@delt/claude-alarm 1.1.1 → 1.3.0

package/dist/cli.js

@@ -12,7 +12,7 @@ var __export = (target, all) => {
 // src/shared/constants.ts
 import path from "path";
 import os from "os";
-var DEFAULT_HUB_HOST, DEFAULT_HUB_PORT, CONFIG_DIR, CONFIG_FILE, PID_FILE, LOG_FILE, UPLOADS_DIR, CODEX_PID_FILE, CODEX_LOG_FILE, WS_PATH_CHANNEL, WS_PATH_DASHBOARD, CHANNEL_SERVER_NAME, CHANNEL_SERVER_VERSION;
+var DEFAULT_HUB_HOST, DEFAULT_HUB_PORT, CONFIG_DIR, CONFIG_FILE, PID_FILE, LOG_FILE, UPLOADS_DIR, CODEX_PID_FILE, CODEX_LOG_FILE, WS_PATH_CHANNEL, WS_PATH_DASHBOARD, WS_PATH_CODEX, CHANNEL_SERVER_NAME, CHANNEL_SERVER_VERSION;
 var init_constants = __esm({
   "src/shared/constants.ts"() {
     "use strict";
@@ -27,6 +27,7 @@ var init_constants = __esm({
     CODEX_LOG_FILE = path.join(CONFIG_DIR, "codex.log");
     WS_PATH_CHANNEL = "/ws/channel";
     WS_PATH_DASHBOARD = "/ws/dashboard";
+    WS_PATH_CODEX = "/ws/codex";
     CHANNEL_SERVER_NAME = "claude-alarm";
     CHANNEL_SERVER_VERSION = "0.1.0";
   }
@@ -201,6 +202,19 @@ var init_crash_guard = __esm({
   }
 });
 
+// src/shared/hub-url.ts
+import net from "net";
+function hubUrlHost(host) {
+  if (host === "" || host === "0.0.0.0") return "127.0.0.1";
+  if (host === "::") return "[::1]";
+  return net.isIPv6(host) ? `[${host}]` : host;
+}
+var init_hub_url = __esm({
+  "src/shared/hub-url.ts"() {
+    "use strict";
+  }
+});
+
 // src/shared/peer-name.ts
 function isValidPeerName(name) {
   return typeof name === "string" && name.trim() !== "" && SAFE_PEER_NAME.test(name);
@@ -351,6 +365,7 @@ var init_notifier = __esm({
           execFile(
             "powershell",
             ["-Command", '(Get-ItemProperty -Path "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\PushNotifications" -Name ToastEnabled -ErrorAction SilentlyContinue).ToastEnabled'],
+            { windowsHide: true },
             (err, stdout) => {
               if (err) {
                 resolve(true);
@@ -368,7 +383,7 @@ var init_notifier = __esm({
         logger.warn("Windows notifications are disabled. Opening notification settings...");
         logger.warn("Please enable notifications for this app, then try again.");
         if (process.platform === "win32") {
-          execFile("powershell", ["-Command", "Start-Process ms-settings:notifications"]);
+          execFile("powershell", ["-Command", "Start-Process ms-settings:notifications"], { windowsHide: true });
         }
         setTimeout(() => {
           this.notificationSettingsOpened = false;
@@ -424,10 +439,13 @@ var init_permission_key = __esm({
 });
 
 // src/hub/telegram.ts
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path6 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-var TELEGRAM_API, MAX_CHOICE_MESSAGES, TelegramBot;
+function visibleLength(html) {
+  return html.replace(/<[^>]*>/g, "").replace(/&(?:amp|lt|gt);/g, "&").length;
+}
+var TELEGRAM_API, MAX_CHOICE_MESSAGES, MAX_SELECTIONS, MAX_VISIBLE_CHARS, TRUNCATED, MAX_PHOTO_BYTES, TelegramBot;
 var init_telegram = __esm({
   "src/hub/telegram.ts"() {
     "use strict";
@@ -437,6 +455,10 @@ var init_telegram = __esm({
     init_permission_key();
     TELEGRAM_API = "https://api.telegram.org/bot";
     MAX_CHOICE_MESSAGES = 200;
+    MAX_SELECTIONS = 20;
+    MAX_VISIBLE_CHARS = 4e3;
+    TRUNCATED = "\u2026(truncated)";
+    MAX_PHOTO_BYTES = 10 * 1024 * 1024;
     TelegramBot = class _TelegramBot {
       config;
       offset = 0;
@@ -457,9 +479,9 @@ var init_telegram = __esm({
       choiceMessages = /* @__PURE__ */ new Map();
       // Callback: get current sessions list
       getSessions;
-      // Pending messages for session selection
-      pendingMessages = /* @__PURE__ */ new Map();
-      // chatId -> pending
+      latestSelection;
+      // Keyed by prompt, not by chat: buttons from an older prompt must still send that prompt's message.
+      selections = /* @__PURE__ */ new Map();
       constructor(config2) {
         this.config = config2;
       }
@@ -468,8 +490,7 @@ var init_telegram = __esm({
       }
       /** Send a notification message to Telegram */
       async sendNotification(sessionId2, _sessionLabel, title, message) {
-        const text = `<b>${this.escHtml(title)}</b>
-${this.mdToHtml(message)}`;
+        const text = this.fitNotification(title, message);
         const result = await this.sendMessage(text);
         if (result?.message_id) {
           this.messageSessionMap.set(result.message_id, sessionId2);
@@ -481,6 +502,25 @@ ${this.mdToHtml(message)}`;
           }
         }
       }
+      fitNotification(title, message) {
+        const render = (body) => `<b>${this.escHtml(title)}</b>
+${this.mdToHtml(body)}`;
+        const full = render(message);
+        if (visibleLength(full) <= MAX_VISIBLE_CHARS) return full;
+        const cut = (n) => {
+          const end = n > 0 && /[\uD800-\uDBFF]/.test(message[n - 1]) ? n - 1 : n;
+          return render(`${message.slice(0, end)}
+${TRUNCATED}`);
+        };
+        let lo = 0;
+        let hi = message.length;
+        while (lo < hi) {
+          const mid = Math.ceil((lo + hi) / 2);
+          if (visibleLength(cut(mid)) <= MAX_VISIBLE_CHARS) lo = mid;
+          else hi = mid - 1;
+        }
+        return cut(lo);
+      }
       /** Send a text message to the configured chat */
       async sendMessage(text, replyToMessageId, replyMarkup) {
         try {
@@ -562,6 +602,13 @@ ${this.mdToHtml(message)}`;
         const hasPhoto = msg.photo && msg.photo.length > 0;
         const text = (msg.text || msg.caption || "").trim();
         if (!text && !hasPhoto) return;
+        if (hasPhoto) {
+          const size = msg.photo[msg.photo.length - 1].file_size;
+          if (size !== void 0 && size > MAX_PHOTO_BYTES) {
+            this.photoNotDelivered("it is larger than 10 MB");
+            return;
+          }
+        }
         if (msg.reply_to_message) {
           const sessionId2 = this.messageSessionMap.get(msg.reply_to_message.message_id);
           if (sessionId2) {
@@ -575,18 +622,20 @@ ${this.mdToHtml(message)}`;
         }
         if (text) {
           const selectMatch = text.match(/^\/s_(\d+)$/);
-          if (selectMatch) {
-            const pending = this.pendingMessages.get(msg.chat.id);
+          const latest = this.latestSelection;
+          if (selectMatch && latest !== void 0) {
+            const pending = this.selections.get(latest);
             if (pending) {
-              this.pendingMessages.delete(msg.chat.id);
+              this.selections.delete(latest);
               const session = this.pendingSession(pending, parseInt(selectMatch[1], 10) - 1);
               if (session) {
+                let delivered = true;
                 if (pending.photoFileId) {
-                  await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
+                  delivered = await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
                 } else if (pending.text) {
                   this.deliverToSession(session.id, pending.text);
                 }
-                this.sendMessage(`Sent to [${this.getLabel(session)}]`);
+                if (delivered) this.sendMessage(`Sent to [${this.getLabel(session)}]`);
               } else {
                 this.sendMessage("Invalid session number.");
               }
@@ -607,16 +656,19 @@ ${this.mdToHtml(message)}`;
           }
           return;
         }
+        const selectionId = randomUUID2().replace(/-/g, "").slice(0, 8);
+        this.latestSelection = selectionId;
         const sessionIds = sessions.map((s) => s.id);
         if (hasPhoto) {
           const largest = msg.photo[msg.photo.length - 1];
-          this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text, sessionIds });
+          this.selections.set(selectionId, { photoFileId: largest.file_id, caption: text, sessionIds });
         } else {
-          this.pendingMessages.set(msg.chat.id, { text, sessionIds });
+          this.selections.set(selectionId, { text, sessionIds });
         }
+        while (this.selections.size > MAX_SELECTIONS) this.selections.delete(this.selections.keys().next().value);
         const buttons = sessions.map((s, i) => ({
           text: this.getLabel(s),
-          callback_data: `sess:${i}:${msg.chat.id}`
+          callback_data: `sel:${selectionId}:${i}`
         }));
         const rows = [];
         for (let i = 0; i < buttons.length; i += 2) {
@@ -631,44 +683,54 @@ ${this.mdToHtml(message)}`;
       }
       async deliverPhotoToSession(sessionId2, photos, caption) {
         const largest = photos[photos.length - 1];
-        await this.deliverPhotoToSessionByFileId(sessionId2, largest.file_id, caption);
+        return this.deliverPhotoToSessionByFileId(sessionId2, largest.file_id, caption);
       }
       async deliverPhotoToSessionByFileId(sessionId2, fileId, caption) {
         try {
           const fileRes = await fetch(`${this.apiUrl}/getFile?file_id=${fileId}`);
-          if (!fileRes.ok) {
-            logger.warn("Failed to get Telegram file info");
-            return;
+          const fileData = fileRes.ok ? await fileRes.json() : void 0;
+          if (!fileData?.ok || !fileData.result) {
+            this.photoNotDelivered("Telegram did not return the file");
+            return false;
           }
-          const fileData = await fileRes.json();
-          if (!fileData.ok) return;
           const downloadUrl = `https://api.telegram.org/file/bot${this.config.botToken}/${fileData.result.file_path}`;
           const imgRes = await fetch(downloadUrl);
           if (!imgRes.ok) {
-            logger.warn("Failed to download Telegram photo");
-            return;
+            this.photoNotDelivered("the download failed");
+            return false;
           }
           const buffer = Buffer.from(await imgRes.arrayBuffer());
+          if (buffer.length > MAX_PHOTO_BYTES) {
+            this.photoNotDelivered("it is larger than 10 MB");
+            return false;
+          }
           const ext = fileData.result.file_path.split(".").pop() || "jpg";
           const mimeType = ext === "png" ? "image/png" : ext === "gif" ? "image/gif" : ext === "webp" ? "image/webp" : "image/jpeg";
-          fs4.mkdirSync(UPLOADS_DIR, { recursive: true });
+          fs5.mkdirSync(UPLOADS_DIR, { recursive: true });
           const filename = `${randomUUID2()}.${ext}`;
-          const filePath = path4.join(UPLOADS_DIR, filename);
-          fs4.writeFileSync(filePath, buffer);
+          const filePath = path6.join(UPLOADS_DIR, filename);
+          fs5.writeFileSync(filePath, buffer);
           logger.info(`Telegram photo saved: ${filename} (${buffer.length} bytes)`);
           if (this.onImageToSession) {
             this.onImageToSession(sessionId2, filePath, mimeType, caption);
           }
           setTimeout(() => {
             try {
-              fs4.unlinkSync(filePath);
+              fs5.unlinkSync(filePath);
             } catch {
             }
-          }, 5 * 60 * 1e3);
+          }, 5 * 60 * 1e3).unref();
+          return this.onImageToSession !== void 0;
         } catch (err) {
           logger.warn(`Telegram photo download failed: ${err.message}`);
+          this.photoNotDelivered("the download failed");
+          return false;
         }
       }
+      photoNotDelivered(reason) {
+        logger.warn(`Telegram photo not delivered: ${reason}`);
+        void this.sendMessage(`Photo not delivered: ${reason}`);
+      }
       // Buttons are numbered against the list shown when they were sent; Codex sessions come and go, so the live list may have shifted.
       pendingSession(pending, idx) {
         const id = pending.sessionIds[idx];
@@ -782,7 +844,7 @@ ${this.escHtml(description)}` : "") + (slice ? `
       async handleChoiceCallback(query) {
         const choice = this.choiceTokens.get(query.data.slice("pc:".length));
         if (!choice) {
-          await this.answerCallbackQuery(query.id, "Expired");
+          await this.expire(query);
           return;
         }
         this.dropChoiceTokens(choice.sessionId, choice.requestId);
@@ -811,10 +873,14 @@ ${this.escHtml(description)}` : "") + (slice ? `
       async handleCallbackQuery(query) {
         if (!query.data) return;
         if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
-        if (query.data.startsWith("sess:")) {
+        if (query.data.startsWith("sel:")) {
           await this.handleSessionSelectCallback(query);
           return;
         }
+        if (query.data.startsWith("sess:")) {
+          await this.expire(query);
+          return;
+        }
         if (query.data.startsWith("pc:")) {
           await this.handleChoiceCallback(query);
           return;
@@ -837,19 +903,25 @@ ${label}`);
         }
       }
       async handleSessionSelectCallback(query) {
-        const parts = query.data.split(":");
-        if (parts.length < 3) return;
-        const [, idxStr, chatIdStr] = parts;
-        const chatId = parseInt(chatIdStr, 10);
-        const pending = this.pendingMessages.get(chatId);
-        const session = pending ? this.pendingSession(pending, parseInt(idxStr, 10)) : void 0;
-        if (!pending || !session) {
+        const [, selectionId, idxStr] = query.data.split(":");
+        const pending = this.selections.get(selectionId);
+        if (!pending) {
+          await this.expire(query);
+          return;
+        }
+        const session = this.pendingSession(pending, parseInt(idxStr, 10));
+        if (!session) {
           await this.answerCallbackQuery(query.id, "Session not found");
           return;
         }
-        this.pendingMessages.delete(chatId);
+        this.selections.delete(selectionId);
         if (pending.photoFileId) {
-          await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
+          const delivered = await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
+          if (!delivered) {
+            await this.answerCallbackQuery(query.id, "Photo not delivered");
+            if (query.message) await this.removeButtons(query.message.chat.id, query.message.message_id);
+            return;
+          }
         } else if (pending.text) {
           this.deliverToSession(session.id, pending.text);
         }
@@ -869,6 +941,21 @@ ${label}`);
           logger.warn(`Telegram answerCallbackQuery error: ${err.message}`);
         }
       }
+      async expire(query) {
+        await this.answerCallbackQuery(query.id, "Expired");
+        if (query.message) await this.removeButtons(query.message.chat.id, query.message.message_id);
+      }
+      async removeButtons(chatId, messageId) {
+        try {
+          await fetch(`${this.apiUrl}/editMessageReplyMarkup`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ chat_id: chatId, message_id: messageId, reply_markup: { inline_keyboard: [] } })
+          });
+        } catch (err) {
+          logger.warn(`Telegram editMessageReplyMarkup error: ${err.message}`);
+        }
+      }
       async editMessageText(chatId, messageId, text) {
         try {
           await fetch(`${this.apiUrl}/editMessageText`, {
@@ -913,8 +1000,8 @@ ${label}`);
         css: "css",
         scss: "scss"
       };
-      langOf(path10) {
-        const m = /\.([a-z0-9]+)$/i.exec(path10 || "");
+      langOf(path12) {
+        const m = /\.([a-z0-9]+)$/i.exec(path12 || "");
         return m ? _TelegramBot.LANG_BY_EXT[m[1].toLowerCase()] ?? "" : "";
       }
       /** Convert markdown to Telegram HTML (escape first, then apply formatting) */
@@ -961,10 +1048,15 @@ ${bodyLines.join("\n")}`;
 
 // src/hub/codex-supervisor.ts
 import { spawn as spawn2 } from "child_process";
-import fs5 from "fs";
-import path5 from "path";
+import fs6 from "fs";
+import path7 from "path";
 function resolveAdapterScript(baseDir) {
-  return [path5.join(baseDir, "..", "codex", "main.js"), path5.join(baseDir, "codex", "main.js")].find((p) => fs5.existsSync(p));
+  return [path7.join(baseDir, "..", "codex", "main.js"), path7.join(baseDir, "codex", "main.js")].find((p) => fs6.existsSync(p));
+}
+function adapterEnv(base, hub) {
+  const env = { ...base, CLAUDE_ALARM_HUB_HOST: hub.host, CLAUDE_ALARM_HUB_PORT: String(hub.port) };
+  delete env.CLAUDE_ALARM_HUB_TOKEN;
+  return env;
 }
 var HEALTHY_RUN_MS, CodexSupervisor;
 var init_codex_supervisor = __esm({
@@ -973,18 +1065,24 @@ var init_codex_supervisor = __esm({
     init_logger();
     HEALTHY_RUN_MS = 6e4;
     CodexSupervisor = class {
-      constructor(script, spawnFn = spawn2, minDelayMs = 2e3, maxDelayMs = 6e4, stopGraceMs = 3e3) {
+      constructor(script, opts = {}) {
         this.script = script;
-        this.spawnFn = spawnFn;
-        this.minDelayMs = minDelayMs;
-        this.maxDelayMs = maxDelayMs;
-        this.stopGraceMs = stopGraceMs;
-        this.delay = minDelayMs;
+        this.spawnFn = opts.spawnFn ?? spawn2;
+        this.minDelayMs = opts.minDelayMs ?? 2e3;
+        this.maxDelayMs = opts.maxDelayMs ?? 6e4;
+        this.stopGraceMs = opts.stopGraceMs ?? 3e3;
+        this.env = opts.env;
+        this.delay = this.minDelayMs;
       }
       child;
       timer;
       stopped = true;
       delay;
+      spawnFn;
+      minDelayMs;
+      maxDelayMs;
+      stopGraceMs;
+      env;
       start() {
         this.stopped = false;
         this.launch();
@@ -1006,7 +1104,8 @@ var init_codex_supervisor = __esm({
         const child = this.spawnFn(process.execPath, [this.script, "--watch-stdin"], {
           detached: true,
           stdio: ["pipe", "pipe", "pipe"],
-          windowsHide: true
+          windowsHide: true,
+          ...this.env ? { env: this.env } : {}
         });
         this.child = child;
         child.stdout?.on("data", (d) => process.stdout.write(d));
@@ -1030,16 +1129,28 @@ var init_codex_supervisor = __esm({
   }
 });
 
+// src/shared/entry.ts
+function isEntryScript(argv1, suffixes) {
+  if (!argv1) return false;
+  const normalized = argv1.replace(/\\/g, "/");
+  return suffixes.some((suffix) => normalized.endsWith(suffix));
+}
+var init_entry = __esm({
+  "src/shared/entry.ts"() {
+    "use strict";
+  }
+});
+
 // src/hub/auth.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 function safeEqual(a, b) {
   if (typeof a !== "string") return false;
   const x = Buffer.from(a);
   const y = Buffer.from(b);
-  return x.length === y.length && crypto.timingSafeEqual(x, y);
+  return x.length === y.length && crypto2.timingSafeEqual(x, y);
 }
 function dashboardCookieValue(token) {
-  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+  return crypto2.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
 }
 function parseCookies(header) {
   const out = {};
@@ -1099,8 +1210,8 @@ __export(server_exports, {
   HubServer: () => HubServer
 });
 import http from "http";
-import fs6 from "fs";
-import path6 from "path";
+import fs7 from "fs";
+import path8 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer, WebSocket as WebSocket2 } from "ws";
 import { randomUUID as randomUUID3 } from "crypto";
@@ -1109,7 +1220,7 @@ function validChoices(choices) {
   const valid = choices.filter((c) => typeof c?.id === "string" && typeof c?.label === "string");
   return valid.length ? valid : void 0;
 }
-var __dirname, MAX_WS_PAYLOAD, HubServer;
+var __dirname, MAX_WS_PAYLOAD, nonEmpty, HubServer;
 var init_server = __esm({
   "src/hub/server.ts"() {
     "use strict";
@@ -1123,9 +1234,12 @@ var init_server = __esm({
     init_session_label();
     init_crash_guard();
     init_permission_key();
+    init_entry();
+    init_hub_url();
     init_auth();
-    __dirname = path6.dirname(fileURLToPath(import.meta.url));
+    __dirname = path8.dirname(fileURLToPath(import.meta.url));
     MAX_WS_PAYLOAD = 16 * 1024 * 1024;
+    nonEmpty = (v) => typeof v === "string" && v.trim() !== "";
     HubServer = class {
       httpServer;
       wssChannel;
@@ -1151,7 +1265,13 @@ var init_server = __esm({
       token;
       codexEnabled;
       codexSupervisor;
-      constructor(config2) {
+      wssCodex;
+      codexAdapters = /* @__PURE__ */ new Map();
+      codexAlive = /* @__PURE__ */ new WeakMap();
+      codexCallTimeoutMs;
+      codexCalls = /* @__PURE__ */ new Map();
+      constructor(config2, options = {}) {
+        this.codexCallTimeoutMs = options.codexCallTimeoutMs ?? 6e4;
         this.host = config2?.hub?.host ?? DEFAULT_HUB_HOST;
         this.port = config2?.hub?.port ?? DEFAULT_HUB_PORT;
         this.token = config2?.hub?.token;
@@ -1164,7 +1284,7 @@ var init_server = __esm({
         if (config2?.webhooks) {
           this.notifier.configure({ webhooks: config2.webhooks });
         }
-        const displayHost = this.host === "0.0.0.0" ? "127.0.0.1" : this.host;
+        const displayHost = hubUrlHost(this.host);
         this.notifier.configure({ dashboardUrl: `http://${displayHost}:${this.port}` });
         const fullConfig = loadConfig();
         if (fullConfig.telegram?.enabled && fullConfig.telegram.botToken && fullConfig.telegram.chatId) {
@@ -1177,6 +1297,9 @@ var init_server = __esm({
         this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
         this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
+        this.wssCodex = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
+        this.wssCodex.on("connection", (ws, req) => this.handleCodexConnection(ws, req));
+        this.wssCodex.on("error", (err) => logger.warn(`Codex WebSocket server error: ${err.message}`));
         this.httpServer.on("upgrade", (req, socket, head) => {
           socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
           const url = new URL(req.url ?? "/", "http://hub");
@@ -1197,6 +1320,10 @@ var init_server = __esm({
             this.wssDashboard.handleUpgrade(req, socket, head, (ws) => {
               this.wssDashboard.emit("connection", ws, req);
             });
+          } else if (pathname === WS_PATH_CODEX) {
+            this.wssCodex.handleUpgrade(req, socket, head, (ws) => {
+              this.wssCodex.emit("connection", ws, req);
+            });
           } else {
             socket.destroy();
           }
@@ -1211,7 +1338,7 @@ var init_server = __esm({
           this.httpServer.listen(this.port, this.host, () => {
             this.httpServer.removeListener("error", onStartupError);
             this.httpServer.on("error", (err) => logger.error(`HTTP server error: ${err.message}`));
-            const displayHost = this.host === "0.0.0.0" ? "127.0.0.1" : this.host;
+            const displayHost = hubUrlHost(this.host);
             logger.info(`Hub server listening on http://${displayHost}:${this.port}`);
             this.startCodexAdapter();
             resolve();
@@ -1226,10 +1353,12 @@ var init_server = __esm({
           if (this.telegramBot) this.telegramBot.stopPolling();
           for (const ws of this.channelSockets.values()) ws.terminate();
           for (const ws of this.dashboardSockets) ws.terminate();
+          for (const { ws } of this.codexAdapters.values()) ws.terminate();
           this.channelSockets.clear();
           this.dashboardSockets.clear();
           this.wssChannel.close();
           this.wssDashboard.close();
+          this.wssCodex.close();
           this.httpServer.close(() => {
             logger.info("Hub server stopped");
             resolve();
@@ -1294,6 +1423,12 @@ var init_server = __esm({
           this.handleApiSend(req, res);
         } else if (url.pathname === "/api/notify" && req.method === "POST") {
           this.handleApiNotify(req, res);
+        } else if (url.pathname === "/api/codex/folders" && req.method === "GET") {
+          this.handleCodexFolders(url, res);
+        } else if (url.pathname === "/api/codex/threads" && req.method === "POST") {
+          this.handleCodexCreate(req, res);
+        } else if (url.pathname === "/api/codex/threads/close" && req.method === "POST") {
+          this.handleCodexClose(req, res);
         } else if (url.pathname === "/api/webhooks" && req.method === "GET") {
           const config2 = loadConfig();
           this.jsonResponse(res, 200, { webhooks: config2.webhooks || [] });
@@ -1323,23 +1458,23 @@ var init_server = __esm({
           return;
         }
         const candidates = [
-          path6.join(__dirname, "..", "dashboard", "index.html"),
+          path8.join(__dirname, "..", "dashboard", "index.html"),
           // from dist/hub/
-          path6.join(__dirname, "dashboard", "index.html"),
+          path8.join(__dirname, "dashboard", "index.html"),
           // from dist/ (bundled index.js)
-          path6.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
+          path8.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
           // from dist/hub/ -> src/
-          path6.join(__dirname, "..", "src", "dashboard", "index.html"),
+          path8.join(__dirname, "..", "src", "dashboard", "index.html"),
           // from dist/ -> src/
-          path6.join(process.cwd(), "dist", "dashboard", "index.html"),
+          path8.join(process.cwd(), "dist", "dashboard", "index.html"),
           // from cwd
-          path6.join(process.cwd(), "src", "dashboard", "index.html")
+          path8.join(process.cwd(), "src", "dashboard", "index.html")
           // from cwd/src
         ];
         logger.debug(`Dashboard candidates: ${JSON.stringify(candidates)}`);
         for (const candidate of candidates) {
-          if (fs6.existsSync(candidate)) {
-            const html = fs6.readFileSync(candidate, "utf-8");
+          if (fs7.existsSync(candidate)) {
+            const html = fs7.readFileSync(candidate, "utf-8");
             res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
             res.end(html);
             return;
@@ -1557,6 +1692,114 @@ var init_server = __esm({
           }
         }
       }
+      handleCodexConnection(ws, req) {
+        const isLocal = this.isLocalRequest(req);
+        let adapterId;
+        ws.on("error", (err) => {
+          logger.warn(`Codex adapter WebSocket error: ${err.message}`);
+          ws.terminate();
+        });
+        ws.on("pong", () => this.codexAlive.set(ws, true));
+        ws.on("message", (data) => {
+          let msg;
+          try {
+            msg = JSON.parse(data.toString());
+            if (msg === null || typeof msg !== "object") {
+              logger.warn("Invalid message from Codex adapter");
+              return;
+            }
+          } catch {
+            logger.warn("Invalid message from Codex adapter");
+            return;
+          }
+          if (msg.type === "adapter_hello") {
+            const a = msg.adapter;
+            if (typeof a?.id !== "string" || !a.id || typeof a.host !== "string") return;
+            if (adapterId && adapterId !== a.id) return;
+            const holder = this.codexAdapters.get(a.id);
+            if (holder && holder.ws !== ws) holder.ws.terminate();
+            if (!adapterId) logger.info(`Codex adapter connected: ${a.host} (${a.id}, local: ${isLocal})`);
+            adapterId = a.id;
+            this.codexAdapters.set(a.id, { ws, info: { id: a.id, host: a.host, ready: a.ready === true, isLocal } });
+            this.broadcastCodexAdapters();
+          } else if (msg.type === "adapter_result" && adapterId) {
+            const call = this.codexCalls.get(msg.requestId);
+            if (!call || call.adapterId !== adapterId) return;
+            call.settle(msg.ok ? { status: 200, body: msg.data } : { status: 422, body: { error: String(msg.error) } });
+          }
+        });
+        ws.on("close", () => {
+          if (!adapterId || this.codexAdapters.get(adapterId)?.ws !== ws) return;
+          this.codexAdapters.delete(adapterId);
+          for (const call of [...this.codexCalls.values()]) {
+            if (call.adapterId === adapterId) call.settle({ status: 502, body: { error: "Codex adapter disconnected" } });
+          }
+          logger.info(`Codex adapter disconnected: ${adapterId}`);
+          this.broadcastCodexAdapters();
+        });
+      }
+      callCodexAdapter(adapterId, call) {
+        const adapter = this.codexAdapters.get(adapterId);
+        if (!adapter || adapter.ws.readyState !== WebSocket2.OPEN) {
+          return Promise.resolve({ status: 404, body: { error: "Codex adapter is not connected" } });
+        }
+        const requestId = randomUUID3();
+        return new Promise((resolve) => {
+          const timer = setTimeout(
+            () => settle({ status: 504, body: { error: "Codex did not respond in time. The conversation may still appear." } }),
+            this.codexCallTimeoutMs
+          );
+          const settle = (outcome) => {
+            clearTimeout(timer);
+            this.codexCalls.delete(requestId);
+            resolve(outcome);
+          };
+          this.codexCalls.set(requestId, { adapterId, settle });
+          adapter.ws.send(JSON.stringify({ type: "adapter_call", requestId, call }));
+        });
+      }
+      async handleCodexFolders(url, res) {
+        const adapterId = url.searchParams.get("adapterId");
+        if (!nonEmpty(adapterId)) {
+          this.jsonResponse(res, 400, { error: "adapterId is required" });
+          return;
+        }
+        const out = await this.callCodexAdapter(adapterId, { kind: "folders" });
+        this.jsonResponse(res, out.status, out.body);
+      }
+      async handleCodexCreate(req, res) {
+        const body = await this.readBody(req);
+        const adapterId = body?.adapterId;
+        const cwd = body?.cwd;
+        if (!nonEmpty(adapterId) || !nonEmpty(cwd)) {
+          this.jsonResponse(res, 400, { error: "adapterId and cwd are required" });
+          return;
+        }
+        const out = await this.callCodexAdapter(adapterId, { kind: "create", cwd });
+        this.jsonResponse(res, out.status, out.body);
+      }
+      async handleCodexClose(req, res) {
+        const body = await this.readBody(req);
+        const sessionId2 = body?.sessionId;
+        if (!nonEmpty(sessionId2)) {
+          this.jsonResponse(res, 400, { error: "sessionId is required" });
+          return;
+        }
+        const session = this.sessions.get(sessionId2);
+        const ws = this.channelSockets.get(sessionId2);
+        if (session?.agentKind !== "codex" || !session.closable || ws?.readyState !== WebSocket2.OPEN) {
+          this.jsonResponse(res, 404, { error: "No closable Codex conversation" });
+          return;
+        }
+        ws.send(JSON.stringify({ type: "codex_close", sessionId: sessionId2 }));
+        this.jsonResponse(res, 200, { ok: true });
+      }
+      codexAdapterList() {
+        return [...this.codexAdapters.values()].map((a) => a.info);
+      }
+      broadcastCodexAdapters() {
+        this.broadcastToDashboards({ type: "codex_adapters", adapters: this.codexAdapterList() });
+      }
       // --- Dashboard WebSocket ---
       handleDashboardConnection(ws) {
         this.dashboardSockets.add(ws);
@@ -1575,6 +1818,7 @@ var init_server = __esm({
           requests: [...this.choiceRequests.values()].map((c) => c.request)
         };
         ws.send(JSON.stringify(pendingMsg));
+        ws.send(JSON.stringify({ type: "codex_adapters", adapters: this.codexAdapterList() }));
         ws.on("message", (data) => {
           try {
             const msg = JSON.parse(data.toString());
@@ -1584,7 +1828,7 @@ var init_server = __esm({
                 channelWs.send(JSON.stringify({ ...msg, source: "dashboard" }));
               }
             } else if (msg.type === "image_upload") {
-              this.handleImageUpload(msg);
+              this.handleImageUpload(ws, msg);
             } else if (msg.type === "permission_response") {
               if (this.forwardPermissionResponse(msg)) {
                 const verdict = msg.choiceId !== void 0 ? `choice ${msg.choiceId}` : msg.behavior;
@@ -1635,43 +1879,55 @@ var init_server = __esm({
           }
         }
       }
-      handleImageUpload(msg) {
+      handleImageUpload(ws, msg) {
         const { sessionId: sessionId2, imageData, mimeType, originalName, content } = msg;
+        const reject = (reason) => {
+          logger.warn(`Image upload rejected for ${sessionId2}: ${reason}`);
+          const rejected = { type: "upload_rejected", sessionId: sessionId2, reason, withText: typeof content === "string" && content.trim().length > 0 };
+          if (ws.readyState === WebSocket2.OPEN) ws.send(JSON.stringify(rejected));
+        };
+        const channelWs = this.channelSockets.get(sessionId2);
+        if (!channelWs || channelWs.readyState !== WebSocket2.OPEN) {
+          reject("the session is not connected");
+          return;
+        }
         if (!this.localChannels.has(sessionId2)) {
-          logger.warn(`Image upload rejected: session ${sessionId2} is not local`);
+          reject("this session is on another PC; images can only go to sessions on the hub's PC");
           return;
         }
-        const channelWs = this.channelSockets.get(sessionId2);
-        if (!channelWs || channelWs.readyState !== WebSocket2.OPEN) return;
         const allowedTypes = ["image/png", "image/jpeg", "image/gif", "image/webp"];
-        if (!allowedTypes.includes(mimeType)) return;
+        if (!allowedTypes.includes(mimeType)) {
+          reject("only PNG, JPEG, GIF and WebP images are supported");
+          return;
+        }
         const base64Data = imageData.replace(/^data:image\/\w+;base64,/, "");
         const buffer = Buffer.from(base64Data, "base64");
         if (buffer.length > 10 * 1024 * 1024) {
-          logger.warn("Image upload rejected: exceeds 10MB");
+          reject("the image is larger than 10 MB");
           return;
         }
-        fs6.mkdirSync(UPLOADS_DIR, { recursive: true });
+        fs7.mkdirSync(UPLOADS_DIR, { recursive: true });
         const ext = mimeType.split("/")[1] === "jpeg" ? "jpg" : mimeType.split("/")[1];
         const filename = `${randomUUID3()}.${ext}`;
-        const filePath = path6.join(UPLOADS_DIR, filename);
-        fs6.writeFileSync(filePath, buffer);
+        const filePath = path8.join(UPLOADS_DIR, filename);
+        fs7.writeFileSync(filePath, buffer);
         const forwardMsg = {
           type: "image_to_session",
           sessionId: sessionId2,
           imagePath: filePath,
           mimeType,
           originalName,
-          content
+          content,
+          source: "dashboard"
         };
         channelWs.send(JSON.stringify(forwardMsg));
         logger.info(`Image saved and forwarded: ${filename} (${buffer.length} bytes)`);
         setTimeout(() => {
           try {
-            fs6.unlinkSync(filePath);
+            fs7.unlinkSync(filePath);
           } catch {
           }
-        }, 5 * 60 * 1e3);
+        }, 5 * 60 * 1e3).unref();
       }
       async handleWebhookSave(req, res) {
         const body = await this.readBody(req);
@@ -1704,7 +1960,7 @@ var init_server = __esm({
         this.telegramBot.onImageToSession = (sessionId2, imagePath, mimeType, caption) => {
           const channelWs = this.channelSockets.get(sessionId2);
           if (channelWs?.readyState === WebSocket2.OPEN) {
-            const msg = { type: "image_to_session", sessionId: sessionId2, imagePath, mimeType, content: caption };
+            const msg = { type: "image_to_session", sessionId: sessionId2, imagePath, mimeType, content: caption, source: "telegram" };
             channelWs.send(JSON.stringify(msg));
             logger.info(`Telegram photo forwarded to session: ${sessionId2}`);
           }
@@ -1832,7 +2088,7 @@ var init_server = __esm({
           logger.warn("Codex adapter is enabled but codex/main.js was not found next to the hub");
           return;
         }
-        this.codexSupervisor = new CodexSupervisor(script);
+        this.codexSupervisor = new CodexSupervisor(script, { env: adapterEnv(process.env, { host: this.host, port: this.port }) });
         this.codexSupervisor.start();
         logger.info("Codex adapter started");
       }
@@ -1847,15 +2103,23 @@ var init_server = __esm({
             this.channelAlive.set(sessionId2, false);
             ws.ping();
           }
+          for (const { ws } of this.codexAdapters.values()) {
+            if (this.codexAlive.get(ws) === false) {
+              ws.terminate();
+              continue;
+            }
+            this.codexAlive.set(ws, false);
+            ws.ping();
+          }
         }, 3e4);
       }
       cleanupUploads() {
         try {
-          if (!fs6.existsSync(UPLOADS_DIR)) return;
-          const files = fs6.readdirSync(UPLOADS_DIR);
+          if (!fs7.existsSync(UPLOADS_DIR)) return;
+          const files = fs7.readdirSync(UPLOADS_DIR);
           for (const file of files) {
             try {
-              fs6.unlinkSync(path6.join(UPLOADS_DIR, file));
+              fs7.unlinkSync(path8.join(UPLOADS_DIR, file));
             } catch {
             }
           }
@@ -1909,7 +2173,7 @@ Content-Length: 0\r
         });
       }
     };
-    if (process.argv[1] && (process.argv[1].endsWith("hub/server.js") || process.argv[1].endsWith("hub/server.ts"))) {
+    if (isEntryScript(process.argv[1], ["/hub/server.js", "/hub/server.ts"])) {
       installCrashGuard("hub daemon");
       logStartup("Hub daemon");
       const config2 = loadConfig();
@@ -2054,9 +2318,9 @@ var init_hub_client = __esm({
 });
 
 // src/channel/peer-name.ts
-import fs7 from "fs";
+import fs8 from "fs";
 import os2 from "os";
-import path7 from "path";
+import path9 from "path";
 function findPeerName(records, env) {
   const valid = records.filter((r) => typeof r === "object" && r !== null);
   const nameOf = (match) => {
@@ -2076,18 +2340,18 @@ function readPeerName(env = process.env) {
     sessionId: env.CLAUDE_CODE_SESSION_ID
   };
   if (!lookup.messagingSocket && !lookup.sessionId) return void 0;
-  const configDir = env.CLAUDE_CONFIG_DIR || path7.join(os2.homedir(), ".claude");
-  const dir = path7.join(configDir, "sessions");
+  const configDir = env.CLAUDE_CONFIG_DIR || path9.join(os2.homedir(), ".claude");
+  const dir = path9.join(configDir, "sessions");
   let files;
   try {
-    files = fs7.readdirSync(dir).filter((f) => f.endsWith(".json"));
+    files = fs8.readdirSync(dir).filter((f) => f.endsWith(".json"));
   } catch {
     return void 0;
   }
   const records = [];
   for (const f of files) {
     try {
-      records.push(JSON.parse(fs7.readFileSync(path7.join(dir, f), "utf8")));
+      records.push(JSON.parse(fs8.readFileSync(path9.join(dir, f), "utf8")));
     } catch {
     }
   }
@@ -2110,7 +2374,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { randomUUID as randomUUID4 } from "crypto";
-import path8 from "path";
+import path10 from "path";
 async function main() {
   logger.info(`Starting MCP channel server (session: ${sessionId})`);
   hubClient.connect();
@@ -2179,7 +2443,7 @@ var init_server2 = __esm({
     init_hub_client();
     init_peer_name2();
     sessionId = randomUUID4();
-    sessionName = process.env.CLAUDE_ALARM_SESSION_NAME ?? path8.basename(process.cwd());
+    sessionName = process.env.CLAUDE_ALARM_SESSION_NAME ?? path10.basename(process.cwd());
     peerName = readPeerName();
     server = new Server(
       {
@@ -2356,8 +2620,8 @@ NOTIFICATIONS:
 // src/cli.ts
 init_config();
 import { spawn as spawn3 } from "child_process";
-import fs8 from "fs";
-import path9 from "path";
+import fs9 from "fs";
+import path11 from "path";
 import readline from "readline";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -2368,6 +2632,12 @@ import fs2 from "fs";
 import path3 from "path";
 import { Duplex } from "stream";
 import WebSocket from "ws";
+function resolveCommand(command, platform = process.platform, env = process.env) {
+  if (platform !== "win32") return { file: command, shell: false };
+  if (/[\\/]/.test(command) || path3.extname(command)) return { file: command, shell: /\.(cmd|bat)$/i.test(command) };
+  const file = findCodex(command, platform, env);
+  return file ? { file, shell: file.endsWith(".cmd") } : { file: command, shell: false };
+}
 function findOnPath(command, platform = process.platform, env = process.env) {
   const dirs = (env.PATH ?? env.Path ?? "").split(path3.delimiter).filter(Boolean);
   for (const ext of platform === "win32" ? [".exe", ".cmd"] : [""]) {
@@ -2378,12 +2648,772 @@ function findOnPath(command, platform = process.platform, env = process.env) {
   }
   return void 0;
 }
+function findCodex(command, platform = process.platform, env = process.env) {
+  const onPath = findOnPath(command, platform, env);
+  if (onPath || platform !== "win32") return onPath;
+  const candidates = [
+    env.LOCALAPPDATA && path3.join(env.LOCALAPPDATA, "Programs", "OpenAI", "Codex", "bin", `${command}.exe`),
+    env.APPDATA && path3.join(env.APPDATA, "npm", `${command}.cmd`)
+  ];
+  return candidates.find((file) => !!file && fs2.existsSync(file));
+}
+var defaultSpawn = (command, args) => {
+  const { file, shell } = resolveCommand(command);
+  if (shell) return spawn(`"${file}" ${args.join(" ")}`, { stdio: "pipe", windowsHide: true, shell: true });
+  return spawn(file, args, { stdio: "pipe", windowsHide: true });
+};
+var HANDSHAKE_TIMEOUT_MS = 1e4;
+function connectProxy(command, spawnFn = defaultSpawn, timeoutMs = HANDSHAKE_TIMEOUT_MS) {
+  const child = spawnFn(command, ["app-server", "proxy"]);
+  child.stdin?.on("error", () => {
+  });
+  child.stderr?.on("data", (d) => logger.debug(`codex proxy: ${String(d).trim()}`));
+  const stream = new Duplex({
+    read() {
+    },
+    write(chunk, _encoding, callback) {
+      if (child.stdin?.writable) child.stdin.write(chunk, callback);
+      else callback();
+    },
+    final(callback) {
+      child.stdin?.end();
+      callback();
+    }
+  });
+  child.stdout?.on("data", (d) => stream.push(d));
+  child.stdout?.on("end", () => stream.push(null));
+  Object.assign(stream, { setNoDelay() {
+  }, setTimeout() {
+  }, setKeepAlive() {
+  }, ref() {
+  }, unref() {
+  } });
+  const ws = new WebSocket("ws://localhost/", {
+    createConnection: (() => stream)
+  });
+  const close = () => {
+    ws.terminate();
+    child.kill();
+  };
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timer = setTimeout(() => fail(new Error(`codex daemon did not answer within ${timeoutMs / 1e3}s`)), timeoutMs);
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      close();
+      reject(err);
+    };
+    child.on("error", fail);
+    child.once("exit", (code) => fail(new Error(`codex proxy exited (code ${code})`)));
+    ws.on("error", fail);
+    ws.once("open", () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      child.on("error", (err) => logger.warn(`codex proxy error: ${err.message}`));
+      ws.on("error", (err) => logger.warn(`codex daemon socket error: ${err.message}`));
+      resolve({ ws, close });
+    });
+  });
+}
+
+// src/codex/run.ts
+import path4 from "path";
+
+// src/codex/rpc.ts
+init_logger();
+import { EventEmitter } from "events";
+var RpcError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+var RpcClient = class extends EventEmitter {
+  constructor(ws, timeoutMs = 3e4) {
+    super();
+    this.ws = ws;
+    this.timeoutMs = timeoutMs;
+    ws.on("message", (data) => this.onMessage(String(data)));
+    ws.on("close", () => {
+      for (const p of this.pending.values()) {
+        clearTimeout(p.timer);
+        p.reject(new Error("connection closed"));
+      }
+      this.pending.clear();
+      this.emit("close");
+    });
+  }
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  request(method, params, timeoutMs = this.timeoutMs) {
+    if (this.ws.readyState !== this.ws.OPEN) return Promise.reject(new Error("connection closed"));
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = timeoutMs === null ? void 0 : setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`${method} timed out`));
+      }, timeoutMs);
+      this.pending.set(id, { resolve, reject, timer });
+      this.ws.send(JSON.stringify(params === void 0 ? { id, method } : { id, method, params }));
+    });
+  }
+  notify(method, params) {
+    if (this.ws.readyState !== this.ws.OPEN) return;
+    this.ws.send(JSON.stringify(params === void 0 ? { method } : { method, params }));
+  }
+  respond(id, result) {
+    if (this.ws.readyState !== this.ws.OPEN) return;
+    this.ws.send(JSON.stringify({ id, result }));
+  }
+  // ws stops reading the socket for good if a 'message' listener throws.
+  guarded(method, fn) {
+    try {
+      fn();
+    } catch (err) {
+      logger.warn(`Codex ${method} handling failed: ${err.message}`);
+    }
+  }
+  onMessage(text) {
+    let msg;
+    try {
+      msg = JSON.parse(text);
+    } catch {
+      return;
+    }
+    if (!msg || typeof msg !== "object") return;
+    if (msg.method === void 0 && msg.id !== void 0) {
+      const p = this.pending.get(msg.id);
+      if (!p) return;
+      this.pending.delete(msg.id);
+      clearTimeout(p.timer);
+      if (msg.error) p.reject(new RpcError(msg.error.code, msg.error.message));
+      else p.resolve(msg.result);
+    } else if (msg.method !== void 0 && msg.id !== void 0) {
+      this.guarded(msg.method, () => this.emit("request", msg.id, msg.method, msg.params));
+    } else if (msg.method !== void 0) {
+      this.guarded(msg.method, () => this.emit("notification", msg.method, msg.params));
+    }
+  }
+};
+
+// src/codex/mapping.ts
+var SOURCE_LABEL = { dashboard: "Dashboard", telegram: "Telegram", api: "API" };
+var SOURCE_PREFIX = new RegExp(`^\\[claude-alarm(?: \xB7 (?:${Object.values(SOURCE_LABEL).join("|")}))?\\] ?`);
+function finalAnswer(messages) {
+  const finals = messages.filter((m) => m.phase === "final_answer").map((m) => m.text);
+  if (finals.length) return finals.join("\n\n");
+  return messages.at(-1)?.text ?? null;
+}
+
+// src/codex/run.ts
+init_constants();
+var MINUTE = 6e4;
+var SUMMARY_MAX = 200;
+var clip = (text) => text.length > SUMMARY_MAX ? `${text.slice(0, SUMMARY_MAX)}\u2026` : text;
+function relayed(method, params) {
+  switch (method) {
+    case "item/commandExecution/requestApproval": {
+      const command = params.command ?? (params.commandActions ?? []).map((a) => a.command).join("\n");
+      return { kind: "command", summary: clip(String(command || params.reason || "")), decline: { decision: "decline" } };
+    }
+    case "item/fileChange/requestApproval":
+      return { kind: "file change", summary: clip(String(params.reason ?? "")), decline: { decision: "decline" } };
+    case "mcpServer/elicitation/request":
+      if (params._meta?.codex_approval_kind !== "mcp_tool_call") return null;
+      return { kind: "MCP tool", summary: clip(`${params.serverName ?? ""}: ${params.message ?? ""}`), decline: { action: "decline" } };
+    default:
+      return null;
+  }
+}
+function unrelayed(method, params) {
+  switch (method) {
+    case "item/permissions/requestApproval":
+      return { kind: "permissions", summary: clip(String(params.reason ?? "")), answer: { permissions: {} } };
+    case "item/tool/requestUserInput":
+      return {
+        kind: "question",
+        summary: clip((params.questions ?? []).map((q) => q.question ?? "").join(" / ")),
+        answer: { answers: {} }
+      };
+    case "mcpServer/elicitation/request":
+      return { kind: "MCP form", summary: clip(String(params.message ?? "")), answer: { action: "decline" } };
+    default:
+      return null;
+  }
+}
+async function runCodexTask(opts) {
+  const progress = opts.progress ?? (() => {
+  });
+  const approvalTimeoutMs = opts.approvalTimeoutMs ?? 10 * MINUTE;
+  const started = Date.now();
+  const conn = await connectProxy(opts.command ?? "codex", opts.spawnFn ?? defaultSpawn);
+  const rpc = new RpcClient(conn.ws);
+  const timers = /* @__PURE__ */ new Set();
+  try {
+    const init2 = await rpc.request("initialize", {
+      clientInfo: { name: "claude-alarm-run", version: CHANNEL_SERVER_VERSION }
+    });
+    rpc.notify("initialized");
+    const yolo = { sandbox: "danger-full-access", approvalPolicy: "never" };
+    let threadId;
+    if (opts.threadId) {
+      await rpc.request("thread/resume", opts.yolo ? { threadId: opts.threadId, ...yolo } : { threadId: opts.threadId });
+      threadId = opts.threadId;
+    } else {
+      const res = await rpc.request("thread/start", {
+        cwd: opts.cwd,
+        ...opts.yolo ? yolo : { sandbox: "workspace-write", approvalPolicy: "on-request" }
+      });
+      threadId = res.thread.id;
+      if (opts.name) {
+        await rpc.request("thread/name/set", { threadId, name: opts.name }).catch(() => {
+        });
+      }
+    }
+    progress(`thread ${threadId}`);
+    const messages = /* @__PURE__ */ new Map();
+    const approvals = [];
+    const waiting = /* @__PURE__ */ new Map();
+    let finish;
+    let lose;
+    const completed = new Promise((resolve, reject) => {
+      finish = resolve;
+      lose = reject;
+    });
+    completed.catch(() => {
+    });
+    rpc.on("close", () => lose(new Error("connection to the Codex daemon closed")));
+    rpc.on("notification", (method, params) => {
+      if (params?.threadId !== threadId) return;
+      if (method === "item/completed") {
+        const item = params.item ?? {};
+        if (item.type === "agentMessage") {
+          const list = messages.get(params.turnId) ?? [];
+          list.push({ text: item.text, phase: item.phase });
+          messages.set(params.turnId, list);
+        } else if (item.type === "commandExecution") {
+          progress(`ran ${clip(String(item.command ?? ""))} (exit ${item.exitCode ?? "?"})`);
+        }
+      } else if (method === "serverRequest/resolved") {
+        const record = waiting.get(params.requestId);
+        if (record) {
+          waiting.delete(params.requestId);
+          record.outcome = "answered-elsewhere";
+          progress(`approval answered elsewhere: ${record.kind}`);
+        }
+      } else if (method === "turn/completed") {
+        finish(params.turn);
+      }
+    });
+    rpc.on("request", (id, method, params) => {
+      if (params?.threadId !== threadId) return;
+      const wait = relayed(method, params);
+      if (wait) {
+        const record = { kind: wait.kind, summary: wait.summary, outcome: "unanswered" };
+        approvals.push(record);
+        waiting.set(id, record);
+        progress(`approval pending (${Math.round(approvalTimeoutMs / 1e3)}s): ${wait.kind} ${wait.summary}`);
+        const timer = setTimeout(() => {
+          timers.delete(timer);
+          if (!waiting.delete(id)) return;
+          record.outcome = "timeout-declined";
+          rpc.respond(id, wait.decline);
+          progress(`approval declined after timeout: ${wait.kind}`);
+        }, approvalTimeoutMs);
+        timers.add(timer);
+        return;
+      }
+      const answer = unrelayed(method, params);
+      if (answer) {
+        approvals.push({ kind: answer.kind, summary: answer.summary, outcome: "auto-declined" });
+        rpc.respond(id, answer.answer);
+        progress(`declined at once: ${answer.kind}`);
+      }
+    });
+    const turnStart = { threadId, input: [{ type: "text", text: opts.brief }] };
+    if (opts.outputSchema !== void 0) turnStart.outputSchema = opts.outputSchema;
+    const { turn } = await rpc.request("turn/start", turnStart);
+    const turnId = turn.id;
+    progress(`turn ${turnId} started`);
+    let stopReason = null;
+    let interruptRequested;
+    const stopped = new Promise((resolve) => interruptRequested = resolve);
+    const stop = (reason) => {
+      if (stopReason) return;
+      stopReason = reason;
+      progress(reason === "timedOut" ? "timeout reached, interrupting the turn" : "interrupting the turn");
+      rpc.request("turn/interrupt", { threadId, turnId }).catch(() => {
+      });
+      interruptRequested();
+    };
+    const deadline = setTimeout(() => stop("timedOut"), opts.timeoutMs ?? 60 * MINUTE);
+    timers.add(deadline);
+    const onAbort = () => stop("interrupted");
+    if (opts.signal?.aborted) onAbort();
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    const grace = stopped.then(
+      () => new Promise((resolve) => {
+        const t = setTimeout(() => resolve(null), opts.interruptGraceMs ?? 15e3);
+        timers.add(t);
+      })
+    );
+    let ended;
+    let lost = null;
+    try {
+      ended = await Promise.race([completed, grace]);
+    } catch (err) {
+      ended = null;
+      lost = err.message;
+    } finally {
+      opts.signal?.removeEventListener("abort", onAbort);
+    }
+    let status;
+    let error = null;
+    if (stopReason) status = stopReason;
+    else if (lost) {
+      status = "failed";
+      error = lost;
+    } else if (ended?.status === "failed" || ended?.error) {
+      status = "failed";
+      error = ended?.error?.message ?? "the turn failed";
+    } else if (ended?.status === "interrupted") status = "interrupted";
+    else status = "completed";
+    const collected = messages.get(turnId) ?? [];
+    const fromTurn = (ended?.items ?? []).filter((i) => i.type === "agentMessage");
+    const finalText = finalAnswer(collected.length ? collected : fromTurn);
+    let result = null;
+    if (opts.outputSchema !== void 0 && finalText) {
+      try {
+        result = JSON.parse(finalText);
+      } catch {
+        result = null;
+      }
+    }
+    return {
+      threadId,
+      turnId,
+      status,
+      error,
+      result,
+      finalText,
+      approvals,
+      durationMs: Date.now() - started,
+      codex: { userAgent: init2.userAgent ?? null }
+    };
+  } finally {
+    for (const t of timers) clearTimeout(t);
+    conn.close();
+  }
+}
+var VALUE_FLAGS = {
+  "--brief": "brief",
+  "--cwd": "cwd",
+  "--thread": "threadId",
+  "--name": "name",
+  "--output-schema": "outputSchema",
+  "--approval-timeout": "approvalTimeoutMs",
+  "--timeout": "timeoutMs"
+};
+function parseRunArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag === "--yolo") {
+      out.yolo = true;
+      continue;
+    }
+    const key = VALUE_FLAGS[flag];
+    if (!key) throw new Error(`Unknown option: ${flag}`);
+    const value = argv[++i];
+    if (value === void 0) throw new Error(`${flag} needs a value`);
+    if (key === "approvalTimeoutMs" || key === "timeoutMs") {
+      const minutes = Number(value);
+      if (!Number.isFinite(minutes) || minutes <= 0) throw new Error(`${flag} must be a number of minutes`);
+      out[key] = Math.round(minutes * MINUTE);
+    } else {
+      out[key] = value;
+    }
+  }
+  if (out.brief === void 0) throw new Error("--brief <file|-> is required");
+  return out;
+}
+async function runFromCli(argv, io) {
+  let task;
+  try {
+    const args = parseRunArgs(argv);
+    const brief = args.brief === "-" ? await io.readStdin() : await io.readFile(args.brief);
+    if (!brief.trim()) throw new Error("the brief is empty");
+    task = {
+      brief,
+      cwd: path4.resolve(io.cwd, args.cwd ?? "."),
+      threadId: args.threadId,
+      name: args.name,
+      yolo: args.yolo,
+      outputSchema: args.outputSchema === void 0 ? void 0 : JSON.parse(await io.readFile(args.outputSchema)),
+      approvalTimeoutMs: args.approvalTimeoutMs,
+      timeoutMs: args.timeoutMs,
+      signal: io.signal,
+      spawnFn: io.spawnFn,
+      progress: (line) => io.err(`[codex run] ${line}
+`)
+    };
+  } catch (err) {
+    io.err(`codex run: ${err.message}
+`);
+    return 2;
+  }
+  try {
+    const result = await runCodexTask(task);
+    io.out(`${JSON.stringify(result, null, 2)}
+`);
+    return result.status === "completed" ? 0 : 1;
+  } catch (err) {
+    io.err(`codex run: could not start the task: ${err.message}
+`);
+    return 2;
+  }
+}
 
 // src/cli.ts
 init_constants();
 init_logger();
 init_crash_guard();
-var __dirname2 = path9.dirname(fileURLToPath2(import.meta.url));
+
+// src/hub/readiness.ts
+var HUB_START_TIMEOUT_MS = 5e3;
+async function waitForHub(opts) {
+  const timeoutMs = opts.timeoutMs ?? HUB_START_TIMEOUT_MS;
+  const intervalMs = opts.intervalMs ?? 200;
+  const deadline = Date.now() + timeoutMs;
+  const headers = opts.token ? { Authorization: `Bearer ${opts.token}` } : {};
+  for (; ; ) {
+    if (!opts.isAlive()) return "exited";
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) return "timeout";
+    try {
+      const res = await fetch(opts.url, { headers, signal: AbortSignal.timeout(Math.min(remaining, 1e3)) });
+      if (res.ok) {
+        const body = await res.json();
+        if (body.pid === opts.pid) return "ready";
+      }
+    } catch {
+    }
+    await new Promise((resolve) => setTimeout(resolve, Math.min(intervalMs, Math.max(0, deadline - Date.now()))));
+  }
+}
+
+// src/cli.ts
+init_hub_url();
+
+// src/codex/hub-target.ts
+init_hub_url();
+function resolveAdapterHub(config2, env = process.env) {
+  const envHost = env.CLAUDE_ALARM_HUB_HOST;
+  const envPort = env.CLAUDE_ALARM_HUB_PORT;
+  const envToken = env.CLAUDE_ALARM_HUB_TOKEN;
+  return {
+    host: hubUrlHost(envHost ?? config2.hub.host),
+    port: envPort ? parseInt(envPort, 10) : config2.hub.port,
+    token: envToken ?? config2.hub.token,
+    fromEnv: { host: envHost !== void 0, port: !!envPort, token: envToken !== void 0 }
+  };
+}
+
+// src/codex/start-check.ts
+var ADAPTER_REPORT_TIMEOUT_MS = 1e4;
+var HUB_CHECK_TIMEOUT_MS = 3e3;
+var RESTART_HINT = "After fixing this, restart the adapter: claude-alarm codex stop, then claude-alarm codex start (if the hub started the adapter, restart the hub instead)";
+var CONFIG_PATH = "~/.claude-alarm/config.json";
+var NOT_CHECKED = { text: "Codex daemon: not checked (the adapter was already running)", warning: false };
+function toOutcome(msg) {
+  if (msg.connected === true) return typeof msg.userAgent === "string" ? { connected: true, userAgent: msg.userAgent } : { connected: true };
+  return { connected: false, error: String(msg.error ?? ""), notFound: msg.notFound === true };
+}
+function waitForAdapterReport(child, timeoutMs = ADAPTER_REPORT_TIMEOUT_MS) {
+  return new Promise((resolve) => {
+    const finish = (result) => {
+      clearTimeout(timer);
+      child.off("message", onMessage);
+      child.off("exit", onExit);
+      child.off("error", onError);
+      resolve(result);
+    };
+    const onMessage = (msg) => {
+      if (!msg || typeof msg !== "object") return;
+      const m = msg;
+      if (m.type === "codex-first-connect") finish({ kind: "report", outcome: toOutcome(m) });
+      else if (m.type === "codex-already-running" && Number.isInteger(m.pid)) finish({ kind: "already", pid: m.pid });
+      else if (m.type === "codex-lock-failed") finish({ kind: "lockFailed", error: String(m.error ?? "") });
+    };
+    const onExit = (code, signal) => finish({ kind: "exited", code, signal });
+    const onError = (error) => finish({ kind: "exited", code: null, signal: null, error });
+    const timer = setTimeout(() => finish({ kind: "timeout" }), timeoutMs);
+    child.on("message", onMessage);
+    child.on("exit", onExit);
+    child.on("error", onError);
+  });
+}
+function hubUrl(hub) {
+  return `http://${hub.host}:${hub.port}`;
+}
+async function checkHub(hub, timeoutMs = HUB_CHECK_TIMEOUT_MS) {
+  let res;
+  try {
+    res = await fetch(`${hubUrl(hub)}/api/status`, {
+      headers: hub.token ? { Authorization: `Bearer ${hub.token}` } : {},
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    const e = err;
+    return { kind: "unreachable", reason: typeof e.cause?.code === "string" ? e.cause.code : e.name };
+  }
+  if (res.status === 200) {
+    try {
+      const body = await res.json();
+      if (body?.running === true) return { kind: "ok" };
+    } catch {
+    }
+    return { kind: "not-hub", status: 200 };
+  }
+  await res.body?.cancel().catch(() => {
+  });
+  return res.status === 401 ? { kind: "unauthorized" } : { kind: "not-hub", status: res.status };
+}
+function daemonLine(report, command, logFile) {
+  if (report.kind === "timeout") {
+    return { text: `Codex daemon: no answer within ${ADAPTER_REPORT_TIMEOUT_MS / 1e3}s. The adapter keeps trying. See ${logFile}`, warning: true };
+  }
+  const o = report.outcome;
+  if (o.connected) return { text: `Codex daemon: connected (${o.userAgent ?? "unknown version"})`, warning: false };
+  if (o.notFound) {
+    return { text: `Codex daemon: "${command}" not found. Install Codex or set "codex.command" in ${CONFIG_PATH}, and run the restart from a new terminal.`, warning: true };
+  }
+  return { text: `Codex daemon: not connected (${o.error}). Is Codex running? The adapter keeps retrying.`, warning: true };
+}
+function addressSource(hub) {
+  const host = hub.fromEnv.host ? "CLAUDE_ALARM_HUB_HOST" : "hub.host";
+  const port = hub.fromEnv.port ? "CLAUDE_ALARM_HUB_PORT" : "hub.port";
+  const fromConfig = !hub.fromEnv.host || !hub.fromEnv.port;
+  return `${host} and ${port}${fromConfig ? ` in ${CONFIG_PATH}` : ""}`;
+}
+function tokenSource(hub) {
+  return hub.fromEnv.token ? "CLAUDE_ALARM_HUB_TOKEN" : `hub.token in ${CONFIG_PATH}`;
+}
+function hubLine(check, hub) {
+  const url = hubUrl(hub);
+  switch (check.kind) {
+    case "ok":
+      return { text: `Hub: reachable at ${url}`, warning: false };
+    case "unauthorized":
+      return { text: `Hub: ${url} rejected the token (401). Check ${tokenSource(hub)}.`, warning: true };
+    case "not-hub":
+      return { text: `Hub: ${url} answered ${check.status} but is not a claude-alarm hub. Check ${addressSource(hub)}.`, warning: true };
+    case "unreachable":
+      return { text: `Hub: not reachable at ${url} (${check.reason}). Check ${addressSource(hub)} and that the hub is running.`, warning: true };
+  }
+}
+function printChecks(d, daemon, hub) {
+  d.out(`  ${daemon.text}`);
+  d.out(`  ${hub.text}`);
+  if (daemon.warning || hub.warning) d.out(`  ${RESTART_HINT}`);
+}
+function printAlreadyRunning(d, pid, hub) {
+  d.out(`Codex adapter is already running (PID: ${pid})`);
+  printChecks(d, NOT_CHECKED, hubLine(hub, d.hub));
+}
+async function startAdapter(d) {
+  const existing = await d.queryOwner();
+  if (existing.state === "running") {
+    printAlreadyRunning(d, existing.pid, await checkHub(d.hub, d.hubTimeoutMs));
+    return 0;
+  }
+  const child = d.spawnAdapter();
+  const seen = {};
+  child.on("exit", (code, signal) => {
+    seen.exit ??= { code, signal };
+  });
+  child.on("error", (error) => {
+    seen.exit ??= { code: null, signal: null, error };
+  });
+  const [report, hub] = await Promise.all([
+    waitForAdapterReport(child, d.reportTimeoutMs),
+    checkHub(d.hub, d.hubTimeoutMs)
+  ]);
+  if (child.connected) child.disconnect();
+  child.unref();
+  if (report.kind === "already") {
+    printAlreadyRunning(d, report.pid, hub);
+    return 0;
+  }
+  if (report.kind === "lockFailed") {
+    d.err(`Codex adapter cannot start: ${report.error}`);
+    return 1;
+  }
+  if (report.kind !== "exited" && !seen.exit && child.pid !== void 0) {
+    d.out(`Codex adapter started (PID: ${child.pid}). Logs: ${d.logFile}`);
+    printChecks(d, daemonLine(report, d.command, d.logFile), hubLine(hub, d.hub));
+    return 0;
+  }
+  const exit = seen.exit ?? (report.kind === "exited" ? report : void 0);
+  if (!exit || exit.error) {
+    d.err(`Codex adapter failed to start: ${exit?.error?.message ?? "no process id"}`);
+    return 1;
+  }
+  const owner = await d.queryOwner();
+  if (owner.state === "running" && owner.pid !== child.pid) {
+    printAlreadyRunning(d, owner.pid, hub);
+    return 0;
+  }
+  const how = exit.code !== null ? `code ${exit.code}` : `signal ${exit.signal}`;
+  d.err(`Codex adapter exited during startup (${how}). See ${d.logFile}`);
+  return 1;
+}
+
+// src/codex/instance-lock.ts
+import crypto from "crypto";
+import fs4 from "fs";
+import net2 from "net";
+import path5 from "path";
+var CONTROL_PROTOCOL = 1;
+var STOP_PROOF_LABEL = "claude-alarm codex stop";
+var MAX_LINE_BYTES = 4096;
+function stopProof(token) {
+  return crypto.createHmac("sha256", token).update(STOP_PROOF_LABEL).digest("hex");
+}
+function controlEndpoint(configDir, platform = process.platform) {
+  if (platform !== "win32") return path5.posix.join(configDir, "codex.sock");
+  let dir;
+  try {
+    dir = fs4.realpathSync.native(configDir);
+  } catch {
+    dir = path5.win32.resolve(configDir);
+  }
+  const hash = crypto.createHash("sha256").update(dir.toLowerCase()).digest("hex").slice(0, 16);
+  return `\\\\.\\pipe\\claude-alarm-codex-${hash}`;
+}
+function ask(endpoint, request, timeoutMs) {
+  return new Promise((resolve) => {
+    let buffer = "";
+    let settled = false;
+    const socket = net2.connect(endpoint);
+    const finish = (answer) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(answer);
+    };
+    const timer = setTimeout(() => finish({ state: "unknown", error: `no answer within ${timeoutMs}ms` }), timeoutMs);
+    socket.setEncoding("utf8");
+    socket.on("connect", () => socket.write(`${JSON.stringify(request)}
+`));
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const end = buffer.indexOf("\n");
+      if (end < 0) {
+        if (Buffer.byteLength(buffer) > MAX_LINE_BYTES) finish({ state: "unknown", error: "reply too long" });
+        return;
+      }
+      try {
+        finish({ reply: JSON.parse(buffer.slice(0, end)) });
+      } catch {
+        finish({ state: "unknown", error: "unreadable reply" });
+      }
+    });
+    socket.on("end", () => finish({ state: "unknown", error: "closed without a reply" }));
+    socket.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "ECONNREFUSED") finish({ state: "absent" });
+      else finish({ state: "unknown", error: err.code ?? err.message });
+    });
+  });
+}
+async function queryOwner(endpoint, timeoutMs = 1e3) {
+  const answer = await ask(endpoint, { type: "status" }, timeoutMs);
+  if (!("reply" in answer)) return answer;
+  const reply = answer.reply;
+  if (reply?.type === "status" && reply.protocol === CONTROL_PROTOCOL && Number.isInteger(reply.pid)) {
+    return { state: "running", pid: reply.pid };
+  }
+  return { state: "unknown", error: "unexpected reply" };
+}
+async function requestStop(endpoint, token, timeoutMs = 1e3) {
+  const answer = await ask(endpoint, { type: "stop", proof: stopProof(token) }, timeoutMs);
+  if (!("reply" in answer)) return answer;
+  const reply = answer.reply;
+  if (reply?.type === "stopping" && Number.isInteger(reply.pid)) return { state: "stopping", pid: reply.pid };
+  if (reply?.type === "error" && reply.error === "unauthorized") return { state: "unauthorized" };
+  return { state: "unknown", error: "unexpected reply" };
+}
+
+// src/codex/control-cli.ts
+var STOP_WAIT_MS = 5e3;
+var STOP_POLL_MS = 100;
+function legacyNote(d, ownerPid) {
+  const pid = d.legacyPid();
+  if (pid === void 0 || pid === ownerPid) return;
+  if (!d.isRunning(pid)) {
+    d.removeLegacyPidFile();
+    return;
+  }
+  d.out(`Note: ${d.legacyPidFile} names a running process (PID: ${pid}). claude-alarm 1.2.0 and earlier wrote this file; if that process is an old Codex adapter, restart the hub or end it yourself.`);
+}
+function unavailable(d, error) {
+  d.err(`Codex adapter control endpoint is unavailable: ${error}`);
+  return 1;
+}
+async function stopAdapter(d, startWithHub) {
+  const owner = await d.queryOwner();
+  if (owner.state === "unknown") return unavailable(d, owner.error);
+  if (owner.state === "absent") {
+    d.out("Codex adapter is not running");
+    legacyNote(d);
+    return 0;
+  }
+  const reply = await d.requestStop();
+  if (reply.state === "unknown") return unavailable(d, reply.error);
+  if (reply.state === "unauthorized") {
+    d.err(`Codex adapter refused to stop: the token in ${d.configFile} does not match the one it started with`);
+    return 1;
+  }
+  if (reply.state === "absent") {
+    d.out("Codex adapter is not running");
+    return 0;
+  }
+  const sleep = d.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  for (let waited = 0; waited < (d.stopWaitMs ?? STOP_WAIT_MS); waited += STOP_POLL_MS) {
+    await sleep(STOP_POLL_MS);
+    const now = await d.queryOwner();
+    if (now.state === "absent" || now.state === "running" && now.pid !== reply.pid) {
+      d.out(`Codex adapter stopped (PID: ${reply.pid})`);
+      if (now.state === "running") d.out(`Another Codex adapter took over (PID: ${now.pid})`);
+      else if (startWithHub) d.out("If the hub started it, the hub will not start it again until you restart the hub.");
+      return 0;
+    }
+  }
+  d.err(`Stop requested, but the Codex adapter (PID: ${reply.pid}) is still running. Check with: claude-alarm codex status`);
+  return 1;
+}
+async function adapterStatus(d, startWithHub) {
+  const owner = await d.queryOwner();
+  if (owner.state === "running") {
+    d.out(`Codex adapter: running (PID: ${owner.pid})`);
+    legacyNote(d, owner.pid);
+  } else if (owner.state === "unknown") {
+    d.out(`Codex adapter: unknown (${owner.error})`);
+  } else {
+    d.out("Codex adapter: not running");
+    legacyNote(d);
+  }
+  d.out(`Start with hub: ${startWithHub ? "enabled" : "disabled"}`);
+  return 0;
+}
+
+// src/cli.ts
+var __dirname2 = path11.dirname(fileURLToPath2(import.meta.url));
 function authHeaders(token) {
   return token ? { Authorization: `Bearer ${token}` } : {};
 }
@@ -2407,6 +3437,10 @@ Usage:
   claude-alarm codex start      Run the Codex adapter on its own (e.g. Codex on another PC)
   claude-alarm codex stop       Stop a running Codex adapter
   claude-alarm codex status     Show Codex adapter status
+  claude-alarm codex run --brief <file|-> [--cwd <dir>] [--thread <id>] [--name <title>]
+                         [--output-schema <file>] [--approval-timeout <min>] [--timeout <min>] [--yolo]
+                                Hand a task to Codex through the shared daemon and print the result as JSON
+                                (--yolo: no sandbox and no approvals, like codex --yolo)
   claude-alarm help             Show this help
 
 Quick start:
@@ -2415,8 +3449,8 @@ Quick start:
 }
 async function checkForUpdates() {
   try {
-    const pkgPath = path9.join(__dirname2, "..", "package.json");
-    const pkg = JSON.parse(fs8.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path11.join(__dirname2, "..", "package.json");
+    const pkg = JSON.parse(fs9.readFileSync(pkgPath, "utf-8"));
     const currentVersion = pkg.version;
     const res = await fetch("https://registry.npmjs.org/@delt/claude-alarm/latest", {
       signal: AbortSignal.timeout(3e3)
@@ -2437,36 +3471,52 @@ async function hubStart(daemon) {
   const config2 = loadConfig();
   const host = config2.hub.host ?? DEFAULT_HUB_HOST;
   const port = config2.hub.port ?? DEFAULT_HUB_PORT;
-  const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+  const displayHost = hubUrlHost(host);
   checkForUpdates();
-  if (fs8.existsSync(PID_FILE)) {
-    const pid = parseInt(fs8.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  if (fs9.existsSync(PID_FILE)) {
+    const pid = parseInt(fs9.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
       console.log(`Hub is already running (PID: ${pid}). Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       return;
     }
-    fs8.unlinkSync(PID_FILE);
+    fs9.unlinkSync(PID_FILE);
   }
   if (daemon) {
     ensureConfigDir();
-    const logFd = fs8.openSync(LOG_FILE, "a");
-    const hubScript = path9.join(__dirname2, "hub", "server.js");
+    const logFd = fs9.openSync(LOG_FILE, "a");
+    const hubScript = path11.join(__dirname2, "hub", "server.js");
     const child = spawn3(process.execPath, [hubScript], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env }
     });
-    if (child.pid) {
-      fs8.writeFileSync(PID_FILE, String(child.pid), "utf-8");
-      child.unref();
-      console.log(`Hub started as daemon (PID: ${child.pid})`);
-      console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
-      console.log(`Token: ${config2.hub.token}`);
-      console.log(`Logs: ${LOG_FILE}`);
-    } else {
+    const pid = child.pid;
+    if (!pid) {
       console.error("Failed to start hub daemon");
       process.exit(1);
     }
+    fs9.writeFileSync(PID_FILE, String(pid), "utf-8");
+    let exited = false;
+    child.once("exit", () => {
+      exited = true;
+    });
+    child.unref();
+    const startup = await waitForHub({
+      url: `http://${displayHost}:${port}/api/status`,
+      token: config2.hub.token,
+      pid,
+      isAlive: () => !exited
+    });
+    if (startup !== "ready") {
+      if (!exited) child.kill();
+      if (fs9.existsSync(PID_FILE)) fs9.unlinkSync(PID_FILE);
+      console.error(startup === "exited" ? `Hub exited during startup. See ${LOG_FILE}` : `Hub did not answer at http://${displayHost}:${port} within ${HUB_START_TIMEOUT_MS / 1e3}s and was stopped. See ${LOG_FILE}`);
+      process.exit(1);
+    }
+    console.log(`Hub started as daemon (PID: ${pid})`);
+    console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
+    console.log(`Token: ${config2.hub.token}`);
+    console.log(`Logs: ${LOG_FILE}`);
   } else {
     console.log(`Starting hub on http://${displayHost}:${port} (press Ctrl+C to stop)`);
     console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
@@ -2478,11 +3528,11 @@ async function hubStart(daemon) {
     const hub = new HubServer2(config2);
     await hub.start();
     ensureConfigDir();
-    fs8.writeFileSync(PID_FILE, String(process.pid), "utf-8");
+    fs9.writeFileSync(PID_FILE, String(process.pid), "utf-8");
     const shutdown = async () => {
       console.log("\nShutting down...");
       await hub.stop();
-      if (fs8.existsSync(PID_FILE)) fs8.unlinkSync(PID_FILE);
+      if (fs9.existsSync(PID_FILE)) fs9.unlinkSync(PID_FILE);
       process.exit(0);
     };
     process.on("SIGINT", shutdown);
@@ -2490,27 +3540,27 @@ async function hubStart(daemon) {
   }
 }
 function hubStop() {
-  if (!fs8.existsSync(PID_FILE)) {
+  if (!fs9.existsSync(PID_FILE)) {
     console.log("Hub is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs8.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  const pid = parseInt(fs9.readFileSync(PID_FILE, "utf-8").trim(), 10);
   try {
     process.kill(pid, "SIGTERM");
     console.log(`Hub stopped (PID: ${pid})`);
   } catch {
     console.log("Hub process not found (may have already stopped)");
   }
-  fs8.unlinkSync(PID_FILE);
+  fs9.unlinkSync(PID_FILE);
 }
 async function hubStatus() {
   const config2 = loadConfig();
   const host = config2.hub.host ?? DEFAULT_HUB_HOST;
   const port = config2.hub.port ?? DEFAULT_HUB_PORT;
-  const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+  const displayHost = hubUrlHost(host);
   let pidInfo = "not running";
-  if (fs8.existsSync(PID_FILE)) {
-    const pid = parseInt(fs8.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  if (fs9.existsSync(PID_FILE)) {
+    const pid = parseInt(fs9.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
       pidInfo = `running (PID: ${pid})`;
     } else {
@@ -2518,7 +3568,7 @@ async function hubStatus() {
     }
   }
   try {
-    const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
+    const res = await fetch(`http://${displayHost}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
     if (res.ok) {
       const data = await res.json();
       console.log(`Hub: running (PID: ${data.pid})`);
@@ -2553,7 +3603,7 @@ async function test() {
     if (config2.hub.token) {
       headers["Authorization"] = `Bearer ${config2.hub.token}`;
     }
-    const res = await fetch(`http://${host}:${port}/api/notify`, {
+    const res = await fetch(`http://${hubUrlHost(host)}:${port}/api/notify`, {
       method: "POST",
       headers,
       body: JSON.stringify({
@@ -2571,7 +3621,7 @@ async function test() {
     console.error("Could not reach hub. Start it first: claude-alarm hub start");
   }
 }
-function ask(question) {
+function ask2(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (answer) => {
@@ -2582,18 +3632,18 @@ function ask(question) {
 }
 async function init() {
   const dir = process.cwd();
-  const projectName = path9.basename(dir);
+  const projectName = path11.basename(dir);
   console.log(`
 claude-alarm init for "${projectName}"
 `);
-  const remote = await ask("Connect to a remote hub? (y/N): ");
+  const remote = await ask2("Connect to a remote hub? (y/N): ");
   let env = {
     CLAUDE_ALARM_SESSION_NAME: projectName
   };
   if (remote.toLowerCase() === "y") {
-    const host = await ask("Hub host (e.g. 192.168.1.100): ");
-    const port = await ask("Hub port (default: 7900): ");
-    const token = await ask("Hub token: ");
+    const host = await ask2("Hub host (e.g. 192.168.1.100): ");
+    const port = await ask2("Hub port (default: 7900): ");
+    const token = await ask2("Hub token: ");
     if (!host) {
       console.error("Host is required.");
       process.exit(1);
@@ -2602,11 +3652,11 @@ claude-alarm init for "${projectName}"
     if (port) env.CLAUDE_ALARM_HUB_PORT = port;
     if (token) env.CLAUDE_ALARM_HUB_TOKEN = token;
   }
-  const mcpPath = path9.join(dir, ".mcp.json");
+  const mcpPath = path11.join(dir, ".mcp.json");
   let mcpConfig = {};
-  if (fs8.existsSync(mcpPath)) {
+  if (fs9.existsSync(mcpPath)) {
     try {
-      mcpConfig = JSON.parse(fs8.readFileSync(mcpPath, "utf-8"));
+      mcpConfig = JSON.parse(fs9.readFileSync(mcpPath, "utf-8"));
     } catch {
       mcpConfig = {};
     }
@@ -2617,17 +3667,17 @@ claude-alarm init for "${projectName}"
     args: ["-y", "@delt/claude-alarm", "serve"],
     env
   };
-  fs8.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
+  fs9.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
   console.log(`
 \u2713 Created ${mcpPath}`);
   if (remote.toLowerCase() !== "y") {
     const config2 = loadConfig();
     const host = config2.hub.host ?? DEFAULT_HUB_HOST;
     const port = config2.hub.port ?? DEFAULT_HUB_PORT;
-    const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+    const displayHost = hubUrlHost(host);
     let hubRunning = false;
     try {
-      const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
+      const res = await fetch(`http://${displayHost}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
       hubRunning = res.ok;
     } catch {
     }
@@ -2638,8 +3688,8 @@ claude-alarm init for "${projectName}"
       console.log(`  claude-alarm hub start`);
     }
     console.log(`  Dashboard: http://${displayHost}:${port}`);
-    if (shouldOfferCodex(config2, findOnPath("codex") !== void 0)) {
-      const answer = await ask("\nCodex is installed. Show Codex conversations on the dashboard too? (y/N): ");
+    if (shouldOfferCodex(config2, findCodex("codex") !== void 0)) {
+      const answer = await ask2("\nCodex is installed. Show Codex conversations on the dashboard too? (y/N): ");
       if (answer.toLowerCase() === "y") codexEnable(true);
       else setCodexEnabled(false);
     }
@@ -2668,53 +3718,80 @@ function isProcessRunning(pid) {
   }
 }
 function readCodexPid() {
-  if (!fs8.existsSync(CODEX_PID_FILE)) return void 0;
-  const pid = parseInt(fs8.readFileSync(CODEX_PID_FILE, "utf-8").trim(), 10);
+  if (!fs9.existsSync(CODEX_PID_FILE)) return void 0;
+  const pid = parseInt(fs9.readFileSync(CODEX_PID_FILE, "utf-8").trim(), 10);
   return Number.isNaN(pid) ? void 0 : pid;
 }
 function codexEnable(enabled) {
   setCodexEnabled(enabled);
   console.log(enabled ? "Codex adapter enabled. Restart the hub to apply: claude-alarm hub stop, then claude-alarm hub start" : "Codex adapter disabled. Restart the hub to apply.");
 }
-function codexStart() {
-  const pid = readCodexPid();
-  if (pid !== void 0 && isProcessRunning(pid)) {
-    console.log(`Codex adapter is already running (PID: ${pid})`);
-    return;
-  }
+async function codexStart() {
+  const config2 = loadConfig();
   ensureConfigDir();
-  const logFd = fs8.openSync(CODEX_LOG_FILE, "a");
-  const child = spawn3(process.execPath, [path9.join(__dirname2, "codex", "main.js")], {
-    detached: true,
-    stdio: ["ignore", logFd, logFd],
-    env: { ...process.env }
+  legacyNote(controlDeps());
+  const code = await startAdapter({
+    hub: resolveAdapterHub(config2),
+    command: config2.codex?.command ?? "codex",
+    logFile: CODEX_LOG_FILE,
+    queryOwner: () => queryOwner(controlEndpoint(CONFIG_DIR)),
+    spawnAdapter: () => {
+      const logFd = fs9.openSync(CODEX_LOG_FILE, "a");
+      return spawn3(process.execPath, [path11.join(__dirname2, "codex", "main.js")], {
+        detached: true,
+        stdio: ["ignore", logFd, logFd, "ipc"],
+        windowsHide: true,
+        env: { ...process.env }
+      });
+    },
+    out: (line) => console.log(line),
+    err: (line) => console.error(line)
   });
-  child.unref();
-  console.log(`Codex adapter started (PID: ${child.pid}). Logs: ${CODEX_LOG_FILE}`);
+  if (code !== 0) process.exit(code);
 }
-function codexStop() {
-  const pid = readCodexPid();
-  if (pid === void 0) {
-    console.log("Codex adapter is not running");
-    return;
-  }
-  try {
-    process.kill(pid, "SIGTERM");
-    console.log(`Codex adapter stopped (PID: ${pid})`);
-  } catch {
-    console.log("Codex adapter process not found (may have already stopped)");
-  }
+function controlDeps() {
+  const endpoint = controlEndpoint(CONFIG_DIR);
+  const token = loadConfig().hub.token ?? "";
+  return {
+    queryOwner: () => queryOwner(endpoint),
+    requestStop: () => requestStop(endpoint, token),
+    legacyPid: readCodexPid,
+    isRunning: isProcessRunning,
+    removeLegacyPidFile: () => {
+      try {
+        fs9.unlinkSync(CODEX_PID_FILE);
+      } catch {
+      }
+    },
+    legacyPidFile: CODEX_PID_FILE,
+    configFile: CONFIG_FILE,
+    out: (line) => console.log(line),
+    err: (line) => console.error(line)
+  };
+}
+async function codexRun(argv) {
+  const abort = new AbortController();
+  const stop = () => abort.abort();
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
   try {
-    fs8.unlinkSync(CODEX_PID_FILE);
-  } catch {
+    return await runFromCli(argv, {
+      readFile: (file) => fs9.promises.readFile(file, "utf-8"),
+      readStdin: async () => {
+        let text = "";
+        for await (const chunk of process.stdin) text += chunk;
+        return text;
+      },
+      out: (text) => process.stdout.write(text),
+      err: (text) => process.stderr.write(text),
+      cwd: process.cwd(),
+      signal: abort.signal
+    });
+  } finally {
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
   }
 }
-function codexStatus() {
-  const pid = readCodexPid();
-  const state = pid === void 0 ? "not running" : isProcessRunning(pid) ? `running (PID: ${pid})` : "not running (stale PID file)";
-  console.log(`Codex adapter: ${state}`);
-  console.log(`Start with hub: ${loadConfig().codex?.enabled ? "enabled" : "disabled"}`);
-}
 async function main2() {
   const args = process.argv.slice(2);
   const cmd = args[0];
@@ -2749,9 +3826,10 @@ async function main2() {
   if (cmd === "codex") {
     if (sub === "enable") codexEnable(true);
     else if (sub === "disable") codexEnable(false);
-    else if (sub === "start") codexStart();
-    else if (sub === "stop") codexStop();
-    else if (sub === "status") codexStatus();
+    else if (sub === "start") await codexStart();
+    else if (sub === "stop") process.exitCode = await stopAdapter(controlDeps(), loadConfig().codex?.enabled === true);
+    else if (sub === "status") process.exitCode = await adapterStatus(controlDeps(), loadConfig().codex?.enabled === true);
+    else if (sub === "run") process.exitCode = await codexRun(args.slice(2));
     else {
       console.error(`Unknown codex command: ${sub}`);
       printUsage();