pwragent 1.3.12 → 1.3.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pwragent",
-  "version": "1.3.12",
+  "version": "1.3.15",
   "private": false,
   "type": "module",
   "description": "Experimental headless PwrAgent daemon and command-line client.",
@@ -64,7 +64,7 @@
     "node-pty"
   ],
   "pwragentRelease": {
-    "tag": "v1.3.12",
-    "commit": "7654f26215b4b5e47f70cc3fe682fd6e3d39c7f8"
+    "tag": "v1.3.15",
+    "commit": "bea7442e08c8eecf09926b8956e898efb72569b8"
   }
 }

package/src/codex.js

@@ -1,112 +1,111 @@
 import { spawn } from "node:child_process";
+import { CodexAppServerClient } from "../dist/federation-core.js";
 import { readMessages, MAX_RESPONSE_BYTES } from "./wire.js";
 
-// This adapter deliberately supports only the stable App Server job surface.
-// It never reads Codex's storage or imports Electron/desktop modules.
-export class Codex {
-  constructor({ command, home, workspace, onNotification, onRequest, onFailure, timeout = 30000 }) {
-    this.pending = new Map();
-    this.sequence = 0;
-    this.timeout = timeout;
-    this.onFailure = onFailure;
-    const env = { ...process.env, CODEX_HOME: home };
+// The Outpost owns launch settings and process-group shutdown. RPC state and
+// Codex normalization belong to the shared owner client.
+class OutpostCodexTransport {
+  constructor({ command, home, workspace, onFailure, onUnexpectedExit }) {
+    Object.assign(this, { command, home, workspace, onFailure, onUnexpectedExit });
+  }
+
+  setMessageHandler(handler) { this.messageHandler = handler; }
+  setCloseHandler(handler) { this.closeHandler = handler; }
+
+  async connect() {
+    if (this.child) return;
+    this.stopping = false;
+    const env = { ...process.env, CODEX_HOME: this.home };
     for (const key of Object.keys(env)) {
       if (key.toUpperCase() === "ELECTRON_RENDERER_URL") delete env[key];
     }
-    this.child = spawn(command, ["app-server", "--listen", "stdio://"], {
-      cwd: workspace,
-      env,
-      stdio: ["pipe", "pipe", "pipe"],
-      // A dedicated group lets shutdown reap ordinary descendants on POSIX.
-      detached: true,
+    this.child = spawn(this.command, ["app-server", "--listen", "stdio://"], {
+      cwd: this.workspace, env, stdio: ["pipe", "pipe", "pipe"], detached: true,
     });
     this.closed = new Promise((resolve) => this.child.once("close", resolve));
-    this.child.on("error", () => this.fail(new Error("Could not start Codex App Server")));
-    this.child.on("exit", () => this.fail(new Error("Codex App Server exited")));
-    this.child.stdin.on("error", () => this.fail(new Error("Codex App Server input closed")));
-    // Drain diagnostics without copying potentially sensitive provider text to
-    // the journal. Request errors are returned to the private local client.
+    const fail = (error) => {
+      this.closeHandler(error);
+      if (!this.stopping) this.onFailure(error);
+    };
+    this.child.on("error", () => fail(new Error("Could not start Codex App Server")));
+    this.child.on("exit", (code, signal) => {
+      const unexpected = !this.stopping;
+      // Record the host's uncertain outcome before the shared client emits
+      // synthetic turn failures for a lost process.
+      fail(new Error("Codex App Server exited"));
+      if (unexpected) this.onUnexpectedExit({ code, signal, stderrPreview: [] });
+    });
+    this.child.stdin.on("error", () => fail(new Error("Codex App Server input closed")));
+    // Provider diagnostics can contain private text; drain without journaling.
     this.child.stderr.resume();
-    readMessages(this.child.stdout, MAX_RESPONSE_BYTES, (message) => {
-      if (typeof message.method === "string") {
-        if (message.id !== undefined) onRequest(message);
-        else onNotification(message);
-        return;
-      }
-      const request = this.pending.get(message.id);
-      if (!request) return;
-      if (!("error" in message) && !("result" in message)) {
-        this.fail(new Error("Invalid Codex response"));
-        return;
-      }
-      this.pending.delete(message.id);
-      clearTimeout(request.timer);
-      if (message.error) request.reject(new Error(message.error.message || "Codex request failed"));
-      else if ("result" in message) request.resolve(message.result);
-    }, (error) => this.fail(error));
-  }
-
-  fail(error) {
-    if (this.failure) return;
-    this.failure = error;
-    for (const request of this.pending.values()) {
-      clearTimeout(request.timer);
-      request.reject(error);
-    }
-    this.pending.clear();
-    if (!this.stopping) this.onFailure(error);
+    readMessages(this.child.stdout, MAX_RESPONSE_BYTES,
+      (message) => {
+        if (message.id !== undefined && typeof message.method !== "string" && !("result" in message) && !("error" in message)) {
+          fail(new Error("Invalid Codex response"));
+          return;
+        }
+        this.messageHandler(JSON.stringify(message));
+      }, fail);
   }
 
   send(message) {
-    if (this.failure || this.stopping) throw this.failure || new Error("Codex is stopping");
-    this.child.stdin.write(JSON.stringify(message) + "\n");
-  }
-
-  request(method, params) {
-    if (this.failure || this.stopping) return Promise.reject(this.failure || new Error("Codex is stopping"));
-    if (this.pending.size >= 32) return Promise.reject(new Error("Too many pending Codex requests"));
-    const id = ++this.sequence;
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        // A timeout may mean a mutation executed but its reply was lost.
-        // Stop the runtime; never retry an uncertain turn/start.
-        this.fail(new Error(`Codex request timed out: ${method}`));
-      }, this.timeout);
-      this.pending.set(id, { resolve, reject, timer });
-      try {
-        this.send({ id, method, params });
-      } catch (error) {
-        this.fail(error);
-      }
-    });
-  }
-
-  async initialize() {
-    await this.request("initialize", {
-      clientInfo: { name: "pwragent-headless", title: "PwrAgent Headless", version: "0.0.0" },
-      capabilities: { experimentalApi: true },
-    });
-    this.send({ method: "initialized", params: {} });
+    if (this.stopping || !this.child) throw new Error("Codex is stopping");
+    this.child.stdin.write(message + "\n");
   }
 
-  async stop() {
+  async close() {
+    if (!this.child) return;
     this.stopping = true;
-    this.fail(new Error("Codex stopped"));
     const signal = (name) => {
       if (!this.child.pid) return;
-      try {
-        process.kill(-this.child.pid, name);
-      } catch (error) {
-        if (error.code !== "ESRCH") throw error;
-      }
+      try { process.kill(-this.child.pid, name); }
+      catch (error) { if (error.code !== "ESRCH") throw error; }
     };
     signal("SIGTERM");
     let timer;
     await Promise.race([this.closed, new Promise((resolve) => { timer = setTimeout(resolve, 2000); })]);
     clearTimeout(timer);
-    // Also reap descendants that outlived the group leader. systemd's cgroup
-    // owns processes that deliberately leave this group.
     signal("SIGKILL");
     await this.closed;
+    this.child = null;
   }
 }
+
+const quietLogger = { debug() {}, info() {}, warn() {}, error() {} };
+
+export class Codex extends CodexAppServerClient {
+  constructor({ command, home, workspace, onNotification, onRequest, onFailure, timeout = 30000 }) {
+    const transport = new OutpostCodexTransport({ command, home, workspace, onFailure,
+      onUnexpectedExit: () => {} });
+    super({ env: { ...process.env, CODEX_HOME: home }, requestTimeoutMs: timeout }, {
+      createTransport: (callbacks) => { transport.onUnexpectedExit = callbacks.onUnexpectedExit; return transport; },
+      clientInfo: { name: "pwragent-headless", title: "PwrAgent Headless" },
+      onRequestFailure: (error) => {
+        // A lost mutation response leaves an uncertain outcome; stop this host.
+        if (error instanceof Error && error.message.startsWith("json-rpc timeout:")) onFailure(error);
+      },
+      logger: quietLogger,
+      rpcLogger: quietLogger,
+      listingDiagnostics: { trace: (_stage, _fields, work) => work(), link() {} },
+      authState: { isBlocked: () => false, assertAvailable() {} },
+      signInRequiredMessage: "Codex is logged out. Please sign in again to resume operations.",
+      buildShellEnvironment: (env) => env,
+      buildSandboxPolicy: (sandbox, cwd = workspace) => {
+        if (sandbox === undefined) return undefined;
+        if (sandbox === "read-only") return { type: "readOnly", networkAccess: false };
+        if (sandbox !== "workspace-write") throw new Error("Unsupported Outpost sandbox policy");
+        return { type: "workspaceWrite", writableRoots: [cwd], networkAccess: false,
+          excludeTmpdirEnvVar: true, excludeSlashTmp: true };
+      },
+      enrichThreadDirectory: async () => ({ linkedDirectories: [] }),
+      sampleAppServerProcessTree: async () => ({}),
+    });
+    this.hostTransport = transport;
+    this.onNotification(onNotification);
+    this.onRequest(onRequest);
+  }
+
+  get child() { return this.hostTransport.child; }
+  initialize() { return this.getInitializeResult(); }
+  stop() { return this.close(); }
+}

package/src/daemon.js

@@ -68,10 +68,10 @@ export async function serve({ directory, workspace, home, command, profile }) {
     const store = new JobStore(directory, { version: 1, workspace, codexHome: home });
     runtime = new Runtime({ store, workspace, home, command,
       onFailure: (error) => { console.error(`Headless runtime stopped: ${error.message}`); void stop(error); } });
-    writeFileSync(lockPath, JSON.stringify({ pid: process.pid, codexPid: runtime.codex.child.pid }) + "\n");
     process.on("SIGTERM", signalStop);
     process.on("SIGINT", signalStop);
     await runtime.codex.initialize();
+    writeFileSync(lockPath, JSON.stringify({ pid: process.pid, codexPid: runtime.codex.child.pid }) + "\n");
     federation = new HeadlessFederation({ directory, runtime, profile, onFailure: (error) => { void stop(error); } });
     await federation.start();
     if (shutdown) return done;

package/src/federation-backend.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import path from "node:path";
 import { buildThreadIdentityKey, NavigationQueryStore, FEDERATION_BACKEND_METHOD_CAPABILITIES, FEDERATION_MAX_FRAME_BYTES, fitThreadReplayWithinByteBudget, mergeCausalMessagingContext, pageThreadReplay, shortenDerivedThreadTitle } from "../dist/federation-core.js";
 import { ACTIVE, atomicJson, digest } from "./store.js";
+import { OutpostThreadRegistry } from "./owner-thread-registry.js";
 
 // The owner methods this outpost serves. Each one's capability comes from the
 // shared owner contract, so a grant means the same here as on desktop.
@@ -73,6 +74,7 @@ export class HeadlessBackend {
     runtime.listOwnedThreads = () => [...this.threads.values()].filter((thread) => !thread.archived);
     this.latestJobs = new Map();
     this.syncJobs();
+    this.threadRegistry = new OutpostThreadRegistry(this);
   }
 
   persist() {
@@ -140,6 +142,13 @@ export class HeadlessBackend {
     }
     const id = message.params?.threadId || message.params?.thread?.id;
     if (!this.threads.has(id)) return;
+    if (message.method === "thread/name/updated") {
+      const thread = this.threads.get(id);
+      const source = message.params.titleSource || "explicit";
+      if (thread.titleSource === "explicit" && source !== "explicit") return;
+      this.setTitle(thread, message.params.threadName, source);
+      return;
+    }
     // The desktop adapter represents failed completions as turn/failed and
     // supplies turnId alongside the provider's nested turn object.
     const turnId = message.params?.turnId || message.params?.turn?.id;
@@ -188,7 +197,7 @@ export class HeadlessBackend {
           && (!params.afterKey || project.path > params.afterKey)).map((project) => ({ key: project.path, kind: "directory", path: project.path, label: project.label, threadKeys: [] })) };
       case "readTurnAssistantReply": {
         const history = await this.readThread(params.threadId);
-        const messages = history.replay.messages.filter((message) => message.role === "assistant" && message.turn?.id === params.turnId);
+        const messages = history.replay.entries.filter((entry) => entry.type === "message" && entry.role === "assistant" && entry.turn?.id === params.turnId);
         return { message: messages.find((message) => params.itemId ? message.id === params.itemId : message.text === params.text) || null };
       }
       case "readThread": {
@@ -227,7 +236,7 @@ export class HeadlessBackend {
           const original = job.messageOrigin;
           this.runtime.save({ ...job, messageOrigin: { ...incoming, ...mergeCausalMessagingContext([original, incoming]) } });
         }
-        const result = await this.runtime.codex.request("turn/steer", { threadId: params.threadId, expectedTurnId: params.expectedTurnId || job.turnId, input });
+        const result = await this.runtime.codex.steerTurn({ threadId: params.threadId, expectedTurnId: params.expectedTurnId || job.turnId, input });
         return { backend: "codex", threadId: params.threadId, turnId: result.turnId || job.turnId, disposition: "steered",
           ...(name === "controlActiveTurn" ? { ok: true, requestId: params.requestId } : {}) };
       }
@@ -281,8 +290,7 @@ export class HeadlessBackend {
     this.publish({ backend: "codex", notification: { method: "navigation/invalidated", params: { threadId, ...(sourceMethod ? { sourceMethod } : {}) } } }, "navigation");
   }
 
-  // threads.json is the only store for a title. The outpost never sets the
-  // Codex thread name.
+  // threads.json retains owner title provenance, including explicit renames.
   setTitle(thread, title, titleSource) {
     Object.assign(thread, { title, titleSource });
     this.persist();
@@ -340,10 +348,10 @@ export class HeadlessBackend {
     const cwd = this.runtime.projects.resolve(params.cwd || params.directoryPath || params.projectKey);
     this.creating = true;
     try {
-      const result = await this.runtime.codex.request("thread/start", { cwd, dynamicTools: this.runtime.messagingTools.buildDynamicToolSpecs(), approvalPolicy: "never", sandbox, ...(params.model ? { model: params.model } : {}), ephemeral: false });
-      if (!result?.thread?.id || typeof result.thread.id !== "string" || result.thread.id.length > 256) throw new Error("Invalid thread/start response");
-      this.runtime.loadedThreads.add(result.thread.id);
-      const thread = { id: result.thread.id, messagingFileTools: true, title: PLACEHOLDER_THREAD_TITLE, titleSource: "fallback", createdAt: Date.now(), cwd, sandbox,
+      const result = await this.runtime.codex.startThread({ cwd, dynamicTools: this.runtime.messagingTools.buildDynamicToolSpecs(), approvalPolicy: "never", sandbox, ...(params.model ? { model: params.model } : {}), ephemeral: false });
+      if (!result?.threadId || typeof result.threadId !== "string" || result.threadId.length > 256) throw new Error("Invalid thread/start response");
+      this.runtime.loadedThreads.add(result.threadId);
+      const thread = { id: result.threadId, messagingFileTools: true, title: PLACEHOLDER_THREAD_TITLE, titleSource: "fallback", createdAt: Date.now(), cwd, sandbox,
         model: params.model, reasoningEffort: params.reasoningEffort, serviceTier: params.serviceTier };
       this.threads.set(thread.id, thread);
       this.persist();
@@ -369,10 +377,12 @@ export class HeadlessBackend {
   }
 
   async listBackends() {
-    const result = await this.runtime.codex.request("model/list", {});
-    const models = (result.data || []).map((model) => ({ id: model.id, label: model.displayName || model.id,
-      current: model.isDefault, reasoningEfforts: (model.supportedReasoningEfforts || []).map((entry) => entry.reasoningEffort),
-      defaultReasoningEffort: model.defaultReasoningEffort, supportsSteering: true, supportsImage: false, supportsFast: false }));
+    const models = (await this.runtime.codex.listModels()).map((model) => ({
+      id: model.id, label: model.label, current: model.current,
+      reasoningEfforts: model.reasoningEfforts, defaultReasoningEffort: model.defaultReasoningEffort,
+      supportsReasoning: model.supportsReasoning, supportsSteering: true,
+      supportsImage: false, supportsFast: false,
+    }));
     return { fetchedAt: Date.now(), backends: [{ kind: "codex", label: "Codex (headless outpost)", available: true,
       methods: Object.keys(METHOD_CAPABILITIES), capabilities: { listThreads: true, createThread: true, resumeThread: true,
         renameThread: true, readThread: true, startTurn: true, interruptTurn: true, steerTurn: true,
@@ -384,36 +394,23 @@ export class HeadlessBackend {
 
   async readThread(id) {
     this.owned(id);
-    const result = await this.runtime.codex.request("thread/read", { threadId: id, includeTurns: true });
-    const entries = [];
-    for (const turn of result.thread?.turns || []) {
-      const status = turn.status === "inProgress" ? "in_progress" : turn.status;
-      const job = [...this.runtime.store.jobs.values()].find((job) => job.threadId === id && job.turnId === turn.id);
-      const metadata = { id: turn.id,
-        ...(["in_progress", "completed", "failed", "cancelled", "interrupted"].includes(status) ? { status } : {}) };
-      for (const [index, item] of (turn.items || []).entries()) {
-        const itemId = item.id || `${turn.id}-${index}`;
-        if (item.type === "agentMessage" || item.type === "userMessage") {
-          entries.push({ type: "message", id: itemId, role: item.type === "agentMessage" ? "assistant" : "user",
-            text: item.text || (item.content || []).filter((part) => part.type === "text").map((part) => part.text).join("\n"),
-            turn: metadata, ...(item.type === "userMessage" && job?.messageOrigin ? { origin: job.messageOrigin } : {}) });
-        } else {
-          const details = item.type === "commandExecution" ? [{ id: itemId, kind: "command", label: item.command,
-            command: { displayCommand: item.command, cwd: item.cwd, output: item.aggregatedOutput || "", exitCode: item.exitCode, durationMs: item.durationMs } }]
-            : [{ id: itemId, kind: item.type === "fileChange" ? "write" : "read", label: item.type, markdown: JSON.stringify(item, null, 2) }];
-          entries.push({ type: "activity", id: itemId, summary: item.command || item.type,
-            status: item.status === "inProgress" ? "in_progress" : item.status === "failed" ? "failed" : "completed", details, turn: metadata });
-        }
-      }
+    const replay = await this.runtime.codex.readThread({ threadId: id });
+    const entries = replay.entries.map((entry) => {
+      if (entry.type !== "message" || entry.role !== "user") return entry;
+      const job = [...this.runtime.store.jobs.values()].find((job) => job.threadId === id && job.turnId === entry.turn?.id);
+      return job?.messageOrigin ? { ...entry, origin: job.messageOrigin } : entry;
+    });
+    const origins = new Map(entries.filter((entry) => entry.type === "message" && entry.origin).map((entry) => [entry.id, entry.origin]));
+    const messages = replay.messages.map((message) => origins.has(message.id) ? { ...message, origin: origins.get(message.id) } : message);
+    const summary = await this.runtime.codex.readThreadSummary(id);
+    const thread = this.owned(id);
+    if (thread.titleSource === "fallback" && summary.titleSource !== "fallback") {
+      this.setTitle(thread, summary.title, summary.titleSource);
+    } else if (thread.titleSource === "fallback") {
+      this.deriveTitle(id, replay.messages.find((message) => message.role === "user")?.text);
     }
-    const messages = entries.filter((entry) => entry.type === "message");
-    // Names threads created before derived titles, and imported threads.
-    this.deriveTitle(id, typeof result.thread?.preview === "string" && result.thread.preview.trim()
-      ? result.thread.preview : messages.find((item) => item.role === "user")?.text);
-    return { backend: "codex", threadId: id, fetchedAt: Date.now(), threadStatus: this.summary(this.owned(id)).threadStatus,
-      replay: { entries, messages, lastUserMessage: messages.filter((item) => item.role === "user").at(-1)?.text,
-        lastAssistantMessage: messages.filter((item) => item.role === "assistant").at(-1)?.text,
-        pagination: { supportsPagination: false, hasPreviousPage: false } } };
+    return { backend: "codex", threadId: id, fetchedAt: Date.now(), threadStatus: this.summary(thread).threadStatus,
+      replay: { ...replay, entries, messages } };
   }
 
   navigationIndex() {

package/src/federation-core.ts

@@ -26,3 +26,6 @@ export { FEDERATION_BACKEND_METHOD_CAPABILITIES } from "@pwragent/federation/fed
 
 export { NavigationQueryStore } from "@pwragent/owner-core/navigation-query-store";
 export { buildThreadIdentityKey, NAVIGATION_QUERY_MAX_RESULT_BYTES } from "@pwragent/shared";
+
+export { CodexAppServerClient } from "@pwragent/owner-core/codex-app-server/client";
+export { patchOwnerThreadMetadata } from "@pwragent/owner-core/thread-storage";

package/src/handoffs.js

@@ -72,11 +72,8 @@ export function setupHandoffs(federation, directory) {
       exportThreadForHandoff: async (id) => {
         const owned = backend.owned(id);
         if (runtime.active) throw new Error("Wait for the source turn to finish");
-        const result = await runtime.codex.request("thread/read", { threadId: id, includeTurns: false });
-        if (result.thread?.id !== id || typeof result.thread.path !== "string") throw new Error("Codex did not provide a persisted thread for protocol export");
-        const file = await runtime.codex.request("fs/readFile", { path: result.thread.path });
-        if (typeof file.dataBase64 !== "string") throw new Error("Codex protocol thread export is unavailable");
-        return { rolloutBase64: file.dataBase64, replay: (await backend.readThread(id)).replay,
+        const exported = await runtime.codex.exportThreadForHandoff(id);
+        return { ...exported, replay: (await backend.readThread(id)).replay,
           cwd: runtime.projects.resolve(owned.cwd || runtime.workspace),
           // A placeholder would become the destination's explicit name.
           ...(owned.titleSource === "fallback" ? {} : { title: owned.title }) };
@@ -87,9 +84,9 @@ export function setupHandoffs(federation, directory) {
         try {
           const cwd = runtime.projects.contained(await realpath(request.directoryPath));
           if (backend.threads.size >= 10000) throw new Error("Thread retention limit reached");
-          const result = await runtime.codex.request("thread/fork", { threadId: request.sourceThreadId, path: request.sourceThreadPath,
+          const result = await runtime.codex.forkThread({ threadId: request.sourceThreadId, path: request.sourceThreadPath,
             cwd, approvalPolicy: "never", sandbox: "read-only" });
-          const id = result.thread?.id;
+          const id = result.threadId;
           if (typeof id !== "string" || !id || backend.threads.has(id)) throw new Error("Invalid forked thread identity");
           backend.threads.set(id, { id, cwd, title: "Imported thread", titleSource: "fallback", createdAt: Date.now(), sandbox: "read-only" });
           runtime.loadedThreads.add(id);
@@ -101,7 +98,7 @@ export function setupHandoffs(federation, directory) {
       readThread: async ({ threadId }) => ({ replay: (await backend.readThread(threadId)).replay }),
       archiveThread: async ({ threadId }) => {
         backend.owned(threadId);
-        await runtime.codex.request("thread/archive", { threadId });
+        await runtime.codex.archiveThread({ threadId });
         backend.owned(threadId).archived = true;
         backend.persist();
         backend.invalidate(threadId);

package/src/owner-thread-registry.js

@@ -0,0 +1,68 @@
+import { patchOwnerThreadMetadata } from "../dist/federation-core.js";
+
+const FIELDS = [
+  ["archived", "archived"],
+  ["model", "model"], ["reasoningEffort", "reasoningEffort"], ["serviceTier", "serviceTier"], ["fastMode", "fastMode"],
+  ["executionModeUpdatedAt", "executionModeUpdatedAt"], ["reasoningEffortsByModel", "reasoningEffortsByModel"],
+  ["modelMigrationRevision", "modelMigrationRevision"], ["modelSettingsManuallyUpdatedAt", "modelSettingsManuallyUpdatedAt"],
+  ["createdAt", "createdAt"], ["updatedAt", "updatedAt"], ["cwd", "cwd"],
+  ["pinnedRank", "pinnedRank"], ["seenAt", "seenAt"], ["seenUpdatedAt", "seenUpdatedAt"],
+  ["archivedAt", "archivedAt"], ["restoredAt", "restoredAt"],
+  ["archiveRetentionStartedAt", "archiveRetentionStartedAt"],
+  ["subthreadOrder", "subthreadOrder"], ["subthreadsCollapsed", "subthreadsCollapsed"],
+];
+
+/** Storage view over the backend's live threads.json map; no lifecycle calls. */
+export class OutpostThreadRegistry {
+  constructor(backend) {
+    this.backend = backend;
+  }
+
+  identity(identity) {
+    if (identity.backend !== "codex") throw new Error("This outpost stores Codex threads only");
+  }
+
+  record(thread) {
+    const patch = {
+      executionMode: thread.sandbox === "workspace-write" ? "auto" : thread.sandbox === "danger-full-access" ? "full-access" : "default",
+      title: thread.title === undefined ? undefined : { text: thread.title, source: thread.titleSource ?? "fallback" },
+      parent: thread.parentThreadId !== undefined ? { backend: thread.parentThreadBackend ?? "codex", threadId: thread.parentThreadId,
+        ...(thread.parentThreadInstanceId !== undefined ? { instanceId: thread.parentThreadInstanceId } : {}) } : undefined,
+    };
+    for (const [field, stored] of FIELDS) patch[field] = thread[stored];
+    return patchOwnerThreadMetadata(undefined, { backend: "codex", threadId: thread.id }, patch);
+  }
+
+  async getThreadMetadata(identity) {
+    this.identity(identity);
+    const thread = this.backend.threads.get(identity.threadId);
+    return thread ? this.record(thread) : undefined;
+  }
+
+  async listThreadMetadata() {
+    return [...this.backend.threads.values()].map((thread) => this.record(thread));
+  }
+
+  async updateThreadMetadata(identity, patch) {
+    this.identity(identity);
+    const thread = this.backend.threads.get(identity.threadId);
+    const current = thread ? this.record(thread) : undefined;
+    const next = patchOwnerThreadMetadata(current, identity, patch);
+    if (!current || JSON.stringify(current) !== JSON.stringify(next)) {
+      const stored = { ...thread, id: identity.threadId, title: next.title?.text, titleSource: next.title?.source,
+        sandbox: next.executionMode === "auto" ? "workspace-write" : next.executionMode === "full-access" ? "danger-full-access" : "read-only",
+        parentThreadId: next.parent?.threadId, parentThreadBackend: next.parent?.backend,
+        parentThreadInstanceId: next.parent?.instanceId };
+      for (const [field, key] of FIELDS) stored[key] = structuredClone(next[field]);
+      // Keep the live registry unchanged if the durable write fails.
+      this.backend.threads.set(identity.threadId, stored);
+      try { this.backend.persist(); }
+      catch (error) {
+        if (thread) this.backend.threads.set(identity.threadId, thread);
+        else this.backend.threads.delete(identity.threadId);
+        throw error;
+      }
+    }
+    return next;
+  }
+}

package/src/runtime.js

@@ -27,7 +27,7 @@ export class Runtime {
       command, home, workspace,
       onNotification: (message) => { this.notification(message); this.onEvent?.(message); },
       onRequest: (message) => this.serverRequest(message),
-      onFailure,
+      onFailure: (error) => { this.codexFailure = error; onFailure(error); },
     });
   }
 
@@ -57,7 +57,7 @@ export class Runtime {
       case "read": {
         const job = this.store.get(params.id);
         if (!job.threadId) throw new Error("This job has no confirmed thread ID");
-        return this.codex.request("thread/read", { threadId: job.threadId, includeTurns: true });
+        return this.codex.readThreadProtocolResult({ threadId: job.threadId, includeTurns: true });
       }
       case "interrupt": {
         const job = this.store.get(params.id);
@@ -66,7 +66,7 @@ export class Runtime {
         if (job.status === "interrupting") return job;
         this.save({ ...job, status: "interrupting" });
         try {
-          await this.codex.request("turn/interrupt", { threadId: job.threadId, turnId: job.turnId });
+          await this.codex.interruptTurn({ threadId: job.threadId, turnId: job.turnId });
         } catch (error) {
           const current = this.store.get(job.id);
           if (current.status === "interrupting" && current.turnId === job.turnId) {
@@ -115,7 +115,7 @@ export class Runtime {
     this.work = this.start(job, prompt).catch((error) => {
       const current = this.store.get(id);
       if (ACTIVE.has(current.status)) {
-        this.finish(id, this.codex.failure || this.stopping ? "unknown" : "failed", error.message);
+        this.finish(id, this.codexFailure || this.stopping ? "unknown" : "failed", error.message);
       }
     });
     // The durable acceptance precedes inference. Socket loss cannot cancel it.
@@ -126,41 +126,29 @@ export class Runtime {
     const cwd = this.projects.resolve(job.cwd || this.workspace);
     const params = { cwd, approvalPolicy: "never", sandbox: job.sandbox,
       ...(job.model ? { model: job.model } : {}) };
-    const result = job.threadId && this.loadedThreads.has(job.threadId) ? { thread: { id: job.threadId } }
-      : await this.codex.request(job.threadId ? "thread/resume" : "thread/start", {
-        ...params,
-        ...(job.threadId ? { threadId: job.threadId } : { ephemeral: false, dynamicTools: this.messagingTools.buildDynamicToolSpecs() }),
-      });
-    if (typeof result?.thread?.id !== "string" || !result.thread.id || result.thread.id.length > 256
-      || (job.threadId && result.thread.id !== job.threadId)) {
+    const result = job.threadId ? { threadId: job.threadId }
+      : await this.codex.startThread({ ...params, ephemeral: false, dynamicTools: this.messagingTools.buildDynamicToolSpecs() });
+    if (typeof result.threadId !== "string" || !result.threadId || result.threadId.length > 256) {
       throw new Error("Codex returned an invalid thread ID");
     }
-    this.loadedThreads.add(result.thread.id);
-    this.save({ ...this.store.get(job.id), threadId: result.thread.id,
+    this.loadedThreads.add(result.threadId);
+    this.save({ ...this.store.get(job.id), threadId: result.threadId,
       ...(!job.threadId ? { messagingFileTools: true } : {}) });
-    const turn = await this.codex.request("turn/start", {
-      threadId: result.thread.id,
-      input: [{ type: "text", text: prompt, text_elements: [] }],
-      cwd,
-      approvalPolicy: "never",
-      sandboxPolicy: job.sandbox === "workspace-write"
-        ? { type: "workspaceWrite", writableRoots: [cwd], networkAccess: false, excludeTmpdirEnvVar: true, excludeSlashTmp: true }
-        : { type: "readOnly", networkAccess: false },
-      ...(job.model ? { model: job.model } : {}),
-      ...(job.reasoningEffort ? { effort: job.reasoningEffort } : {}),
+    const turn = await this.codex.startTurn({ ...params, threadId: result.threadId,
+      onTerminalResult: (params) => this.notification({ method: "turn/completed", params }),
+      input: [{ type: "text", text: prompt }],
+      ...(job.reasoningEffort ? { reasoningEffort: job.reasoningEffort } : {}),
       ...(job.serviceTier ? { serviceTier: job.serviceTier } : {}),
     });
-    if (typeof turn?.turn?.id !== "string" || !turn.turn.id || turn.turn.id.length > 256) {
+    if (typeof turn.turnId !== "string" || !turn.turnId || turn.turnId.length > 256 || turn.turnId.startsWith("pending:")) {
       this.onFailure(new Error("Codex returned an invalid turn ID; execution outcome is unknown"));
       return;
     }
-    this.save({ ...this.store.get(job.id), turnId: turn.turn.id, status: "running" });
+    this.save({ ...this.store.get(job.id), turnId: turn.turnId, status: "running" });
     // The prompt stays in memory: job records never store it.
-    this.onEvent?.({ method: "headless/turnStarted", params: { threadId: result.thread.id, jobId: job.id, prompt } });
-    if (this.earlyCompletion?.turn?.id === turn.turn.id) {
+    this.onEvent?.({ method: "headless/turnStarted", params: { threadId: result.threadId, jobId: job.id, prompt } });
+    if (this.earlyCompletion?.turn?.id === turn.turnId) {
       this.complete(this.earlyCompletion);
-    } else if (["completed", "failed", "interrupted"].includes(turn.turn.status)) {
-      this.complete({ threadId: result.thread.id, turn: turn.turn });
     } else if (this.blockedReason) {
       await this.handle("interrupt", { id: job.id });
     }
@@ -168,7 +156,10 @@ export class Runtime {
 
   notification({ method, params }) {
     if (method === "thread/closed") this.loadedThreads.delete(params?.threadId);
-    if (method !== "turn/completed" || !this.active) return;
+    if (!["turn/completed", "turn/failed"].includes(method) || !this.active) return;
+    // A process-loss failure is synthesized by the client, not a confirmed
+    // provider result. Shutdown preserves this job as unknown.
+    if (this.codexFailure) return;
     const job = this.store.get(this.active);
     if (params?.threadId !== job.threadId) return;
     if (!job.turnId) this.earlyCompletion = params;
@@ -239,22 +230,23 @@ export class Runtime {
   serverRequest(message) {
     const call = readPwrAgentMessagingDynamicToolCall(message);
     if (call) {
-      void this.dispatchTool(call).then((result) => this.codex.send({ id: message.id, result }),
-        (error) => this.codex.send({ id: message.id, result: { success: false, contentItems: [{ type: "inputText", text: error.message }] } }));
-      return;
+      return this.dispatchTool(call).catch((error) => ({ success: false,
+        contentItems: [{ type: "inputText", text: error.message }] }));
     }
     // Never grant unattended approvals or invent answers to user questions.
     const method = message.method;
     let result;
     if (["item/commandExecution/requestApproval", "item/fileChange/requestApproval"].includes(method)) result = { decision: "decline" };
     else if (method === "item/permissions/requestApproval") result = { permissions: {}, scope: "turn" };
-    this.codex.send(result
-      ? { id: message.id, result }
-      : { id: message.id, error: { code: -32601, message: "Interactive requests are not supported by PwrAgent Headless" } });
-    if (!this.active) return;
+    if (!this.active) {
+      if (result) return result;
+      throw new Error("Interactive requests are not supported by PwrAgent Headless");
+    }
     this.blockedReason = `Interactive request requires an operator: ${method}`;
     const job = this.store.get(this.active);
     if (job.turnId) void this.handle("interrupt", { id: job.id }).catch(this.onFailure);
+    if (result) return result;
+    throw new Error("Interactive requests are not supported by PwrAgent Headless");
   }
 
   finish(id, status, reason) {

package/src/store.js

@@ -26,8 +26,11 @@ export function atomicJson(file, value) {
       closeSync(fd);
     }
     renameSync(temporary, file);
-    const directory = openSync(path.dirname(file), "r");
-    try { fsyncSync(directory); } finally { closeSync(directory); }
+    // Windows rejects directory fsync. The file is synced before rename on every host.
+    if (process.platform !== "win32") {
+      const directory = openSync(path.dirname(file), "r");
+      try { fsyncSync(directory); } finally { closeSync(directory); }
+    }
   } catch (error) {
     // Preserve the original storage failure even if cleanup also fails.
     try { unlinkSync(temporary); } catch { /* A renamed file is already gone. */ }