[merefield]

Codex 0.167 can require a fresh human command decision that Codexometer currently cannot receive. Completed results also keep the same presentation after being reviewed. This PR adds managed command approval support and uses Codex's durable read receipts to distinguish reviewed completions from new results.

Scope

• Keep existing human approval controls compatible with Codex 0.167.
• Help users identify completed results they have not reviewed.
• Preserve accounting, connection and history compatibility through focused regressions.

Managed human approvals

• Advertise requiredHumanApproval only from the terminal and writable web mode. Passive observers and read-only web mode remain ineligible for these requests.
• Show HUMAN APPROVAL REQUIRED and explain that managed policy requires approval each time. Add both strings to all 17 terminal locale catalogues.
• Allow only the advertised one-time accept, decline and cancel decisions. Reject reusable grants again at the response boundary. Each request retains its own connection-bound, single-use capability.
• Require the checkpoint's explicit command and directory, and a current live turn; do not borrow another execution item's details. The checkpoint itself does not create a running command.
• Keep ordinary command approvals actionable for background executions whose originating turn differs from the servicing turn. Their live, single-use request capability still binds the response.
• Preserve the existing confirmation policy. --no-confirm removes the extra step while still requiring an explicit human action for every request.

Shared unread results

• Read optional durable receipts through the existing metadata reads and subscribe to thread/readState/changed. Codex owns persistence and sharing with supported native clients; Codexometer keeps only bounded observations in memory.
• Keep TURN COMPLETE highlighted and its completion pill visible while unread. After acknowledgement, retain the completion status with subdued styling and remove its completion pill. Approval, question and error priority is preserved.
• Deliberately opening partial or full Detail (including completion badges and Live history), or scrolling within visible result content, can acknowledge the latest completed root reply. Selection, hover, automatic refresh, restored layouts and results arriving in an already-open pane do not acknowledge it. Older history and linked-agent previews cannot acknowledge the root's latest result.
• Use the rendered terminal body bounds, including three- and four-row partial panes, and exclude composer controls. Browser results must intersect both the viewport and the content scrollport; restoring a Detail URL never acknowledges a late-arriving result.
• Before writing, check the latest completed turn with a bounded summary read, then send thread/readState/update with the viewed expectedRevision on the original connection. New results, conflicts and disconnects prevent stale acknowledgements; writes are not automatically retried.
• Browser acknowledgements use the existing paired, same-origin writable control boundary. Read-only web mode displays shared state without changing it. Servers or sessions without durable receipts retain the existing completion behaviour.
• Share optional capability lookup, session observation projection and pane geometry so receipt handling is consistent at startup, on refresh and during hit testing.

Codex 0.167 compatibility

• Extend the opt-in native compression smoke test to accept 0.167.0 alongside 0.164.0 and 0.166.0.
• Cover expired network requests resolving independently of sibling requests, and evicted commentary preserving the completed final reply.
• Retain the existing exact-response accounting regressions: incomplete-response spending counts once; context corrections do not create spending; missing usage stays missing.

Upstream references: managed checkpoints, native unread acknowledgement, network prompt expiry, live history retention.

Validation

• Full Go package race/coverage suite passes, with the exhaustive locale matrix run separately.
• All 17 terminal locales pass their presentation suite with the race detector.
• go vet ./..., Windows application build and Windows terminal-test compilation pass.
• Native Codex 0.167.0 compressed-RPC smoke test passes in an isolated temporary home, with no credentials or model requests.
• Browser type/format checks and production build pass; generated contracts and embedded assets are updated. All 116 browser tests pass using installed Chrome via a temporary test configuration, including managed approval labels, partial Detail, arriving results, clipped content, restored Detail URLs and read-only acknowledgement boundaries.
• Duplication policy passes against main with the baseline unchanged; the normalised production scan decreases from 147 to 145 clones.

The native smoke check covers transport interoperability. Managed approvals and read-state races use daemon fixtures and browser mocks; this is not a live managed-policy/model-turn integration test.

[Copilot]

🟡 Changes recommended

Active issues reject valid command approvals and mishandle unread-result acknowledgments in web and terminal views, marking unseen results read while leaving deliberately viewed results unread.

7 open issues

• Preserve approvals for requests originating in earlier turns · New
• Mark results read when opening live history from a badge or control · New
• Remove the global hidden-layout gate for visible partial panes · New
• Match the full-detail receipt offset to conditional history navigation · New
• Support read receipts in compact three- and four-row partial panes · New
• Exclude results clipped by the main content pane from read receipts · New
• Restore the initial route without treating it as a review gesture · New

What changed in this PR

This PR adds Codex 0.167 managed human approvals and shared unread-result tracking to Codexometer’s terminal and web interfaces.

Changes:

• Supports one-time human approval decisions, capability negotiation, and localized policy explanations.
• Uses durable Codex read receipts to distinguish unread completions and acknowledge deliberate review actions.
• Adds compatibility and interaction regressions, updates documentation, and refreshes browser contracts and embedded styles.

File	Description
web/​tests/​browser.spec.ts	Adds unread-result and managed-approval browser tests.
web/​src/​state.svelte.ts	Enables read-receipt control requests.
web/​src/​Sessions.svelte	Adds review gestures and reviewed-completion styling.
web/​src/​SessionActions.svelte	Displays managed human approval guidance.
web/​src/​contracts.generated.ts	Adds approval and receipt fields to browser contracts.
README.md	Documents approvals, unread results, and compatibility checks.
internal/​web/​state.go	Projects approval and read-state information for browsers.
internal/​web/​server.go	Configures approval support and registers the read endpoint.
internal/​web/​dist/​index.html	References refreshed embedded assets.
internal/​web/​dist/​assets/​index-Ei3sATy3.css	Removes the previous stylesheet bundle.
internal/​web/​dist/​assets/​index-DYxZORQa.css	Adds the updated bundle with reviewed-result styling.
internal/​web/​control.go	Connects read receipts and managed approval metadata.
internal/​web/​control_read.go	Validates and processes browser acknowledgements.
internal/​web/​control_read_test.go	Tests acknowledgement authorization and freshness checks.
internal/​ui/​monitor.go	Subdues reviewed completion badges.
internal/​ui/​monitor_summary.go	Filters reviewed completion pills and records review intent.
internal/​ui/​monitor_read.go	Handles terminal review gestures and receipt updates.
internal/​ui/​monitor_read_test.go	Tests deliberate review and receipt preservation.
internal/​ui/​monitor_history.go	Records review intent during history navigation.
internal/​ui/​monitor_detail.go	Adds localized managed-policy guidance.
internal/​ui/​monitor_detail_test.go	Tests managed approval presentation.
internal/​ui/​monitor_copy.go	Reuses shared partial-pane geometry.
internal/​ui/​monitor_context.go	Adds approval headings and review-intent hooks.
internal/​ui/​monitor_context_modes.go	Shares pane geometry and tracks detail-opening intent.
internal/​ui/​model.go	Enables human approvals and preserves observed read state.
internal/​i18n/​locales/​zh-Hans.json	Adds Simplified Chinese approval text.
internal/​i18n/​locales/​tr.json	Adds Turkish approval text.
internal/​i18n/​locales/​sv.json	Adds Swedish approval text.
internal/​i18n/​locales/​ru.json	Adds Russian approval text.
internal/​i18n/​locales/​pt-PT.json	Adds European Portuguese approval text.
internal/​i18n/​locales/​pt-BR.json	Adds Brazilian Portuguese approval text.
internal/​i18n/​locales/​nl.json	Adds Dutch approval text.
internal/​i18n/​locales/​nb.json	Adds Norwegian Bokmål approval text.
internal/​i18n/​locales/​ja.json	Adds Japanese approval text.
internal/​i18n/​locales/​it.json	Adds Italian approval text.
internal/​i18n/​locales/​fr.json	Adds French approval text.
internal/​i18n/​locales/​fi.json	Adds Finnish approval text.
internal/​i18n/​locales/​et.json	Adds Estonian approval text.
internal/​i18n/​locales/​es.json	Adds Spanish approval text.
internal/​i18n/​locales/​en-GB.json	Adds canonical English approval text.
internal/​i18n/​locales/​de.json	Adds German approval text.
internal/​i18n/​locales/​da.json	Adds Danish approval text.
internal/​codex/​session_settings_unix_test.go	Extends daemon fixtures for receipts and capabilities.
internal/​codex/​session_read_state.go	Defines optional read-state parsing and client access.
internal/​codex/​session_read_state_unix.go	Observes receipts and validates acknowledgement writes.
internal/​codex/​session_read_state_unix_test.go	Tests persistence, conflicts, and stale-result rejection.
internal/​codex/​session_human_approval_test.go	Tests checkpoint identity and one-time decisions.
internal/​codex/​session_history_unix_test.go	Tests final-reply retention after commentary eviction.
internal/​codex/​session_context.go	Adds managed human approval metadata.
internal/​codex/​session_context_daemon.go	Parses and validates human command checkpoints.
internal/​codex/​session_approval.go	Exposes human approval capability configuration.
internal/​codex/​session_approval_unix.go	Rejects reusable grants for human checkpoints.
internal/​codex/​session_approval_unix_test.go	Tests capability negotiation and response restrictions.
internal/​codex/​session_167_test.go	Tests independent network-request expiry.
internal/​codex/​live_usage.go	Carries read state into live session snapshots.
internal/​codex/​daemon_status.go	Adds read states to daemon snapshots.
internal/​codex/​daemon_status_unix.go	Integrates receipt observation and approval negotiation.
internal/​codex/​daemon_native_unix_test.go	Allows Codex 0.167.0 in the native smoke check.
internal/​codex/​client.go	Centralizes optional session-capability lookup.
internal/​codex/​approval_options.go	Identifies permitted one-time approval decisions.

_{Review effort: Balanced}