Support Codex 0.134 approvals

Use available approval decisions from the app-server schema, preserve structured policy decisions in callbacks, and keep approval rendering aligned with normal tool-call output.

Also simplify thread commands, clear stale active turns more carefully, and update command/help docs.

internal/store/store.go

@@ -44,6 +44,12 @@ type Session struct {
 	UpdatedAt         string
 }
 
+type ActiveTurn struct {
+	TelegramUserID int64
+	CodexThreadID  string
+	TurnID         string
+}
+
 type Thread struct {
 	ID             int64
 	TelegramUserID int64
@@ -338,11 +344,42 @@ func (s *Store) SetActiveTurn(ctx context.Context, telegramUserID int64, turnID
 	return err
 }
 
+func (s *Store) ClearActiveTurn(ctx context.Context, telegramUserID int64, turnID string) error {
+	if strings.TrimSpace(turnID) == "" {
+		return s.SetActiveTurn(ctx, telegramUserID, "")
+	}
+	_, err := s.db.ExecContext(ctx, "UPDATE sessions SET active_turn_id = '', updated_at = datetime('now') WHERE telegram_user_id = ? AND active_turn_id = ?", telegramUserID, turnID)
+	return err
+}
+
 func (s *Store) ClearActiveTurns(ctx context.Context) error {
 	_, err := s.db.ExecContext(ctx, "UPDATE sessions SET active_turn_id = '', updated_at = datetime('now') WHERE active_turn_id <> ''")
 	return err
 }
 
+func (s *Store) ListActiveTurns(ctx context.Context) ([]ActiveTurn, error) {
+	rows, err := s.db.QueryContext(ctx, `
+SELECT s.telegram_user_id, t.codex_thread_id, s.active_turn_id
+FROM sessions s
+JOIN threads t ON t.id = s.active_thread_id AND t.telegram_user_id = s.telegram_user_id
+WHERE s.active_turn_id <> ''
+ORDER BY s.updated_at`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var turns []ActiveTurn
+	for rows.Next() {
+		var turn ActiveTurn
+		if err := rows.Scan(&turn.TelegramUserID, &turn.CodexThreadID, &turn.TurnID); err != nil {
+			return nil, err
+		}
+		turns = append(turns, turn)
+	}
+	return turns, rows.Err()
+}
+
 func (s *Store) CreateThread(ctx context.Context, telegramUserID int64, codexThreadID string, workspaceID int64, title string) (Thread, error) {
 	result, err := s.db.ExecContext(ctx, `
 INSERT INTO threads (telegram_user_id, codex_thread_id, workspace_id, title)

internal/store/store_test.go

@@ -72,9 +72,33 @@ func TestStoreUsersWorkspacesSessions(t *testing.T) {
 	if session.SettingsChatID != 1001 || session.SettingsMessageID != 2002 {
 		t.Fatalf("settings message not saved: %+v", session)
 	}
+	thread, err := st.CreateThread(ctx, 42, "codex-thread-123", ws.ID, "test thread")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.SetActiveThread(ctx, 42, thread.ID); err != nil {
+		t.Fatal(err)
+	}
 	if err := st.SetActiveTurn(ctx, 42, "turn-123"); err != nil {
 		t.Fatal(err)
 	}
+	turns, err := st.ListActiveTurns(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(turns) != 1 || turns[0].TelegramUserID != 42 || turns[0].CodexThreadID != "codex-thread-123" || turns[0].TurnID != "turn-123" {
+		t.Fatalf("active turns not listed: %+v", turns)
+	}
+	if err := st.ClearActiveTurn(ctx, 42, "other-turn"); err != nil {
+		t.Fatal(err)
+	}
+	session, err = st.GetSession(ctx, 42)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session.ActiveTurnID != "turn-123" {
+		t.Fatalf("wrong turn cleared: %+v", session)
+	}
 	if err := st.ClearActiveTurns(ctx); err != nil {
 		t.Fatal(err)
 	}