Merge branch 'main' into codex/viyatb/trusted-project-config-gating

2026-11-09 20:50:33 +00:00 · 2026-04-10 23:02:34 -07:00
parent b2f0342a94 a9796e39c4
commit a0bb3073b7
187 changed files with 2813 additions and 491 deletions
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+
+"""Verify codex-tui does not depend on or import codex-core directly."""
+
+from __future__ import annotations
+
+import re
+import sys
+import tomllib
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+TUI_ROOT = ROOT / "codex-rs" / "tui"
+TUI_MANIFEST = TUI_ROOT / "Cargo.toml"
+FORBIDDEN_PACKAGE = "codex-core"
+FORBIDDEN_SOURCE_PATTERNS = (
+    re.compile(r"\bcodex_core::"),
+    re.compile(r"\buse\s+codex_core\b"),
+    re.compile(r"\bextern\s+crate\s+codex_core\b"),
+)
+
+
+def main() -> int:
+    failures = []
+    failures.extend(manifest_failures())
+    failures.extend(source_failures())
+
+    if not failures:
+        return 0
+
+    print("codex-tui must not depend on or import codex-core directly.")
+    print(
+        "Use the app-server protocol/client boundary instead; temporary embedded "
+        "startup gaps belong behind codex_app_server_client::legacy_core."
+    )
+    print()
+    for failure in failures:
+        print(f"- {failure}")
+
+    return 1
+
+
+def manifest_failures() -> list[str]:
+    manifest = tomllib.loads(TUI_MANIFEST.read_text())
+    failures = []
+    for section_name, dependencies in dependency_sections(manifest):
+        if FORBIDDEN_PACKAGE in dependencies:
+            failures.append(
+                f"{relative_path(TUI_MANIFEST)} declares `{FORBIDDEN_PACKAGE}` "
+                f"in `[{section_name}]`"
+            )
+    return failures
+
+
+def dependency_sections(manifest: dict) -> list[tuple[str, dict]]:
+    sections: list[tuple[str, dict]] = []
+    for section_name in ("dependencies", "dev-dependencies", "build-dependencies"):
+        dependencies = manifest.get(section_name)
+        if isinstance(dependencies, dict):
+            sections.append((section_name, dependencies))
+
+    for target_name, target in manifest.get("target", {}).items():
+        if not isinstance(target, dict):
+            continue
+        for section_name in ("dependencies", "dev-dependencies", "build-dependencies"):
+            dependencies = target.get(section_name)
+            if isinstance(dependencies, dict):
+                sections.append((f'target.{target_name}.{section_name}', dependencies))
+
+    return sections
+
+
+def source_failures() -> list[str]:
+    failures = []
+    for path in sorted(TUI_ROOT.glob("**/*.rs")):
+        text = path.read_text()
+        for line_number, line in enumerate(text.splitlines(), start=1):
+            if any(pattern.search(line) for pattern in FORBIDDEN_SOURCE_PATTERNS):
+                failures.append(f"{relative_path(path)}:{line_number} imports `codex_core`")
+    return failures
+
+
+def relative_path(path: Path) -> str:
+    return str(path.relative_to(ROOT))
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -17,6 +17,9 @@ jobs:
      - name: Verify codex-rs Cargo manifests inherit workspace settings
        run: python3 .github/scripts/verify_cargo_workspace_manifests.py

+      - name: Verify codex-tui does not import codex-core directly
+        run: python3 .github/scripts/verify_tui_core_boundary.py
+
      - name: Verify Bazel clippy flags match Cargo workspace lints
        run: python3 .github/scripts/verify_bazel_clippy_lints.py

@@ -2845,7 +2845,6 @@ dependencies = [
 "codex-cli",
 "codex-cloud-requirements",
 "codex-config",
- "codex-core",
 "codex-exec-server",
 "codex-features",
 "codex-feedback",
@@ -56,6 +56,90 @@ use tracing::warn;
 pub use crate::remote::RemoteAppServerClient;
 pub use crate::remote::RemoteAppServerConnectArgs;

+/// Transitional access to core-only embedded app-server types.
+///
+/// New TUI behavior should prefer the app-server protocol methods. This
+/// module exists so clients can remove a direct `codex-core` dependency
+/// while legacy startup/config paths are migrated to RPCs.
+pub mod legacy_core {
+    pub use codex_core::Cursor;
+    pub use codex_core::DEFAULT_PROJECT_DOC_FILENAME;
+    pub use codex_core::INTERACTIVE_SESSION_SOURCES;
+    pub use codex_core::LOCAL_PROJECT_DOC_FILENAME;
+    pub use codex_core::McpManager;
+    pub use codex_core::PLUGIN_TEXT_MENTION_SIGIL;
+    pub use codex_core::RolloutRecorder;
+    pub use codex_core::TOOL_MENTION_SIGIL;
+    pub use codex_core::ThreadItem;
+    pub use codex_core::ThreadSortKey;
+    pub use codex_core::ThreadsPage;
+    pub use codex_core::append_message_history_entry;
+    pub use codex_core::check_execpolicy_for_warnings;
+    pub use codex_core::discover_project_doc_paths;
+    pub use codex_core::find_thread_meta_by_name_str;
+    pub use codex_core::find_thread_name_by_id;
+    pub use codex_core::find_thread_names_by_ids;
+    pub use codex_core::format_exec_policy_error_with_source;
+    pub use codex_core::grant_read_root_non_elevated;
+    pub use codex_core::lookup_message_history_entry;
+    pub use codex_core::message_history_metadata;
+    pub use codex_core::path_utils;
+    pub use codex_core::read_session_meta_line;
+    pub use codex_core::web_search_detail;
+
+    pub mod config {
+        pub use codex_core::config::*;
+
+        pub mod edit {
+            pub use codex_core::config::edit::*;
+        }
+    }
+
+    pub mod config_loader {
+        pub use codex_core::config_loader::*;
+    }
+
+    pub mod connectors {
+        pub use codex_core::connectors::*;
+    }
+
+    pub mod otel_init {
+        pub use codex_core::otel_init::*;
+    }
+
+    pub mod personality_migration {
+        pub use codex_core::personality_migration::*;
+    }
+
+    pub mod plugins {
+        pub use codex_core::plugins::*;
+    }
+
+    pub mod review_format {
+        pub use codex_core::review_format::*;
+    }
+
+    pub mod review_prompts {
+        pub use codex_core::review_prompts::*;
+    }
+
+    pub mod skills {
+        pub use codex_core::skills::*;
+    }
+
+    pub mod test_support {
+        pub use codex_core::test_support::*;
+    }
+
+    pub mod util {
+        pub use codex_core::util::*;
+    }
+
+    pub mod windows_sandbox {
+        pub use codex_core::windows_sandbox::*;
+    }
+}
+
 const SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(5);

 /// Raw app-server request result for typed in-process requests.
@@ -94,6 +94,13 @@
          ],
          "type": "string"
        },
+        {
+          "description": "Automatic approval review timed out before reaching a decision.",
+          "enum": [
+            "timed_out"
+          ],
+          "type": "string"
+        },
        {
          "description": "User has denied this command and the agent should not do anything until the user's next command.",
          "enum": [
@@ -1277,6 +1277,27 @@
      ],
      "type": "string"
    },
+    "McpServerToolCallParams": {
+      "properties": {
+        "_meta": true,
+        "arguments": true,
+        "server": {
+          "type": "string"
+        },
+        "threadId": {
+          "type": "string"
+        },
+        "tool": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "server",
+        "threadId",
+        "tool"
+      ],
+      "type": "object"
+    },
    "MergeStrategy": {
      "enum": [
        "replace",
@@ -4569,6 +4590,30 @@
      "title": "McpServer/resource/readRequest",
      "type": "object"
    },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "mcpServer/tool/call"
+          ],
+          "title": "McpServer/tool/callRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/McpServerToolCallParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "McpServer/tool/callRequest",
+      "type": "object"
+    },
    {
      "properties": {
        "id": {
@@ -94,6 +94,13 @@
          ],
          "type": "string"
        },
+        {
+          "description": "Automatic approval review timed out before reaching a decision.",
+          "enum": [
+            "timed_out"
+          ],
+          "type": "string"
+        },
        {
          "description": "User has denied this command and the agent should not do anything until the user's next command.",
          "enum": [
@@ -1348,6 +1348,7 @@
        "inProgress",
        "approved",
        "denied",
+        "timedOut",
        "aborted"
      ],
      "type": "string"
@@ -1225,6 +1225,30 @@
          "title": "McpServer/resource/readRequest",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "mcpServer/tool/call"
+              ],
+              "title": "McpServer/tool/callRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/McpServerToolCallParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "McpServer/tool/callRequest",
+          "type": "object"
+        },
        {
          "properties": {
            "id": {
@@ -3398,6 +3422,13 @@
          ],
          "type": "string"
        },
+        {
+          "description": "Automatic approval review timed out before reaching a decision.",
+          "enum": [
+            "timed_out"
+          ],
+          "type": "string"
+        },
        {
          "description": "User has denied this command and the agent should not do anything until the user's next command.",
          "enum": [
@@ -8297,6 +8328,7 @@
          "inProgress",
          "approved",
          "denied",
+          "timedOut",
          "aborted"
        ],
        "type": "string"
@@ -9206,6 +9238,51 @@
        "title": "McpServerStatusUpdatedNotification",
        "type": "object"
      },
+      "McpServerToolCallParams": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "_meta": true,
+          "arguments": true,
+          "server": {
+            "type": "string"
+          },
+          "threadId": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "server",
+          "threadId",
+          "tool"
+        ],
+        "title": "McpServerToolCallParams",
+        "type": "object"
+      },
+      "McpServerToolCallResponse": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "_meta": true,
+          "content": {
+            "items": true,
+            "type": "array"
+          },
+          "isError": {
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "structuredContent": true
+        },
+        "required": [
+          "content"
+        ],
+        "title": "McpServerToolCallResponse",
+        "type": "object"
+      },
      "McpToolCallError": {
        "properties": {
          "message": {
@@ -1807,6 +1807,30 @@
          "title": "McpServer/resource/readRequest",
          "type": "object"
        },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/RequestId"
+            },
+            "method": {
+              "enum": [
+                "mcpServer/tool/call"
+              ],
+              "title": "McpServer/tool/callRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/McpServerToolCallParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "McpServer/tool/callRequest",
+          "type": "object"
+        },
        {
          "properties": {
            "id": {
@@ -5056,6 +5080,7 @@
        "inProgress",
        "approved",
        "denied",
+        "timedOut",
        "aborted"
      ],
      "type": "string"
@@ -6009,6 +6034,51 @@
      "title": "McpServerStatusUpdatedNotification",
      "type": "object"
    },
+    "McpServerToolCallParams": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "_meta": true,
+        "arguments": true,
+        "server": {
+          "type": "string"
+        },
+        "threadId": {
+          "type": "string"
+        },
+        "tool": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "server",
+        "threadId",
+        "tool"
+      ],
+      "title": "McpServerToolCallParams",
+      "type": "object"
+    },
+    "McpServerToolCallResponse": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "_meta": true,
+        "content": {
+          "items": true,
+          "type": "array"
+        },
+        "isError": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "structuredContent": true
+      },
+      "required": [
+        "content"
+      ],
+      "title": "McpServerToolCallResponse",
+      "type": "object"
+    },
    "McpToolCallError": {
      "properties": {
        "message": {
@@ -222,6 +222,7 @@
        "inProgress",
        "approved",
        "denied",
+        "timedOut",
        "aborted"
      ],
      "type": "string"
@@ -215,6 +215,7 @@
        "inProgress",
        "approved",
        "denied",
+        "timedOut",
        "aborted"
      ],
      "type": "string"
@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "_meta": true,
+    "arguments": true,
+    "server": {
+      "type": "string"
+    },
+    "threadId": {
+      "type": "string"
+    },
+    "tool": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "server",
+    "threadId",
+    "tool"
+  ],
+  "title": "McpServerToolCallParams",
+  "type": "object"
+}
@@ -0,0 +1,22 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "properties": {
+    "_meta": true,
+    "content": {
+      "items": true,
+      "type": "array"
+    },
+    "isError": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "structuredContent": true
+  },
+  "required": [
+    "content"
+  ],
+  "title": "McpServerToolCallResponse",
+  "type": "object"
+}
@@ -4,16 +4,16 @@
 import type { FileChange } from "./FileChange";
 import type { ThreadId } from "./ThreadId";

-export type ApplyPatchApprovalParams = { conversationId: ThreadId, 
+export type ApplyPatchApprovalParams = { conversationId: ThreadId,
 /**
 * Use to correlate this with [codex_protocol::protocol::PatchApplyBeginEvent]
 * and [codex_protocol::protocol::PatchApplyEndEvent].
 */
-callId: string, fileChanges: { [key in string]?: FileChange }, 
+callId: string, fileChanges: { [key in string]?: FileChange },
 /**
 * Optional explanatory reason (e.g. request for extra write access).
 */
-reason: string | null, 
+reason: string | null,
 /**
 * When set, the agent is asking the user to allow writes under this root
 * for the remainder of the session (unclear if this is honored today).
@@ -4,12 +4,12 @@
 import type { ParsedCommand } from "./ParsedCommand";
 import type { ThreadId } from "./ThreadId";

-export type ExecCommandApprovalParams = { conversationId: ThreadId, 
+export type ExecCommandApprovalParams = { conversationId: ThreadId,
 /**
 * Use to correlate this with [codex_protocol::protocol::ExecCommandBeginEvent]
 * and [codex_protocol::protocol::ExecCommandEndEvent].
 */
-callId: string, 
+callId: string,
 /**
 * Identifier for this specific approval callback.
 */
@@ -5,11 +5,11 @@
 /**
 * Client-declared capabilities negotiated during initialize.
 */
-export type InitializeCapabilities = { 
+export type InitializeCapabilities = {
 /**
 * Opt into receiving experimental API methods and fields.
 */
-experimentalApi: boolean, 
+experimentalApi: boolean,
 /**
 * Exact notification method names that should be suppressed for this
 * connection (for example `thread/started`).
@@ -3,16 +3,16 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "./AbsolutePathBuf";

-export type InitializeResponse = { userAgent: string, 
+export type InitializeResponse = { userAgent: string,
 /**
 * Absolute path to the server's $CODEX_HOME directory.
 */
-codexHome: AbsolutePathBuf, 
+codexHome: AbsolutePathBuf,
 /**
 * Platform family for the running app-server target, for example
 * `"unix"` or `"windows"`.
 */
-platformFamily: string, 
+platformFamily: string,
 /**
 * Operating system for the running app-server target, for example
 * `"macos"`, `"linux"`, or `"windows"`.
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ParsedCommand = { "type": "read", cmd: string, name: string, 
+export type ParsedCommand = { "type": "read", cmd: string, name: string,
 /**
 * (Best effort) Path to the file being read by the command. When
 * possible, this is an absolute path, though when relative, it should
@@ -6,11 +6,11 @@ import type { JsonValue } from "./serde_json/JsonValue";
 /**
 * Contents returned when reading a resource from an MCP server.
 */
-export type ResourceContent = { 
+export type ResourceContent = {
 /**
 * The URI of this resource.
 */
-uri: string, mimeType?: string, text: string, _meta?: JsonValue, } | { 
+uri: string, mimeType?: string, text: string, _meta?: JsonValue, } | {
 /**
 * The URI of this resource.
 */
@@ -11,7 +11,7 @@ import type { ReasoningItemContent } from "./ReasoningItemContent";
 import type { ReasoningItemReasoningSummary } from "./ReasoningItemReasoningSummary";
 import type { WebSearchAction } from "./WebSearchAction";

-export type ResponseItem = { "type": "message", role: string, content: Array<ContentItem>, end_turn?: boolean, phase?: MessagePhase, } | { "type": "reasoning", summary: Array<ReasoningItemReasoningSummary>, content?: Array<ReasoningItemContent>, encrypted_content: string | null, } | { "type": "local_shell_call", 
+export type ResponseItem = { "type": "message", role: string, content: Array<ContentItem>, end_turn?: boolean, phase?: MessagePhase, } | { "type": "reasoning", summary: Array<ReasoningItemReasoningSummary>, content?: Array<ReasoningItemContent>, encrypted_content: string | null, } | { "type": "local_shell_call",
 /**
 * Set when using the Responses API.
 */
@@ -7,4 +7,4 @@ import type { NetworkPolicyAmendment } from "./NetworkPolicyAmendment";
 /**
 * User's decision in response to an ExecApprovalRequest.
 */
-export type ReviewDecision = "approved" | { "approved_execpolicy_amendment": { proposed_execpolicy_amendment: ExecPolicyAmendment, } } | "approved_for_session" | { "network_policy_amendment": { network_policy_amendment: NetworkPolicyAmendment, } } | "denied" | "abort";
+export type ReviewDecision = "approved" | { "approved_execpolicy_amendment": { proposed_execpolicy_amendment: ExecPolicyAmendment, } } | "approved_for_session" | { "network_policy_amendment": { network_policy_amendment: NetworkPolicyAmendment, } } | "denied" | "timed_out" | "abort";
@@ -7,7 +7,7 @@ import type { AppMetadata } from "./AppMetadata";
 /**
 * EXPERIMENTAL - app metadata returned by app-list APIs.
 */
-export type AppInfo = { id: string, name: string, description: string | null, logoUrl: string | null, logoUrlDark: string | null, distributionChannel: string | null, branding: AppBranding | null, appMetadata: AppMetadata | null, labels: { [key in string]?: string } | null, installUrl: string | null, isAccessible: boolean, 
+export type AppInfo = { id: string, name: string, description: string | null, logoUrl: string | null, logoUrlDark: string | null, distributionChannel: string | null, branding: AppBranding | null, appMetadata: AppMetadata | null, labels: { [key in string]?: string } | null, installUrl: string | null, isAccessible: boolean,
 /**
 * Whether this app is enabled in config.toml.
 * Example:
@@ -5,19 +5,19 @@
 /**
 * EXPERIMENTAL - list available apps/connectors.
 */
-export type AppsListParams = { 
+export type AppsListParams = {
 /**
 * Opaque pagination cursor returned by a previous call.
 */
-cursor?: string | null, 
+cursor?: string | null,
 /**
 * Optional page size; defaults to a reasonable server-side value.
 */
-limit?: number | null, 
+limit?: number | null,
 /**
 * Optional thread id used to evaluate app feature gating from that thread's config.
 */
-threadId?: string | null, 
+threadId?: string | null,
 /**
 * When true, bypass app caches and fetch the latest data from sources.
 */
@@ -6,7 +6,7 @@ import type { AppInfo } from "./AppInfo";
 /**
 * EXPERIMENTAL - app list response.
 */
-export type AppsListResponse = { data: Array<AppInfo>, 
+export type AppsListResponse = { data: Array<AppInfo>,
 /**
 * Opaque cursor to pass to the next call to continue after the last item.
 * If None, there are no more items to return.
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ChatgptAuthTokensRefreshReason } from "./ChatgptAuthTokensRefreshReason";

-export type ChatgptAuthTokensRefreshParams = { reason: ChatgptAuthTokensRefreshReason, 
+export type ChatgptAuthTokensRefreshParams = { reason: ChatgptAuthTokensRefreshReason,
 /**
 * Workspace/account identifier that Codex was previously using.
 *
@@ -9,20 +9,20 @@ import type { CommandExecOutputStream } from "./CommandExecOutputStream";
 * These notifications are connection-scoped. If the originating connection
 * closes, the server terminates the process.
 */
-export type CommandExecOutputDeltaNotification = { 
+export type CommandExecOutputDeltaNotification = {
 /**
 * Client-supplied, connection-scoped `processId` from the original
 * `command/exec` request.
 */
-processId: string, 
+processId: string,
 /**
 * Output stream for this chunk.
 */
-stream: CommandExecOutputStream, 
+stream: CommandExecOutputStream,
 /**
 * Base64-encoded output bytes.
 */
-deltaBase64: string, 
+deltaBase64: string,
 /**
 * `true` on the final streamed chunk for a stream when `outputBytesCap`
 * truncated later output on that stream.
@@ -12,11 +12,11 @@ import type { SandboxPolicy } from "./SandboxPolicy";
 * sent only after all `command/exec/outputDelta` notifications for that
 * connection have been emitted.
 */
-export type CommandExecParams = { 
+export type CommandExecParams = {
 /**
 * Command argv vector. Empty arrays are rejected.
 */
-command: Array<string>, 
+command: Array<string>,
 /**
 * Optional client-supplied, connection-scoped process id.
 *
@@ -25,56 +25,56 @@ command: Array<string>,
 * `command/exec/terminate` calls. When omitted, buffered execution gets an
 * internal id that is not exposed to the client.
 */
-processId?: string | null, 
+processId?: string | null,
 /**
 * Enable PTY mode.
 *
 * This implies `streamStdin` and `streamStdoutStderr`.
 */
-tty?: boolean, 
+tty?: boolean,
 /**
 * Allow follow-up `command/exec/write` requests to write stdin bytes.
 *
 * Requires a client-supplied `processId`.
 */
-streamStdin?: boolean, 
+streamStdin?: boolean,
 /**
 * Stream stdout/stderr via `command/exec/outputDelta` notifications.
 *
 * Streamed bytes are not duplicated into the final response and require a
 * client-supplied `processId`.
 */
-streamStdoutStderr?: boolean, 
+streamStdoutStderr?: boolean,
 /**
 * Optional per-stream stdout/stderr capture cap in bytes.
 *
 * When omitted, the server default applies. Cannot be combined with
 * `disableOutputCap`.
 */
-outputBytesCap?: number | null, 
+outputBytesCap?: number | null,
 /**
 * Disable stdout/stderr capture truncation for this request.
 *
 * Cannot be combined with `outputBytesCap`.
 */
-disableOutputCap?: boolean, 
+disableOutputCap?: boolean,
 /**
 * Disable the timeout entirely for this request.
 *
 * Cannot be combined with `timeoutMs`.
 */
-disableTimeout?: boolean, 
+disableTimeout?: boolean,
 /**
 * Optional timeout in milliseconds.
 *
 * When omitted, the server default applies. Cannot be combined with
 * `disableTimeout`.
 */
-timeoutMs?: number | null, 
+timeoutMs?: number | null,
 /**
 * Optional working directory. Defaults to the server cwd.
 */
-cwd?: string | null, 
+cwd?: string | null,
 /**
 * Optional environment overrides merged into the server-computed
 * environment.
@@ -82,12 +82,12 @@ cwd?: string | null,
 * Matching names override inherited values. Set a key to `null` to unset
 * an inherited variable.
 */
-env?: { [key in string]?: string | null } | null, 
+env?: { [key in string]?: string | null } | null,
 /**
 * Optional initial PTY size in character cells. Only valid when `tty` is
 * true.
 */
-size?: CommandExecTerminalSize | null, 
+size?: CommandExecTerminalSize | null,
 /**
 * Optional sandbox policy for this command.
 *
@@ -6,12 +6,12 @@ import type { CommandExecTerminalSize } from "./CommandExecTerminalSize";
 /**
 * Resize a running PTY-backed `command/exec` session.
 */
-export type CommandExecResizeParams = { 
+export type CommandExecResizeParams = {
 /**
 * Client-supplied, connection-scoped `processId` from the original
 * `command/exec` request.
 */
-processId: string, 
+processId: string,
 /**
 * New PTY size in character cells.
 */
@@ -5,17 +5,17 @@
 /**
 * Final buffered result for `command/exec`.
 */
-export type CommandExecResponse = { 
+export type CommandExecResponse = {
 /**
 * Process exit code.
 */
-exitCode: number, 
+exitCode: number,
 /**
 * Buffered stdout capture.
 *
 * Empty when stdout was streamed via `command/exec/outputDelta`.
 */
-stdout: string, 
+stdout: string,
 /**
 * Buffered stderr capture.
 *
@@ -5,11 +5,11 @@
 /**
 * PTY size in character cells for `command/exec` PTY sessions.
 */
-export type CommandExecTerminalSize = { 
+export type CommandExecTerminalSize = {
 /**
 * Terminal height in character cells.
 */
-rows: number, 
+rows: number,
 /**
 * Terminal width in character cells.
 */
@@ -5,7 +5,7 @@
 /**
 * Terminate a running `command/exec` session.
 */
-export type CommandExecTerminateParams = { 
+export type CommandExecTerminateParams = {
 /**
 * Client-supplied, connection-scoped `processId` from the original
 * `command/exec` request.
@@ -6,16 +6,16 @@
 * Write stdin bytes to a running `command/exec` session, close stdin, or
 * both.
 */
-export type CommandExecWriteParams = { 
+export type CommandExecWriteParams = {
 /**
 * Client-supplied, connection-scoped `processId` from the original
 * `command/exec` request.
 */
-processId: string, 
+processId: string,
 /**
 * Optional base64-encoded stdin bytes to write.
 */
-deltaBase64?: string | null, 
+deltaBase64?: string | null,
 /**
 * Close stdin after writing `deltaBase64`, if present.
 */
@@ -8,7 +8,7 @@ import type { ExecPolicyAmendment } from "./ExecPolicyAmendment";
 import type { NetworkApprovalContext } from "./NetworkApprovalContext";
 import type { NetworkPolicyAmendment } from "./NetworkPolicyAmendment";

-export type CommandExecutionRequestApprovalParams = { threadId: string, turnId: string, itemId: string, 
+export type CommandExecutionRequestApprovalParams = { threadId: string, turnId: string, itemId: string,
 /**
 * Unique identifier for this specific approval callback.
 *
@@ -18,39 +18,39 @@ export type CommandExecutionRequestApprovalParams = { threadId: string, turnId:
 * one parent `itemId`, so `approvalId` is a distinct opaque callback id
 * (a UUID) used to disambiguate routing.
 */
-approvalId?: string | null, 
+approvalId?: string | null,
 /**
 * Optional explanatory reason (e.g. request for network access).
 */
-reason?: string | null, 
+reason?: string | null,
 /**
 * Optional context for a managed-network approval prompt.
 */
-networkApprovalContext?: NetworkApprovalContext | null, 
+networkApprovalContext?: NetworkApprovalContext | null,
 /**
 * The command to be executed.
 */
-command?: string | null, 
+command?: string | null,
 /**
 * The command's working directory.
 */
-cwd?: string | null, 
+cwd?: string | null,
 /**
 * Best-effort parsed command actions for friendly display.
 */
-commandActions?: Array<CommandAction> | null, 
+commandActions?: Array<CommandAction> | null,
 /**
 * Optional additional permissions requested for this command.
 */
-additionalPermissions?: AdditionalPermissionProfile | null, 
+additionalPermissions?: AdditionalPermissionProfile | null,
 /**
 * Optional proposed execpolicy amendment to allow similar commands without prompting.
 */
-proposedExecpolicyAmendment?: ExecPolicyAmendment | null, 
+proposedExecpolicyAmendment?: ExecPolicyAmendment | null,
 /**
 * Optional proposed network policy amendments (allow/deny host) for future requests.
 */
-proposedNetworkPolicyAmendments?: Array<NetworkPolicyAmendment> | null, 
+proposedNetworkPolicyAmendments?: Array<NetworkPolicyAmendment> | null,
 /**
 * Ordered list of decisions the client may present for this prompt.
 */
@@ -3,11 +3,11 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ConfigEdit } from "./ConfigEdit";

-export type ConfigBatchWriteParams = { edits: Array<ConfigEdit>, 
+export type ConfigBatchWriteParams = { edits: Array<ConfigEdit>,
 /**
 * Path to the config file to write; defaults to the user's `config.toml` when omitted.
 */
-filePath?: string | null, expectedVersion?: string | null, 
+filePath?: string | null, expectedVersion?: string | null,
 /**
 * When true, hot-reload the updated user config into all loaded threads after writing.
 */
@@ -3,12 +3,12 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "../AbsolutePathBuf";

-export type ConfigLayerSource = { "type": "mdm", domain: string, key: string, } | { "type": "system", 
+export type ConfigLayerSource = { "type": "mdm", domain: string, key: string, } | { "type": "system",
 /**
 * This is the path to the system config.toml file, though it is not
 * guaranteed to exist.
 */
-file: AbsolutePathBuf, } | { "type": "user", 
+file: AbsolutePathBuf, } | { "type": "user",
 /**
 * This is the path to the user's config.toml file, though it is not
 * guaranteed to exist.
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ConfigReadParams = { includeLayers: boolean, 
+export type ConfigReadParams = { includeLayers: boolean,
 /**
 * Optional working directory to resolve project config layers. If specified,
 * return the effective config as seen from that directory (i.e., including any
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ConfigRequirements } from "./ConfigRequirements";

-export type ConfigRequirementsReadResponse = { 
+export type ConfigRequirementsReadResponse = {
 /**
 * Null if no requirements are configured (e.g. no requirements.toml/MDM entries).
 */
@@ -4,7 +4,7 @@
 import type { JsonValue } from "../serde_json/JsonValue";
 import type { MergeStrategy } from "./MergeStrategy";

-export type ConfigValueWriteParams = { keyPath: string, value: JsonValue, mergeStrategy: MergeStrategy, 
+export type ConfigValueWriteParams = { keyPath: string, value: JsonValue, mergeStrategy: MergeStrategy,
 /**
 * Path to the config file to write; defaults to the user's `config.toml` when omitted.
 */
@@ -3,19 +3,19 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { TextRange } from "./TextRange";

-export type ConfigWarningNotification = { 
+export type ConfigWarningNotification = {
 /**
 * Concise summary of the warning.
 */
-summary: string, 
+summary: string,
 /**
 * Optional extra guidance or error details.
 */
-details: string | null, 
+details: string | null,
 /**
 * Optional path to the config file that triggered the warning.
 */
-path?: string, 
+path?: string,
 /**
 * Optional range for the error location inside the config file.
 */
@@ -5,7 +5,7 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 import type { OverriddenMetadata } from "./OverriddenMetadata";
 import type { WriteStatus } from "./WriteStatus";

-export type ConfigWriteResponse = { status: WriteStatus, version: string, 
+export type ConfigWriteResponse = { status: WriteStatus, version: string,
 /**
 * Canonical path to the config file that was written.
 */
@@ -2,11 +2,11 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type DeprecationNoticeNotification = { 
+export type DeprecationNoticeNotification = {
 /**
 * Concise summary of what is deprecated.
 */
-summary: string, 
+summary: string,
 /**
 * Optional extra guidance, such as migration steps or rationale.
 */
@@ -3,34 +3,34 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ExperimentalFeatureStage } from "./ExperimentalFeatureStage";

-export type ExperimentalFeature = { 
+export type ExperimentalFeature = {
 /**
 * Stable key used in config.toml and CLI flag toggles.
 */
-name: string, 
+name: string,
 /**
 * Lifecycle stage of this feature flag.
 */
-stage: ExperimentalFeatureStage, 
+stage: ExperimentalFeatureStage,
 /**
 * User-facing display name shown in the experimental features UI.
 * Null when this feature is not in beta.
 */
-displayName: string | null, 
+displayName: string | null,
 /**
 * Short summary describing what the feature does.
 * Null when this feature is not in beta.
 */
-description: string | null, 
+description: string | null,
 /**
 * Announcement copy shown to users when the feature is introduced.
 * Null when this feature is not in beta.
 */
-announcement: string | null, 
+announcement: string | null,
 /**
 * Whether this feature is currently enabled in the loaded config.
 */
-enabled: boolean, 
+enabled: boolean,
 /**
 * Whether this feature is enabled by default.
 */
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ExperimentalFeatureEnablementSetParams = { 
+export type ExperimentalFeatureEnablementSetParams = {
 /**
 * Process-wide runtime feature enablement keyed by canonical feature name.
 *
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ExperimentalFeatureEnablementSetResponse = { 
+export type ExperimentalFeatureEnablementSetResponse = {
 /**
 * Feature enablement entries updated by this request.
 */
@@ -2,11 +2,11 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ExperimentalFeatureListParams = { 
+export type ExperimentalFeatureListParams = {
 /**
 * Opaque pagination cursor returned by a previous call.
 */
-cursor?: string | null, 
+cursor?: string | null,
 /**
 * Optional page size; defaults to a reasonable server-side value.
 */
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ExperimentalFeature } from "./ExperimentalFeature";

-export type ExperimentalFeatureListResponse = { data: Array<ExperimentalFeature>, 
+export type ExperimentalFeatureListResponse = { data: Array<ExperimentalFeature>,
 /**
 * Opaque cursor to pass to the next call to continue after the last item.
 * If None, there are no more items to return.
@@ -2,11 +2,11 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ExternalAgentConfigDetectParams = { 
+export type ExternalAgentConfigDetectParams = {
 /**
 * If true, include detection under the user's home (~/.claude, ~/.codex, etc.).
 */
-includeHome?: boolean, 
+includeHome?: boolean,
 /**
 * Zero or more working directories to include for repo-scoped detection.
 */
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ExternalAgentConfigMigrationItemType } from "./ExternalAgentConfigMigrationItemType";

-export type ExternalAgentConfigMigrationItem = { itemType: ExternalAgentConfigMigrationItemType, description: string, 
+export type ExternalAgentConfigMigrationItem = { itemType: ExternalAgentConfigMigrationItemType, description: string,
 /**
 * Null or empty means home-scoped migration; non-empty means repo-scoped migration.
 */
@@ -2,11 +2,11 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type FileChangeRequestApprovalParams = { threadId: string, turnId: string, itemId: string, 
+export type FileChangeRequestApprovalParams = { threadId: string, turnId: string, itemId: string,
 /**
 * Optional explanatory reason (e.g. request for extra write access).
 */
-reason?: string | null, 
+reason?: string | null,
 /**
 * [UNSTABLE] When set, the agent is asking the user to allow writes under this root
 * for the remainder of the session (unclear if this is honored today).
@@ -6,11 +6,11 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Filesystem watch notification emitted for `fs/watch` subscribers.
 */
-export type FsChangedNotification = { 
+export type FsChangedNotification = {
 /**
 * Watch identifier previously provided to `fs/watch`.
 */
-watchId: string, 
+watchId: string,
 /**
 * File or directory paths associated with this event.
 */
@@ -6,15 +6,15 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Copy a file or directory tree on the host filesystem.
 */
-export type FsCopyParams = { 
+export type FsCopyParams = {
 /**
 * Absolute source path.
 */
-sourcePath: AbsolutePathBuf, 
+sourcePath: AbsolutePathBuf,
 /**
 * Absolute destination path.
 */
-destinationPath: AbsolutePathBuf, 
+destinationPath: AbsolutePathBuf,
 /**
 * Required for directory copies; ignored for file copies.
 */
@@ -6,11 +6,11 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Create a directory on the host filesystem.
 */
-export type FsCreateDirectoryParams = { 
+export type FsCreateDirectoryParams = {
 /**
 * Absolute directory path to create.
 */
-path: AbsolutePathBuf, 
+path: AbsolutePathBuf,
 /**
 * Whether parent directories should also be created. Defaults to `true`.
 */
@@ -6,7 +6,7 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Request metadata for an absolute path.
 */
-export type FsGetMetadataParams = { 
+export type FsGetMetadataParams = {
 /**
 * Absolute path to inspect.
 */
@@ -5,19 +5,19 @@
 /**
 * Metadata returned by `fs/getMetadata`.
 */
-export type FsGetMetadataResponse = { 
+export type FsGetMetadataResponse = {
 /**
 * Whether the path currently resolves to a directory.
 */
-isDirectory: boolean, 
+isDirectory: boolean,
 /**
 * Whether the path currently resolves to a regular file.
 */
-isFile: boolean, 
+isFile: boolean,
 /**
 * File creation time in Unix milliseconds when available, otherwise `0`.
 */
-createdAtMs: number, 
+createdAtMs: number,
 /**
 * File modification time in Unix milliseconds when available, otherwise `0`.
 */
@@ -5,15 +5,15 @@
 /**
 * A directory entry returned by `fs/readDirectory`.
 */
-export type FsReadDirectoryEntry = { 
+export type FsReadDirectoryEntry = {
 /**
 * Direct child entry name only, not an absolute or relative path.
 */
-fileName: string, 
+fileName: string,
 /**
 * Whether this entry resolves to a directory.
 */
-isDirectory: boolean, 
+isDirectory: boolean,
 /**
 * Whether this entry resolves to a regular file.
 */
@@ -6,7 +6,7 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * List direct child names for a directory.
 */
-export type FsReadDirectoryParams = { 
+export type FsReadDirectoryParams = {
 /**
 * Absolute directory path to read.
 */
@@ -6,7 +6,7 @@ import type { FsReadDirectoryEntry } from "./FsReadDirectoryEntry";
 /**
 * Directory entries returned by `fs/readDirectory`.
 */
-export type FsReadDirectoryResponse = { 
+export type FsReadDirectoryResponse = {
 /**
 * Direct child entries in the requested directory.
 */
@@ -6,7 +6,7 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Read a file from the host filesystem.
 */
-export type FsReadFileParams = { 
+export type FsReadFileParams = {
 /**
 * Absolute path to read.
 */
@@ -5,7 +5,7 @@
 /**
 * Base64-encoded file contents returned by `fs/readFile`.
 */
-export type FsReadFileResponse = { 
+export type FsReadFileResponse = {
 /**
 * File contents encoded as base64.
 */
@@ -6,15 +6,15 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Remove a file or directory tree from the host filesystem.
 */
-export type FsRemoveParams = { 
+export type FsRemoveParams = {
 /**
 * Absolute path to remove.
 */
-path: AbsolutePathBuf, 
+path: AbsolutePathBuf,
 /**
 * Whether directory removal should recurse. Defaults to `true`.
 */
-recursive?: boolean | null, 
+recursive?: boolean | null,
 /**
 * Whether missing paths should be ignored. Defaults to `true`.
 */
@@ -5,7 +5,7 @@
 /**
 * Stop filesystem watch notifications for a prior `fs/watch`.
 */
-export type FsUnwatchParams = { 
+export type FsUnwatchParams = {
 /**
 * Watch identifier previously provided to `fs/watch`.
 */
@@ -6,11 +6,11 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Start filesystem watch notifications for an absolute path.
 */
-export type FsWatchParams = { 
+export type FsWatchParams = {
 /**
 * Connection-scoped watch identifier used for `fs/unwatch` and `fs/changed`.
 */
-watchId: string, 
+watchId: string,
 /**
 * Absolute file or directory path to watch.
 */
@@ -6,7 +6,7 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Successful response for `fs/watch`.
 */
-export type FsWatchResponse = { 
+export type FsWatchResponse = {
 /**
 * Canonicalized path associated with the watch.
 */
@@ -6,11 +6,11 @@ import type { AbsolutePathBuf } from "../AbsolutePathBuf";
 /**
 * Write a file on the host filesystem.
 */
-export type FsWriteFileParams = { 
+export type FsWriteFileParams = {
 /**
 * Absolute path to write.
 */
-path: AbsolutePathBuf, 
+path: AbsolutePathBuf,
 /**
 * File contents encoded as base64.
 */
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type GetAccountParams = { 
+export type GetAccountParams = {
 /**
 * When `true`, requests a proactive token refresh before returning.
 *
@@ -3,11 +3,11 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { RateLimitSnapshot } from "./RateLimitSnapshot";

-export type GetAccountRateLimitsResponse = { 
+export type GetAccountRateLimitsResponse = {
 /**
 * Backward-compatible single-bucket view; mirrors the historical payload.
 */
-rateLimits: RateLimitSnapshot, 
+rateLimits: RateLimitSnapshot,
 /**
 * Multi-bucket view keyed by metered `limit_id` (for example, `codex`).
 */
@@ -5,4 +5,4 @@
 /**
 * [UNSTABLE] Lifecycle state for a guardian approval review.
 */
-export type GuardianApprovalReviewStatus = "inProgress" | "approved" | "denied" | "aborted";
+export type GuardianApprovalReviewStatus = "inProgress" | "approved" | "denied" | "timedOut" | "aborted";
@@ -9,11 +9,11 @@ import type { GuardianApprovalReviewAction } from "./GuardianApprovalReviewActio
 * [UNSTABLE] Temporary notification payload for guardian automatic approval
 * review. This shape is expected to change soon.
 */
-export type ItemGuardianApprovalReviewCompletedNotification = { threadId: string, turnId: string, 
+export type ItemGuardianApprovalReviewCompletedNotification = { threadId: string, turnId: string,
 /**
 * Stable identifier for this review.
 */
-reviewId: string, 
+reviewId: string,
 /**
 * Identifier for the reviewed item or tool call when one exists.
 *
@@ -8,11 +8,11 @@ import type { GuardianApprovalReviewAction } from "./GuardianApprovalReviewActio
 * [UNSTABLE] Temporary notification payload for guardian automatic approval
 * review. This shape is expected to change soon.
 */
-export type ItemGuardianApprovalReviewStartedNotification = { threadId: string, turnId: string, 
+export type ItemGuardianApprovalReviewStartedNotification = { threadId: string, turnId: string,
 /**
 * Stable identifier for this review.
 */
-reviewId: string, 
+reviewId: string,
 /**
 * Identifier for the reviewed item or tool call when one exists.
 *
@@ -3,15 +3,15 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { McpServerStatusDetail } from "./McpServerStatusDetail";

-export type ListMcpServerStatusParams = { 
+export type ListMcpServerStatusParams = {
 /**
 * Opaque pagination cursor returned by a previous call.
 */
-cursor?: string | null, 
+cursor?: string | null,
 /**
 * Optional page size; defaults to a server-defined value.
 */
-limit?: number | null, 
+limit?: number | null,
 /**
 * Controls how much MCP inventory data to fetch for each server.
 * Defaults to `Full` when omitted.
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { McpServerStatus } from "./McpServerStatus";

-export type ListMcpServerStatusResponse = { data: Array<McpServerStatus>, 
+export type ListMcpServerStatusResponse = { data: Array<McpServerStatus>,
 /**
 * Opaque cursor to pass to the next call to continue after the last item.
 * If None, there are no more items to return.
@@ -2,16 +2,16 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type LoginAccountParams = { "type": "apiKey", apiKey: string, } | { "type": "chatgpt" } | { "type": "chatgptDeviceCode" } | { "type": "chatgptAuthTokens", 
+export type LoginAccountParams = { "type": "apiKey", apiKey: string, } | { "type": "chatgpt" } | { "type": "chatgptDeviceCode" } | { "type": "chatgptAuthTokens",
 /**
 * Access token (JWT) supplied by the client.
 * This token is used for backend API requests and email extraction.
 */
-accessToken: string, 
+accessToken: string,
 /**
 * Workspace/account identifier supplied by the client.
 */
-chatgptAccountId: string, 
+chatgptAccountId: string,
 /**
 * Optional plan type supplied by the client.
 *
@@ -2,15 +2,15 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type LoginAccountResponse = { "type": "apiKey", } | { "type": "chatgpt", loginId: string, 
+export type LoginAccountResponse = { "type": "apiKey", } | { "type": "chatgpt", loginId: string,
 /**
 * URL the client should open in a browser to initiate the OAuth flow.
 */
-authUrl: string, } | { "type": "chatgptDeviceCode", loginId: string, 
+authUrl: string, } | { "type": "chatgptDeviceCode", loginId: string,
 /**
 * URL the client should open in a browser to complete device code authorization.
 */
-verificationUrl: string, 
+verificationUrl: string,
 /**
 * One-time code the user must enter after signing in.
 */
@@ -4,7 +4,7 @@
 import type { JsonValue } from "../serde_json/JsonValue";
 import type { McpElicitationSchema } from "./McpElicitationSchema";

-export type McpServerElicitationRequestParams = { threadId: string, 
+export type McpServerElicitationRequestParams = { threadId: string,
 /**
 * Active Codex turn when this elicitation was observed, if app-server could correlate one.
 *
@@ -4,13 +4,13 @@
 import type { JsonValue } from "../serde_json/JsonValue";
 import type { McpServerElicitationAction } from "./McpServerElicitationAction";

-export type McpServerElicitationRequestResponse = { action: McpServerElicitationAction, 
+export type McpServerElicitationRequestResponse = { action: McpServerElicitationAction,
 /**
 * Structured user input for accepted elicitations, mirroring RMCP `CreateElicitationResult`.
 *
 * This is nullable because decline/cancel responses have no content.
 */
-content: JsonValue | null, 
+content: JsonValue | null,
 /**
 * Optional client metadata for form-mode action handling.
 */
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { JsonValue } from "../serde_json/JsonValue";
+
+export type McpServerToolCallParams = { threadId: string, server: string, tool: string, arguments?: JsonValue, _meta?: JsonValue, };
@@ -0,0 +1,6 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { JsonValue } from "../serde_json/JsonValue";
+
+export type McpServerToolCallResponse = { content: Array<JsonValue>, structuredContent?: JsonValue, isError?: boolean, _meta?: JsonValue, };
@@ -2,15 +2,15 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ModelListParams = { 
+export type ModelListParams = {
 /**
 * Opaque pagination cursor returned by a previous call.
 */
-cursor?: string | null, 
+cursor?: string | null,
 /**
 * Optional page size; defaults to a reasonable server-side value.
 */
-limit?: number | null, 
+limit?: number | null,
 /**
 * When true, include models that are hidden from the default picker list.
 */
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Model } from "./Model";

-export type ModelListResponse = { data: Array<Model>, 
+export type ModelListResponse = { data: Array<Model>,
 /**
 * Opaque cursor to pass to the next call to continue after the last item.
 * If None, there are no more items to return.
@@ -4,28 +4,28 @@
 import type { NetworkDomainPermission } from "./NetworkDomainPermission";
 import type { NetworkUnixSocketPermission } from "./NetworkUnixSocketPermission";

-export type NetworkRequirements = { enabled: boolean | null, httpPort: number | null, socksPort: number | null, allowUpstreamProxy: boolean | null, dangerouslyAllowNonLoopbackProxy: boolean | null, dangerouslyAllowAllUnixSockets: boolean | null, 
+export type NetworkRequirements = { enabled: boolean | null, httpPort: number | null, socksPort: number | null, allowUpstreamProxy: boolean | null, dangerouslyAllowNonLoopbackProxy: boolean | null, dangerouslyAllowAllUnixSockets: boolean | null,
 /**
 * Canonical network permission map for `experimental_network`.
 */
-domains: { [key in string]?: NetworkDomainPermission } | null, 
+domains: { [key in string]?: NetworkDomainPermission } | null,
 /**
 * When true, only managed allowlist entries are respected while managed
 * network enforcement is active.
 */
-managedAllowedDomainsOnly: boolean | null, 
+managedAllowedDomainsOnly: boolean | null,
 /**
 * Legacy compatibility view derived from `domains`.
 */
-allowedDomains: Array<string> | null, 
+allowedDomains: Array<string> | null,
 /**
 * Legacy compatibility view derived from `domains`.
 */
-deniedDomains: Array<string> | null, 
+deniedDomains: Array<string> | null,
 /**
 * Canonical unix socket permission map for `experimental_network`.
 */
-unixSockets: { [key in string]?: NetworkUnixSocketPermission } | null, 
+unixSockets: { [key in string]?: NetworkUnixSocketPermission } | null,
 /**
 * Legacy compatibility view derived from `unix_sockets`.
 */
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "../AbsolutePathBuf";

-export type PluginInstallParams = { marketplacePath: AbsolutePathBuf, pluginName: string, 
+export type PluginInstallParams = { marketplacePath: AbsolutePathBuf, pluginName: string,
 /**
 * When true, apply the remote plugin change before the local install flow.
 */
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "../AbsolutePathBuf";

-export type PluginInterface = { displayName: string | null, shortDescription: string | null, longDescription: string | null, developerName: string | null, category: string | null, capabilities: Array<string>, websiteUrl: string | null, privacyPolicyUrl: string | null, termsOfServiceUrl: string | null, 
+export type PluginInterface = { displayName: string | null, shortDescription: string | null, longDescription: string | null, developerName: string | null, category: string | null, capabilities: Array<string>, websiteUrl: string | null, privacyPolicyUrl: string | null, termsOfServiceUrl: string | null,
 /**
 * Starter prompts for the plugin. Capped at 3 entries with a maximum of
 * 128 characters per entry.
@@ -3,12 +3,12 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "../AbsolutePathBuf";

-export type PluginListParams = { 
+export type PluginListParams = {
 /**
 * Optional working directories used to discover repo marketplaces. When omitted,
 * only home-scoped marketplaces and the official curated marketplace are considered.
 */
-cwds?: Array<AbsolutePathBuf> | null, 
+cwds?: Array<AbsolutePathBuf> | null,
 /**
 * When true, reconcile the official curated marketplace against the remote plugin state
 * before listing marketplaces.
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type PluginUninstallParams = { pluginId: string, 
+export type PluginUninstallParams = { pluginId: string,
 /**
 * When true, apply the remote plugin change before the local uninstall flow.
 */
@@ -4,7 +4,7 @@
 import type { ReviewDelivery } from "./ReviewDelivery";
 import type { ReviewTarget } from "./ReviewTarget";

-export type ReviewStartParams = { threadId: string, target: ReviewTarget, 
+export type ReviewStartParams = { threadId: string, target: ReviewTarget,
 /**
 * Where to run the review: inline (default) on the current thread or
 * detached on a new thread (returned in `reviewThreadId`).
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Turn } from "./Turn";

-export type ReviewStartResponse = { turn: Turn, 
+export type ReviewStartResponse = { turn: Turn,
 /**
 * Identifies the thread where the review runs.
 *
@@ -2,7 +2,7 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ReviewTarget = { "type": "uncommittedChanges" } | { "type": "baseBranch", branch: string, } | { "type": "commit", sha: string, 
+export type ReviewTarget = { "type": "uncommittedChanges" } | { "type": "baseBranch", branch: string, } | { "type": "commit", sha: string,
 /**
 * Optional human-readable label (e.g., commit subject) for UIs.
 */
@@ -5,7 +5,7 @@ import type { SkillDependencies } from "./SkillDependencies";
 import type { SkillInterface } from "./SkillInterface";
 import type { SkillScope } from "./SkillScope";

-export type SkillMetadata = { name: string, description: string, 
+export type SkillMetadata = { name: string, description: string,
 /**
 * Legacy short_description from SKILL.md. Prefer SKILL.json interface.short_description.
 */
@@ -3,11 +3,11 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { AbsolutePathBuf } from "../AbsolutePathBuf";

-export type SkillsConfigWriteParams = { 
+export type SkillsConfigWriteParams = {
 /**
 * Path-based selector.
 */
-path?: AbsolutePathBuf | null, 
+path?: AbsolutePathBuf | null,
 /**
 * Name-based selector.
 */
@@ -3,15 +3,15 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { SkillsListExtraRootsForCwd } from "./SkillsListExtraRootsForCwd";

-export type SkillsListParams = { 
+export type SkillsListParams = {
 /**
 * When empty, defaults to the current session working directory.
 */
-cwds?: Array<string>, 
+cwds?: Array<string>,
 /**
 * When true, bypass the skills cache and re-scan skills from disk.
 */
-forceReload?: boolean, 
+forceReload?: boolean,
 /**
 * Optional per-cwd extra roots to scan as user-scoped skills.
 */
@@ -3,11 +3,11 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ByteRange } from "./ByteRange";

-export type TextElement = { 
+export type TextElement = {
 /**
 * Byte range in the parent `text` buffer that this element occupies.
 */
-byteRange: ByteRange, 
+byteRange: ByteRange,
 /**
 * Optional human-readable placeholder for the element, displayed in the UI.
 */
@@ -2,11 +2,11 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type TextPosition = { 
+export type TextPosition = {
 /**
 * 1-based line number.
 */
-line: number, 
+line: number,
 /**
 * 1-based column number (in Unicode scalar values).
 */
@@ -6,67 +6,67 @@ import type { SessionSource } from "./SessionSource";
 import type { ThreadStatus } from "./ThreadStatus";
 import type { Turn } from "./Turn";

-export type Thread = { id: string, 
+export type Thread = { id: string,
 /**
 * Source thread id when this thread was created by forking another thread.
 */
-forkedFromId: string | null, 
+forkedFromId: string | null,
 /**
 * Usually the first user message in the thread, if available.
 */
-preview: string, 
+preview: string,
 /**
 * Whether the thread is ephemeral and should not be materialized on disk.
 */
-ephemeral: boolean, 
+ephemeral: boolean,
 /**
 * Model provider used for this thread (for example, 'openai').
 */
-modelProvider: string, 
+modelProvider: string,
 /**
 * Unix timestamp (in seconds) when the thread was created.
 */
-createdAt: number, 
+createdAt: number,
 /**
 * Unix timestamp (in seconds) when the thread was last updated.
 */
-updatedAt: number, 
+updatedAt: number,
 /**
 * Current runtime status for the thread.
 */
-status: ThreadStatus, 
+status: ThreadStatus,
 /**
 * [UNSTABLE] Path to the thread on disk.
 */
-path: string | null, 
+path: string | null,
 /**
 * Working directory captured for the thread.
 */
-cwd: string, 
+cwd: string,
 /**
 * Version of the CLI that created the thread.
 */
-cliVersion: string, 
+cliVersion: string,
 /**
 * Origin of the thread (CLI, VSCode, codex exec, codex app-server, etc.).
 */
-source: SessionSource, 
+source: SessionSource,
 /**
 * Optional random unique nickname assigned to an AgentControl-spawned sub-agent.
 */
-agentNickname: string | null, 
+agentNickname: string | null,
 /**
 * Optional role (agent_role) assigned to an AgentControl-spawned sub-agent.
 */
-agentRole: string | null, 
+agentRole: string | null,
 /**
 * Optional Git metadata captured when the thread was created.
 */
-gitInfo: GitInfo | null, 
+gitInfo: GitInfo | null,
 /**
 * Optional user-facing thread title.
 */
-name: string | null, 
+name: string | null,
 /**
 * Only populated on `thread/resume`, `thread/rollback`, `thread/fork`, and `thread/read`
 * (when `includeTurns` is true) responses.
@@ -8,7 +8,7 @@ import type { AskForApproval } from "./AskForApproval";
 import type { SandboxPolicy } from "./SandboxPolicy";
 import type { Thread } from "./Thread";

-export type ThreadForkResponse = { thread: Thread, model: string, modelProvider: string, serviceTier: ServiceTier | null, cwd: string, approvalPolicy: AskForApproval, 
+export type ThreadForkResponse = { thread: Thread, model: string, modelProvider: string, serviceTier: ServiceTier | null, cwd: string, approvalPolicy: AskForApproval,
 /**
 * Reviewer currently used for approval requests on this thread.
 */
@@ -22,78 +22,78 @@ import type { PatchApplyStatus } from "./PatchApplyStatus";
 import type { UserInput } from "./UserInput";
 import type { WebSearchAction } from "./WebSearchAction";

-export type ThreadItem = { "type": "userMessage", id: string, content: Array<UserInput>, } | { "type": "hookPrompt", id: string, fragments: Array<HookPromptFragment>, } | { "type": "agentMessage", id: string, text: string, phase: MessagePhase | null, memoryCitation: MemoryCitation | null, } | { "type": "plan", id: string, text: string, } | { "type": "reasoning", id: string, summary: Array<string>, content: Array<string>, } | { "type": "commandExecution", id: string, 
+export type ThreadItem = { "type": "userMessage", id: string, content: Array<UserInput>, } | { "type": "hookPrompt", id: string, fragments: Array<HookPromptFragment>, } | { "type": "agentMessage", id: string, text: string, phase: MessagePhase | null, memoryCitation: MemoryCitation | null, } | { "type": "plan", id: string, text: string, } | { "type": "reasoning", id: string, summary: Array<string>, content: Array<string>, } | { "type": "commandExecution", id: string,
 /**
 * The command to be executed.
 */
-command: string, 
+command: string,
 /**
 * The command's working directory.
 */
-cwd: string, 
+cwd: string,
 /**
 * Identifier for the underlying PTY process (when available).
 */
-processId: string | null, source: CommandExecutionSource, status: CommandExecutionStatus, 
+processId: string | null, source: CommandExecutionSource, status: CommandExecutionStatus,
 /**
 * A best-effort parsing of the command to understand the action(s) it will perform.
 * This returns a list of CommandAction objects because a single shell command may
 * be composed of many commands piped together.
 */
-commandActions: Array<CommandAction>, 
+commandActions: Array<CommandAction>,
 /**
 * The command's output, aggregated from stdout and stderr.
 */
-aggregatedOutput: string | null, 
+aggregatedOutput: string | null,
 /**
 * The command's exit code.
 */
-exitCode: number | null, 
+exitCode: number | null,
 /**
 * The duration of the command execution in milliseconds.
 */
-durationMs: number | null, } | { "type": "fileChange", id: string, changes: Array<FileUpdateChange>, status: PatchApplyStatus, } | { "type": "mcpToolCall", id: string, server: string, tool: string, status: McpToolCallStatus, arguments: JsonValue, result: McpToolCallResult | null, error: McpToolCallError | null, 
+durationMs: number | null, } | { "type": "fileChange", id: string, changes: Array<FileUpdateChange>, status: PatchApplyStatus, } | { "type": "mcpToolCall", id: string, server: string, tool: string, status: McpToolCallStatus, arguments: JsonValue, result: McpToolCallResult | null, error: McpToolCallError | null,
 /**
 * The duration of the MCP tool call in milliseconds.
 */
-durationMs: number | null, } | { "type": "dynamicToolCall", id: string, tool: string, arguments: JsonValue, status: DynamicToolCallStatus, contentItems: Array<DynamicToolCallOutputContentItem> | null, success: boolean | null, 
+durationMs: number | null, } | { "type": "dynamicToolCall", id: string, tool: string, arguments: JsonValue, status: DynamicToolCallStatus, contentItems: Array<DynamicToolCallOutputContentItem> | null, success: boolean | null,
 /**
 * The duration of the dynamic tool call in milliseconds.
 */
-durationMs: number | null, } | { "type": "collabAgentToolCall", 
+durationMs: number | null, } | { "type": "collabAgentToolCall",
 /**
 * Unique identifier for this collab tool call.
 */
-id: string, 
+id: string,
 /**
 * Name of the collab tool that was invoked.
 */
-tool: CollabAgentTool, 
+tool: CollabAgentTool,
 /**
 * Current status of the collab tool call.
 */
-status: CollabAgentToolCallStatus, 
+status: CollabAgentToolCallStatus,
 /**
 * Thread ID of the agent issuing the collab request.
 */
-senderThreadId: string, 
+senderThreadId: string,
 /**
 * Thread ID of the receiving agent, when applicable. In case of spawn operation,
 * this corresponds to the newly spawned agent.
 */
-receiverThreadIds: Array<string>, 
+receiverThreadIds: Array<string>,
 /**
 * Prompt text sent as part of the collab tool call, when available.
 */
-prompt: string | null, 
+prompt: string | null,
 /**
 * Model requested for the spawned agent, when applicable.
 */
-model: string | null, 
+model: string | null,
 /**
 * Reasoning effort requested for the spawned agent, when applicable.
 */
-reasoningEffort: ReasoningEffort | null, 
+reasoningEffort: ReasoningEffort | null,
 /**
 * Last known status of the target agents, when available.
 */
@@ -4,39 +4,39 @@
 import type { ThreadSortKey } from "./ThreadSortKey";
 import type { ThreadSourceKind } from "./ThreadSourceKind";

-export type ThreadListParams = { 
+export type ThreadListParams = {
 /**
 * Opaque pagination cursor returned by a previous call.
 */
-cursor?: string | null, 
+cursor?: string | null,
 /**
 * Optional page size; defaults to a reasonable server-side value.
 */
-limit?: number | null, 
+limit?: number | null,
 /**
 * Optional sort key; defaults to created_at.
 */
-sortKey?: ThreadSortKey | null, 
+sortKey?: ThreadSortKey | null,
 /**
 * Optional provider filter; when set, only sessions recorded under these
 * providers are returned. When present but empty, includes all providers.
 */
-modelProviders?: Array<string> | null, 
+modelProviders?: Array<string> | null,
 /**
 * Optional source filter; when set, only sessions from these source kinds
 * are returned. When omitted or empty, defaults to interactive sources.
 */
-sourceKinds?: Array<ThreadSourceKind> | null, 
+sourceKinds?: Array<ThreadSourceKind> | null,
 /**
 * Optional archived filter; when set to true, only archived threads are returned.
 * If false or null, only non-archived threads are returned.
 */
-archived?: boolean | null, 
+archived?: boolean | null,
 /**
 * Optional cwd filter; when set, only threads whose session cwd exactly
 * matches this path are returned.
 */
-cwd?: string | null, 
+cwd?: string | null,
 /**
 * Optional substring filter for the extracted thread title.
 */
@@ -3,7 +3,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Thread } from "./Thread";

-export type ThreadListResponse = { data: Array<Thread>, 
+export type ThreadListResponse = { data: Array<Thread>,
 /**
 * Opaque cursor to pass to the next call to continue after the last item.
 * if None, there are no more items to return.
@@ -2,11 +2,11 @@

 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ThreadLoadedListParams = { 
+export type ThreadLoadedListParams = {
 /**
 * Opaque pagination cursor returned by a previous call.
 */
-cursor?: string | null, 
+cursor?: string | null,
 /**
 * Optional page size; defaults to no limit.
 */
--- a/Show More
+++ b/Show More