@gotcos/glasses-server 6.36.11 → 6.36.13

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 ## Unreleased
 
+## 6.36.13
+- **Codex was spawned by bare name in four places, and it only worked here by accident.**
+  `codex` on PATH is a shell alias to `/Applications/Codex.app`, which does not exist; the real
+  binary lives in ChatGPT.app. Every bare `spawn('codex', …)` resolved through a PATH that COS
+  Control injects into the managed plist — so it worked on this machine and was ENOENT for every
+  public npx user, and for anything launchd- or Finder-spawned. The sites: the model catalog, the
+  `--add-dir` capability probe, the health probe, and `callCodexStreaming`, which is the **live
+  turn-execution path**. Each now resolves first, and each refuses in the way that suits it: the
+  live turn throws with the reason, the catalog rejects to its existing `cli-default` degradation,
+  the capability probe reports unsupported, and the health probe reports `unresolved (…)` instead
+  of collapsing "cannot find it" and "found it and it errored" into one `error`.
+- **Binary resolution moved to its own leaf module.** `provider-binary.ts` imports nothing from the
+  repo, deliberately: reaching the resolver through `attached-provider-adapter.ts` would close the
+  cycle adapter → codex-run-ledger → codex-model-catalog → adapter. The adapter re-exports it, so
+  no existing importer changed.
+- **Three source-text assertions replaced with fixtures.** Two tests asserted on this repo's own
+  characters — `not.toMatch('AGENT_SESSION_MAX_FILE_BYTES')` and `toMatch('end = HEAD_BYTES - 1')`
+  — which go stale on any refactor and cannot observe the property they name. A Codex rollout is
+  now made genuinely larger than the 32 MB gate (sparse, via `truncateSync`) and asserted to still
+  be listed. Verified by mutation: adding that gate to `listCodexSessions` fails the new test.
+
+## 6.36.12
+- **Claude and Codex now rank candidates by recency before spending the budget.** Both
+  walked in raw `readdir` order, so which sessions were reachable came down to filesystem
+  layout — `collectCursorDocs` had ranked for a while and these two were the inconsistent
+  ones. Statting every candidate first costs ~41ms across 2,118 files. Cursor also charged
+  its budget before the keep-warm filter, the same defect, now fixed.
+- **The reach claim in the module docstring was never true and is now measured.** It said
+  "older chats stay findable". Ranked and measured on this machine, search reaches roughly
+  24 days of Claude, 89 days of Codex and 19 days of Cursor, because once candidates are
+  ordered by recency the per-provider doc budget IS the horizon. `EXAMINE_MULTIPLE` was
+  re-swept and raised to 12 — the point where examining more files stops finding anything
+  older and the doc budget takes over. A sampled older stratum was considered and
+  rejected: partial coverage makes a miss uninterpretable, and a search that silently
+  samples cannot tell you whether something is absent or merely unsampled.
+- **Embedding batches go out together instead of one after another.** The loop awaited
+  each batch in turn, so cost was a round trip per 64 docs and grew as the collector
+  returned more — 389 docs is 7 serialized trips at the old size. Now 128 per request,
+  all in flight at once. Structural; not measured end to end, because this harness has no
+  OpenAI key and the running server was left alone.
+- **Session search was 68% scaffolding, and the budget was the reason.** Of the 1,296
+  Claude transcripts on this machine the collector indexed 41, and 28 of those 41 were
+  machine prompts — 22 Slack Bridge proxy, 4 reply-with, 2 slack_search_users. Roughly 13
+  real conversations were searchable, which is why searching an exact session title
+  returned nothing. Two changes, which do not work apart: `isKeepWarmSessionTitle` now
+  recognises the machine families by anchored prefix, and both the Claude and Codex
+  collectors run that filter — and the Codex `thread_source === 'subagent'` check — BEFORE
+  charging the doc budget rather than after. Measured against the real corpus: 41 indexed
+  Claude docs with 28 junk becomes **79 indexed with 0 junk**.
+- **The budget now counts docs kept, not files opened.** That is the whole fix: a run of
+  machine transcripts used to consume the 134-file allowance and return nothing, so the
+  newest real transcript on disk was never reached. A second `examined` ceiling
+  (`EXAMINE_MULTIPLE`, 5x the doc budget) stops a pathological corpus walking all 1,296
+  files, and the expensive transcript-body read is deferred until a file is being kept.
+- **This also removes rows from COS Control's session LIST.** The predicate is shared by
+  all four collectors and the list path, so keep-warm and Slack Bridge entries stop
+  appearing there too. That is intended, not a side effect to fix.
+- **Control may not see any of this yet.** The search route's median is ~2.27s against
+  Control's 2s client timeout, of which ~1.7s is two sequential embedding round trips;
+  this work adds ~350ms on top. Until that timeout and `EMBED_BATCH` are addressed,
+  Control falls back to its local scanner and reports a fabricated `server_too_old`.
+- **The scan budget had no test coverage at all.** `collectAgentSessionSearchDocs` was
+  never called by any test and its `cap` was never exercised, so the branch that spends
+  the budget had never run. 21 tests added, each verified to FAIL against the previous
+  code before being kept.
+
 ## 6.36.11
 - **Fences now record WHY, so the population can be measured before anything resolves
   automatically.** Two plans designed an automatic fence resolver and both were rejected —
@@ -54,6 +120,21 @@
   default install (`COS_THREAD_FENCE_DURABLE` unset) nothing is written to disk at all;
   and reading the distribution means reading `thread-fences.json` or the server log —
   there is no UI for it.
+- **A live session was reporting itself hours idle.** Separate from the fence work above.
+  `liveClaudeRows` builds a row's `modified` from the peer registry's `lastActiveAt`, which
+  tracks the REGISTRY record and not the transcript — so a session that is actively writing
+  keeps reporting whenever the registry last moved. Measured on three live sessions
+  2026-08-18: the wire said 55.3m / 407.7m / 435.0m old while their transcripts had been
+  written 0.1m / 0.2m / 5.1m earlier. Under-reporting by up to 7.2 hours. Shipped in
+  66dff88; `enrichLiveClaude` already resolves the transcript path and reads the file twice,
+  so the true mtime costs one `stat`. A resolved file that fails to stat keeps the
+  heartbeat; a session with no transcript at all (2 of 6 measured) returns early on the
+  existing guard. Prerequisite for any surface that renders a real date — without it,
+  showing the timestamp displays an actively-writing session as seven hours stale.
+  Coverage: `enrichLiveClaude` had NO execution coverage before this (every existing test
+  passes an empty live array). Two tests now drive it through `listAgentSessions`. Three
+  mutations, two caught; the third (the stat-failure fallback) SURVIVES because the
+  missing-file guard returns first, so that branch is unreached. The code says so.
 
 ## 6.36.10
 - **A fenced thread had no exit and left no trace.** An ambiguous delivery fences the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.11",
-  "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
+  "version": "6.36.13",
+  "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {
     "glasses-server": "bin/cli.cjs",

package/server/lib/agent-session-search.ts

@@ -4,7 +4,18 @@
  * Keyword: local title / sidebar name / first prompt / transcript scan. No model.
  * Semantic: one OpenAI query embedding scored against those same texts.
  * Sessions have no Qdrant collection — this is not meeting or memory search.
- * The 7-day list window does not apply; older chats stay findable.
+ *
+ * REACH, measured 2026-08-18 rather than claimed. The 7-day list window does not apply,
+ * but this is not unbounded either: each provider gets a doc budget of MAX_SCAN_FILES/3,
+ * and once candidates are ranked by recency that budget IS the horizon. On this machine
+ * that is roughly 24 days of Claude, 89 days of Codex and 19 days of Cursor. An older
+ * chat is reachable only if its provider has not filled its budget with newer ones.
+ *
+ * This previously read "older chats stay findable", which was written before ranking and
+ * was never measured. Widening it means a bigger budget, which costs embedding time on
+ * the route -- not a deeper examine ceiling, which saturates. A sampled older stratum was
+ * considered and rejected: partial coverage makes a miss uninterpretable, and a search
+ * that silently samples cannot tell you whether a thing is absent or merely unsampled.
  */
 
 import { join } from 'node:path'
@@ -46,11 +57,51 @@ import {
 
 const HEAD_TEXT = 8_000
 const MAX_SCAN_FILES = 400
+
+/**
+ * How many files a provider may OPEN per search, as a multiple of the docs it may KEEP.
+ *
+ * Before the filter moved ahead of the decrement, `remaining` meant "files read" -- so a
+ * run of machine transcripts consumed the whole allowance and returned nothing. Now it
+ * means "docs kept", which on its own would let a pathological corpus walk all 1,296
+ * files. This is the ceiling that stops it.
+ *
+ * Swept 2026-08-18 against the real corpus (1,296 Claude transcripts, 822 Codex
+ * rollouts). Docs kept vs collector wall time, median of 5 warm runs:
+ *
+ * Re-swept after recency ranking landed, since ranking changes which files the ceiling
+ * is spent on -- the newest region of the corpus is the densest in machine transcripts:
+ *
+ *     x5     329 docs   74 claude   11.4d window   1287 ms
+ *     x8     389 docs  134 claude   21.3d window   1585 ms
+ *     x12    389 docs  134 claude   24.5d window   1697 ms   <- chosen
+ *     x16    389 docs  134 claude   24.5d window   1637 ms
+ *
+ * x12 is where the ceiling stops being the constraint and the 134-doc budget takes over:
+ * past it, examining more files finds nothing older. That is the principled stopping
+ * point -- raise until the other limit binds, then stop.
+ */
+const EXAMINE_MULTIPLE = 12
+
+/**
+ * `remaining` counts docs KEPT. `examined` counts files OPENED. They are different
+ * numbers because most files on this machine are filtered out after their title is read.
+ */
+type ScanBudget = { remaining: number; examined: number }
 const SEMANTIC_DOC_CAP = 120
 const SEMANTIC_MIN = 0.28
 const EMBED_MODEL = 'text-embedding-3-small'
 const EMBED_TIMEOUT_MS = 12_000
-const EMBED_BATCH = 64
+/**
+ * 128 inputs per request, and the requests go out TOGETHER.
+ *
+ * This loop used to `await` each batch in turn, so the embedding cost was a round trip
+ * per 64 docs -- about 1.7s of a 2.3s route, and it got worse as the collector started
+ * returning more docs (389 docs is 7 serialized trips at the old batch size, 4 at this
+ * one). Serialization was the expensive part, not the batch size, so both changed:
+ * fewer requests, and one round trip of latency instead of N.
+ */
+const EMBED_BATCH = 128
 
 export interface AgentSessionSearchHit extends AgentSessionRow {
   snippet: string
@@ -139,7 +190,9 @@ export async function defaultEmbedTexts(texts: string[]): Promise<number[][] | {
   if (!key) return { reason: 'no_session_embeddings' }
   if (texts.length === 0) return []
   const vectors: number[][] = new Array(texts.length)
-  for (let offset = 0; offset < texts.length; offset += EMBED_BATCH) {
+  const offsets: number[] = []
+  for (let offset = 0; offset < texts.length; offset += EMBED_BATCH) offsets.push(offset)
+  const failed = await Promise.all(offsets.map(async offset => {
     const slice = texts.slice(offset, offset + EMBED_BATCH).map(text => text.slice(0, HEAD_TEXT))
     try {
       const response = await fetch('https://api.openai.com/v1/embeddings', {
@@ -151,17 +204,19 @@ export async function defaultEmbedTexts(texts: string[]): Promise<number[][] | {
         body: JSON.stringify({ model: EMBED_MODEL, input: slice }),
         signal: AbortSignal.timeout(EMBED_TIMEOUT_MS),
       })
-      if (!response.ok) return { reason: 'embeddings_unreachable' }
+      if (!response.ok) return true
       const parsed = await response.json() as { data?: Array<{ embedding?: number[]; index?: number }> }
       const rows = Array.isArray(parsed.data) ? parsed.data : []
       for (const row of rows) {
         const index = typeof row.index === 'number' ? row.index : 0
         if (Array.isArray(row.embedding)) vectors[offset + index] = row.embedding
       }
+      return false
     } catch {
-      return { reason: 'embeddings_unreachable' }
+      return true
     }
-  }
+  }))
+  if (failed.some(Boolean)) return { reason: 'embeddings_unreachable' }
   if (vectors.some(row => !Array.isArray(row) || row.length === 0)) return { reason: 'embeddings_unreachable' }
   return vectors
 }
@@ -180,40 +235,53 @@ function pushDoc(docs: SearchDoc[], next: SearchDoc) {
   }
 }
 
-async function collectClaudeDocs(roots: AgentSessionRoots, docs: SearchDoc[], budget: { remaining: number }) {
+async function collectClaudeDocs(roots: AgentSessionRoots, docs: SearchDoc[], budget: ScanBudget) {
   const starred = await loadClaudeStarredIds(roots.claudeDesktopConfig)
+  // Stat every candidate and rank by recency BEFORE spending anything, the shape
+  // `collectCursorDocs` already used. Claude and Codex were the inconsistent ones: they
+  // walked in raw `readdir` order, so which sessions were reachable came down to
+  // filesystem layout and the newest transcript on disk was routinely never opened.
+  // Statting is not the expensive part -- measured at 41ms across 2,118 candidates.
+  const candidates: Array<{ file: string; native: string; folder: string; mtimeMs: number; birthtimeMs: number }> = []
   for (const folder of await dirents(roots.claudeProjects)) {
     const dir = join(roots.claudeProjects, folder)
     for (const name of await dirents(dir)) {
-      if (!CLAUDE_UUID_JSONL.test(name) || budget.remaining <= 0) continue
+      if (!CLAUDE_UUID_JSONL.test(name)) continue
       const file = join(dir, name)
       const st = await fileStat(file)
       if (!st?.isFile) continue
-      budget.remaining -= 1
-      const native = name.slice(0, -6)
-      const custom = await lastCustomTitle(file)
-      const first = await firstClaudeUserTitle(file)
-      const users = await transcriptHaystack('claude', file)
-      const title = custom || first || 'Claude session'
-      if (isKeepWarmSessionTitle(title)) continue
-      const haystack = clip(`${title}\n${custom || ''}\n${first || ''}\n${workspaceLabel(folder)}\n${users}`)
-      pushDoc(docs, {
-        title,
-        haystack,
-        row: {
-          session_id: native,
-          provider: 'claude',
-          display_label: title,
-          project: workspaceLabel(folder),
-          modified: isoFromMtime(st.mtimeMs),
-          created: isoFromMtime(st.birthtimeMs),
-          alive: false,
-          state: 'recent',
-          pinned: starred.has(native.toLowerCase()),
-        },
-      })
+      candidates.push({ file, native: name.slice(0, -6), folder, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs })
     }
   }
+  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs)
+  for (const candidate of candidates) {
+    if (budget.remaining <= 0 || budget.examined <= 0) break
+    budget.examined -= 1
+    const custom = await lastCustomTitle(candidate.file)
+    const first = await firstClaudeUserTitle(candidate.file)
+    const title = custom || first || 'Claude session'
+    // Both filters run BEFORE the doc budget is charged, and the haystack -- by far the
+    // most expensive read here -- runs only for a file we are actually keeping.
+    if (isKeepWarmSessionTitle(title)) continue
+    budget.remaining -= 1
+    const users = await transcriptHaystack('claude', candidate.file)
+    const haystack = clip(`${title}\n${custom || ''}\n${first || ''}\n${workspaceLabel(candidate.folder)}\n${users}`)
+    pushDoc(docs, {
+      title,
+      haystack,
+      row: {
+        session_id: candidate.native,
+        provider: 'claude',
+        display_label: title,
+        project: workspaceLabel(candidate.folder),
+        modified: isoFromMtime(candidate.mtimeMs),
+        created: isoFromMtime(candidate.birthtimeMs),
+        alive: false,
+        state: 'recent',
+        pinned: starred.has(candidate.native.toLowerCase()),
+      },
+    })
+  }
   for (const starredId of starred) {
     if (docs.some(doc => doc.row.provider === 'claude' && doc.row.session_id.toLowerCase() === starredId)) continue
     if (budget.remaining <= 0) break
@@ -221,10 +289,10 @@ async function collectClaudeDocs(roots: AgentSessionRoots, docs: SearchDoc[], bu
     if (!desktop) continue
     const st = await fileStat(desktop)
     if (!st?.isFile) continue
-    budget.remaining -= 1
     const head = peekClaudeDesktopHead(await readWindow(desktop, false))
     const title = head.title || 'Claude session'
     if (isKeepWarmSessionTitle(title)) continue
+    budget.remaining -= 1
     pushDoc(docs, {
       title,
       haystack: clip(`${title}\n${head.cwd}\n${workspaceLabel(head.cwd)}`),
@@ -243,23 +311,31 @@ async function collectClaudeDocs(roots: AgentSessionRoots, docs: SearchDoc[], bu
   }
 }
 
-async function collectCodexDocs(roots: AgentSessionRoots, docs: SearchDoc[], budget: { remaining: number }) {
+async function collectCodexDocs(roots: AgentSessionRoots, docs: SearchDoc[], budget: ScanBudget) {
   const names = await loadCodexThreadNames(roots.codexSessions)
   const pinned = await loadCodexPinnedIds(roots.codexSessions)
+  const candidates: Array<{ file: string; mtimeMs: number; birthtimeMs: number }> = []
   for (const file of await listCodexJsonlFiles(roots.codexSessions)) {
-    if (budget.remaining <= 0) break
     const st = await fileStat(file)
     if (!st?.isFile) continue
-    budget.remaining -= 1
+    candidates.push({ file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs })
+  }
+  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs)
+  for (const { file, mtimeMs, birthtimeMs } of candidates) {
+    if (budget.remaining <= 0 || budget.examined <= 0) break
+    budget.examined -= 1
     const meta = await peekCodexMeta(file)
+    // Subagent rollouts are the Codex analogue of the keep-warm transcripts: 427 of 822
+    // on this machine per the 2026-08-18 census. Filtered before the doc budget is charged.
     if (!meta || meta.subagent) continue
     const name = file.split('/').pop() || file
     const native = meta.id || name.slice(0, -6)
     const thread = names.get(native) || ''
     const title = thread || meta.title || 'Codex session'
     if (isKeepWarmSessionTitle(title)) continue
+    budget.remaining -= 1
     const users = await transcriptHaystack('codex', file)
-    const created = meta.created || createdFromCodexFilename(name) || isoFromMtime(st.birthtimeMs)
+    const created = meta.created || createdFromCodexFilename(name) || isoFromMtime(birthtimeMs)
     pushDoc(docs, {
       title,
       haystack: clip(`${title}\n${thread}\n${meta.title}\n${meta.cwd}\n${users}`),
@@ -268,7 +344,7 @@ async function collectCodexDocs(roots: AgentSessionRoots, docs: SearchDoc[], bud
         provider: 'codex',
         display_label: title,
         project: workspaceLabel(meta.cwd),
-        modified: isoFromMtime(st.mtimeMs),
+        modified: isoFromMtime(mtimeMs),
         created,
         alive: false,
         state: 'recent',
@@ -305,11 +381,12 @@ async function collectCursorDocs(
   const ranked = [...byId.entries()].sort((a, b) => b[1].mtimeMs - a[1].mtimeMs)
   for (const [sessionDir, candidate] of ranked) {
     if (budget.remaining <= 0) break
-    budget.remaining -= 1
     const sidebar = composerNames.get(sessionDir) || ''
     const users = await transcriptHaystack('cursor', candidate.file)
     const title = sidebar || users.split('\n')[0] || 'Cursor session'
+    // Cursor already ranked, but it charged the budget before this filter too.
     if (isKeepWarmSessionTitle(title)) continue
+    budget.remaining -= 1
     pushDoc(docs, {
       title,
       haystack: clip(`${title}\n${sidebar}\n${candidate.project}\n${users}`),
@@ -335,8 +412,9 @@ export async function collectAgentSessionSearchDocs(
 ): Promise<SearchDoc[]> {
   const docs: SearchDoc[] = []
   const share = Math.max(1, Math.ceil(Math.min(cap, MAX_SCAN_FILES) / 3))
-  await collectClaudeDocs(roots, docs, { remaining: share })
-  await collectCodexDocs(roots, docs, { remaining: share })
+  const examined = share * EXAMINE_MULTIPLE
+  await collectClaudeDocs(roots, docs, { remaining: share, examined })
+  await collectCodexDocs(roots, docs, { remaining: share, examined })
   await collectCursorDocs(roots, docs, { remaining: share }, now)
   docs.sort((a, b) => (b.row.modified || '').localeCompare(a.row.modified || ''))
   return docs.slice(0, Math.max(1, Math.min(cap, MAX_SCAN_FILES)))

package/server/lib/agent-session-store.ts

@@ -97,10 +97,32 @@ export function isScratchCursorProject(folder: string): boolean {
 
 export const isSkippedCursorFolder = isScratchCursorProject
 
+/**
+ * Titles that belong to a MACHINE, not to a conversation Miles had.
+ *
+ * Measured 2026-08-18 by driving the real collector over the 1,296 Claude transcripts on
+ * this machine: of the 41 Claude docs it indexed, 28 were machine prompts -- 22 Slack
+ * Bridge proxy, 4 reply-with, 2 slack_search_users. Two thirds of Claude search was
+ * answering with scaffolding.
+ *
+ * Every `you are ...` prefix here is ANCHORED to a specific known caller. A bare
+ * `startsWith('you are')` would also swallow any human sentence beginning that way
+ * ("You are right that ..."), and the anchored pair covers the measured volume without
+ * that risk.
+ *
+ * Shared by all four search collectors AND the session-list path, so a title added here
+ * also stops appearing as a row in COS Control's session list. That is the intent.
+ */
 export function isKeepWarmSessionTitle(title: string): boolean {
   const t = title.trim().toLowerCase()
   if (t === 'ready') return true
-  return t.startsWith('this is an automated local readiness check')
+  if (t.startsWith('this is an automated local readiness check')) return true
+  if (t.startsWith('you are the cos slack bridge proxy')) return true
+  if (t.startsWith('you are a post-processing editor')) return true
+  if (t.startsWith('call mcp__claude_ai_slack__slack_search_users')) return true
+  if (/^reply with (exactly|the single word)\b/.test(t)) return true
+  if (t === 'say ok' || t === 'say: ok' || t === 'reply ok') return true
+  return false
 }
 
 /**

package/server/lib/attached-provider-adapter.ts

@@ -227,173 +227,28 @@ export function attachedDeliveryAmbiguous(result: AttachedTurnResult): boolean {
 // ---------------------------------------------------------------------------
 // Binary resolution
 // ---------------------------------------------------------------------------
+//
+// MOVED to ./provider-binary.js so codex-bridge, codex-model-catalog and
+// health-static-probes can resolve without importing this module -- doing so would close
+// the cycle adapter -> codex-run-ledger -> codex-model-catalog -> adapter.
+// Re-exported here so existing importers and tests are unaffected.
+
+import {
+  resolveProviderBinary,
+  type BinaryResolution,
+} from './provider-binary.js'
+
+export {
+  STALE_SHIM_PREFIXES,
+  isKnownStaleShimPath,
+  providerBinarySpec,
+  resolveProviderBinary,
+  resolveBinaryFromSpec,
+  type BinaryResolution,
+  type BinaryResolutionFailure,
+  type BinarySpec,
+} from './provider-binary.js'
 
-export type BinaryResolutionFailure = 'env_override_unusable' | 'not_found'
-
-export type BinaryResolution =
-  | { ok: true; path: string; source: 'env' | 'absolute' | 'path' }
-  | { ok: false; binary: string; detail: BinaryResolutionFailure }
-
-/**
- * Path prefixes that can never be a usable provider binary.
- *
- * `codex` resolved through PATH (or a shell alias) points at
- * `/Applications/Codex.app/Contents/Resources/codex` on this machine, and that
- * app no longer exists. Today the shim is dangling, so an existence check
- * already rejects it — but a reinstalled or partially-removed Codex.app puts a
- * real, executable file back on that path, and then only this list stands
- * between an attached turn and a binary that cannot serve it.
- */
-export const STALE_SHIM_PREFIXES: readonly string[] = ['/Applications/Codex.app/']
-
-export function isKnownStaleShimPath(
-  candidate: string,
-  prefixes: readonly string[] = STALE_SHIM_PREFIXES,
-): boolean {
-  // A non-array argument falls back to the known list rather than to "exclude
-  // nothing" — the classic version of this bug is `list.some(isKnownStaleShimPath)`,
-  // where `.some` passes the INDEX as the second argument and every exclusion
-  // silently disappears.
-  const list = Array.isArray(prefixes) ? prefixes : STALE_SHIM_PREFIXES
-  return list.some(prefix => typeof prefix === 'string' && prefix.length > 0 && candidate.startsWith(prefix))
-}
-
-function isUsableExecutable(
-  candidate: string,
-  excludePrefixes: readonly string[] = STALE_SHIM_PREFIXES,
-): boolean {
-  try {
-    if (!isAbsolute(candidate) || candidate.includes('\0')) return false
-    if (isKnownStaleShimPath(candidate, excludePrefixes)) return false
-    if (!statSync(candidate).isFile()) return false
-    accessSync(candidate, fsConstants.X_OK)
-    return true
-  } catch {
-    return false
-  }
-}
-
-export interface BinarySpec {
-  name: string
-  envKeys: readonly string[]
-  /** Tried in order, BEFORE any PATH scan. */
-  absolutes: readonly string[]
-  /**
-   * Paths that must never be selected, from any source. Defaults to
-   * `STALE_SHIM_PREFIXES`.
-   *
-   * On the spec rather than hardcoded because the exclusion is the only guard
-   * standing between resolution and a known-bad binary, and a guard whose input
-   * cannot be constructed is a guard nobody can prove works: the real prefix
-   * lives under `/Applications`, which no fixture can write to.
-   */
-  excludePrefixes?: readonly string[]
-}
-
-/**
- * Where each provider's binary is looked for, in precedence order.
- *
- * Exported as data rather than kept private so the precedence itself is
- * testable: on a machine where a stale shim sits on PATH, "ChatGPT.app is tried
- * before PATH" is the property that decides whether an attached Codex turn
- * launches the real binary or a dangling one.
- */
-export function providerBinarySpec(provider: AttachedProvider): BinarySpec {
-  const home = (() => {
-    try {
-      return homedir()
-    } catch {
-      return ''
-    }
-  })()
-  if (provider === 'claude') {
-    return {
-      name: 'claude',
-      envKeys: ['COS_ATTACHED_CLAUDE_BIN', 'COS_CLAUDE_BIN'],
-      absolutes: [
-        '/opt/homebrew/bin/claude',
-        '/usr/local/bin/claude',
-        home ? join(home, '.local', 'bin', 'claude') : '',
-      ].filter(Boolean),
-    }
-  }
-  return {
-    name: 'codex',
-    envKeys: ['COS_ATTACHED_CODEX_BIN', 'COS_CODEX_BIN'],
-    absolutes: [
-      // Verified 2026-08-15: codex-cli 0.148.0-alpha.9 lives here, and there is
-      // no `codex` on PATH at all on this machine.
-      '/Applications/ChatGPT.app/Contents/Resources/codex',
-      home ? join(home, '.codex', 'bin', 'codex') : '',
-      '/opt/homebrew/bin/codex',
-      '/usr/local/bin/codex',
-    ].filter(Boolean),
-  }
-}
-
-/**
- * Resolve a provider binary to a verified absolute path, or refuse.
- *
- * Never returns a bare name. A bare name is a silent PATH lookup, and the two
- * environments this server runs in disagree about PATH: a login shell finds the
- * CLI, a Finder- or launchd-spawned process gets a minimal PATH and does not
- * (hit twice in COS Control). The PATH scan below is done by us, entry by
- * entry, and still yields an absolute path we have stat'ed — so a failure names
- * the missing binary instead of surfacing as ENOENT from inside a spawn.
- *
- * An unusable env override REFUSES rather than falling through to the
- * candidates: an operator who set it wrongly needs to be told, not overridden.
- */
-export function resolveProviderBinary(
-  provider: AttachedProvider,
-  env: NodeJS.ProcessEnv = process.env,
-): BinaryResolution {
-  return resolveBinaryFromSpec(providerBinarySpec(provider), env)
-}
-
-/**
- * The resolution algorithm itself, separated from the provider tables.
- *
- * Not a testing seam bolted on: on any developer machine at least one real
- * absolute candidate exists, so the PATH-scan and not-found branches of
- * `resolveProviderBinary` are unreachable from a test and would ship
- * unexercised — which is exactly how a launchd-only failure hides. Driving the
- * REAL algorithm with a fixture spec exercises them for real.
- */
-export function resolveBinaryFromSpec(spec: BinarySpec, env: NodeJS.ProcessEnv): BinaryResolution {
-  const excluded = spec.excludePrefixes ?? STALE_SHIM_PREFIXES
-
-  for (const key of spec.envKeys) {
-    const raw = env[key]
-    if (typeof raw !== 'string' || raw.trim().length === 0) continue
-    const candidate = raw.trim()
-    if (!isUsableExecutable(candidate, excluded)) {
-      return { ok: false, binary: spec.name, detail: 'env_override_unusable' }
-    }
-    return { ok: true, path: candidate, source: 'env' }
-  }
-
-  for (const candidate of spec.absolutes) {
-    if (isUsableExecutable(candidate, excluded)) return { ok: true, path: candidate, source: 'absolute' }
-  }
-
-  const pathValue = typeof env.PATH === 'string' ? env.PATH : ''
-  for (const dir of pathValue.split(delimiter)) {
-    // A relative PATH entry resolves against the server's cwd, which is not a
-    // location we control. Skipped rather than resolved.
-    //
-    // Redundant with the `isAbsolute` inside `isUsableExecutable` — verified by
-    // mutation: removing EITHER one alone changes no outcome, and only removing
-    // BOTH lets a relative entry through. Kept because two independent guards
-    // on "never resolve against the server cwd" is the correct amount for a
-    // path that ends up as a spawned executable.
-    if (!dir || !isAbsolute(dir)) continue
-    const candidate = join(dir, spec.name)
-    if (isUsableExecutable(candidate, excluded)) return { ok: true, path: candidate, source: 'path' }
-  }
-
-  return { ok: false, binary: spec.name, detail: 'not_found' }
-}
 
 // ---------------------------------------------------------------------------
 // Injected surface

package/server/lib/codex-bridge.ts

@@ -2,6 +2,11 @@
 // Concrete GPT ids resolve from Codex's live model catalog at run time.
 
 import { spawn, spawnSync } from 'node:child_process'
+// Resolved, never bare. `codex` on PATH is a shell alias to /Applications/Codex.app,
+// which does not exist; the real binary is in ChatGPT.app. A bare argv works here only
+// because COS Control injects that directory into the managed plist PATH -- it is ENOENT
+// for every public npx user, and for anything launchd- or Finder-spawned.
+import { resolveProviderBinary } from './provider-binary.js'
 import { logTokenAudit } from './token-audit.js'
 import { cleanupModelImageInputs, type ModelImageInput } from './model-image-input.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt } from './context-builder.js'
@@ -137,7 +142,14 @@ let addDirSupported: boolean | undefined
 export function codexSupportsAdditionalDir(): boolean {
   if (addDirSupported !== undefined) return addDirSupported
   try {
-    const result = spawnSync('codex', ['exec', '--help'], {
+    const resolved = resolveProviderBinary('codex')
+    if (!resolved.ok) {
+      // Cannot probe what cannot be found. Report unsupported rather than throwing:
+      // this gate only disables output publishing, and chat stays functional.
+      addDirSupported = false
+      return addDirSupported
+    }
+    const result = spawnSync(resolved.path, ['exec', '--help'], {
       encoding: 'utf8',
       timeout: 5_000,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -413,7 +425,18 @@ export async function callCodexStreaming(
   delete env.CLAUDECODE
   if (outputImagePublisher) Object.assign(env, outputImagePublisher.env)
 
-  const proc = spawn('codex', args, {
+  // The live turn path. This one REFUSES loudly rather than degrading -- a turn that
+  // cannot reach the binary must say so, not fail later as an opaque ENOENT from inside
+  // a spawn whose argv the caller never sees.
+  const resolvedCodex = resolveProviderBinary('codex')
+  if (!resolvedCodex.ok) {
+    throw new Error(
+      `codex binary unresolved (${resolvedCodex.detail}). Checked the env override, `
+      + 'then ChatGPT.app, then PATH; /Applications/Codex.app is excluded as a stale shim.',
+    )
+  }
+
+  const proc = spawn(resolvedCodex.path, args, {
     stdio: ['pipe', 'pipe', 'pipe'],
     env,
     cwd: codexCwd,

package/server/lib/codex-model-catalog.ts

@@ -6,6 +6,10 @@
 // the CLI default is used only when no discovered catalog exists yet.
 
 import { spawn } from 'node:child_process'
+// Resolved, never bare -- see provider-binary.ts. This module is a leaf, and the resolver
+// was extracted precisely so importing it here cannot close the cycle
+// catalog -> adapter -> codex-run-ledger -> catalog.
+import { resolveProviderBinary } from './provider-binary.js'
 import { existsSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { resolve } from 'node:path'
@@ -248,7 +252,15 @@ async function fetchAppServerModels(): Promise<CodexCatalogModel[]> {
   return new Promise((resolveModels, reject) => {
     const env = { ...process.env }
     delete env.CLAUDECODE
-    const child = spawn('codex', ['app-server', '--stdio'], {
+    const resolved = resolveProviderBinary('codex')
+    if (!resolved.ok) {
+      // Degrade, do not throw: this module already models exactly this outcome as
+      // `CodexCatalogSource = 'cli-default'`. A catalog refresh that cannot find the
+      // binary is a stale catalog, not a broken server.
+      reject(new Error(`codex binary unresolved (${resolved.detail})`))
+      return
+    }
+    const child = spawn(resolved.path, ['app-server', '--stdio'], {
       stdio: ['pipe', 'pipe', 'pipe'],
       env,
     })

package/server/lib/health-static-probes.ts

@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process'
+import { resolveProviderBinary } from './provider-binary.js'
 import { PYTHON_BIN } from './python-bridge.js'
 import {
   getCursorModelCatalog,
@@ -116,7 +117,12 @@ async function probeClaude(): Promise<{ value: string; available: boolean }> {
 
 async function probeCodex(): Promise<{ value: string; available: boolean }> {
   try {
-    const result = await execute('codex', ['--version'])
+    // Distinguish "cannot find the binary" from "found it and it errored" -- collapsing
+    // both to 'error' told every public npx user their Codex was broken when the real
+    // problem was a bare argv resolving through a PATH they do not have.
+    const resolved = resolveProviderBinary('codex')
+    if (!resolved.ok) return { value: `unresolved (${resolved.detail})`, available: false }
+    const result = await execute(resolved.path, ['--version'])
     const combined = `${result.stdout}\n${result.stderr}`.trim()
     const versionLine = combined.split(/\r?\n/).map(line => line.trim())
       .find(line => /^codex(?:-cli)?\s+/i.test(line))

package/server/lib/provider-binary.ts

@@ -0,0 +1,192 @@
+/**
+ * Where a provider's executable actually is.
+ *
+ * Extracted from `attached-provider-adapter.ts` 2026-08-19, unchanged. It moved because
+ * three other modules spawn providers by BARE NAME and need this resolution, and importing
+ * the adapter to get it closes a cycle: adapter -> codex-run-ledger -> codex-model-catalog
+ * -> adapter. This module imports nothing from the repo, so it can never be in one.
+ *
+ * Bare `'codex'` in argv resolves through PATH, and a Finder- or launchd-spawned process
+ * gets a minimal one. On this machine the bare sites work ONLY because COS Control injects
+ * ChatGPT.app onto the managed plist PATH -- they are broken for every public npx user.
+ */
+
+import { accessSync, constants as fsConstants, statSync } from 'node:fs'
+import { delimiter, isAbsolute, join } from 'node:path'
+import { homedir } from 'node:os'
+
+// ---------------------------------------------------------------------------
+// Binary resolution
+// ---------------------------------------------------------------------------
+
+export type BinaryResolutionFailure = 'env_override_unusable' | 'not_found'
+
+export type BinaryResolution =
+  | { ok: true; path: string; source: 'env' | 'absolute' | 'path' }
+  | { ok: false; binary: string; detail: BinaryResolutionFailure }
+
+/**
+ * Path prefixes that can never be a usable provider binary.
+ *
+ * `codex` resolved through PATH (or a shell alias) points at
+ * `/Applications/Codex.app/Contents/Resources/codex` on this machine, and that
+ * app no longer exists. Today the shim is dangling, so an existence check
+ * already rejects it — but a reinstalled or partially-removed Codex.app puts a
+ * real, executable file back on that path, and then only this list stands
+ * between an attached turn and a binary that cannot serve it.
+ */
+export const STALE_SHIM_PREFIXES: readonly string[] = ['/Applications/Codex.app/']
+
+export function isKnownStaleShimPath(
+  candidate: string,
+  prefixes: readonly string[] = STALE_SHIM_PREFIXES,
+): boolean {
+  // A non-array argument falls back to the known list rather than to "exclude
+  // nothing" — the classic version of this bug is `list.some(isKnownStaleShimPath)`,
+  // where `.some` passes the INDEX as the second argument and every exclusion
+  // silently disappears.
+  const list = Array.isArray(prefixes) ? prefixes : STALE_SHIM_PREFIXES
+  return list.some(prefix => typeof prefix === 'string' && prefix.length > 0 && candidate.startsWith(prefix))
+}
+
+function isUsableExecutable(
+  candidate: string,
+  excludePrefixes: readonly string[] = STALE_SHIM_PREFIXES,
+): boolean {
+  try {
+    if (!isAbsolute(candidate) || candidate.includes('\0')) return false
+    if (isKnownStaleShimPath(candidate, excludePrefixes)) return false
+    if (!statSync(candidate).isFile()) return false
+    accessSync(candidate, fsConstants.X_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+export interface BinarySpec {
+  name: string
+  envKeys: readonly string[]
+  /** Tried in order, BEFORE any PATH scan. */
+  absolutes: readonly string[]
+  /**
+   * Paths that must never be selected, from any source. Defaults to
+   * `STALE_SHIM_PREFIXES`.
+   *
+   * On the spec rather than hardcoded because the exclusion is the only guard
+   * standing between resolution and a known-bad binary, and a guard whose input
+   * cannot be constructed is a guard nobody can prove works: the real prefix
+   * lives under `/Applications`, which no fixture can write to.
+   */
+  excludePrefixes?: readonly string[]
+}
+
+/**
+ * Where each provider's binary is looked for, in precedence order.
+ *
+ * Exported as data rather than kept private so the precedence itself is
+ * testable: on a machine where a stale shim sits on PATH, "ChatGPT.app is tried
+ * before PATH" is the property that decides whether an attached Codex turn
+ * launches the real binary or a dangling one.
+ */
+/**
+ * Takes a plain string, not `AttachedProvider`, deliberately. That type is declared in
+ * `attached-provider-adapter.ts`, and importing it back would recreate exactly the cycle
+ * this extraction exists to break. Callers pass a string-union value, which is assignable.
+ */
+export function providerBinarySpec(provider: string): BinarySpec {
+  const home = (() => {
+    try {
+      return homedir()
+    } catch {
+      return ''
+    }
+  })()
+  if (provider === 'claude') {
+    return {
+      name: 'claude',
+      envKeys: ['COS_ATTACHED_CLAUDE_BIN', 'COS_CLAUDE_BIN'],
+      absolutes: [
+        '/opt/homebrew/bin/claude',
+        '/usr/local/bin/claude',
+        home ? join(home, '.local', 'bin', 'claude') : '',
+      ].filter(Boolean),
+    }
+  }
+  return {
+    name: 'codex',
+    envKeys: ['COS_ATTACHED_CODEX_BIN', 'COS_CODEX_BIN'],
+    absolutes: [
+      // Verified 2026-08-15: codex-cli 0.148.0-alpha.9 lives here, and there is
+      // no `codex` on PATH at all on this machine.
+      '/Applications/ChatGPT.app/Contents/Resources/codex',
+      home ? join(home, '.codex', 'bin', 'codex') : '',
+      '/opt/homebrew/bin/codex',
+      '/usr/local/bin/codex',
+    ].filter(Boolean),
+  }
+}
+
+/**
+ * Resolve a provider binary to a verified absolute path, or refuse.
+ *
+ * Never returns a bare name. A bare name is a silent PATH lookup, and the two
+ * environments this server runs in disagree about PATH: a login shell finds the
+ * CLI, a Finder- or launchd-spawned process gets a minimal PATH and does not
+ * (hit twice in COS Control). The PATH scan below is done by us, entry by
+ * entry, and still yields an absolute path we have stat'ed — so a failure names
+ * the missing binary instead of surfacing as ENOENT from inside a spawn.
+ *
+ * An unusable env override REFUSES rather than falling through to the
+ * candidates: an operator who set it wrongly needs to be told, not overridden.
+ */
+export function resolveProviderBinary(
+  provider: string,
+  env: NodeJS.ProcessEnv = process.env,
+): BinaryResolution {
+  return resolveBinaryFromSpec(providerBinarySpec(provider), env)
+}
+
+/**
+ * The resolution algorithm itself, separated from the provider tables.
+ *
+ * Not a testing seam bolted on: on any developer machine at least one real
+ * absolute candidate exists, so the PATH-scan and not-found branches of
+ * `resolveProviderBinary` are unreachable from a test and would ship
+ * unexercised — which is exactly how a launchd-only failure hides. Driving the
+ * REAL algorithm with a fixture spec exercises them for real.
+ */
+export function resolveBinaryFromSpec(spec: BinarySpec, env: NodeJS.ProcessEnv): BinaryResolution {
+  const excluded = spec.excludePrefixes ?? STALE_SHIM_PREFIXES
+
+  for (const key of spec.envKeys) {
+    const raw = env[key]
+    if (typeof raw !== 'string' || raw.trim().length === 0) continue
+    const candidate = raw.trim()
+    if (!isUsableExecutable(candidate, excluded)) {
+      return { ok: false, binary: spec.name, detail: 'env_override_unusable' }
+    }
+    return { ok: true, path: candidate, source: 'env' }
+  }
+
+  for (const candidate of spec.absolutes) {
+    if (isUsableExecutable(candidate, excluded)) return { ok: true, path: candidate, source: 'absolute' }
+  }
+
+  const pathValue = typeof env.PATH === 'string' ? env.PATH : ''
+  for (const dir of pathValue.split(delimiter)) {
+    // A relative PATH entry resolves against the server's cwd, which is not a
+    // location we control. Skipped rather than resolved.
+    //
+    // Redundant with the `isAbsolute` inside `isUsableExecutable` — verified by
+    // mutation: removing EITHER one alone changes no outcome, and only removing
+    // BOTH lets a relative entry through. Kept because two independent guards
+    // on "never resolve against the server cwd" is the correct amount for a
+    // path that ends up as a spawned executable.
+    if (!dir || !isAbsolute(dir)) continue
+    const candidate = join(dir, spec.name)
+    if (isUsableExecutable(candidate, excluded)) return { ok: true, path: candidate, source: 'path' }
+  }
+
+  return { ok: false, binary: spec.name, detail: 'not_found' }
+}