVENTORY_LIMITS.coldSettleMs;
+  }
+  noteAnswer(snapshot) {
+    const { generation } = snapshot;
+    if (this.isSettled(generation) || this.answeredGeneration === generation || this.disposed) {
+      return;
     }
+    this.answeredGeneration = generation;
+    this.armSettle(snapshot, 1);
+  }
+  noteSettlingAnswer(live, serial) {
+    const settling = this.settling;
+    if (!settling || settling.generation !== live.generation || serial < settling.serial)
+      return;
+    this.settling = null;
+    if (settling.round >= 2 && snapshotSignature(live) === settling.baseline || settling.round >= SKILL_INVENTORY_LIMITS.maxSettleReads) {
+      this.settledGeneration = live.generation;
+      return;
+    }
+    this.armSettle(live, settling.round + 1);
+  }
+  armSettle(snapshot, round) {
+    const { generation } = snapshot;
+    const baseline = snapshotSignature(snapshot);
+    if (this.settleTimer)
+      clearTimeout(this.settleTimer);
+    this.settleTimer = setTimeout(() => {
+      this.settleTimer = null;
+      if (this.disposed || this.deps.generation() !== generation)
+        return;
+      this.invalidationSerial += 1;
+      this.dirty = true;
+      const settling = {
+        generation,
+        serial: this.invalidationSerial,
+        round,
+        baseline
+      };
+      this.settling = settling;
+      this.stats.settlingReads += 1;
+      const pending = this.inflight?.promise.catch(() => {
+        return;
+      });
+      const read = () => {
+        if (this.disposed || this.deps.generation() !== generation || this.settling !== settling)
+          return;
+        return this.read();
+      };
+      (pending ? pending.then(read) : read())?.catch(() => {
+        return;
+      });
+    }, this.coldSettleMs());
+    this.settleTimer.unref?.();
   }
   dispose() {
     this.disposed = true;
     if (this.refreshTimer)
       clearTimeout(this.refreshTimer);
     this.refreshTimer = null;
+    if (this.settleTimer)
+      clearTimeout(this.settleTimer);
+    this.settleTimer = null;
+    this.settling = null;
   }
 }
 
@@ -22362,9 +22554,11 @@ class CodexCommandCatalogue {
       now: options.now,
       ...options.skillTtlMs !== undefined ? { ttlMs: options.skillTtlMs } : {},
       ...options.skillRefreshDebounceMs !== undefined ? { refreshDebounceMs: options.skillRefreshDebounceMs } : {},
+      ...options.skillColdSettleMs !== undefined ? { coldSettleMs: options.skillColdSettleMs } : {},
       onRefreshed: (read) => {
         this.skillsDigest = commandBindingRevision([
           String(read.fresh),
+          String(read.settled),
           read.snapshot ? JSON.stringify([
             read.snapshot.truncated,
             read.snapshot.bindings.map((binding) => skillCommandRow(binding))
@@ -22411,10 +22605,6 @@ class CodexCommandCatalogue {
     this.bumpIfChanged();
     return scan;
   }
-  async listTemplateAndBuiltinRows() {
-    const templates = await this.scanTemplates();
-    return [...BUILTINS.map(builtinRow), ...templates.effective.map(templateCommandRow)];
-  }
   async collect(projectResources = true) {
     this.deferredBumps += 1;
     let templates;
@@ -22444,7 +22634,7 @@ class CodexCommandCatalogue {
     }
     return {
       commands,
-      status: skillRead.fresh ? "ready" : "stale",
+      status: skillRead.fresh && skillRead.settled ? "ready" : "stale",
       truncated,
       templates,
       skills: skillRead.snapshot
@@ -22752,7 +22942,8 @@ class CodexRuntimeContext {
       cwd: options.cwd,
       now: this.now,
       ...options.skillInventoryTtlMs !== undefined ? { skillTtlMs: options.skillInventoryTtlMs } : {},
-      ...options.skillRefreshDebounceMs !== undefined ? { skillRefreshDebounceMs: options.skillRefreshDebounceMs } : {}
+      ...options.skillRefreshDebounceMs !== undefined ? { skillRefreshDebounceMs: options.skillRefreshDebounceMs } : {},
+      ...options.skillColdSettleMs !== undefined ? { skillColdSettleMs: options.skillColdSettleMs } : {}
     });
   }
   getRevisedRowsOverflowVersion(sessionId) {
@@ -22792,6 +22983,30 @@ function promptThreadConfig(config) {
   ]);
 }
 
+// ../../bridges/codex-bridge/src/sessions/auth-recovery-notice.ts
+var RENEWAL_FAILED = /\b(fail(?:ed|ure)?|could ?n[o']t|unable|unrecoverable|log ?(?:in|out) again|sign ?(?:in|out) again)\b/i;
+var CODEX_LOGIN_RENEWING_MESSAGE = "Codex's login stopped working during this turn, and Codex is renewing it.";
+var CODEX_LOGIN_RENEWAL_FAILED_SUFFIX = "Sign in to Codex again to keep working.";
+function nextThreadAuthNotice(current, event, newOccurrenceId) {
+  if (event.phase === "started") {
+    if (current?.state === "expired")
+      return current;
+    return {
+      state: "expired",
+      message: event.message ?? CODEX_LOGIN_RENEWING_MESSAGE,
+      occurrenceId: newOccurrenceId()
+    };
+  }
+  if (event.message && RENEWAL_FAILED.test(event.message)) {
+    return {
+      state: "needs-auth",
+      message: `${event.message.replace(/[.\s]*$/, "")}. ${CODEX_LOGIN_RENEWAL_FAILED_SUFFIX}`,
+      occurrenceId: current?.state === "needs-auth" ? current.occurrenceId : newOccurrenceId()
+    };
+  }
+  return;
+}
+
 // ../../bridges/codex-bridge/src/messages/coalescer.ts
 var DEFAULT_COALESCE_INTERVAL_MS = 100;
 
@@ -23480,6 +23695,9 @@ class CodexRuntimeLifecycle {
       case "turn.model.updated":
         this.applyConfirmedModel(context, event.model, event.turnId);
         return;
+      case "thread.authRecovery":
+        this.setThreadAuthNotice(context, nextThreadAuthNotice(context.authNotice, event, () => crypto.randomUUID()));
+        return;
       case "turn.configuration.updated": {
         const turn = context.activeTurn;
         if (!turn || !turn.accepts(event))
@@ -23531,6 +23749,12 @@ class CodexRuntimeLifecycle {
           turn.noteModelToolCall();
         return;
       }
+      case "model.response.completed": {
+        const turn = context.activeTurn;
+        if (turn?.accepts(event))
+          turn.noteModelResponseCompleted();
+        return;
+      }
       case "item.started":
       case "item.updated":
       case "item.completed": {
@@ -23649,8 +23873,13 @@ class CodexRuntimeLifecycle {
         const turn = context.activeTurn;
         if (!turn || !turn.accepts(event))
           return;
+        if (event.status === "completed")
+          this.setThreadAuthNotice(context, undefined);
         this.discardOutlivingCommandWindows(turn);
-        turn.complete(event.status, event.error);
+        if (turn.stoppedByShutdown && event.status === "interrupted")
+          this.completeRecoveredTurn(turn, event.status);
+        else
+          turn.complete(event.status, event.error);
         this.ctx.options.changeEvidence?.turn(this.evidenceSource(context, turn), event.status);
         const finalize = () => this.runFinalization(context, turn).catch((error) => {
           console.error(`[codex-bridge] Failed to finalize turn ${turn.turnId}:`, error instanceof Error ? error.message : error);
@@ -23944,6 +24173,18 @@ class CodexRuntimeLifecycle {
       bytes: patchable ? estimateOrderedEventBytes(changedParts) : normalizedMessageSnapshotChars(target) * 2
     });
   }
+  setThreadAuthNotice(context, notice) {
+    if (context.authNotice === notice)
+      return;
+    context.authNotice = notice;
+    for (const session of this.ctx.registry.boundSessionsForThread(context.threadId)) {
+      this.ctx.options.emit({
+        type: "session.updated",
+        sessionId: session.id,
+        data: { authNotice: notice ?? null }
+      });
+    }
+  }
   applyConfirmedModel(context, model, turnId) {
     if (!turnId)
       context.modelId = model;
@@ -25313,9 +25554,6 @@ class CodexRuntimePrompt {
     }
     return this.ctx.commandCatalogue.refresh();
   }
-  async listGlobalCommandRows() {
-    return this.ctx.commandCatalogue.listTemplateAndBuiltinRows();
-  }
   async modelsListText(session) {
     const { models } = await this.ctx.callbacks.listModels();
     const current = session.config.model || models[0]?.id || "UNCONFIRMED";
@@ -25466,6 +25704,32 @@ class CodexRuntimeTail {
     this.lifecycle = lifecycle;
     this.sessions = sessions;
   }
+  async interruptForParentExit(budgetMs) {
+    const stopping = [];
+    for (const context of this.ctx.registry.listThreads()) {
+      const turn = context.activeTurn;
+      if (!turn || turn.isTerminal() || turn.isUnconfirmed())
+        continue;
+      turn.stoppedByShutdown = true;
+      const { engineHandle } = context;
+      stopping.push(this.ctx.options.engine.interruptTurn(engineHandle, turn.turnId).then(() => this.ctx.options.engine.waitForTurnTerminal(engineHandle, turn.turnId, {
+        timeoutMs: budgetMs
+      })).catch(() => {
+        return;
+      }));
+    }
+    if (stopping.length === 0)
+      return 0;
+    let timer;
+    await Promise.race([
+      Promise.allSettled(stopping),
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, budgetMs);
+      })
+    ]);
+    clearTimeout(timer);
+    return stopping.length;
+  }
   async abort(sessionId) {
     const session = this.ctx.registry.getSession(sessionId);
     if (!session)
@@ -25776,6 +26040,9 @@ class AppServerRuntime {
   logoutAuth(...args) {
     return this.sessions.logoutAuth(...args);
   }
+  cancelAuthLogin(...args) {
+    return this.sessions.cancelAuthLogin(...args);
+  }
   rewindMessages(...args) {
     return this.sessions.rewindMessages(...args);
   }
@@ -25824,15 +26091,15 @@ class AppServerRuntime {
   refreshCommandCatalogue(...args) {
     return this.prompts.refreshCommandCatalogue(...args);
   }
-  listGlobalCommandRows(...args) {
-    return this.prompts.listGlobalCommandRows(...args);
-  }
   get closeStopBudgetMs() {
     return this.tail.closeStopBudgetMs;
   }
   set closeStopBudgetMs(value) {
     this.tail.closeStopBudgetMs = value;
   }
+  interruptForParentExit(...args) {
+    return this.tail.interruptForParentExit(...args);
+  }
   abort(...args) {
     return this.tail.abort(...args);
   }
@@ -26028,7 +26295,8 @@ function parseEventCursor(raw) {
 
 // ../protocol/src/parent-watchdog.ts
 var PARENT_PID_ENV = "ORKESTRATOR_PARENT_PID";
-var DEFAULT_POLL_INTERVAL_MS = 15000;
+var PARENT_WATCH_INTERVAL_MS = 1000;
+var DEFAULT_POLL_INTERVAL_MS = PARENT_WATCH_INTERVAL_MS;
 function parseParentPid(value) {
   if (!value)
     return null;
@@ -26460,6 +26728,19 @@ function createShutdownHandler(timer, clearTimer = clearInterval, exit = (code)
     ]).finally(() => exit(0));
   };
 }
+function createParentExitHandler(interrupt, shutdown, report = (turns, ms) => {
+  console.error(`[codex-bridge] Stopped ${turns} running turn(s) in ${ms} ms`);
+}) {
+  return async () => {
+    const detectedAt = performance.now();
+    try {
+      const turns = await interrupt(PARENT_EXIT_INTERRUPT_BUDGET_MS).catch(() => 0);
+      report(turns, Math.round(performance.now() - detectedAt));
+    } finally {
+      shutdown();
+    }
+  };
+}
 var FALLBACK_MODELS = [
   {
     id: "gpt-5.4",
@@ -26756,6 +27037,7 @@ var __testing = {
   createCodexProcessDiagnosticsForTesting: createCodexProcessDiagnostics,
   createSharedTranscriptMetaLoaderForTesting: createSharedTranscriptMetaLoader,
   createShutdownHandlerForTesting: createShutdownHandler,
+  createParentExitHandlerForTesting: createParentExitHandler,
   emitForTesting: emit,
   eventRingForTesting: () => eventRing,
   withIsolatedEventRingForTesting: () => {
@@ -26971,6 +27253,10 @@ app.post("/global/auth/login", async (c) => {
     ...raw.userCode ? { code: raw.userCode } : {}
   });
 });
+app.post("/global/auth/login/cancel", async (c) => {
+  const status = await appServerRuntime.cancelAuthLogin();
+  return c.json({ cancelled: status === "canceled" });
+});
 app.post("/global/auth/logout", async (c) => {
   await appServerRuntime.logoutAuth();
   return c.json({ ok: true });
@@ -26982,10 +27268,6 @@ app.get("/global/usage", async (c) => {
   const account = await appServerRuntime.readPlanUsage();
   return c.json({ account: account ?? null });
 });
-app.get("/global/slash-commands", async (c) => {
-  const cwd = getWorkingDirectory();
-  return c.json({ commands: await appServerRuntime.listGlobalCommandRows(), cwd });
-});
 app.get("/session/:id/commands", async (c) => {
   return c.json(await appServerRuntime.getCommandCatalogue(c.req.param("id")));
 });
@@ -27602,13 +27884,14 @@ for (const signal of ["SIGTERM", "SIGINT"]) {
   process.on(signal, shutdownHandler);
 }
 installFatalRejectionGuard({ label: "[codex-bridge]" });
+var PARENT_EXIT_INTERRUPT_BUDGET_MS = 2000;
 var parentPid = parseParentPid(process.env[PARENT_PID_ENV]);
 if (parentPid !== null) {
   startParentWatchdog({
     parentPid,
     onParentExit: () => {
       console.error(`[codex-bridge] Backend process ${parentPid} is gone; shutting down`);
-      shutdownHandler();
+      createParentExitHandler((budgetMs) => appServerRuntime.interruptForParentExit(budgetMs), shutdownHandler)();
     }
   });
 }