Big-bang upstream sync: mobile, Connect, and 516 commits

[wizzoapp]

Summary

Merge upstream/main at 1a003e3 into fork main at 18a5665, preserving fork audience/data-segregation guards, sidebar settlement, MCP toolkits, remote access/pairing, factory workflows, Opus 5 catalog support, and out-of-tree hosted deployment hardening while taking upstream mobile/Expo/EAS, T3 Connect, and refactors.

This PR stages code only. It does not promote a release, restart t3code.service, or touch the live immutable worktree.

Validation

• vp run typecheck: green across 15 workspace projects
• vp check: 2,789 files formatted; 2,623 files lint-clean
• server: 2,895 passed, 21 environment probes skipped
• web: 2,165 passed
• shared: 365 passed
• protected four-provider harness: 271 passed, 4 skipped

This is an upstream-sync PR and must land through the CI-only sync policy after CI is green and the adversarial verifier approves it.

[wizzoapp]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/web/package.json

Line 9 in 1529ff4

"build": "vp build",

Restore the hosted web build script

This scripts block no longer defines build:hosted, but the nightly production cycle still executes pnpm -C "$stage_checkout/apps/web" run build:hosted in its normal and fallback build paths (scripts/ops/daily-restart/t3-nightly-cycle:794 and :911). When that path runs, pnpm will fail before producing the hosted web bundle, so the automated refresh/rollback cannot complete; either restore build:hosted or update every caller to the new script.

---

t3code/apps/web/vercel.ts

Line 28 in 1529ff4

'vp run --filter @t3tools/web build && node ../../scripts/apply-web-brand-assets.ts --channel "${VITE_HOSTED_APP_CHANNEL:-latest}"',

Run the hosted scanner for Vercel builds

For hosted Vercel deployments this now runs plain build, while this commit also removed the hosted script’s assert-web-no-dev-endpoints check and the Vite config no longer calls assertHostedBuildEnvClean. If the Vercel/project build environment ever contains VITE_HTTP_URL or VITE_WS_URL, those values are inlined and the hosted app dials a baked backend instead of window.location.origin, recreating the remote-browser origin breakage this repo explicitly guards against; keep the hosted build/scanner or scrub these envs in the Vercel build.

AGENTS.md reference: AGENTS.md:L59-L63

---

t3code/apps/mobile/app.config.ts

Line 177 in 1529ff4

url: "https://u.expo.dev/d763fcb8-d37c-41ea-a773-b54a0ab4a454",

Honor the EAS project/update env

In EAS builds, apps/mobile/eas.json supplies EXPO_PROJECT_ID and EXPO_UPDATES_URL for every profile, and the previous config read those values. Hardcoding this old update URL (and the matching extra.eas.projectId below) makes preview/production binaries point at the wrong Expo project, so OTA updates and EAS metadata will not line up with the project CI is building; keep using the env-driven project/update values here.

---

t3code/apps/web/vite.config.ts

Line 158 in 1529ff4

devCompressionPlugin(),

Restore the build identity asset

The web plugin list no longer includes the build-identity.json emitter, but desktop artifact packaging still validates apps/server/dist/client/build-identity.json after vp run build:desktop copies the web dist into the server bundle (scripts/build-desktop-artifact.ts). Non---skip-build desktop artifact jobs will therefore abort with BundledClientBuildStampMissingError even though the web build succeeded; restore an equivalent build identity asset before packaging.

---

t3code/apps/web/src/modelSelection.ts

Line 212 in 1529ff4

for (const slug of normalizeCustomModelSlugs(customModels, builtInModelSlugs)) {

Keep excluding reserved Claude custom slugs

With a Claude provider instance whose settings still contain reserved/future slugs such as claude-opus-5 or retired claude-opus-4-8, this now re-adds those entries from providerInstances[id].config.customModels because only current built-ins are excluded. The server-side provider snapshot still reserves those slugs and omits them until the installed Claude CLI supports them, so the model picker/default resolver can select and dispatch a model the provider deliberately withheld instead of falling back or migrating; keep CLAUDE_RESERVED_MODEL_SLUGS in the exclusion set for Claude instances.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Lines 819 to 821 in ef6f8b1

	...(event.payload.worktreePath !== undefined
	? { worktreePath: event.payload.worktreePath }
	: {}),

Persist worktree cleanup metadata on thread updates

When a thread.meta-updated event carries worktreeRemovable or worktreeRemovalPath (for example after a prepared worktree is attached or after cleanup clears it), this projection upsert now only copies worktreePath and silently leaves the stored cleanup fields at their previous values. ProjectionSnapshotQuery reads those columns for clients and deletion lifecycle decisions, so the persisted read model can keep advertising a removed worktree or fail to mark a newly-created worktree as removable after the projector catches up or the server restarts. The repo's event-sourced flow depends on projectors deriving the read model clients render, so these payload fields need to be restored here.

AGENTS.md reference: AGENTS.md:L122-L124

---

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Line 592 in ef6f8b1

message.role === "user" &&

Count sub-agent wake messages in latest prompt time

This refresh now ignores system messages like [sub-agent child completed] ..., even though the decider/projector/client sorting logic treats those as prompt/wake messages. For threads woken by a child completion, latest_user_message_at in the persisted shell stays at the previous human message or null, so consumers such as ChildThreadCoordinator can treat a stopped latest turn as terminal despite a newer sub-agent wake, and sidebar recency/settled state can remain stale. Please keep the previous prompt-message predicate for this persisted summary.

AGENTS.md reference: AGENTS.md:L122-L124

---

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Line 974 in ef6f8b1

parentThreadId: event.payload.parentThreadId,

Persist parent environment ids for remote children

When thread.parent-set links a child to a parent in another environment, this upsert now stores only parentThreadId and drops event.payload.parentEnvironmentId. The in-memory projector still keeps both fields and ProjectionSnapshotQuery exposes parent_environment_id, so after the durable projection catches up or replays, remote children look like local children with a null parent environment; code that filters children by both parent id and source environment can then fail to find them. Persist parentEnvironmentId alongside parentThreadId.

AGENTS.md reference: AGENTS.md:L122-L124

---

t3code/apps/server/src/orchestration/decider.ts

Line 625 in ef6f8b1

if (hasOpenBlockingRequest(thread)) {

Use persisted pending counters for settle guards

After a server restart, getCommandReadModel() intentionally bootstraps threads without activity bodies, and OrchestrationEngine still reads the current shell counters before settling. This branch now ignores that context and calls hasOpenBlockingRequest(thread), so a stale RPC/MCP client can settle a thread that already has a persisted pending approval or user-input request because the decider sees an empty activity list. Please use the shell counters loaded for the settle guard instead of the lightweight command model.

AGENTS.md reference: AGENTS.md:L122-L124

---

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Line 1202 in ef6f8b1

if (turnId === null || event.payload.session.status !== "running") {

Treat waiting sessions as active in turn projection

Providers can emit thread.session-set with status waiting and a non-null activeTurnId, and the in-memory projector/client still treat that as an active turn. The persistent projector now returns before the active-turn upsert for every non-running status, so a waiting session never binds the pending prompt or creates/updates latest_turn; shell/detail snapshots after projection or restart can show stale/null turn state while the provider is still active. Restore the previous running-or-waiting branch.

AGENTS.md reference: AGENTS.md:L122-L124

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/server/src/serverRuntimeStartup.ts

Lines 359 to 360 in 15eb9ac

	yield* orchestrationReactor.start().pipe(Scope.provide(reactorScope));
	yield* providerSessionReaper.start().pipe(Scope.provide(reactorScope));

Restore startup of scheduled/subagent reactors

When a server boots with scheduled tasks or child/subagent state, this startup path now only starts the orchestration reactor and provider reaper. The removed childThreadCoordinator.start()/scheduledTasksReactor.start() calls were the only production startup call sites (rg only finds tests otherwise), while ReactorLayerLive merely constructs those services, so scheduled turns never tick and child-thread recovery/wake bookkeeping is not hydrated after restart. Please start those reactors under the same reactorScope before marking commands ready.

---

t3code/apps/mobile/app.config.ts

Line 368 in 15eb9ac

projectId: "d763fcb8-d37c-41ea-a773-b54a0ab4a454",

Respect EAS project env in app config

Every EAS profile in apps/mobile/eas.json still sets EXPO_OWNER, EXPO_PROJECT_ID, and EXPO_UPDATES_URL for the Adam project, but this config now ignores those values and always writes the pingdotgg/d763 project into the manifest. In those development/preview/production EAS builds, the binary and OTA checks are associated with the wrong Expo project/update URL, so the profile-specific builds no longer publish or receive their intended updates; keep these fields derived from the profile env instead of hard-coding them.

---

t3code/apps/server/src/assets/AssetAccess.ts

Line 517 in 15eb9ac

.resolvePath(workspaceRoot, input.projectFaviconPath ?? undefined)

Pass the saved favicon path to the resolver

assetsCreateUrl is the only production caller of issueAssetUrl, and it never supplies this new projectFaviconPath parameter; the web/mobile ProjectFavicon components put the saved icon on resource.path only as a cache-key hint while the contract says the server reads the authoritative projection. When a user picks a project icon in Settings, this call passes undefined to resolvePath, so the signed URL still resolves the automatic/t3.json icon instead of the persisted project.faviconPath until the path is forwarded from the projection.

---

t3code/apps/web/vercel.ts

Line 28 in 15eb9ac

'vp run --filter @t3tools/web build && node ../../scripts/apply-web-brand-assets.ts --channel "${VITE_HOSTED_APP_CHANNEL:-latest}"',

Use the hosted build entrypoint for Vercel

This hosted Vercel deployment now runs the plain build script, but isHostedBuild() only turns on the Vite scrubbing/forced scanner for T3CODE_HOSTED_BUILD=1 or the build:hosted lifecycle, and the release/web-preview Vercel deploys do not pass that env var. That means a contaminated VITE_HTTP_URL/VITE_WS_URL can again be inlined while assert-web-no-dev-endpoints skips as “not a hosted build”; restore build:hosted or set T3CODE_HOSTED_BUILD=1 for these hosted deploys.

---

t3code/apps/server/src/ws.ts

Line 2095 in 15eb9ac

workspaceEntries.searchContents(input).pipe(

Guard content search with project visibility

For non-private sessions, the neighboring list and path-search RPCs first call ensureProjectEntriesVisible/ensureProjectSearchVisible, including the hidden-descendant check, but this new content-search RPC goes straight to workspaceEntries.searchContents. Since that service only normalizes cwd and returns matching lineContent, a client with orchestration read scope can search a private/hidden workspace by path and receive file contents; run the same visibility guard before starting the content index.

---

t3code/apps/server/src/ws.ts

Line 1323 in 15eb9ac

readWorkflowScript({ scriptPath: input.scriptPath }),

Bind workflow script reads to the requested thread

This RPC accepts threadId but drops it and reads any absolute .js file under ~/.claude/projects. A non-private or remote client with orchestration read scope can therefore call it with a script path from another project/thread and get the script contents without proving that the requested thread is visible or that the script path came from that thread's run handle; validate input.threadId against the projection/run handle before serving the file.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/web/src/routes/__root.tsx

Line 129 in 3dd6668

<ToastProvider>

Keep mounting the PWA runtime

In the authenticated web shell this return no longer mounts PwaRuntime, and repo-wide search shows it is now only defined/tested, never rendered. As a result app.t3.codes and locally hosted web clients stop creating PwaServiceWorkerRegistration and PwaRuntimeForEnvironment, so /sw.js registration plus browser/desktop notification delivery and recovery no longer run on any route. Please keep the runtime in the root shell (including the pre-auth branches) so both web surfaces still get the PWA side effects.

AGENTS.md reference: AGENTS.md:L23-L31

---

t3code/apps/web/src/routes/__root.tsx

Line 129 in 3dd6668

<ToastProvider>

Keep mounting the PWA runtime

In the authenticated web shell this return no longer mounts PwaRuntime, and repo-wide search shows it is now only defined/tested, never rendered. As a result app.t3.codes and locally hosted web clients stop creating PwaServiceWorkerRegistration and PwaRuntimeForEnvironment, so /sw.js registration plus browser/desktop notification delivery and recovery no longer run on any route. Please keep the runtime in the root shell (including the pre-auth branches) so both web surfaces still get the PWA side effects.

---

t3code/.github/workflows/release.yml

Lines 6 to 7 in 3dd6668

	- "v*.*.*"
	- "!v*-nightly.*"

Keep prerelease tags off the stable release path

With GitHub's ordered tag filters, this positive pattern includes any v*.*.* ref and the later negative pattern excludes only *-nightly.* (docs: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onpushbranchestagsbranches-ignoretags-ignore), so v1.2.3-beta.1 still starts this workflow. That ref then takes the stable branch in preflight (release_channel=stable, cli_dist_tag=latest), which means a prerelease tag publishes the CLI under npm latest and aliases hosted web to the latest domain; restore a plain-semver include/exclude or route these tags to a non-latest channel.

---

t3code/apps/mobile/app.config.ts

Line 177 in 3dd6668

url: "https://u.expo.dev/d763fcb8-d37c-41ea-a773-b54a0ab4a454",

Honor the EAS project env in mobile config

This hard-coded update URL ignores the EXPO_PROJECT_ID/EXPO_UPDATES_URL values that every build profile in apps/mobile/eas.json still provides (currently c5d56501-… under owner adam0410). In preview/production EAS builds, the generated native config now points at the pingdotgg/d763… Expo project instead of the selected project, so OTA updates and build metadata go to the wrong project and forks cannot publish to their own EAS project; keep deriving updates.url, extra.eas.projectId, and owner from the profile/env values.

---

t3code/apps/server/src/usage/UsageService.ts

Lines 217 to 219 in 3dd6668

	const claudeHome = yield* resolveClaudeHomePath(settings.providers.claudeAgent);
	const claudeDir = yield* resolveClaudeTranscriptDir(claudeHome);
	const codexLayout = yield* resolveCodexHomeLayout(settings.providers.codex);

Include provider instance homes in usage scans

This resolver only reads the legacy default Claude/Codex settings, so any configured provider instance with its own homePath is omitted from the Usage page. The provider registry/drivers support multiple instances with independent homes (for example codex_work and codex_personal), but this scan will report only the default home’s transcripts, leaving the other instance's token/cost history missing; include transcript roots from providerInstances as well as the legacy defaults.

---

t3code/apps/server/src/http.ts

Lines 98 to 101 in 3dd6668

	for (const configuredOrigin of config.devAllowedOrigins) {
	const normalizedOrigin = normalizeCorsOrigin(configuredOrigin);
	if (normalizedOrigin !== null) {
	origins.add(normalizedOrigin);

Trust dev allowed origins for cookie CSRF too

Adding devAllowedOrigins here only makes the preflight succeed; the cookie-auth CSRF list still comes from configuredCookieAuthCsrfOrigins, which delegates to configuredBrowserCookieCredentialOrigins and never includes these origins. For the --share/direct-call cases this env var was added for, a cross-origin browser-session-cookie POST from an origin supplied only via T3CODE_DEV_ALLOWED_ORIGINS gets access-control-allow-credentials on OPTIONS but is then rejected by requireCookieAuthCsrfOrigin as invalid_credential. Please include the same normalized dev origins in the trusted cookie-origin set.

AGENTS.md reference: AGENTS.md:L19-L21

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/mobile/app.config.ts

Line 177 in b0d3c7a

url: "https://u.expo.dev/d763fcb8-d37c-41ea-a773-b54a0ab4a454",

Restore EAS project env overrides

When any EAS profile supplies a different project (the existing apps/mobile/eas.json does this for preview/dev/prod via EXPO_PROJECT_ID and EXPO_UPDATES_URL), this hard-coded update URL ignores it while extra.eas.projectId and owner are also pinned below. Those builds will request OTA updates from the d763... project instead of the profile’s project (or a fork’s project), and EAS build/update commands can be associated with the wrong owner/project; please keep the env-driven fallback that was removed here.

AGENTS.md reference: AGENTS.md:L11-L13

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/web/vercel.ts

Lines 27 to 28 in e58d6ad

	buildCommand:
	'vp run --filter @t3tools/web build && node ../../scripts/apply-web-brand-assets.ts --channel "${VITE_HOSTED_APP_CHANNEL:-latest}"',

Use the hosted web build for Vercel deploys

When Vercel runs this config for web-preview or release deploys, this now invokes the package build script, while the hosted-build guard only activates for T3CODE_HOSTED_BUILD=1 or the build:hosted lifecycle. Since those deploy paths do not set the flag, any VITE_HTTP_URL/VITE_WS_URL present in the Vercel environment is no longer rejected or scrubbed and can be inlined into the hosted bundle, making remote browsers try to reach a baked backend instead of their serving origin. Restore build:hosted here or set the hosted flag for Vercel builds.

AGENTS.md reference: AGENTS.md:L63-L63

---

t3code/apps/mobile/app.config.ts

Lines 367 to 371 in e58d6ad

	eas: {
	projectId: "d763fcb8-d37c-41ea-a773-b54a0ab4a454",
	},
	},
	owner: "pingdotgg",

Honor Expo project overrides for mobile builds

When a fork or staging mobile pipeline sets EXPO_PROJECT_ID/EXPO_OWNER, this config still points EAS at the hardcoded pingdotgg project. The preview and production workflows invoke EAS using this app config, so non-official builds either publish to the wrong Expo project or fail authorization instead of using their configured project; restore the previous env-based project/owner overrides around these values.

AGENTS.md reference: AGENTS.md:L11-L13

---

t3code/.github/workflows/release.yml

Lines 248 to 252 in e58d6ad

	required=(
	relay_domain
	CLERK_PUBLISHABLE_KEY
	CLERK_JWT_TEMPLATE
	CLERK_CLI_OAUTH_CLIENT_ID

Keep local-only release artifacts buildable

When a tag or workflow_dispatch release runs in a fork/local-only repo without RELAY_DOMAIN/Clerk vars, this required list now flows to the missing-config exit below, and every publish job depends on relay_public_config succeeding. The previous workflow warned and emitted empty cloud values so desktop/CLI artifacts still built without T3 Connect; with this change those releases fail before any artifact is produced. Keep this path optional unless the workflow is only intended for the official deployment.

AGENTS.md reference: AGENTS.md:L11-L13

---

t3code/apps/web/src/environments/primary/auth.ts

Line 246 in e58d6ad

error.reason === "invalid_credential"

Preserve pairing-token rejection reasons

When the server rejects a pairing token because it is expired or already consumed, EnvironmentAuthInvalidError.reason is expired_credential or consumed_credential, but this branch now only converts invalid_credential into the pairing-token error type. Those common one-time-token failures therefore surface as a generic Primary environment request failed during exchange-bootstrap-credential (HTTP 401) message instead of telling the user to request a new pairing link; include the other rejection reasons here.

---

t3code/.github/workflows/release.yml

Line 150 in e58d6ad

echo "cli_dist_tag=latest" >> "$GITHUB_OUTPUT"

Do not publish prerelease CLI builds as latest

For any non-nightly prerelease tag or dispatch version such as v1.2.3-beta.1, this branch marks the GitHub release as a prerelease but still exports cli_dist_tag=latest, and the publish step passes that value directly to npm. That makes a beta CLI become the default install for npm install -g t3/npx t3; send prerelease versions to a prerelease dist-tag or reject them here.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

t3code/packages/contracts/src/orchestration.ts

Line 711 in cfcebae

turnLimit: Schema.optionalKey(PositiveInt),

Apply turnLimit to fallback snapshots

When the HTTP snapshot path is unavailable or the resume cursor is rejected, the client now sends turnLimit on subscribeThread and this contract says the fallback WebSocket snapshot is windowed, but the server handler still calls projectionSnapshotQuery.getThreadDetailSnapshot(input.threadId) without passing a window. In that fallback scenario, large threads are still sent in full over the WebSocket, defeating the pagination work and causing the exact socket payload spike this field is meant to avoid.

AGENTS.md reference: AGENTS.md:L15-L17

---

t3code/apps/server/src/orchestration/decider.ts

Line 521 in cfcebae

worktreePath: command.worktreePath,

Preserve worktree cleanup metadata

For threads started in new_worktree/prepared-worktree flows, BootstrapTurnStartDispatcher still sends worktreeRemovable and worktreeRemovalPath, but this thread.created payload now omits them (and the later thread.meta.update path drops them too). The persistent projection treats missing values as false/null, while ThreadDeletionReactor only tears down archived/deleted worktrees when worktreeRemovable === true, so newly created owned worktrees will never be cleaned up after archive/delete.

---

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Lines 1278 to 1280 in cfcebae

	pendingMessageId:
	existingTurn.value.pendingMessageId ??
	(Option.isSome(pendingTurnStart) ? pendingTurnStart.value.messageId : null),

Keep pending prompts on their own turns

When a thread.session-set refreshes an already-projected turn while a newer thread.turn-start-requested is pending, this now copies the pending message onto that existing turn and the code below always deletes the pending row. The old pendingTurnStart.requestedAt <= existingTurn.requestedAt guard prevented adopting a later queued prompt; without it, a late session update for the previous turn can consume the next user's queued turn, binding its prompt/source-plan metadata to the wrong turn and making the real turn start disappear from projections.

---

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Line 1460 in cfcebae

assistantMessageId: event.payload.assistantMessageId,

Validate checkpoint assistant boundaries

When a checkpoint for a turn arrives after a newer assistant message/checkpoint, this line now blindly replaces the turn's assistantMessageId with the checkpoint payload. The deleted guard used to verify the message belonged to this turn and only advance the boundary; without it, a delayed checkpoint with null, missing, or stale assistant id can erase the final answer pointer or point a checkpoint at another turn's message, so thread snapshots/review show the wrong assistant response for that turn.

---

t3code/apps/server/src/orchestration/Layers/ProjectionPipeline.ts

Line 1352 in cfcebae

session.value.status === "running" &&

Treat waiting sessions as active turns

When the projected session is waiting with the same activeTurnId (for example while the provider is paused on an approval or user-input request), this predicate now treats the turn as no longer active, so a non-streaming assistant message finalizes it as completed. Since the later thread.session-set path preserves already-completed turns instead of reopening them, resuming from that waiting state leaves the read model showing a completed turn while the provider is still waiting/running.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[adamfgr]

Auto-approved by wizzo-approve: all policy conditions verified against HEAD cfcebae.