@gotcos/glasses-server 6.50.4 → 6.51.0

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 6.51.0
+
+Codex and Cursor sessions get the Continue and queue that Claude sessions have, each through the engine's own door, and Cursor composers get hook-grounded state. Nothing on a Claude path changes.
+
+- **Continue into a Codex thread the Codex app has open.** Before this, a Continue into any thread open in ChatGPT.app (Codex Desktop) could not work: the app's app-server holds the thread's writer lock for as long as the thread is loaded, idle included, so the `codex exec resume` child died in about 0.2 s on "thread already has an active writer" AFTER the prompt was written to its stdin. That is an `ambiguous` turn and a fence (two on record from August, both released by hand). Now, when the gate's own verdict names a foreign writer on a Codex thread, the turn goes through `codex queue --thread=<id> --message=<text>`, which inserts a row into Codex's own queue (`$CODEX_HOME/queue_1.sqlite`). Every app-server watches that database for writes from other processes, so the Codex app runs the message 10 ms after the current turn's `task_complete`, or within about 7 s when the thread is idle, as an ordinary user turn that is visible and editable in the app's own queue. Canary 2026-09-19 against a scratch `CODEX_HOME` and codex-cli 0.155.0-alpha.9.2 (the detail is in `codex-live-queue.ts`). Delivered means exit 0 AND the CLI's confirmation line naming our thread: 200 `completed`, `via: live`, copy "Queued in the Codex app...". A timeout, a kill or an unreadable confirmation might have inserted a row, and nothing can re-check that before a resend, so the turn is `delivery_ambiguous`: ledgered (a replay answers the same) and the thread fenced until a person looks at the Codex app's queue and releases it, like every other unproven delivery. The CLI's own "failed to queue session message", or a clap usage error (a `codex` without `queue`), is `codex_live_unavailable`: nothing was queued, not retryable, and no child is spawned against the held thread. A Codex thread nobody holds takes the 6.50 path unchanged. `COS_CODEX_LIVE_QUEUE=0` restores 6.50 everywhere. The prompt rides in argv for about 50 ms (the CLI has no stdin form: `--message -` queues a literal dash); it is never logged, and the `--message=` form keeps a prompt that starts with a dash as text. The runner kills its whole process group at the 5 s ceiling and answers at the ceiling even if a daemonised grandchild keeps stdout open. `/api/health` gains `codexLiveQueue` next to `continueLive`.
+- **A queued turn on a Codex thread drains at the engine's `task_complete`**, not 30 s later. The B6 clause gains a Codex branch: a Codex holder whose rollout's newest turn marker is `task_complete`, `turn_complete` or `turn_aborted` reads idle at once, with the drain's own tail rule (an aborted Codex turn now ends the turn on the stream and for the drain too; a follow-up used to wait out the 30 min open-turn ceiling). The clause is off with `COS_CODEX_LIVE_QUEUE=0`, so that switch restores 6.50 fully. That is safe for Codex in a way it never was for a Claude Stop, because every write into a held Codex thread now goes through the app's queue, which the engine serialises behind any turn it starts next.
+- **Cursor: a turn can queue for a composer that is mid-turn, and leaves through that composer's own Stop hook.** Cursor 3.21 runs hooks from `~/.claude/settings.json` by default, so the COS session hook installed on 9/15 has been running for Cursor composers since (478 Cursor events in the ledger by 9/18). And Cursor submits a Stop hook's `{"followup_message": ...}` as that composer's next message. So: occupancy reads a composer its hooks show mid-turn as `native_thread_working` (still never attachable: Gate 0 stands); the queue admits a Cursor turn for that reason only (every other Cursor reason stays 423, including ones that are queueable for Claude); the drainer never delivers a Cursor turn; and at the composer's Stop the hook script asks `POST /hooks/cursor/stop-followup` (outside `/api`, hook-token auth) and prints the reply. One turn per Stop, oldest first, claimed before the text leaves, and never for a hook that already hung up (the claim happens only on an open connection); only a `completed` turn gets one (an `aborted` or `error` Stop gets nothing). The hook asks only when the queue folder holds a file for that composer (almost every Stop sends nothing), falls back to asking when the folder is absent, and reads the payload with any JSON spacing. The script's new branch runs only when the environment carries `CURSOR_VERSION` AND the payload carries `"cursor_version"`; a Claude Stop takes the old line and never touches the network. An idle composer fires no Stop, so a turn cannot be put into one; that stays refused. The new script reaches `~/.cos-glasses/bin` through `--hooks install` (the settings entries are unchanged, so `settings.json` is not rewritten).
+- **Cursor rows carry `agent_state` from their own hooks.** A composer whose events reached the signal store gets the same one derivation Claude rows get (running while its turn is open, idle after its Stop), on the list and the detail. A Cursor row with no events keeps the 6.50 shape.
+- Tests: the Codex hop over HTTP (queued via live, replay-safe, held on unverified or a throw, refused without spawning when nothing was queued, 6.50 when disabled, without a holder, or without the dep, never for Claude, the turn clock opening the gate); every verdict rule, the argv, the confirmation, and the runner against real children (argv without a shell, a hang, an escaped grandchild, a missing binary, end to end through a fake `codex`); the Codex turn clock against real rollout lines; the Cursor composer signal (open, closed, ended, stale, throwing, CLI chat untouched, Claude and Codex untouched); the queue route's Cursor rule and the drainer's skip including TTL retirement; the Stop claim over HTTP (one per Stop, aborted gets nothing, Claude Stop and junk get `{}`, token required, only the cursor queue); the hook script run as Cursor runs it (posts and prints, `{}` prints nothing, a Claude Stop mentioning cursor_version never posts, missing env, payload or event sends nothing, a missing token or a closed port is silent and fast); Cursor rows over HTTP. The refusal vocabulary table covers `codex_live_unavailable`. Gate: 30/30 new cases (`codex-live-*`, `route-codex-*`, `codex-clock-*`, `codex-abort-*`, `cursor-*`, `hook-script-*`); `codex-live-timeout-waits-for-close` survived the first draft of the tests and the escaped-grandchild case was added for it.
+- **QA pass (one skeptic, before publish) and the live canary.** Fixed from QA: an unverified Codex hand-off was retryable, so the drainer could insert the same sentence at every turn end (now ambiguous and fenced); a Cursor claim could be marked delivered after the hook had hung up; the Codex turn clock stayed on with the switch off; `turn_aborted` was read differently by the server and COS Control. A second, narrow QA round found the hung-up check was not enough: when the server is busy past the hook's 3 s, curl gives up and closes, but Node reads the request before the close, so the socket still looked open and the turn was claimed for a hook that was gone. A real-curl test (the event loop blocked 2.6 s against a 1 s curl) reproduced it: the row read `delivered`. Now the route claims only within 2 s of the hook's own start stamp (the envelope's `ts`, same Mac clock), so the reply always leaves with a second to spare; a later or unstamped Stop leaves the turn waiting for the next one. The hook also reads `session_id` when a payload has no `conversation_id`, and asks the server rather than skipping when it cannot read an id at all. Live canary on a scratch server (scratch `CODEX_HOME`, throwaway sessions): Codex Continue into a held thread queued in the app and the holder itself ran it 2.6 s later; a working Codex thread refused at attach, the follow-up parked, and the drainer handed it to the app, which ran it 3.8 s after the hand-off; Cursor mid-turn admitted, idle refused, and a Claude-shaped or aborted Stop got nothing. Found upstream, not from this release: Claude Code 2.1.278 HOLDS a peer message (`crossSessionInbound`: "Held peer message, from an unidentified session") when the receiving session runs a permissive mode, so a live Continue into such a session reads `live_unverified` and waits for approval at the desk; the Claude path here is unchanged.
+
 ## 6.50.4
 
 - **The ring never moves in a way that stops the only recording.** A copy told to yield stops its recording (that is how a duplicate ends). QA of 6.50.3, with glasses 6.9.507 on the phone: reopening COS on a blank phone page mid-meeting (the 2026-09-18 08:15 symptom) gave the ring to the newer copy, so the meeting ended within 15 s and the new window was not recording. The referee now notes every meeting-chunk POST as it passes: a live chunk, or an iPhone offline chunk replayed; the preview does not count. The router is mounted before the transcribe-stream router and only notes, never answers. It records whose chunk it was (`?clientInstance=`, glasses 6.9.509+) or, for an untagged chunk, which device sent it. Two rules follow. (1) While the owner's OWN chunks arrive (30 s window, `CLIENT_INSTANCE_CAPTURE_LIVE_MS`), a newer copy is told to wait, however quiet the owner's claims. A hidden or locked WebView throttles its timers, but chunk uploads follow the audio. The ring moves on the first claim after the meeting stops. (2) A claimant whose own chunks arrive while the owner's do not takes the ring. That covers the case QA found in the first draft of this release, which held the ring on ANY chunk: COS reopened offline, a meeting started on the new copy, and on reconnect that copy's own chunks switched the hold on for the dead copy the Mac still remembered, so its claim was told to yield and the only recording stopped. (3) A claim now says whether its copy is recording (`recording`, glasses 6.9.510+). A recording claimant takes the ring from an owner that is not recording, and an owner's last `recording: true` holds the ring while it keeps claiming (45 s). Chunk arrival alone lags: after an outage the uploader backs off up to 60 s, and only a visible page resets it, which a hidden recording copy never gets. QA round 3 found that gap: a reopened copy that reclaimed offline took the ring back on reconnect, and the recording copy was then told to stop. Untagged chunks (glasses 6.9.507/6.9.508) count for the owner only while it still claims (45 s), so a dead owner is never pinned by them or by a stale flag. When both copies record, the owner keeps the ring and the claimant stops. The answer's `captureLive` means the owner is recording; glasses 6.9.510 refuse a yield while recording when it is `false`. `lastRecordingChunkAt` (first draft) is gone.

package/bin/hooks/cos-session-hook

@@ -1,5 +1,5 @@
 #!/bin/sh
-# COS session hook (glasses-server 6.48.0). Installed into ~/.claude/settings.json by
+# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
 # on every path. Only PermissionRequest ever talks to the server, and only when the
@@ -23,6 +23,29 @@ T="$SPOOL/.tmp.$$.$TS"; head -c 1048576 > "$T.in"                    # stdin to
 case "$(head -c 1 "$T.in")" in '{') ;; *) EVENT=rejected ;; esac
 { printf '{"ts":%s,"ppid":%s,"event":"%s","payload":' "$TS" "$PPID" "$EVENT"; cat "$T.in"; printf '}\n'; } > "$T"
 rm -f "$T.in"
+# 6.51.0, CURSOR ONLY. Cursor runs this hook from ~/.claude/settings.json for its own
+# composers, and submits a Stop hook's {"followup_message":...} as that composer's next
+# message. A turn COS queued for the composer is handed over here, at the end of its turn.
+# Claude Code sets no CURSOR_VERSION and sends no cursor_version, so a Claude Stop takes
+# the line below this block exactly as before and never touches the network.
+if [ "$EVENT" = Stop ] && [ -n "${CURSOR_VERSION:-}" ] && grep -Eq '"cursor_version"[[:space:]]*:[[:space:]]*"' "$T" 2>/dev/null; then
+  cp "$T" "$T.req" 2>/dev/null; mv "$T" "$SPOOL/$TS-$$-$EVENT.json"
+  # Nothing queued for this composer (almost every Stop): no request at all. The queue
+  # folder sits beside the spool. If it is not there, or the id cannot be read here,
+  # ask anyway rather than guess; the server reads the id the same way (conversation_id,
+  # then session_id).
+  QDIR="$(dirname "$SPOOL")/thread-turn-queue"
+  CONV=$(grep -Eo '"conversation_id"[[:space:]]*:[[:space:]]*"[0-9A-Fa-f-]{36}"' "$T.req" 2>/dev/null | grep -Eo '[0-9A-Fa-f-]{36}' | head -1 | tr 'A-F' 'a-f')
+  [ -n "$CONV" ] || CONV=$(grep -Eo '"session_id"[[:space:]]*:[[:space:]]*"[0-9A-Fa-f-]{36}"' "$T.req" 2>/dev/null | grep -Eo '[0-9A-Fa-f-]{36}' | head -1 | tr 'A-F' 'a-f')
+  if [ -d "$QDIR" ] && [ -n "$CONV" ] && [ ! -f "$QDIR/cursor-$CONV.json" ]; then rm -f "$T.req"; exit 0; fi
+  TOK=$(cat "$GH/hook-token" 2>/dev/null); PORT=$(cat "$GH/hook-port" 2>/dev/null || echo 3141)
+  if [ -n "$TOK" ] && [ -f "$T.req" ]; then
+    OUT=$(curl -s --connect-timeout 1 --max-time 3 -H "X-Cos-Hook-Token: $TOK" -H 'content-type: application/json' \
+      --data-binary @"$T.req" "http://127.0.0.1:$PORT/hooks/cursor/stop-followup") || OUT=''
+    case "$OUT" in '{"followup_message"'*) printf '%s' "$OUT" ;; esac
+  fi
+  rm -f "$T.req"; exit 0
+fi
 if [ "$EVENT" != PermissionRequest ]; then mv "$T" "$SPOOL/$TS-$$-$EVENT.json"; exit 0; fi   # rename = publish
 # A permission request keeps its own copy: the server unlinks the published file within
 # milliseconds of the rename, and the request body below must outlive that.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.50.4",
+  "version": "6.51.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -34,10 +34,13 @@ import {
 import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
 import { targetKey } from './lib/agent-session-binding-store.js'
 import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
-import { buildOccupancyProbes, realOccupancyDirs, withHookTurnClock } from './lib/occupancy-probes.js'
+import { buildOccupancyProbes, realOccupancyDirs, withCodexTurnClock, withCursorComposerTurn, withHookTurnClock } from './lib/occupancy-probes.js'
+import { readCodexTurnEndedAtMs } from './lib/codex-turn-clock.js'
+import { codexLiveQueueEnabled } from './lib/codex-live-queue.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
 import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
 import { makeLiveTurnDeliverer } from './lib/session-peer-inbox-deps.js'
+import { makeCodexLiveDeliverer } from './lib/codex-live-queue-deps.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
 import { nativeHead, realNativeHeadDeps } from './lib/native-head.js'
 import { threadOccupancy, holderActivity } from './lib/thread-occupancy.js'
@@ -131,7 +134,9 @@ import {
 
 const app = express()
 import { createThreadTurnQueueRouter, drainAllThreads } from './routes/thread-turn-queue.js'
-import { queuedThreadKeys, transcriptTurnEnded, transcriptTurnVerdict } from './lib/thread-turn-queue-store.js'
+import { createCursorStopFollowupRouter } from './routes/cursor-stop-followup.js'
+import { queuedThreadKeys, readQueue, transcriptTurnEnded, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
+import { readHookToken } from './lib/claude-hooks-installer.js'
 import { OPEN_TURN_CEILING_MS } from './lib/session-state-derive.js'
 import { createDrainKick, kickPlanFor } from './lib/thread-drain-kick.js'
 import { transcriptPathFor } from './lib/native-head.js'
@@ -386,12 +391,24 @@ const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
  * Read the canary evidence in `thread-occupancy.ts` under THE IDLE-HOLDER
  * RELAXATION before changing this line.
  */
-const occupancyProbes = sessionHooksEnabled()
+const occupancyProbes = withCursorComposerTurn(withCodexTurnClock(sessionHooksEnabled()
   // 6.48.1, the B6 clause: with the hooks on, a foreign Desktop holder whose newest hook
   // event is a Stop reads idle at once instead of after the 30 s transcript window. The
   // wrapper only adds a probe; the gate's precedence is unchanged. Off is 6.48.0.
   ? withHookTurnClock(buildOccupancyProbes(cosSpawnedPids, nativeHeadDeps, threadAttachEnabled()), signalFor, registryIdleAfterStop)
-  : buildOccupancyProbes(cosSpawnedPids, nativeHeadDeps, threadAttachEnabled())
+  : buildOccupancyProbes(cosSpawnedPids, nativeHeadDeps, threadAttachEnabled()),
+  // 6.51.0: the Codex counterpart, from the rollout's own turn markers. A queued COS turn
+  // on a Codex thread then drains at the engine's `task_complete` instead of 30 s later,
+  // and goes out through the app's own queue (`codex-live-queue.ts`).
+  // Off with `COS_CODEX_LIVE_QUEUE=0`: the clock only opens the gate because every write
+  // into a held thread goes through the app's queue, so without that hop it must not.
+  (threadId: string) => (codexLiveQueueEnabled() ? readCodexTurnEndedAtMs(threadId, nativeHeadDeps) : null)),
+  // 6.51.0: a Cursor composer its own hooks show mid-turn reads `native_thread_working`,
+  // so a turn can queue for its Stop hook. Without the hooks feature there is no signal
+  // and every composer keeps the 6.50 verdict.
+  (sessionId: string) => (sessionHooksEnabled() ? signalFor(sessionId) : undefined),
+  () => Date.now(),
+  OPEN_TURN_CEILING_MS)
 
 // 6.48.0: the hook spool ingester and the one signal store every session row reads. Starts
 // before any router is registered so the first list request already sees the replayed
@@ -690,6 +707,14 @@ if (threadAttachEnabled()) {
     now: () => Date.now(),
   }
   app.use('/api', createThreadTurnQueueRouter(queueDeps))
+  // 6.51.0: a queued Cursor turn leaves ONLY through the composer's own Stop hook (the
+  // drainer skips Cursor, see `drainThread`). Hook-token auth, outside /api.
+  app.use(createCursorStopFollowupRouter({
+    hookToken: readHookToken,
+    readQueue,
+    writeQueue,
+    now: () => Date.now(),
+  }))
 
   // Every 20s. Fast enough that a freed thread drains while the user is still looking
   // at the pending row, slow enough to be nothing: the sweep does no work at all when
@@ -762,6 +787,10 @@ app.use('/api', createAgentSessionBindingsRouter({
   // the resume child second. Reads `COS_CONTINUE_LIVE` per call, so the flag reports
   // on /api/health without a restart and every refusal falls back to the 6.48.2 path.
   deliverLiveTurn: makeLiveTurnDeliverer(nativeHeadDeps),
+  // 6.51.0: a Codex thread the Codex app holds goes into that app's own queue
+  // (`codex queue`), never into a resume child that cannot open a held thread.
+  // `COS_CODEX_LIVE_QUEUE=0` restores the 6.50 path.
+  deliverCodexLiveTurn: makeCodexLiveDeliverer(),
   forkThread: forkThreadForRoute,
   // The fork's real spawn directory. Separate from `resolveTarget` above, which
   // deliberately yields only fingerprints because plan 3.3 keeps a filesystem path

package/server/lib/codex-live-queue-deps.ts

@@ -0,0 +1,135 @@
+// The real world behind `codex-live-queue.ts`: the binary, the process, the counters.
+//
+// Kept apart from the pure module so the verdict rules there never touch a process.
+// Nothing here writes a file; the only write is the one `codex queue` makes itself.
+
+import { spawn } from 'node:child_process'
+import { resolveProviderBinary } from './provider-binary.js'
+import {
+  codexLiveQueueEnabled,
+  deliverOverCodexQueue,
+  type CodexLiveResult,
+  type CodexQueueRun,
+} from './codex-live-queue.js'
+
+/** Output past this is not a confirmation line; keep memory bounded if the CLI misbehaves. */
+const MAX_CAPTURE_BYTES = 64 * 1024
+
+/**
+ * Run the CLI with no shell, a closed stdin and a hard timeout. Always resolves.
+ *
+ * The environment is the server's own, so `CODEX_HOME` (if an operator set one) is the
+ * same one occupancy read the writer lock from: the queue row lands in the database the
+ * holder is watching.
+ */
+export function runCodexQueueCli(binary: string, args: readonly string[], timeoutMs: number): Promise<CodexQueueRun> {
+  return new Promise(resolve => {
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+    let settled = false
+    const finish = (run: CodexQueueRun) => {
+      if (settled) return
+      settled = true
+      resolve(run)
+    }
+    let child: ReturnType<typeof spawn>
+    try {
+      // Its own process group, so the ceiling can kill anything it started too: a
+      // grandchild holding stdout open would otherwise keep 'close' from ever firing
+      // (found by the hang test, which waited out the whole `sleep`).
+      child = spawn(binary, [...args], { stdio: ['ignore', 'pipe', 'pipe'], shell: false, detached: true })
+    } catch (error) {
+      finish({ code: null, stdout: '', stderr: '', timedOut: false, spawnError: error instanceof Error ? error.message : 'spawn threw' })
+      return
+    }
+    const timer = setTimeout(() => {
+      timedOut = true
+      try { if (typeof child.pid === 'number') process.kill(-child.pid, 'SIGKILL') } catch { /* group already gone */ }
+      try { child.kill('SIGKILL') } catch { /* already gone */ }
+      // Answer at the ceiling, not whenever the pipes finally close.
+      finish({ code: null, stdout, stderr, timedOut: true, spawnError: null })
+    }, Math.max(100, timeoutMs))
+    timer.unref?.()
+    child.stdout?.on('data', (chunk: Buffer) => { if (stdout.length < MAX_CAPTURE_BYTES) stdout += chunk.toString('utf-8') })
+    child.stderr?.on('data', (chunk: Buffer) => { if (stderr.length < MAX_CAPTURE_BYTES) stderr += chunk.toString('utf-8') })
+    child.on('error', error => {
+      clearTimeout(timer)
+      // ENOENT/EACCES arrive here before any byte ran: nothing was queued.
+      finish({ code: null, stdout, stderr, timedOut: false, spawnError: error.message })
+    })
+    child.on('close', code => {
+      clearTimeout(timer)
+      finish({ code: timedOut ? null : code, stdout, stderr, timedOut, spawnError: null })
+    })
+  })
+}
+
+export interface CodexLiveStats {
+  attempts: number
+  delivered: number
+  /** By reason, so the health row says WHY a Codex Continue did not go live. */
+  fallbacks: Record<string, number>
+  lastReason: string | null
+  lastAt: number | null
+}
+
+const stats: CodexLiveStats = { attempts: 0, delivered: 0, fallbacks: {}, lastReason: null, lastAt: null }
+
+/** For `/api/health`. A copy, never the live object. */
+export function codexLiveStats(): CodexLiveStats {
+  return { ...stats, fallbacks: { ...stats.fallbacks } }
+}
+
+/** Tests only. */
+export function __resetCodexLiveStatsForTests(): void {
+  stats.attempts = 0
+  stats.delivered = 0
+  stats.fallbacks = {}
+  stats.lastReason = null
+  stats.lastAt = null
+}
+
+/**
+ * The route's Codex dep. `disabled` and `no_holder` are not counted as attempts: the
+ * first is the operator's choice and the second is the ordinary spawn path, so neither
+ * should make the health row look busy.
+ */
+export function makeCodexLiveDeliverer(deps?: {
+  run?: typeof runCodexQueueCli
+  resolveBinary?: () => string | null
+  enabled?: () => boolean
+}) {
+  return async (request: { provider: string; sessionId: string; prompt: string; foreignHolder?: boolean }): Promise<CodexLiveResult> => {
+    const result = await deliverOverCodexQueue(
+      {
+        provider: request.provider,
+        sessionId: request.sessionId,
+        prompt: request.prompt,
+        enabled: (deps?.enabled ?? codexLiveQueueEnabled)(),
+        foreignHolder: request.foreignHolder === true,
+      },
+      {
+        resolveBinary: deps?.resolveBinary ?? (() => {
+          const resolved = resolveProviderBinary('codex')
+          return resolved.ok ? resolved.path : null
+        }),
+        run: deps?.run ?? runCodexQueueCli,
+        now: () => Date.now(),
+        log: (level, event, detail) => {
+          const line = `[${event}] ${JSON.stringify(detail)}`
+          if (level === 'warn') console.warn(line)
+          else console.log(line)
+        },
+      },
+    )
+    if (result.reason !== 'disabled' && result.reason !== 'no_holder') {
+      stats.attempts += 1
+      if (result.ok) stats.delivered += 1
+      else stats.fallbacks[result.reason] = (stats.fallbacks[result.reason] ?? 0) + 1
+      stats.lastReason = result.reason
+      stats.lastAt = Date.now()
+    }
+    return result
+  }
+}

package/server/lib/codex-live-queue.ts

@@ -0,0 +1,232 @@
+// Continue into a Codex thread the Codex app already has open, through Codex's own queue.
+//
+// ---------------------------------------------------------------------------
+// WHY THIS EXISTS (6.51.0)
+// ---------------------------------------------------------------------------
+// The attached path spawns `codex exec resume <id> -`. When ChatGPT.app (Codex Desktop)
+// has the thread open, its app-server holds the thread's writer lock for as long as the
+// thread is LOADED, idle included, and the child dies in about 0.2 s with "thread
+// <id> already has an active writer" -- AFTER the adapter has written the prompt to its
+// stdin, so the turn lands as `ambiguous` and fences the thread until an operator
+// releases it. Production has two such fences on record (August, provider_exit_nonzero,
+// exit 1, ~0.7 s). So for a thread the Codex app holds, today's Continue cannot work.
+//
+// Codex ships the fix itself. `codex queue --thread <id> --message <text>` inserts a row
+// into `$CODEX_HOME/queue_1.sqlite`, and every app-server watches that database for writes
+// from OTHER processes (`PRAGMA data_version` plus the `queued_thread_revisions` table).
+// Canary, 2026-09-19, scratch CODEX_HOME, codex-cli 0.155.0-alpha.9.2, holder =
+// `codex app-server` over stdio exactly as ChatGPT.app runs it:
+//
+//   holder mid-turn     queued in 0.05 s; the holder started it 10 ms after the running
+//                       turn's `task_complete`, as an ordinary user turn
+//   holder idle         the holder picked it up and started it 7.35 s later
+//   no holder           the row waits in the queue until something opens the thread;
+//                       no daemon is started
+//   writer lock         held by the holder the whole time the thread is loaded, idle too
+//   exec resume, held   exits 1 in 0.2 s: "already has an active writer"
+//   --message=-h        queued the literal text "-h" (the `=` form is flag-safe)
+//   --message -         queued a literal "-": the CLI does NOT read stdin
+//   unknown thread      exit 1, "failed to queue session message: ... no rollout found",
+//                       and nothing queued
+//
+// So this is the Codex counterpart of the Claude peer inbox (`session-peer-inbox.ts`),
+// and a better one: the message is a real user turn in the app's own queue, visible and
+// editable there, and delivered by the engine at exactly the end of the running turn.
+//
+// ---------------------------------------------------------------------------
+// THE ONE CONCESSION: THE PROMPT RIDES IN ARGV
+// ---------------------------------------------------------------------------
+// The attached adapter keeps prompts off argv. `codex queue` has no stdin form (measured
+// above), and the alternative -- a second `codex app-server` on the user's CODEX_HOME to
+// send `thread/queue/add` over JSON-RPC -- starts a whole engine that can run automations
+// and memory jobs on its own. The CLI lives about 50 ms, is spawned without a shell, and
+// macOS shows a process's arguments only to its own user. The prompt never reaches a log
+// line here: only lengths, reasons and the queued id do.
+//
+// ---------------------------------------------------------------------------
+// WHAT COUNTS AS DELIVERED
+// ---------------------------------------------------------------------------
+// Exit 0 AND the CLI's confirmation line naming OUR thread id. That line is printed from
+// the insert's own RETURNING row, so it is positive evidence the row exists. Anything
+// else that might have inserted -- exit 0 without the line, a timeout, a kill, a nonzero
+// exit we cannot place -- is `unverified`, and the route fences the thread as an
+// ambiguous delivery rather than retrying, because a retried queue write puts the same
+// sentence into the thread twice. A clap usage error (exit 2) queued nothing.
+
+import { isValidNativeThreadId } from './native-thread-id.js'
+
+export type CodexLiveReason =
+  /** The row is in the holder's queue. */
+  | 'delivered'
+  /** `COS_CODEX_LIVE_QUEUE=0`. Nothing sent. */
+  | 'disabled'
+  /** Not a Codex turn, or not a thread the app holds. Nothing sent; the spawn path is right. */
+  | 'no_holder'
+  | 'invalid_request'
+  /** No usable `codex` binary. Nothing sent. */
+  | 'binary_not_found'
+  /** The CLI never started. Nothing sent. */
+  | 'spawn_failed'
+  /** The CLI said it queued nothing ("failed to queue session message"). */
+  | 'refused'
+  /** Something may be queued. Hold; never retry, never spawn over it. */
+  | 'unverified'
+
+export interface CodexLiveResult {
+  ok: boolean
+  reason: CodexLiveReason
+  verifiedBy: 'codex-queue' | null
+  /** Codex's own id for the queued submission, when delivered. */
+  queuedId: string | null
+  elapsedMs: number
+  /** Always null: the holder is the app-server, not a process this module talks to. */
+  pid: null
+}
+
+export interface CodexQueueRun {
+  /** Null when the process was killed or never started. */
+  code: number | null
+  stdout: string
+  stderr: string
+  timedOut: boolean
+  /** Set when the process could not be started at all. */
+  spawnError: string | null
+}
+
+export interface CodexLiveDeps {
+  /** An absolute, verified `codex` path, or null. */
+  resolveBinary: () => string | null
+  /** Run the CLI without a shell. MUST resolve, never reject. */
+  run: (binary: string, args: readonly string[], timeoutMs: number) => Promise<CodexQueueRun>
+  now: () => number
+  log?: (level: 'info' | 'warn', event: string, detail: Record<string, unknown>) => void
+}
+
+export interface CodexLiveRequest {
+  provider: string
+  sessionId: string
+  prompt: string
+  /** The flag read at the call site, so this module never reads the environment. */
+  enabled: boolean
+  /**
+   * The route's own occupancy verdict: a live process that is not ours holds this
+   * thread's writer lock. Without a holder the queue row would wait until somebody opens
+   * the thread, which is not a Continue; the spawn path is the right answer there.
+   */
+  foreignHolder: boolean
+  timeoutMs?: number
+}
+
+/** Measured 50-70 ms. The ceiling sits inside the phone's 10 s turn budget with room for the gate. */
+export const CODEX_QUEUE_TIMEOUT_MS = 5_000
+
+/** Codex 0.155's confirmation line, printed from the insert's RETURNING row. */
+const CONFIRMATION = /^Queued message (\S+) for thread (\S+)\.\s*$/m
+
+/** The CLI's own "nothing was queued" prefix (the add failed before or at the insert). */
+const NOTHING_QUEUED = /failed to queue session message/i
+
+/**
+ * clap's argument errors (exit 2): a `codex` without the `queue` subcommand, or one that
+ * renamed a flag. The parser refuses before any command runs, so nothing was queued.
+ */
+const USAGE_ERROR = /^error: (unrecognized subcommand|unexpected argument|invalid value|the following required arguments)/m
+
+/**
+ * The argv, in the `--flag=value` form on purpose: clap reads `--message -h` as a flag
+ * and `--message=-h` as text (measured). The thread id is validated by the caller, and
+ * this refuses anything that is not a native thread id anyway, because it is about to
+ * become a process argument.
+ */
+export function buildCodexQueueArgs(threadId: string, prompt: string): string[] {
+  if (!isValidNativeThreadId(threadId)) throw new Error('buildCodexQueueArgs: invalid thread id')
+  if (typeof prompt !== 'string' || prompt.trim().length === 0 || prompt.includes('\0')) {
+    throw new Error('buildCodexQueueArgs: unusable prompt')
+  }
+  return ['queue', `--thread=${threadId}`, `--message=${prompt}`]
+}
+
+/** Codex's queued-submission id when the line names OUR thread, else null. */
+export function parseCodexQueueConfirmation(stdout: string, threadId: string): string | null {
+  const match = CONFIRMATION.exec(typeof stdout === 'string' ? stdout : '')
+  if (!match) return null
+  return match[2]!.toLowerCase() === threadId.toLowerCase() ? match[1]! : null
+}
+
+/**
+ * One CLI run to a verdict. Pure, and total: every shape lands on a reason, and every
+ * shape that could have inserted a row without saying so lands on `unverified`.
+ */
+export function classifyCodexQueueRun(run: CodexQueueRun, threadId: string): { reason: CodexLiveReason; queuedId: string | null } {
+  if (run.spawnError !== null) return { reason: 'spawn_failed', queuedId: null }
+  if (run.timedOut || run.code === null) return { reason: 'unverified', queuedId: null }
+  if (run.code === 0) {
+    const queuedId = parseCodexQueueConfirmation(run.stdout, threadId)
+    return queuedId ? { reason: 'delivered', queuedId } : { reason: 'unverified', queuedId: null }
+  }
+  if (NOTHING_QUEUED.test(run.stderr)) return { reason: 'refused', queuedId: null }
+  if (run.code === 2 && USAGE_ERROR.test(run.stderr)) return { reason: 'refused', queuedId: null }
+  return { reason: 'unverified', queuedId: null }
+}
+
+/** Put the turn into the Codex app's own queue for this thread, and say honestly what happened. */
+export async function deliverOverCodexQueue(request: CodexLiveRequest, deps: CodexLiveDeps): Promise<CodexLiveResult> {
+  const started = deps.now()
+  const done = (reason: CodexLiveReason, queuedId: string | null = null): CodexLiveResult => ({
+    ok: reason === 'delivered',
+    reason,
+    verifiedBy: reason === 'delivered' ? 'codex-queue' : null,
+    queuedId,
+    elapsedMs: Math.max(0, deps.now() - started),
+    pid: null,
+  })
+  if (!request.enabled) return done('disabled')
+  if (request.provider !== 'codex' || request.foreignHolder !== true) return done('no_holder')
+  let args: string[]
+  try {
+    args = buildCodexQueueArgs(request.sessionId, request.prompt)
+  } catch {
+    return done('invalid_request')
+  }
+  let binary: string | null
+  try {
+    binary = deps.resolveBinary()
+  } catch {
+    binary = null
+  }
+  if (!binary) return done('binary_not_found')
+
+  let run: CodexQueueRun
+  try {
+    run = await deps.run(binary, args, request.timeoutMs ?? CODEX_QUEUE_TIMEOUT_MS)
+  } catch (error) {
+    // `run` must not reject; if it does we cannot say whether the CLI got as far as the
+    // insert, so this is the ambiguous answer, never the "nothing sent" one.
+    deps.log?.('warn', 'codex-live-queue', { outcome: 'run_threw', detail: error instanceof Error ? error.message.slice(0, 120) : 'unknown' })
+    return done('unverified')
+  }
+  const verdict = classifyCodexQueueRun(run, request.sessionId)
+  deps.log?.(verdict.reason === 'delivered' ? 'info' : 'warn', 'codex-live-queue', {
+    outcome: verdict.reason,
+    code: run.code,
+    timedOut: run.timedOut,
+    promptChars: request.prompt.length,
+    queuedId: verdict.queuedId,
+    // The CLI's own first stderr line names the failure; it cannot carry the prompt,
+    // which only ever travels in argv. Bounded anyway.
+    stderr: verdict.reason === 'delivered' ? undefined : run.stderr.split('\n').find(l => l.trim().length > 0)?.slice(0, 160),
+  })
+  return done(verdict.reason, verdict.queuedId)
+}
+
+/**
+ * `COS_CODEX_LIVE_QUEUE`. ON unless set to `0`.
+ *
+ * Default-on, unlike `COS_CONTINUE_LIVE`, because the path it replaces cannot work: for a
+ * thread the Codex app holds, the spawn fails every time and leaves a fence. Only a
+ * thread with a foreign writer ever reaches this module, so a thread nobody holds keeps
+ * the 6.50 path exactly.
+ */
+export function codexLiveQueueEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_CODEX_LIVE_QUEUE !== '0'
+}

package/server/lib/codex-turn-clock.ts

@@ -0,0 +1,36 @@
+// When did the Codex engine close this thread's turn? (6.51.0)
+//
+// Read from the rollout itself, never from its mtime: the engine writes `task_complete`
+// (or `turn_complete`) as the turn's last record and `task_started` as the next turn's
+// first, so the NEWEST of those markers in the tail is the answer. The tail rule is the
+// drain's own (`transcriptTurnVerdict`), so the gate and the drain cannot disagree about
+// the same file.
+
+import { statSync } from 'node:fs'
+import { transcriptPathFor, type NativeHeadDeps } from './native-head.js'
+import { transcriptTurnVerdict } from './thread-turn-queue-store.js'
+
+/**
+ * The rollout's mtime when its newest turn marker closed a turn; null on any doubt (no
+ * rollout, an unreadable tail, a tail with no marker, or a turn that is open).
+ */
+export function readCodexTurnEndedAtMs(
+  threadId: string,
+  nativeHeadDeps: NativeHeadDeps,
+  deps: {
+    pathFor?: typeof transcriptPathFor
+    verdict?: typeof transcriptTurnVerdict
+    mtimeMs?: (path: string) => number | null
+  } = {},
+): number | null {
+  try {
+    const path = (deps.pathFor ?? transcriptPathFor)('codex', threadId, nativeHeadDeps)
+    if (!path) return null
+    const verdict = (deps.verdict ?? transcriptTurnVerdict)('codex', path)
+    if (!verdict || verdict.ended !== true || verdict.reason !== 'codex_complete') return null
+    const mtime = (deps.mtimeMs ?? ((p: string) => statSync(p).mtimeMs))(path)
+    return typeof mtime === 'number' && Number.isFinite(mtime) ? mtime : null
+  } catch {
+    return null
+  }
+}

package/server/lib/cursor-stop-followup.ts

@@ -0,0 +1,134 @@
+// A queued turn for a Cursor chat, handed to Cursor by its own Stop hook (6.51.0).
+//
+// ---------------------------------------------------------------------------
+// WHY THE STOP HOOK, AND ONLY THE STOP HOOK
+// ---------------------------------------------------------------------------
+// Cursor has no `queue --thread` and no socket a process outside it can write into. A
+// Cursor IDE composer cannot be resumed from outside either: Gate 0 (2026-08-20) found
+// `--resume` on an IDE transcript to be a clobber / wrong-store landmine, and that stays
+// refused. But Cursor 3.21 runs a `stop` hook when a composer's turn ends, and when the
+// hook answers `{"followup_message": "..."}` Cursor submits that text into THE SAME
+// composer as the next message (`submitChatMaybeAbortCurrent(composerId, text,
+// {isAutoFollowupFromStopHook: true})`, read from the shipped workbench). That is the
+// exact shape of "deliver when the current turn ends", from inside the composer.
+//
+// And the hook is already there: Cursor reads `~/.claude/settings.json` hooks by default
+// (its third-party extensibility setting), so the COS session hook installed on 9/15 has
+// been running for Cursor composers since then -- 478 Cursor events in the ledger by
+// 9/18, stdin = Cursor's own payload (`conversation_id`, `status`, `loop_count`,
+// `cursor_version`), environment `CURSOR_VERSION`. Nothing new is installed for Cursor;
+// the one script gains one Cursor-only branch.
+//
+// ---------------------------------------------------------------------------
+// WHAT THIS CANNOT DO, SAID PLAINLY
+// ---------------------------------------------------------------------------
+// It delivers only at the END OF A TURN. An idle composer fires no Stop, so a turn cannot
+// be put into it from outside; the queue admits a Cursor turn only while the hooks show
+// that composer mid-turn (`native_thread_working`), and a turn that is never claimed
+// expires on the queue's ordinary clock and says so. Cursor also caps consecutive hook
+// follow-ups (its default loop limit, reset by any message typed in Cursor), so a long
+// queue can stop short; the rest waits for the next typed message and its Stop.
+//
+// ---------------------------------------------------------------------------
+// ONE DELIVERER
+// ---------------------------------------------------------------------------
+// The queue drainer never delivers a Cursor turn (see `drainThread`): a turn could
+// otherwise be claimed here and delivered there in the same second. Claiming marks the
+// row `delivered` before the text leaves, and a Stop that is not `completed` (aborted,
+// error) claims nothing -- a queued sentence must not follow a turn the user just
+// stopped.
+
+import { isValidNativeThreadId } from './native-thread-id.js'
+import type { QueuedThreadTurn } from './thread-turn-queue.js'
+
+export interface CursorStopFacts {
+  conversationId: string
+  status: string
+  loopCount: number | null
+  cursorVersion: string
+  /** The envelope's `ts`: when the hook started, epoch ms from the same Mac clock. */
+  hookStartedAtMs: number | null
+}
+
+/** The hook's curl gives up this long after it starts (`--max-time 3`). */
+export const CURSOR_HOOK_WAIT_MS = 3_000
+/**
+ * A claim is made only this soon after the hook started, so its reply is written with at
+ * least a second to spare before the hook stops listening. Past it the turn stays
+ * `waiting` for the next Stop.
+ */
+export const CURSOR_STOP_MAX_AGE_MS = 2_000
+/** A stamp this far in the future is a clock that moved, not a hook; no claim. */
+export const CURSOR_STOP_MAX_SKEW_MS = 5_000
+
+/**
+ * Is the hook that sent this still listening? A socket check cannot answer that (QA,
+ * 6.51.0): when the event loop is blocked past the hook's 3 s, curl gives up and closes,
+ * but Node reads the request bytes before the close, so the handler sees an open socket,
+ * claims the turn, and writes the reply to nobody -- the row reads `delivered` and Cursor
+ * never got it. The hook's own start stamp can answer it: everything from this check to
+ * the reply is synchronous, so a claim made within 2 s of the hook starting is answered
+ * before the hook's 3 s are up.
+ */
+export function cursorStopIsFresh(hookStartedAtMs: number | null, now: number, maxAgeMs = CURSOR_STOP_MAX_AGE_MS): boolean {
+  if (hookStartedAtMs === null || !Number.isFinite(hookStartedAtMs) || !Number.isFinite(now)) return false
+  const age = now - hookStartedAtMs
+  return age <= maxAgeMs && age >= -CURSOR_STOP_MAX_SKEW_MS
+}
+
+/**
+ * The spool envelope the hook posts (`{"ts","ppid","event","payload"}`), read strictly.
+ * Null unless it is a Stop from Cursor naming a valid conversation.
+ */
+export function parseCursorStopEnvelope(body: unknown): CursorStopFacts | null {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return null
+  const envelope = body as Record<string, unknown>
+  if (envelope.event !== 'Stop') return null
+  const payload = envelope.payload
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return null
+  const p = payload as Record<string, unknown>
+  // Cursor stamps every hook payload with its version. Claude Code never does, so this
+  // is the positive evidence the event came from Cursor and not a Claude Stop.
+  if (typeof p.cursor_version !== 'string' || p.cursor_version.trim().length === 0) return null
+  const raw = typeof p.conversation_id === 'string' ? p.conversation_id : typeof p.session_id === 'string' ? p.session_id : ''
+  const conversationId = raw.trim().toLowerCase()
+  if (!isValidNativeThreadId(conversationId)) return null
+  const status = typeof p.status === 'string' ? p.status : ''
+  const loopCount = typeof p.loop_count === 'number' && Number.isFinite(p.loop_count) ? p.loop_count : null
+  const hookStartedAtMs = typeof envelope.ts === 'number' && Number.isFinite(envelope.ts) ? envelope.ts : null
+  return { conversationId, status, loopCount, cursorVersion: p.cursor_version.trim(), hookStartedAtMs }
+}
+
+/**
+ * The next waiting turn, claimed. Pure: returns the new queue and the claimed turn, or
+ * null when there is nothing to hand over. Queue order, oldest first.
+ */
+export function claimNextCursorTurn(
+  queue: readonly QueuedThreadTurn[],
+  now: number,
+): { queue: QueuedThreadTurn[]; turn: QueuedThreadTurn } | null {
+  const index = queue.findIndex(t => t.status === 'waiting')
+  if (index < 0) return null
+  const turn: QueuedThreadTurn = {
+    ...queue[index]!,
+    status: 'delivered',
+    attempts: queue[index]!.attempts + 1,
+    reason: 'cursor_stop_hook',
+    settledAt: now,
+  }
+  const next = queue.slice()
+  next[index] = turn
+  return { queue: next, turn }
+}
+
+/**
+ * Should this Stop receive a queued turn at all? Only a turn that COMPLETED: Cursor
+ * reports `aborted` when the user stops it and `error` when it failed, and neither is a
+ * moment to add a sentence. A loop count past the queue's own size means something other
+ * than this queue is driving the composer.
+ */
+export function cursorStopAcceptsFollowup(facts: CursorStopFacts, maxLoop: number): boolean {
+  if (facts.status !== 'completed') return false
+  if (facts.loopCount !== null && facts.loopCount >= maxLoop) return false
+  return true
+}

package/server/lib/occupancy-probes.ts

@@ -834,6 +834,58 @@ export function withHookTurnClock(
   }
 }
 
+/**
+ * Add the Codex turn clock (6.51.0) to a probe set, keeping whatever the set already
+ * answers for other providers.
+ *
+ * `codexTurnEndedAtMs` reads the thread's rollout tail and answers a time only when the
+ * newest turn marker CLOSED a turn (`task_complete`/`turn_complete`); a `task_started`
+ * after it, an unreadable file, or a tail with no marker all answer null, which keeps
+ * the 30 s transcript window. Measured on codex-cli 0.155: the app starts a turn queued
+ * in its own queue 10 ms after the `task_complete`, and that `task_started` is what the
+ * next read sees.
+ */
+export function withCodexTurnClock(
+  probes: OccupancyProbes,
+  codexTurnEndedAtMs: (threadId: string) => number | null,
+): OccupancyProbes {
+  const inner = probes.holderTurnEndedAtMs
+  return {
+    ...probes,
+    holderTurnEndedAtMs: (provider, threadId) => {
+      if (provider === 'codex') {
+        if (!NATIVE_THREAD_ID_RE.test(threadId)) return null
+        return codexTurnEndedAtMs(threadId)
+      }
+      return typeof inner === 'function' ? inner(provider, threadId) : null
+    },
+  }
+}
+
+/**
+ * Add the Cursor composer turn signal (6.51.0). `signalFor` is the hook signal store's
+ * reader; Cursor's hook events land there under the composer's conversation id. Open
+ * means: a turn was opened (prompt or tool) and no Stop has closed it, nothing ended the
+ * session, and the newest event is inside the open-turn ceiling -- a composer that died
+ * mid-turn must not read working for ever.
+ */
+export function withCursorComposerTurn(
+  probes: OccupancyProbes,
+  signalFor: (sessionId: string) => { turnOpen: boolean; ended: { at: number; reason: string } | null; lastEventAt: number } | undefined,
+  now: () => number,
+  ceilingMs: number,
+): OccupancyProbes {
+  return {
+    ...probes,
+    cursorComposerTurnOpen: (threadId: string) => {
+      if (!NATIVE_THREAD_ID_RE.test(threadId)) return null
+      const signal = signalFor(threadId)
+      if (!signal) return null
+      return signal.turnOpen === true && signal.ended === null && now() - signal.lastEventAt <= ceilingMs
+    },
+  }
+}
+
 /** The facts the hook turn clock reads off a session signal. */
 export interface HookTurnSignal {
   lastEvent: string

package/server/lib/session-stream-events.ts

@@ -627,7 +627,9 @@ function draftsFromCodexRecord(record: Record<string, unknown>): SessionStreamDr
 function draftsFromCodexEvent(payload: Record<string, unknown>): SessionStreamDraft[] {
   const kind = typeof payload.type === 'string' ? payload.type : ''
   if (kind === 'task_started') return [{ kind: 'status', state: 'working' }]
-  if (kind === 'task_complete' || kind === 'turn_complete') return [{ kind: 'status', state: 'done' }]
+  // 6.51.0: an interrupted turn is over too (`turn_aborted`). Without it a follow-up parked
+  // behind an aborted Codex turn waited out the 30 min open-turn ceiling.
+  if (kind === 'task_complete' || kind === 'turn_complete' || kind === 'turn_aborted') return [{ kind: 'status', state: 'done' }]
   if (kind === 'agent_message') {
     const prose = proseDraft(payload.message ?? payload.text)
     return prose ? [prose] : []

package/server/lib/thread-occupancy.ts

@@ -156,11 +156,18 @@ export interface OccupancyProbes {
    * sub-agent is open, the session has not ended, AND the registry record says `idle`
    * with `statusUpdatedAt` at or after the Stop (Claude flips it only when every Stop
    * hook has returned, 12-38 s after the Stop on the release Mac, which is when a prompt
-   * queued at the desk would dequeue). Null otherwise, and always null for Codex.
+   * queued at the desk would dequeue). Null otherwise.
    * OPTIONAL, and its absence is the default: attached by `withHookTurnClock` at the
    * composition root only when `COS_SESSION_HOOKS` is on, so the pure gate never reads
    * the environment.
    *
+   * 6.51.0, CODEX: `withCodexTurnClock` answers for Codex threads from the rollout's own
+   * turn markers: the newest is `task_complete`/`turn_complete`, so the engine closed the
+   * turn. Safe to read idle at once for Codex in a way it never was for a Claude Stop,
+   * because every write into a held Codex thread goes through the app's own queue
+   * (`codex-live-queue.ts`), which the engine itself serialises behind any turn it starts
+   * next; nothing is ever written beside the holder.
+   *
    * What it buys: a foreign Desktop holder whose turn the engine has closed reads `idle`
    * at once instead of after the 30 s transcript window. The transcript's mtime is not
    * consulted: the bookkeeping rows Claude writes as the hooks finish are exactly what
@@ -177,6 +184,13 @@ export interface OccupancyProbes {
     cwd: string
     hasConversation: boolean
   } | null
+  /**
+   * 6.51.0: is this Cursor IDE composer mid-turn, by its own hook events (Cursor runs the
+   * COS session hook from `~/.claude/settings.json`)? True only on positive evidence: a
+   * prompt or tool event newer than the last Stop, inside the open-turn ceiling. OPTIONAL;
+   * absent, null, or a throw keeps the 6.50 verdict (`unsupported_provider`).
+   */
+  cursorComposerTurnOpen?: (threadId: string) => boolean | null
 }
 
 /**
@@ -287,11 +301,11 @@ function readHolderActivity(
   }
   const activity = holderActivity(mtime, nowMs)
   if (activity !== 'working') return activity
-  // THE B6 CLAUSE. Only a `working` verdict is revisited, only for Claude, only with a
-  // real clock behind it, and only when the hook probe VOUCHES that the engine closed
-  // the turn (null is strict). `unknown` stays unknown: the clause narrows a refusal,
-  // never a doubt.
-  if (provider !== 'claude' || typeof probes.holderTurnEndedAtMs !== 'function' || typeof mtime !== 'number') return activity
+  // THE B6 CLAUSE. Only a `working` verdict is revisited, only for Claude (6.51.0: and
+  // Codex, from its rollout's turn markers), only with a real clock behind it, and only
+  // when the probe VOUCHES that the engine closed the turn (null is strict). `unknown`
+  // stays unknown: the clause narrows a refusal, never a doubt.
+  if ((provider !== 'claude' && provider !== 'codex') || typeof probes.holderTurnEndedAtMs !== 'function' || typeof mtime !== 'number') return activity
   let stopAt: number | null
   try {
     stopAt = probes.holderTurnEndedAtMs(provider, threadId)
@@ -612,7 +626,16 @@ export function threadOccupancy(
       return { attachable: false, owners: [], reason: 'probe_failed' }
     }
     if (!session || session.hasConversation !== true) {
-      return { attachable: false, owners: [], reason: 'unsupported_provider' }
+      // 6.51.0: still never attachable (Gate 0: an IDE composer is not resumed from
+      // outside), but a composer the hooks show MID-TURN is working, not unsupported, so
+      // a turn spoken at it can wait for its Stop hook. The reason is the only change.
+      let open: boolean | null = null
+      try {
+        open = typeof probes.cursorComposerTurnOpen === 'function' ? probes.cursorComposerTurnOpen(threadId) : null
+      } catch {
+        open = null
+      }
+      return { attachable: false, owners: [], reason: open === true ? 'native_thread_working' : 'unsupported_provider' }
     }
     return { attachable: true, owners: [], reason: null }
   }

package/server/routes/agent-session-bindings.ts

@@ -344,6 +344,16 @@ export interface AgentSessionBindingsDeps {
    */
   deliverLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number; clientTurnId?: string }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null }>
 
+  /**
+   * 6.51.0: put a Codex turn into the Codex app's OWN queue when the app holds the thread.
+   *
+   * `makeCodexLiveDeliverer` from `server/lib/codex-live-queue-deps.ts`. Separate from
+   * `deliverLiveTurn` on purpose, so the Claude branch is byte-for-byte 6.50. Asked only
+   * when the gate's verdict carries a foreign writer on a Codex thread; absent, that turn
+   * spawns exactly as before.
+   */
+  deliverCodexLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; foreignHolder: boolean }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null }>
+
   /**
    * The self-recursion ledger. Defaults to the real process-wide one.
    *
@@ -498,6 +508,11 @@ export type WriteRefusal =
   // held as retryable and the retry re-reads before doing anything (see
   // `session-peer-inbox.ts`); it is never a fence, because nothing here ran a child.
   | 'live_unverified'
+  // 6.51.0: the Codex app holds this thread and `codex queue` did not take the turn.
+  // Nothing was queued. Never answered by spawning: a resume child against a held
+  // thread dies on "already has an active writer" after the prompt is written, which
+  // is the ambiguous fence this whole branch exists to avoid.
+  | 'codex_live_unavailable'
   // ------------------------------------------------------------------- fork
   //
   // Fork gets its OWN members rather than reusing the ones above, and the reason
@@ -572,6 +587,8 @@ export const WRITE_REASON_COPY: Record<Exclude<WriteRefusal, OccupancyReason>, s
     'COS lost track of this turn after sending it. Open the thread on your Mac and check before sending again.',
   live_unverified:
     'Sent, not yet confirmed. Send again: COS checks before sending twice.',
+  codex_live_unavailable:
+    'The Codex app has this thread open, and COS could not hand it the message. Nothing was sent. Send it from the Codex app, or fork it.',
   turn_failed:
     'COS could not run this turn. Nothing was sent. You can try again.',
 
@@ -1284,6 +1301,8 @@ export const ATTACHED_COPY = 'Attached. COS is driving the original thread.'
 export const TURN_SENT_COPY = 'Sent to the original thread.'
 /** 6.49.0: the turn went into the running session, where the desk will see it. */
 export const TURN_SENT_LIVE_COPY = 'Sent to the open session. It will show where you left it.'
+/** 6.51.0: a Codex turn handed to the Codex app's own queue for the thread it has open. */
+export const TURN_SENT_CODEX_QUEUE_COPY = 'Queued in the Codex app. It runs when the current turn ends, or right away if the thread is idle.'
 /**
  * How long the route waits for the session's transcript to show acceptance.
  *
@@ -1392,18 +1411,18 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
    * one place, so the write routes cannot come to a different conclusion than the
    * probe the user was shown a second earlier.
    */
-  const runOccupancy = (provider: string, threadId: string): AttachabilityBody => {
-    let verdict: Occupancy
+  const detectOccupancy = (provider: string, threadId: string): Occupancy => {
     try {
-      verdict = detect(provider, threadId, deps.probes, deps.dirs)
+      return detect(provider, threadId, deps.probes, deps.dirs)
     } catch (error) {
       // `threadOccupancy` already contains its own probe try/catch, so reaching
       // here means the detector itself threw. Logged without the thread id.
       console.error(`[agent-session-bindings] occupancy threw: ${error instanceof Error ? error.message : error}`)
-      verdict = { attachable: false, owners: [], reason: 'probe_failed' }
+      return { attachable: false, owners: [], reason: 'probe_failed' }
     }
-    return projectAttachability(verdict)
   }
+  const runOccupancy = (provider: string, threadId: string): AttachabilityBody =>
+    projectAttachability(detectOccupancy(provider, threadId))
 
   const refuseAttach = (res: Response, reason: WriteRefusal): void => {
     res.status(refusalStatus(reason)).json({
@@ -2153,9 +2172,16 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // session started in the gap is exactly the residual risk option B leaves
       // open, and it is terminal here rather than a warning because COS has no
       // cross-process lock that could fence a live desktop writer.
-      const verdict = runOccupancy(binding.provider, binding.nativeThreadId)
+      const detected = detectOccupancy(binding.provider, binding.nativeThreadId)
+      const verdict = projectAttachability(detected)
       stage('gate')
       if (!verdict.attachable) return refuseTurn(verdict.reason ?? 'probe_failed')
+      // 6.51.0: the SAME verdict says whether a live process that is not ours holds the
+      // thread. Only the declared idle-holder exemption can carry one on an attachable
+      // verdict (`projectAttachability` refuses anything else), so this is that fact.
+      const foreignHolder = detected.idleHolder === true
+        && Array.isArray(detected.owners)
+        && detected.owners.some(owner => owner?.selfOwned !== true)
 
       const head = await readHead(binding.provider, binding.nativeThreadId)
       stage('head')
@@ -2238,6 +2264,72 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         // suspect_expired: nothing reached a session. Spawn as always.
       }
 
+      // 6.51.0: CODEX, WHEN THE CODEX APP HOLDS THE THREAD. Its app-server keeps the
+      // writer lock for as long as the thread is open, so the resume child below cannot
+      // run (it exits on "already has an active writer" after the prompt is written, and
+      // that fence is what August's two Codex Continues left behind). `codex queue`
+      // hands the turn to that app-server's own queue instead: it runs at the end of the
+      // current turn, or within seconds if the thread is idle (canary in
+      // `codex-live-queue.ts`). A thread nobody holds never gets here.
+      if (binding.provider === 'codex' && foreignHolder && typeof deps.deliverCodexLiveTurn === 'function') {
+        let live: { ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null } | null = null
+        try {
+          live = await deps.deliverCodexLiveTurn({
+            provider: binding.provider,
+            sessionId: binding.nativeThreadId,
+            prompt,
+            foreignHolder: true,
+          })
+        } catch (error) {
+          console.error(`[agent-session-bindings] codex live delivery threw: ${error instanceof Error ? error.message : error}`)
+          live = null
+        }
+        stage(`codex-live(${live?.reason ?? 'threw'})`)
+        if (live?.ok) {
+          console.log(`[agent-session-bindings] turn delivered live provider=codex turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} queuedId=${live.queuedId ?? 'null'}`)
+          respond(200, {
+            turnId,
+            outcome: 'completed',
+            deliveryState: 'delivered',
+            via: 'live',
+            retryable: false,
+            changed: false,
+            revision: null,
+            reason: null,
+            reasonCopy: TURN_SENT_CODEX_QUEUE_COPY,
+          })
+          return
+        }
+        // The operator switched this off: the 6.50 path, unchanged, whatever it does.
+        if (live?.reason !== 'disabled') {
+          // A throw, a timeout, or a confirmation we could not read: a row MAY be in the
+          // app's queue. Unlike the Claude hop, nothing can re-check that before a resend
+          // (QA, 6.51.0), and a retryable answer would have the drainer insert the same
+          // sentence at every turn end until the TTL. So it is what every other unproven
+          // delivery is: ambiguous, ledgered (a replay answers the same), and fenced until
+          // a person looks at the Codex app's queue and releases it.
+          if (live === null || live.reason === 'unverified') {
+            guard.fence(key, 'native_target_fenced', {
+              provider: binding.provider,
+              headBefore: head.digest,
+              turnId,
+              bindingId,
+              now: Date.now(),
+              adapterReason: 'codex_queue_unverified',
+              fenceSite: 'ambiguous',
+              spawns: [],
+            })
+            console.warn(`[agent-session-bindings] fence set site=codex_live provider=codex target=${opaqueRevision(key)} turnId=${turnId} bindingId=${bindingId} headBefore=${head.digest} adapterReason=codex_queue_unverified`)
+            return reportAmbiguous()
+          }
+          // Nothing was queued, and the child cannot run against a held thread. Not
+          // retryable: a missing binary or a CLI that refused does not heal on a 20 s
+          // sweep, and a retryable reason would have the queue drainer re-run it for the
+          // whole TTL (`isRetryableDelivery` trusts the route's own verdict).
+          return refuseTurn('codex_live_unavailable', { retryable: false })
+        }
+      }
+
       // THE QUEUE POINT. Every gate is now behind us — body, replay, queued-prompt,
       // lease, target, epoch, fence, claim, occupancy, head baseline, pin — so a
       // refusal still reaches the user immediately and precisely. Only the spawn is

package/server/routes/agent-sessions.ts

@@ -39,7 +39,7 @@ import {
 import { searchAgentSessions, type AgentSessionSearchHit } from '../lib/agent-session-search.js'
 import { claudeSessionNamesVisible, claudeSessionsDir, claudeSessionsEnabled, readClaudePeerRecords, registryFacts } from './claude-sessions.js'
 import type { ClaudePeerRecord } from '../lib/claude-session-registry.js'
-import { deriveForRow } from '../lib/session-hooks-runtime.js'
+import { deriveForRow, signalFor } from '../lib/session-hooks-runtime.js'
 import { derivedRowFields, type DerivedSessionState } from '../lib/session-state-derive.js'
 import { queuedTurnsFields, queuedWaitingLookup } from '../lib/thread-turn-queue-store.js'
 import { isAttachedTurnActive, sessionStreamKey } from '../lib/session-stream-bus.js'
@@ -387,6 +387,14 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
         attachedTurn: isAttachedTurnActive(sessionStreamKey('claude', row.session_id)),
       }))
     }
+    // 6.51.0: a Cursor composer whose OWN hook events reached the store (Cursor runs the COS
+    // session hook from ~/.claude/settings.json) gets the same one derivation, from the
+    // signal alone. Hook-grounded only: a Cursor row with no events keeps exactly the 6.50
+    // shape, and nothing is inferred from its file times here.
+    for (const row of sessions) {
+      if (row.provider !== 'cursor' || !signalFor(row.session_id)) continue
+      derivedById.set(row.session_id, deriveForRow({ sessionId: row.session_id, now, remember: false }))
+    }
     const queuedOf = queuedWaitingLookup(now)
     res.json({
       sessions: sessions.map((row, index) => withRunning(toEntry(row, activity[index], derivedById.get(row.session_id), queuedOf(row.provider, row.session_id)), running)),
@@ -506,6 +514,9 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
         transcript: { inFlight: running.occupied.get(parsed.session_id)?.activeRecently === true, lastActivityAt: activity.lastActivityAt ? Date.parse(activity.lastActivityAt) : null },
         attachedTurn: isAttachedTurnActive(sessionStreamKey('claude', parsed.session_id)),
       })
+    } else if (provider === 'cursor' && signalFor(parsed.session_id)) {
+      // 6.51.0: the detail agrees with its list row (hook-grounded Cursor state).
+      derived = deriveForRow({ sessionId: parsed.session_id, remember: false })
     }
     res.json({
       ...withRunning({ session_id: parsed.session_id }, running),

package/server/routes/cursor-stop-followup.ts

@@ -0,0 +1,67 @@
+// POST /hooks/cursor/stop-followup -- the COS session hook asks, at a Cursor composer's
+// Stop, whether a turn is queued for it (6.51.0). See `lib/cursor-stop-followup.ts`.
+//
+// NOT under /api, on purpose. The hook holds the per-install HOOK token
+// (`~/.cos-glasses/hook-token`, 0600), never the pairing token the /api gate checks, and
+// widening that gate for one caller would be the larger change. This route checks the
+// hook token itself, in constant time, before it reads anything. It answers only `{}` or
+// `{"followup_message": ...}` so the hook can print it verbatim, and it never answers
+// with anything a Claude Stop could act on: a body that is not a Cursor Stop is `{}`.
+
+import express, { Router, type Request, type Response } from 'express'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
+import { claimNextCursorTurn, cursorStopAcceptsFollowup, cursorStopIsFresh, parseCursorStopEnvelope } from '../lib/cursor-stop-followup.js'
+import { MAX_QUEUED_PER_THREAD, type QueuedThreadTurn } from '../lib/thread-turn-queue.js'
+
+export interface CursorStopFollowupDeps {
+  /** The per-install hook token, or null when none has been minted (then nothing is answered). */
+  hookToken: () => string | null
+  readQueue: (provider: string, threadId: string, now: number) => QueuedThreadTurn[]
+  writeQueue: (provider: string, threadId: string, queue: QueuedThreadTurn[]) => void
+  now: () => number
+}
+
+export const CURSOR_STOP_FOLLOWUP_PATH = '/hooks/cursor/stop-followup'
+
+export function createCursorStopFollowupRouter(deps: CursorStopFollowupDeps): Router {
+  const router = Router()
+  // The hook posts its spool envelope, capped at 1 MiB by the script itself.
+  router.post(CURSOR_STOP_FOLLOWUP_PATH, express.json({ limit: '2mb' }), (req: Request, res: Response) => {
+    res.set('Cache-Control', 'private, no-store')
+    let expected: string | null = null
+    try { expected = deps.hookToken() } catch { expected = null }
+    if (!expected || !timingSafeTokenEqual(req.headers['x-cos-hook-token'], expected)) {
+      return res.status(401).json({})
+    }
+    const facts = parseCursorStopEnvelope(req.body)
+    if (!facts || !cursorStopAcceptsFollowup(facts, MAX_QUEUED_PER_THREAD)) return res.json({})
+    // The hook waits three seconds and then moves on. A claim made after it stopped
+    // listening marks a turn delivered that Cursor never received (QA, 6.51.0: a Stop that
+    // lands while the event loop is busy). A socket that already reads closed is one sign;
+    // the reliable one is the hook's own start stamp (see cursorStopIsFresh). Everything
+    // from here to the reply is synchronous.
+    if (req.socket?.destroyed === true || res.writableEnded) {
+      console.warn('[cursor-stop-followup] the hook hung up before the claim; nothing claimed')
+      return undefined
+    }
+    let claimed: ReturnType<typeof claimNextCursorTurn> = null
+    try {
+      const now = deps.now()
+      if (!cursorStopIsFresh(facts.hookStartedAtMs, now)) {
+        console.warn(`[cursor-stop-followup] the Stop is ${facts.hookStartedAtMs === null ? 'unstamped' : `${now - facts.hookStartedAtMs} ms old`}; the hook may have stopped listening, so nothing is claimed and the turn waits for the next Stop`)
+        return res.json({})
+      }
+      claimed = claimNextCursorTurn(deps.readQueue('cursor', facts.conversationId, now), now)
+      if (!claimed) return res.json({})
+      // Written BEFORE the text leaves: the row must never read `waiting` after the
+      // composer has been handed it, or a later Stop would hand it over again.
+      deps.writeQueue('cursor', facts.conversationId, claimed.queue)
+    } catch (error) {
+      console.error(`[cursor-stop-followup] claim failed: ${error instanceof Error ? error.message : error}`)
+      return res.json({})
+    }
+    console.log(`[cursor-stop-followup] handed a queued turn to Cursor clientTurnId=${claimed.turn.clientTurnId} chars=${claimed.turn.prompt.length} loop=${facts.loopCount ?? 'null'} cursor=${facts.cursorVersion}`)
+    return res.json({ followup_message: claimed.turn.prompt })
+  })
+  return router
+}

package/server/routes/health.ts

@@ -81,6 +81,8 @@ import {
 } from '../lib/thread-attach-capability.js'
 import { sessionHooksHealthFields } from '../lib/session-hooks-runtime.js'
 import { continueLiveEnabled, liveDeliveryStats } from '../lib/session-peer-inbox-deps.js'
+import { codexLiveStats } from '../lib/codex-live-queue-deps.js'
+import { codexLiveQueueEnabled } from '../lib/codex-live-queue.js'
 
 /**
  * 6.49.0: which last hop a Continue takes, and how often each fell back.
@@ -101,6 +103,18 @@ export function continueLiveHealthFields(): Record<string, unknown> {
       lastReason: stats.lastReason,
       lastAt: stats.lastAt,
     },
+    // 6.51.0: Codex's last hop, counted apart so the Claude row above keeps its meaning.
+    codexLiveQueue: (() => {
+      const codex = codexLiveStats()
+      return {
+        enabled: codexLiveQueueEnabled(),
+        attempts: codex.attempts,
+        delivered: codex.delivered,
+        fallbacks: codex.fallbacks,
+        lastReason: codex.lastReason,
+        lastAt: codex.lastAt,
+      }
+    })(),
   }
 }
 

package/server/routes/thread-turn-queue.ts

@@ -119,7 +119,14 @@ export async function drainThread(
     // for every queued row repeats a whole-process descriptor scan. A refusal
     // can delay delivery until the next sweep, but can never authorize a write.
     // Positive verdicts and all checks after a delivery remain fresh.
-    const gate: ReturnType<ThreadTurnQueueDeps['occupancy']> = refusedGate ?? deps.occupancy(provider, threadId)
+    //
+    // 6.51.0: a Cursor turn is NEVER delivered from here. It leaves through the
+    // composer's own Stop hook (`routes/cursor-stop-followup.ts`), which claims it the
+    // moment the turn ends; a second deliverer could hand the same sentence over twice.
+    // The pass still runs for it so the TTL retires an unclaimed turn honestly.
+    const gate: ReturnType<ThreadTurnQueueDeps['occupancy']> = provider === 'cursor'
+      ? { attachable: false, reason: 'cursor_stop_hook_delivery' }
+      : refusedGate ?? deps.occupancy(provider, threadId)
     if (!gate.attachable) refusedGate = gate
     const seen: DrainObservation = {
       attachable: gate.attachable,
@@ -228,15 +235,18 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       return res.status(400).json({ error: 'invalid_request', reason: 'invalid_cos_session_id' })
     }
 
-    if (provider === 'cursor') {
-      return res.status(423).json({ error: 'unsupported_provider', queueable: false })
-    }
-
     // THE GATE DECIDES WHETHER PARKING IS EVEN HONEST. A structural refusal can never
     // clear, and telling someone their turn is queued when it can never run is worse
     // than refusing it. An attachable thread is not queued either -- it is sent now,
     // through the ordinary route, which the client does on this 409.
     const gate = deps.occupancy(provider, threadId)
+
+    // 6.51.0: Cursor queues ONLY a composer its hooks show mid-turn, because the only way
+    // in is that turn's Stop hook. An idle composer fires no Stop, so a turn parked there
+    // could never run; that stays the 423 it always was, as does every Agent CLI chat.
+    if (provider === 'cursor' && gate.reason !== 'native_thread_working') {
+      return res.status(423).json({ error: 'unsupported_provider', queueable: false })
+    }
     if (gate.attachable) return res.status(409).json({ error: 'thread_free', hint: 'send_now' })
     if (!queueableRefusal(gate.reason)) {
       return res.status(423).json({ error: gate.reason ?? 'probe_failed', queueable: false })