@bitkyc08/opencodex 2.79.0 → 2.80.0

package/src/adapters/cursor/tool-guidance.ts

@@ -1,6 +1,7 @@
 import type { OcxRequestOptions, OcxTool } from "../../types";
+import { CURSOR_TOOL_CALL_CONTINUATION, cursorUsesPlainToolWording } from "./tool-wording";
 import { CODE_MODE_HOST_CONTRACT_SENTENCE, CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
-import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EXEC_TOOL, clientSemanticToolNameFromCursorWire, cursorRequestAdvertisesApplyPatch, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolAllowedByChoice, cursorToolWireName, isCodexShellBridgeToolName, isCursorExecutionPathTool, isCursorStructuredEditToolName } from "./tool-naming";
+import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EXEC_TOOL, clientSemanticToolNameFromCursorWire, cursorRequestAdvertisesApplyPatch, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolAllowedByChoice, cursorToolWireName, isBareCodexShellBridgeTool, isClaudeClientBareToolName, isCodexShellBridgeToolName, isCursorExecutionPathTool, isCursorStructuredEditToolName } from "./tool-naming";
 
 export const CURSOR_SHELL_ALIAS_SYSTEM_NOTE =
   'Shell commands use the Codex shell bridge tool shown in this turn\'s catalog (`shell_command` or `exec_command`) with JSON arguments like {"cmd":"..."}. The long `mcp_opencodex-responses_*` display name is the same tool. Prefer it over Cursor-native Shell.';
@@ -129,7 +130,15 @@ function advertisedCoversNeighbor(wireNames: readonly string[], neighbor: (typeo
   return NEIGHBOR_AGENT_TOOL_ALIASES[neighbor].some(alias => advertised.has(alias.toLowerCase()));
 }
 
-function unavailableNeighborAgentToolNames(wireNames: readonly string[]): string[] {
+function unavailableNeighborAgentToolNames(
+  wireNames: readonly string[],
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
+): string[] {
+  if (
+    catalog
+    && !catalog.some(isBareCodexShellBridgeTool)
+    && catalog.some(tool => !tool.namespace && isClaudeClientBareToolName(tool.name))
+  ) return [];
   return NEIGHBOR_AGENT_TOOL_NAMES.filter(name => !advertisedCoversNeighbor(wireNames, name));
 }
 
@@ -144,12 +153,14 @@ function discoveryToolLabel(wireNames: readonly string[]): string | undefined {
 export function buildCursorToolGuidanceSystemNote(
   tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
   toolChoice?: OcxRequestOptions["toolChoice"],
+  modelId?: string,
 ): string | undefined {
   if (!tools?.length) return undefined;
+  const plainToolWording = cursorUsesPlainToolWording(modelId);
   const wireNames = [...new Set(
     tools
       .filter(tool => cursorToolAllowedByChoice(tool, toolChoice, tools))
-      .map(tool => cursorToolWireName(tool)),
+      .map(tool => cursorToolWireName(tool, tools)),
   )];
   if (wireNames.length === 0) return undefined;
 
@@ -170,7 +181,7 @@ export function buildCursorToolGuidanceSystemNote(
     ?.filter(tool => !tool.namespace && isCursorStructuredEditToolName(tool.name))
     .map(tool => tool.name) ?? [];
   const discoveryTools = discoveryToolLabel(wireNames);
-  const unavailableNeighborNames = unavailableNeighborAgentToolNames(wireNames);
+  const unavailableNeighborNames = unavailableNeighborAgentToolNames(wireNames, tools);
   // Host-shell-neutral: the Codex client executes bridge commands, and may differ from
   // the OpenCodex proxy OS (LAN/SSH remote-proxy). Always cover PowerShell 5.1 pitfalls.
   const hostShellNote = hasBareExec
@@ -179,6 +190,9 @@ export function buildCursorToolGuidanceSystemNote(
   const notes = [
     `Cursor tool calls: available tool names are exactly ${listedNames}.`,
     "Use the current tool catalog as ground truth and call only those exact names with their listed argument keys.",
+    plainToolWording && !codeMode && !hasBareExec
+      ? "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not available in this request. Use the listed tool that fits the operation."
+      : undefined,
     unavailableNeighborNames.length > 0
       ? `This turn does not expose neighboring-agent tool names ${quotedNames(unavailableNeighborNames)}; do not call or suggest them unless the catalog lists them.`
       : undefined,
@@ -191,18 +205,24 @@ export function buildCursorToolGuidanceSystemNote(
       ? CODE_MODE_RESULT_ECHO_SENTENCE + " There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers. " + CODE_MODE_HOST_CONTRACT_SENTENCE
       : undefined,
     codeMode
-      ? "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
+      ? plainToolWording
+        ? "Cursor-native Shell, Read, Grep, List, and Write are not available in this request. The exec code cell and its nested helpers provide the execution path; separately listed tools remain callable at the top level."
+        : "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
       : undefined,
     hasBareExec
       ? `${shellBridgeLabel} is the Codex Responses shell bridge for this turn, exposed through Cursor's tool protocol; it is not an external MCP server tool. \`shell_command\` and \`exec_command\` are aliases of the same bridge.`
       : undefined,
     hasBareExec
-      ? "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
+      ? plainToolWording
+        ? "Your tool list may display the same shell bridge under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; call the name listed in the catalog."
+        : "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
       : undefined,
     hasBareExec
-      ? `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
+      ? plainToolWording
+        ? `Cursor-native Shell, Read, Grep, List, and Write are not available in this request. ${shellBridgeLabel} provides shell execution through the Codex client host.`
+        : `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
       : undefined,
-    hasBareExec
+    hasBareExec && !plainToolWording
       ? "Tool-selection commentary is forbidden: for any shell, read, grep, list, or file operation, your FIRST visible action is the bridge call itself — never a sentence about which tool you will use, which tool was redirected, or switching surfaces. Words like 차단/전환/blocked/switching must not appear in your output for tool-routing reasons."
       : undefined,
     hostShellNote,
@@ -233,5 +253,6 @@ export function buildCursorToolGuidanceSystemNote(
       ? `For every file read, directory listing, grep, or shell operation use ${shellBridgeLabel} directly with host-shell-safe commands (POSIX: \`cat\`/\`ls\`/\`rg\`; Windows PowerShell: \`Get-Content\`/\`Get-ChildItem\`/\`Select-String\`). For file edits, use ${structuredEditNames.length > 0 ? `the structured edit tools (${quotedNames(structuredEditNames)}) or ` : ""}\`apply_patch\` when available.`
       : undefined,
   ].filter((note): note is string => typeof note === "string");
+  if (plainToolWording) notes.push(CURSOR_TOOL_CALL_CONTINUATION);
   return notes.join(" ");
 }

package/src/adapters/cursor/tool-naming.ts

@@ -67,11 +67,11 @@ function cursorToolChoiceMatches(
     if (catalogHasBareCodexShellBridge(catalog)) {
       return isBareCodexShellBridgeTool(tool);
     }
-    return tool.name === choiceName || cursorToolWireName(tool) === choiceName;
+    return tool.name === choiceName || cursorToolWireName(tool, catalog) === choiceName;
   }
   if (tool.name === choiceName) return true;
   if (cursorToolChoiceAliases(tool).includes(choiceName)) return true;
-  return cursorToolWireName(tool) === choiceName
+  return cursorToolWireName(tool, catalog) === choiceName
     && !catalog.some(candidate => candidate.name === choiceName);
 }
 
@@ -178,16 +178,49 @@ const CURSOR_PROXY_OWNED_BARE_TOOL_NAMES = new Set([
   CODEX_TOOL_SEARCH_TOOL,
 ]);
 
+export const CLAUDE_CLIENT_BARE_TOOL_NAMES = new Set([
+  "Bash",
+  "Read",
+  "Write",
+  "Edit",
+  "Grep",
+  "Glob",
+  "Task",
+  "GetDynamicTools",
+  "EnterMode",
+  "ExitMode",
+  "Todo",
+  "AddTodo",
+  "UpdateTodo",
+  "ViewTodo",
+  "WebSearch",
+  "FetchUrl",
+  "KillProcess",
+  "ListProcesses",
+  "ViewProcessOutput",
+]);
+
+export function isClaudeClientBareToolName(name: string): boolean {
+  return CLAUDE_CLIENT_BARE_TOOL_NAMES.has(name);
+}
+
 /** Avoid collisions with Cursor's private bare-tool namespace. */
-function isCursorBareClientToolWireAliased(
+export function isCursorBareClientToolWireAliased(
   tool: Pick<OcxTool, "namespace" | "name">,
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
 ): boolean {
-  return !tool.namespace
-    && !CURSOR_PROXY_OWNED_BARE_TOOL_NAMES.has(tool.name);
+  if (tool.namespace || CURSOR_PROXY_OWNED_BARE_TOOL_NAMES.has(tool.name)) return false;
+  if (isClaudeClientBareToolName(tool.name)) {
+    return catalog ? catalogHasBareCodexShellBridge(catalog) : false;
+  }
+  return true;
 }
 
-export function cursorToolWireName(tool: Pick<OcxTool, "namespace" | "name">): string {
-  if (isCursorBareClientToolWireAliased(tool)) {
+export function cursorToolWireName(
+  tool: Pick<OcxTool, "namespace" | "name">,
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
+): string {
+  if (isCursorBareClientToolWireAliased(tool, catalog)) {
     return `${CURSOR_CLIENT_TOOL_WIRE_PREFIX}${tool.name}`;
   }
   return namespacedToolName(tool.namespace, tool.name);

package/src/adapters/cursor/tool-wording.ts

@@ -0,0 +1,46 @@
+import type { OcxTool } from "../../types";
+import type { McpToolDefinition } from "./gen/agent_pb";
+import { CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
+import { OCX_RESPONSES_TOOL_PROVIDER, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolWireName } from "./tool-naming";
+
+/** Cursor may expose Claude with version-first, family-first, or effort-suffixed ids. */
+export function cursorUsesPlainToolWording(modelId?: string): boolean {
+  return /^(?:cursor\/)?claude-/i.test(modelId?.trim() ?? "");
+}
+
+export const CURSOR_TOOL_CALL_CONTINUATION = "Continue the task with that tool call.";
+const CURSOR_NO_CLIENT_TOOLS = "Cursor-native filesystem, shell, and fetch tools are not available through this execution channel. No client tools are available in this request. Answer without tools using the information already provided, or report that the requested operation cannot be completed without tools.";
+
+/** Factual catalog wording; legacy model wording is owned by native-exec.ts unchanged. */
+export function cursorPlainNativeExecRedirectHint(
+  tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
+  mcpToolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[],
+): string | undefined {
+  const clientTools = tools ?? [];
+  const names = [...new Set([
+    ...clientTools.map(tool => cursorToolWireName(tool, clientTools)),
+    ...mcpToolDefs.map(def => `mcp_${def.providerIdentifier}_${def.name}`),
+  ])];
+  if (names.length === 0) return CURSOR_NO_CLIENT_TOOLS;
+  const shown = names.slice(0, 16).map(name => `\`${name}\``).join(", ");
+  const more = names.length > 16 ? ` (+${names.length - 16} more)` : "";
+  const catalog = `Available tools in this request's catalog: ${shown}${more}. `
+    + `The harness displays a \`${OCX_RESPONSES_TOOL_PROVIDER}\` entry as \`mcp_${OCX_RESPONSES_TOOL_PROVIDER}_<name>\`; that is the same tool. `
+    + "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not available in this request. ";
+  if (!cursorRequestHasShellAlias(clientTools) && cursorRequestUsesCodeMode(clientTools)) {
+    return catalog + "`exec` takes a JavaScript body evaluated in a V8 isolate, not a shell command. Shell, file, search, and fetch are nested helpers called inside it as `await tools.<name>(...)`, for example `text(await tools.exec_command({cmd: \"ls\"}))`. "
+      + "`shell_command` and `exec_command` are nested helpers, not top-level tools here. Every other listed tool remains callable at the top level. "
+      + CODE_MODE_RESULT_ECHO_SENTENCE + " " + CURSOR_TOOL_CALL_CONTINUATION;
+  }
+  const operation = cursorRequestHasExecutionPath(clientTools)
+    ? "Use the listed execution tool with its advertised argument schema and the Codex client host's shell syntax; use a listed edit tool for file edits. "
+    : "Use the listed tool that fits the operation: a file, search, or fetch tool when provided, or a listed worker-agent delegation tool. ";
+  return catalog + operation + CURSOR_TOOL_CALL_CONTINUATION;
+}
+
+/** Fallback uses advertised dispatcher definitions, never assumed shell/edit tools. */
+export function cursorPlainNativeExecFallback(
+  toolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[] = [],
+): string {
+  return cursorPlainNativeExecRedirectHint([], toolDefs)!;
+}

package/src/adapters/cursor.ts

@@ -65,6 +65,7 @@ import {
   type CursorTransportFactory,
 } from "./cursor/transport";
 import { cursorLiveRosterScope } from "./cursor/catalog";
+import { cursorUsesPlainToolWording } from "./cursor/tool-wording";
 
 export const CURSOR_API_URL = "https://api2.cursor.sh";
 
@@ -313,8 +314,10 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
           const armMidstreamEcho = cursorNeedsExternalToolContinuation(activeRequest.modelId) && replaysToolResult;
           const midstreamObserver = armMidstreamEcho ? new CursorMidstreamEchoObserver() : undefined;
           const midstreamFilter = armMidstreamEcho ? new ToolEnvelopeEchoFilter() : undefined;
+          // Claude's factual redirects allow truthful routing prose; it is not a failure claim.
           const armRoutingCommentarySniffer =
             isCursorExternalWireModel(activeRequest.modelId)
+            && !cursorUsesPlainToolWording(activeRequest.modelId)
             && (
               cursorRequestUsesCodeMode(activeRequest.tools, activeRequest.toolChoice)
               || cursorRequestHasShellAlias(activeRequest.tools)

package/src/adapters/devin.ts

@@ -524,30 +524,44 @@ export function mapOcxMessagesToDevin(
   if (system) items.push({ role: "system", content: system });
 
   let previousToolResult: ChatHistoryItem | undefined;
+  let textChunks: string[] | undefined;
+  const flushText = () => {
+    if (previousToolResult && textChunks) previousToolResult.content = textChunks.join("\n\n");
+    textChunks = undefined;
+  };
   for (const message of parsed.context.messages) {
     // Original-message adjacency matters even when an intervening message maps to nothing.
-    if (message.role !== "toolResult") previousToolResult = undefined;
+    if (message.role !== "toolResult") {
+      flushText();
+      previousToolResult = undefined;
+    }
     const mapped = mapOneMessage(message, parsed.modelId, options);
     if (!mapped) continue;
     if (mapped.role === "tool") {
       if (previousToolResult && previousToolResult.tool_call_id === mapped.tool_call_id) {
         const previous = previousToolResult;
-        previous.content = typeof previous.content === "string" && typeof mapped.content === "string"
-          ? `${previous.content}\n\n${mapped.content}`
-          : [
-              ...(typeof previous.content === "string"
-                ? [{ type: "text" as const, text: previous.content }] : previous.content),
-              { type: "text", text: "\n\n" },
-              ...(typeof mapped.content === "string"
-                ? [{ type: "text" as const, text: mapped.content }] : mapped.content),
-            ];
+        if (textChunks && typeof mapped.content === "string") {
+          textChunks.push(mapped.content);
+        } else {
+          flushText();
+          // mapOneMessage owns these wire arrays; append without recopying their prefix.
+          const parts: ContentPart[] = typeof previous.content === "string"
+            ? [{ type: "text", text: previous.content }] : previous.content;
+          parts.push({ type: "text", text: "\n\n" });
+          if (typeof mapped.content === "string") parts.push({ type: "text", text: mapped.content });
+          else for (const part of mapped.content) parts.push(part);
+          previous.content = parts;
+        }
         if (mapped.is_error) previous.is_error = true;
         continue;
       }
+      flushText();
       previousToolResult = mapped;
+      textChunks = typeof mapped.content === "string" ? [mapped.content] : undefined;
     }
     items.push(mapped);
   }
+  flushText();
   return items;
 }
 
@@ -795,7 +809,7 @@ export function createDevinAdapter(
         // An admitted HTTP turn owns globally shared capacity until this call
         // emits. Without an explicit wait allowance, preserve the typed reset
         // delay in generated diagnostic wording and return immediately.
-        const signedMessages = mapOcxMessagesToDevin(parsed);
+        const signedMessages = messages; // Reuse the history already mapped above.
         // A Claude signature is replayed because it is what carries the reasoning into this
         // turn, but Cognition streams Claude's thinking as a summary the signature does not
         // cover, and some replays are refused with invalid_argument before any output. That

package/src/adapters/openai-chat/messages.ts

@@ -144,7 +144,9 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
   const nativeOpenAI = isNativeOpenAIChatTarget(provider);
   // Qwen3.8-27B's pinned chat template rejects non-leading system and every developer role;
   // a later user is rendered in place. Keep this exception specific to that template family.
-  const qwen38LeadingSystemTemplate = !nativeOpenAI && /^(?:Qwen\/)?(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?)$/i.test(parsed.modelId);
+  // Gateways serve it under namespaced ids (LiteLLM's openai/Qwen3.8-27B, #6674), so any number
+  // of leading path segments is accepted; the final segment still has to name the checkpoint.
+  const qwen38LeadingSystemTemplate = !nativeOpenAI && /^(?:[^/]+\/)*(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?)$/i.test(parsed.modelId);
   // Which role a developer message carries, and why the unrecorded state folds, is stated once
   // in ./developer-role.ts and read from there by the native passthrough as well. Either way the
   // message keeps the slot it arrived in — only the role changes, never the position.

package/src/claude/inbound.ts

@@ -72,6 +72,15 @@ function toolResultOutput(block: Rec): string | Rec[] {
       if (!isRec(item)) continue;
       if (item.type === "text" && typeof item.text === "string") {
         out.push({ type: "input_text", text: item.text });
+      } else if (item.type === "tool_reference" && typeof item.tool_name === "string" && item.tool_name.length > 0) {
+        // Responses has no tool_reference result carrier. Preserve ToolSearch's loaded-name
+        // evidence as result text so a reference-only reply does not become empty (#6647).
+        // This describes client output; it must not create tools or widen authorization.
+        // Text-only tool output is later joined without separators, so the marker carries its
+        // own line breaks to keep each loaded name distinct from its neighbours.
+        const prev = out[out.length - 1];
+        const lead = prev?.type === "input_text" && typeof prev.text === "string" && !prev.text.endsWith("\n") ? "\n" : "";
+        out.push({ type: "input_text", text: `${lead}Tool loaded: ${item.tool_name}\n` });
       } else if (item.type === "image") {
         const img = imageBlockToInputImage(item);
         if (img) out.push(img);

package/src/codex/autostart-health.ts

@@ -4,7 +4,7 @@ import type { OcxConfig } from "../types";
 import { getCodexRoutingKind, type CodexRoutingKind } from "./inject";
 import { collectRoutingAdoption, type RoutingAdoptionEvidence } from "./routing-adoption";
 import { diagnoseCodexShim, type CodexShimDiagnostic } from "./shim";
-import { diagnoseMacDesktopStartup, type DesktopStartupDiagnostic } from "../service/desktop-startup";
+import { diagnoseDesktopStartup, type DesktopStartupDiagnostic } from "../service/desktop-startup";
 
 export type StartupProtection = "service" | "desktop" | "shim" | "none";
 export type StartupHealthStatus = "native" | "protected" | "at-risk";
@@ -90,7 +90,7 @@ export function deriveStartupHealth(inputs: StartupHealthInputs): StartupHealth
   // We can only credit an opencodex service/shim for routing that opencodex owns.
   // An arbitrary localhost gateway has an independent lifecycle that OCX cannot repair.
   const ownsLocalRouting = inputs.routingKind === "opencodex-local";
-  const desktopEffective = inputs.platform === "darwin" && !inputs.diagnosticStale
+  const desktopEffective = (inputs.platform === "darwin" || inputs.platform === "linux") && !inputs.diagnosticStale
     && inputs.desktop?.owned === true && inputs.desktop.loginEnabled
     && inputs.desktop.running && inputs.desktop.viable;
   const protection: StartupProtection = ownsLocalRouting && inputs.serviceViable
@@ -147,7 +147,7 @@ export function collectStartupHealth(
   const shim = diagnostics.shim ?? diagnoseCodexShim();
   const service = diagnostics.service ?? diagnoseService();
   const routingKind = diagnostics.routingKind ?? getCodexRoutingKind();
-  const desktop = diagnostics.desktop ?? diagnoseMacDesktopStartup();
+  const desktop = diagnostics.desktop ?? diagnoseDesktopStartup();
   const routingAdoption = diagnostics.routingAdoption
     ?? (routingKind === "opencodex-local" ? collectRoutingAdoption({ routingKind }) : undefined);
   return deriveStartupHealth({

package/src/codex/journal.ts

@@ -85,6 +85,9 @@ export interface RestoreJournalResult {
   ownershipRefusal?: CodexHomeOwnerRefusalReason;
   configRestored: boolean;
   profileRestored: boolean;
+  /** True only when restore rewrote or removed a file (not when state was already original). */
+  configRewritten: boolean;
+  profileRewritten: boolean;
   configChanged: boolean;
   profileChanged: boolean;
   complete: boolean;
@@ -299,12 +302,13 @@ export function restoreJournalState(): RestoreJournalResult {
   try { assertCodexHomeOwner(CODEX_HOME); }
   catch (error) {
     if (!(error instanceof CodexHomeOwnerRefusal)) throw error;
-    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false,
-      complete: false, unverified: true, ownershipRefusal: error.reason };
+    return { configRestored: false, profileRestored: false, configRewritten: false, profileRewritten: false,
+      configChanged: false, profileChanged: false, complete: false, unverified: true, ownershipRefusal: error.reason };
   }
   const journal = readJournal();
   if (!journal) {
-    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false, complete: false, unverified: false };
+    return { configRestored: false, profileRestored: false, configRewritten: false, profileRewritten: false,
+      configChanged: false, profileChanged: false, complete: false, unverified: false };
   }
   const currentConfig = existsSync(CODEX_CONFIG_PATH) ? readFileSync(CODEX_CONFIG_PATH, "utf-8") : null;
   const currentProfile = existsSync(CODEX_PROFILE_PATH) ? readFileSync(CODEX_PROFILE_PATH, "utf-8") : null;
@@ -316,6 +320,8 @@ export function restoreJournalState(): RestoreJournalResult {
     return {
       configRestored: comparison.configAlreadyOriginal,
       profileRestored: comparison.profileAlreadyOriginal,
+      configRewritten: false,
+      profileRewritten: false,
       configChanged: !configUnchanged,
       profileChanged: !profileUnchanged,
       complete: false,
@@ -326,14 +332,18 @@ export function restoreJournalState(): RestoreJournalResult {
   assertCodexHomeOwner(CODEX_HOME);
   let configRestored = comparison.configAlreadyOriginal;
   let profileRestored = comparison.profileAlreadyOriginal;
+  let configRewritten = false;
+  let profileRewritten = false;
   if (configUnchanged && !configRestored) {
     atomicWriteFile(CODEX_CONFIG_PATH, comparison.originalConfig);
     configRestored = true;
+    configRewritten = true;
   }
   if (profileUnchanged && !profileRestored) {
     if (comparison.originalProfile !== null) {
       atomicWriteFile(CODEX_PROFILE_PATH, comparison.originalProfile);
       profileRestored = true;
+      profileRewritten = true;
     } else if (existsSync(CODEX_PROFILE_PATH)) {
       // "There was no profile before, so remove the one we generated." Claiming success
       // without checking is how a caller ends up deleting the journal, reporting a clean
@@ -343,6 +353,7 @@ export function restoreJournalState(): RestoreJournalResult {
       try {
         unlinkSync(CODEX_PROFILE_PATH);
         profileRestored = true;
+        profileRewritten = true;
       } catch (error) {
         profileRestored = (error as NodeJS.ErrnoException).code === "ENOENT";
       }
@@ -355,6 +366,8 @@ export function restoreJournalState(): RestoreJournalResult {
   return {
     configRestored,
     profileRestored,
+    configRewritten,
+    profileRewritten,
     configChanged: !configUnchanged,
     profileChanged: !profileUnchanged,
     complete,
@@ -367,6 +380,11 @@ export function restoreJournal(): boolean {
   return restoreJournalState().complete;
 }
 
+/** A no-rewrite recovery is quiet only when the stale journal is actually gone. */
+function warnIfJournalRetained(): void {
+  if (existsSync(JOURNAL_PATH)) console.error("⚠️ Codex journal recovery found nothing to restore, but the journal could not be removed; it will be retried on the next start.");
+}
+
 export interface ReconcileJournalOptions {
   activeClientApiKeyId?: string;
 }
@@ -388,7 +406,13 @@ export function reconcileJournal(options: ReconcileJournalOptions = {}): boolean
       console.error("⚠️ Codex journal recovery was not verified; current configuration files and the journal were preserved.");
       return false;
     }
-    if (!restored.configRestored && !restored.profileRestored) return false;
+    if (!restored.complete) {
+      console.error("⚠️ Codex journal recovery was incomplete; the journal was preserved — check the Codex files.");
+      return false;
+    }
+    // Warn only when restore actually rewrote state; an already-original
+    // snapshot still cleans itself up but has nothing to report.
+    if (!restored.configRewritten && !restored.profileRewritten) { warnIfJournalRetained(); return false; }
     console.error(`⚠️  Uncommitted or mismatched client routing (${owner.apiKeyId}) was restored from the Codex journal.`);
     return true;
   }
@@ -406,7 +430,14 @@ export function reconcileJournal(options: ReconcileJournalOptions = {}): boolean
     console.error("⚠️ Codex journal recovery was not verified; current configuration files and the journal were preserved.");
     return false;
   }
-  if (!restored.configRestored && !restored.profileRestored) return false;
+  if (!restored.complete) {
+    console.error("⚠️ Codex journal recovery was incomplete; the journal was preserved — check the Codex files.");
+    return false;
+  }
+  // Warn only when restore actually rewrote state. A stale journal whose
+  // artifacts are already original still cleans itself up (complete removes
+  // it) but has nothing to report — claiming a restore then cries wolf.
+  if (!restored.configRewritten && !restored.profileRewritten) { warnIfJournalRetained(); return false; }
   console.error(`⚠️  Previous session (PID ${pid}) did not shut down cleanly. Codex state restored from journal.`);
   return true;
 }

package/src/codex/shim-overlay.ts

@@ -48,11 +48,19 @@ function lexical(path: string): Stats | null {
   try { return lstatSync(path); }
   catch (error) { if (fileErrorCode(error) === "ENOENT") return null; throw error; }
 }
+/** Name the path and the failed check; a group/world-writable owned file gets the chmod that fixes it. */
+function untrustedArtifact(path: string, stat: Stats): Error {
+  const prefix = `Private Codex artifact is not an owned regular file: ${path}`;
+  if (stat.isSymbolicLink() || !stat.isFile()) return new Error(`${prefix} is not a regular file`);
+  if (stat.uid !== process.getuid?.()) return new Error(`${prefix} is owned by uid ${stat.uid}`);
+  const mode = (stat.mode & 0o777).toString(8).padStart(4, "0");
+  return new Error(`${prefix} is group- or world-writable (mode ${mode}); run chmod 600 ${shQuote(path)} and retry`);
+}
 function snapshot(path: string): Snapshot | null {
   const before = lexical(path);
   if (!before) return null;
   if (!before.isFile() || before.isSymbolicLink() || before.uid !== process.getuid?.() || (before.mode & 0o022)) {
-    throw new Error("Private Codex artifact is not an owned regular file");
+    throw untrustedArtifact(path, before);
   }
   const bounded = readBoundedRegularFile(path, PRIVATE_FILE_MAX_BYTES);
   if (!bounded || "warning" in bounded) throw new Error("Private Codex artifact is unreadable or changed");

package/src/combos/jev.ts

@@ -47,6 +47,7 @@ const TOOL_NAME_CHARS = 160;
 const VISIBLE_TEXT_CHUNK_CHARS = 16_384;
 
 const ENVELOPE_TAGS = [
+  "system-reminder",
   "codex_internal_context",
   "recommended_plugins",
   "environment_context",
@@ -302,7 +303,8 @@ function taskWithoutProtectedEnvelopes(text: string): string {
       }
     } else {
       if (stack.length === 0) appendTrimmedRange(visible, "\n", 0, 1);
-      if (!completedGoal && !goal && tag === "codex_internal_context") {
+      // A Codex goal quoted inside a Claude reminder is context, never a fallback task.
+      if (!completedGoal && !goal && tag === "codex_internal_context" && !stack.includes("system-reminder")) {
         goal = { sample: emptyTextSample(), pendingWhitespace: emptyTextSample() };
         goalDepth = stack.length;
       }