@gotcos/glasses-server 6.61.7 → 6.62.1

package/server/lib/session-cancel.ts

@@ -10,7 +10,11 @@
 //   desk_run     Claude Code at the desk (a Desktop tab, a terminal, a Continue delivered
 //                live into the open window). A halt marker plus the synchronous PreToolUse
 //                hook stops it at its NEXT tool call (canaries C1b, C5, C10).
-//   unsupported  the Codex app or Cursor. Nothing outside the app can reach the run.
+//                6.62.0: also Cursor (it runs the Claude hooks, so the same marker stops it,
+//                C10), and Codex once the COS hooks are installed in Codex AND Codex trusts
+//                them (its deny-only reply, C10/C12). A pure `js` Codex step is not a tool
+//                call, so a Codex run stops at its next COMMAND (W20).
+//   unsupported  the Codex app or Cursor without hooks that can reach the run.
 //   hooks_*      a desk Claude run on a Mac whose hooks cannot stop it yet.
 //
 // `cancelTargetFor` is the ONE function that decides, and both the cancel route and the
@@ -33,6 +37,74 @@ export interface CancelFacts {
   hooksEnabled: boolean
   /** The hooks installed on this Mac carry the 6.53.0 script and subscription. */
   hooksReady: boolean
+  /**
+   * 6.62.0: the COS hooks in `~/.codex/hooks.json` can stop a desk Codex run: installed, trusted
+   * by Codex itself, and this package's script. Absent: the registered reader answers
+   * (`setCodexDeskCancelReady`), and with none registered, no.
+   */
+  codexHooksReady?: boolean
+  /**
+   * 6.62.0 (QA W1): the Claude hooks Cursor runs carry THIS package's script, not merely a
+   * halt-capable earlier one: the 6.61.7 script reads the first `session_id`, which a Cursor
+   * payload writes behind `tool_input`, so it misses or mis-stops Cursor runs. Absent: the
+   * registered reader answers (`setDeskCancelReaders`), and with none registered, no.
+   */
+  cursorHooksReady?: boolean
+  /** 6.62.0 (QA W2): the thread the cancel is for, so the hooks can be seen to fire for IT. */
+  threadId?: string
+  /**
+   * 6.62.0 (QA W2): a hook event from this engine has already reached COS for this thread:
+   * positive evidence the hooks run there (a freshly trusted Codex hook may not be loaded by a
+   * long-running app; a Cursor IDE halt was canaried in `-p` only). Absent: read through the
+   * registered reader for `threadId`; with neither, no.
+   */
+  threadHookSeen?: boolean
+}
+
+export interface DeskCancelReaders {
+  codexReady: () => boolean
+  cursorReady: () => boolean
+  threadHookSeen: (provider: 'codex' | 'cursor', threadId: string) => boolean
+}
+
+const NO_READERS: DeskCancelReaders = { codexReady: () => false, cursorReady: () => false, threadHookSeen: () => false }
+let readers: DeskCancelReaders = { ...NO_READERS }
+
+/**
+ * 6.62.0: the composition root registers how to read Codex and Cursor readiness and the
+ * per-thread hook evidence (`index.ts`, `provider-observe.ts`). Unregistered reads are "no".
+ */
+export function setDeskCancelReaders(next: Partial<DeskCancelReaders>): void {
+  readers = { ...readers, ...next }
+}
+
+/** 6.62.0: the Codex half of `setDeskCancelReaders`, kept for its callers. */
+export function setCodexDeskCancelReady(read: () => boolean): void {
+  setDeskCancelReaders({ codexReady: read })
+}
+
+export function __resetDeskCancelReadersForTests(): void {
+  readers = { ...NO_READERS }
+}
+
+function readerSays(read: () => boolean): boolean {
+  try { return read() === true } catch { return false }
+}
+
+function codexReady(facts: CancelFacts): boolean {
+  if (typeof facts.codexHooksReady === 'boolean') return facts.codexHooksReady
+  return readerSays(readers.codexReady)
+}
+
+function cursorReady(facts: CancelFacts): boolean {
+  if (typeof facts.cursorHooksReady === 'boolean') return facts.cursorHooksReady
+  return readerSays(readers.cursorReady)
+}
+
+function hookSeen(facts: CancelFacts, provider: 'codex' | 'cursor'): boolean {
+  if (typeof facts.threadHookSeen === 'boolean') return facts.threadHookSeen
+  const threadId = facts.threadId
+  return typeof threadId === 'string' && threadId.length > 0 && readerSays(() => readers.threadHookSeen(provider, threadId))
 }
 
 /**
@@ -40,13 +112,18 @@ export interface CancelFacts {
  *   1. COS's own turn first. It is the one run COS can end at once, and a marker would
  *      also stop it only at its next tool (R3), so aborting the child is always better.
  *   2. Nothing running: null. The lens shows no row at all.
- *   3. Codex and Cursor cannot be stopped from outside their app.
+ *   3. 6.62.0: Cursor stops through the Claude hooks it runs, with THIS package's script
+ *      (`cursorHooksReady`, QA W1), and Codex through its own installed, trusted, current hooks
+ *      (`codexHooksReady`); either only once a hook event of that engine has been seen for the
+ *      thread (`threadHookSeen`, QA W2). Without all of it, still only from their app.
  *   4. A desk Claude run needs the hooks applied AND the new script installed; either
  *      missing is its own answer, because the fixes differ (a setting vs Install hooks).
  */
 export function cancelTargetFor(facts: CancelFacts): CancelTarget | null {
   if (facts.cosTurnInFlight === true) return 'cos_turn'
   if (facts.runningOutsideCos !== true) return null
+  if (facts.provider === 'cursor') return facts.hooksEnabled === true && cursorReady(facts) && hookSeen(facts, 'cursor') ? 'desk_run' : 'unsupported'
+  if (facts.provider === 'codex') return facts.hooksEnabled === true && codexReady(facts) && hookSeen(facts, 'codex') ? 'desk_run' : 'unsupported'
   if (facts.provider !== 'claude') return 'unsupported'
   if (facts.hooksEnabled !== true) return 'hooks_disabled'
   if (facts.hooksReady !== true) return 'hooks_outdated'
@@ -59,10 +136,24 @@ export function cancelTargetFor(facts: CancelFacts): CancelTarget | null {
  * NOW: the hooks applied AND the 6.53 script and subscription installed. False until
  * Install hooks after the update, which is the rollout step Control's banner asks for.
  */
-export function sessionCancelFeature(hooksEnabled: boolean, hooksInstalled: boolean): { cosTurn: true; deskClaude: boolean } {
-  return { cosTurn: true, deskClaude: hooksEnabled === true && hooksInstalled === true }
+export function sessionCancelFeature(hooksEnabled: boolean, hooksInstalled: boolean, codexHooksReady = false, cursorHooksReady = false): { cosTurn: true; deskClaude: boolean; deskCodex: boolean; deskCursor: boolean } {
+  return {
+    cosTurn: true,
+    deskClaude: hooksEnabled === true && hooksInstalled === true,
+    // 6.62.0: whether THIS MAC can stop a desk Codex or Cursor run at all: Codex through its own
+    // installed, trusted, current hooks; Cursor through the Claude hooks with the current script
+    // (QA W1). Each thread's `cancel` field also needs that engine's hooks seen for it (QA W2).
+    deskCodex: hooksEnabled === true && codexHooksReady === true,
+    deskCursor: hooksEnabled === true && cursorHooksReady === true,
+  }
 }
 
+/**
+ * 6.62.0 (W20): what an accepted desk cancel does, in the lens's words. A Codex `js` step is not
+ * a tool call, so a run stops at its next command, not at once; so does every desk run.
+ */
+export const DESK_RUN_EFFECT_COPY = 'Stops the run at its next command.'
+
 /** Refusal codes on the cancel route, with the lens's own words (app 6.9.529 matches). */
 export type CancelRefusal = 'not_running' | 'cancel_unsupported' | 'hooks_outdated' | 'hooks_disabled' | 'cancel_failed' | 'invalid_request'
 

package/server/lib/session-continue-facts-real.ts

@@ -0,0 +1,74 @@
+// The production wiring for `session-continue-facts.ts`: live catalogs and live stores,
+// read-only. A module of its own so the resolver's tests never import the live catalogs
+// (which read ~/.codex and the repo's model cache at import).
+//
+// Roots are read PER CALL, not captured at construction, so `COS_AGENT_SESSIONS_HOME` (the
+// session store's own override, which the route tests set) decides every path here too,
+// the Codex config included.
+
+import { join } from 'node:path'
+import type { ContinueFactsDeps } from './session-continue-facts.js'
+import { agentSessionRoots } from './agent-session-store.js'
+import { getCodexTrustMode } from './codex-run-ledger.js'
+import { codexModelDisplayName, isKnownCodexModel } from './codex-model-catalog.js'
+import { cursorModelDisplayName, isKnownCursorModel } from './cursor-model-catalog.js'
+import { resolveCursorAgentSession } from './cursor-agent-store.js'
+import {
+  codexConfigPath,
+  codexFolderTrusted,
+  codexGitTrustRoot,
+  codexGitTrustRootSync,
+  readCodexConfigText,
+  type GitRunner,
+  type GitRunnerSync,
+} from './codex-session-posture.js'
+import { execFile, execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+
+/** Homebrew's git first: `/usr/bin/git` without the developer tools opens an install dialog. */
+const GIT_BIN = ['/opt/homebrew/bin/git', '/usr/local/bin/git', '/usr/bin/git'].find(path => existsSync(path)) ?? '/usr/bin/git'
+const GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0' }
+
+export const realGitRunner: GitRunner = (args, cwd, timeoutMs) => new Promise((resolve, reject) => {
+  execFile(GIT_BIN, [...args], { cwd, timeout: timeoutMs, encoding: 'utf8', env: GIT_ENV, maxBuffer: 256 * 1024 }, (error, stdout) => {
+    if (error) reject(error)
+    else resolve(String(stdout))
+  })
+})
+
+export const realGitRunnerSync: GitRunnerSync = (args, cwd, timeoutMs) =>
+  String(execFileSync(GIT_BIN, [...args], { cwd, timeout: timeoutMs, encoding: 'utf8', env: GIT_ENV, maxBuffer: 256 * 1024, stdio: ['ignore', 'pipe', 'ignore'] }))
+
+function liveCodexConfigText(): string | null {
+  const home = process.env.COS_AGENT_SESSIONS_HOME?.trim()
+  return readCodexConfigText(home ? join(home, '.codex', 'config.toml') : codexConfigPath())
+}
+
+/**
+ * 6.62.0 /qa (W5, N1): the adapter's SPAWN-TIME re-check for a full-access Codex plan, read
+ * fresh from the config (the git root usually comes from the plan's cache seconds before).
+ */
+export function codexFolderTrustedNow(cwd: string): boolean {
+  try {
+    return codexFolderTrusted(cwd, codexGitTrustRootSync(cwd, realGitRunnerSync), liveCodexConfigText())
+  } catch {
+    return false
+  }
+}
+
+/** The production wiring: live catalogs, live stores, read-only. */
+export function realContinueFactsDeps(): ContinueFactsDeps {
+  return {
+    codexFallbackSandbox: () => getCodexTrustMode(),
+    isKnownCodexModel: id => isKnownCodexModel(id),
+    codexModelLabel: id => codexModelDisplayName(id),
+    codexConfigText: () => liveCodexConfigText(),
+    codexGitTrustRoot: cwd => codexGitTrustRoot(cwd, realGitRunner),
+    isKnownCursorModel: id => isKnownCursorModel(id),
+    cursorModelLabel: id => cursorModelDisplayName(id),
+    cursorChatDir: threadId => resolveCursorAgentSession(threadId, agentSessionRoots().cursorChats)?.dir ?? null,
+    get cursorComposerDb() {
+      return agentSessionRoots().cursorComposerDb
+    },
+  }
+}

package/server/lib/session-continue-facts.ts

@@ -0,0 +1,267 @@
+// One resolver for "what model is this session on, and what would a Continue run with"
+// (6.62.0, plans 1.8, 3.2, 3.3, 3.12).
+//
+// These readers share the resolver; observations may change between reads:
+//   - the attached shim in index.ts (the plan that becomes argv),
+//   - the detail route (`reported_model`, `continue_note`); list rows skip these reads,
+//   - the attachability verdict (`continue_note`).
+//
+// Every read is bounded and fails to "unknown": `reported_model` is OMITTED on any failure
+// (never blanked, never guessed), and a Continue whose session cannot be read falls back
+// to the 6.61 posture with a note that says so.
+
+import { open, stat } from 'node:fs/promises'
+import {
+  codexReportedModel,
+  planCodexContinue,
+  readCodexConfigText,
+  readCodexSessionPosture,
+  type CodexSessionPosture,
+} from './codex-session-posture.js'
+import {
+  continueFullPermissionsEnabled,
+  killSwitchNote,
+  planCursorContinue,
+  CURSOR_ASK_UNACKED_NOTE,
+  CURSOR_COMPOSER_NOTE,
+  type AttachedContinuePlan,
+} from './continue-plan.js'
+import {
+  cursorSlugCandidates,
+  pickListedCursorModel,
+  readCliChatFacts,
+  readComposerFacts,
+} from './cursor-session-model.js'
+
+/** The lens's own filter for this field (session-model-identity.ts), applied here first. */
+export const REPORTED_MODEL_RE = /^[a-zA-Z0-9][a-zA-Z0-9._:/ -]*$/
+export const REPORTED_MODEL_MAX = 100
+
+export function sanitizeReportedModel(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  if (trimmed.length === 0 || trimmed.length > REPORTED_MODEL_MAX) return null
+  return REPORTED_MODEL_RE.test(trimmed) ? trimmed : null
+}
+
+// ---------------------------------------------------------------------------
+// Claude: the transcript's newest `message.model`
+// ---------------------------------------------------------------------------
+
+const CLAUDE_TAIL_WINDOWS = [1024 * 1024, 8 * 1024 * 1024]
+const claudeModelMemo = new Map<string, { mtimeMs: number; size: number; model: string | null }>()
+const MAX_MEMO = 512
+
+/** Tests only. */
+export function __resetSessionContinueFactsForTests(): void {
+  claudeModelMemo.clear()
+  fallbackLogged.clear()
+}
+
+function newestClaudeModel(text: string): string | null {
+  const lines = text.split('\n')
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i]!
+    if (!line.includes('"assistant"') || !line.includes('"model"')) continue
+    let row: any
+    try { row = JSON.parse(line) } catch { continue }
+    if (row?.type !== 'assistant') continue
+    const model = row?.message?.model
+    // `<synthetic>` is Claude Code's own stand-in for a reply no model wrote (an API error,
+    // an interrupt). It is not what the session runs on.
+    if (typeof model === 'string' && model.trim() && model !== '<synthetic>') return model.trim()
+  }
+  return null
+}
+
+/** Claude's newest real model from the transcript tail, memoized on (mtime, size). */
+export async function readClaudeReportedModel(path: string | null | undefined): Promise<string | null> {
+  if (typeof path !== 'string' || !path.startsWith('/')) return null
+  let mtimeMs: number
+  let size: number
+  try {
+    const st = await stat(path)
+    if (!st.isFile()) return null
+    mtimeMs = st.mtimeMs
+    size = st.size
+  } catch {
+    return null
+  }
+  const memo = claudeModelMemo.get(path)
+  if (memo && memo.mtimeMs === mtimeMs && memo.size === size) return memo.model
+  let model: string | null = null
+  try {
+    const handle = await open(path, 'r')
+    try {
+      for (const window of CLAUDE_TAIL_WINDOWS) {
+        const length = Math.min(window, size)
+        const buffer = Buffer.alloc(length)
+        const { bytesRead } = await handle.read(buffer, 0, length, size - length)
+        model = newestClaudeModel(buffer.subarray(0, bytesRead).toString('utf8'))
+        if (model !== null || length >= size) break
+      }
+    } finally {
+      await handle.close()
+    }
+  } catch {
+    return null
+  }
+  claudeModelMemo.delete(path)
+  claudeModelMemo.set(path, { mtimeMs, size, model })
+  while (claudeModelMemo.size > MAX_MEMO) {
+    const oldest = claudeModelMemo.keys().next()
+    if (oldest.done) break
+    claudeModelMemo.delete(oldest.value)
+  }
+  return model
+}
+
+// ---------------------------------------------------------------------------
+// 6.62.0 /qa (W17): every silent fallback gets a server log line, once per thread per window
+// ---------------------------------------------------------------------------
+
+export const FALLBACK_LOG_EVERY_MS = 10 * 60_000
+const fallbackLogged = new Map<string, number>()
+
+/** Logs `[continue-plan] <what> thread=<8> <detail>` unless the same pair logged recently. */
+export function logContinueFallback(what: string, threadId: string, detail: string, now = Date.now()): boolean {
+  const key = `${what}:${threadId}`
+  const last = fallbackLogged.get(key)
+  if (last !== undefined && now - last < FALLBACK_LOG_EVERY_MS) return false
+  fallbackLogged.delete(key)
+  fallbackLogged.set(key, now)
+  while (fallbackLogged.size > 512) {
+    const oldest = fallbackLogged.keys().next()
+    if (oldest.done) break
+    fallbackLogged.delete(oldest.value)
+  }
+  console.warn(`[continue-plan] ${what} thread=${String(threadId).slice(0, 8)} ${detail}`)
+  return true
+}
+
+// ---------------------------------------------------------------------------
+// The resolver
+// ---------------------------------------------------------------------------
+
+export interface ContinueFactsDeps {
+  env?: NodeJS.ProcessEnv
+  /** The 6.61 Codex sandbox (`getCodexTrustMode`). */
+  codexFallbackSandbox: () => 'read-only' | 'workspace-write'
+  isKnownCodexModel: (id: string) => boolean
+  codexModelLabel: (id: string) => string | null
+  /** `~/.codex/config.toml` text. Defaults to the live, read-only reader. */
+  codexConfigText?: () => string | null
+  /** 6.62.0 /qa (W5): the cwd's git trust root (K7), bounded; absent means no git lookup. */
+  codexGitTrustRoot?: (cwd: string) => Promise<string | null>
+  isKnownCursorModel: (id: string) => boolean
+  cursorModelLabel: (id: string) => string | null
+  /** The CLI chat dir for this id (`~/.cursor/chats/<hash>/<id>`), or null for an IDE composer. */
+  cursorChatDir: (threadId: string) => string | null
+  /** `globalStorage/state.vscdb`. */
+  cursorComposerDb: string
+}
+
+export interface SessionContinueFacts {
+  /** For the attached shim only. Undefined: the 6.61 argv. */
+  plan?: AttachedContinuePlan
+  /** At most 60 characters, or null (Claude: unchanged, so no note). */
+  note: string | null
+  /** Sanitized to the lens rule, or null (then omitted from the wire). */
+  reportedModel: string | null
+}
+
+export interface ContinueFactsInput {
+  provider: string
+  threadId: string
+  /** The transcript or rollout, when the caller already holds it. */
+  transcriptPath: string | null
+  /** The Continue's real cwd (the shim's resolved workspace). Rows pass null. */
+  cwd: string | null
+  /** Pre-read composer facts for list pages (one query for the whole page). */
+  composerFacts?: Map<string, import('./cursor-session-model.js').ComposerFacts | null>
+  /**
+   * 6.62.0 /qa (Q3): the client sent `X-COS-Continue-Note: 1` (it shows this note). Without
+   * it a Cursor Continue gets NO plan (the 6.61 Ask posture) and a note that says so.
+   */
+  noteAck?: boolean
+}
+
+export async function resolveSessionContinueFacts(
+  input: ContinueFactsInput,
+  deps: ContinueFactsDeps,
+): Promise<SessionContinueFacts> {
+  const full = continueFullPermissionsEnabled(deps.env)
+  if (input.provider === 'claude') {
+    return { note: null, reportedModel: sanitizeReportedModel(await readClaudeReportedModel(input.transcriptPath)) }
+  }
+  if (input.provider === 'codex') {
+    let posture: CodexSessionPosture | null = null
+    try {
+      posture = await readCodexSessionPosture(input.transcriptPath)
+    } catch {
+      posture = null
+    }
+    const reportedModel = sanitizeReportedModel(codexReportedModel(posture))
+    let fallback: 'read-only' | 'workspace-write' = 'read-only'
+    try { fallback = deps.codexFallbackSandbox() === 'workspace-write' ? 'workspace-write' : 'read-only' } catch { fallback = 'read-only' }
+    if (!full) return { note: killSwitchNote('codex', fallback), reportedModel }
+    const cwd = input.cwd ?? posture?.cwd ?? ''
+    // Only full access needs the trust question, and only it pays for the git lookup.
+    let gitTrustRoot: string | null = null
+    if (posture?.sandboxType === 'danger-full-access' && typeof deps.codexGitTrustRoot === 'function') {
+      try { gitTrustRoot = await deps.codexGitTrustRoot(cwd) } catch { gitTrustRoot = null }
+    }
+    const plan = planCodexContinue(posture, cwd, {
+      fallbackSandbox: () => fallback,
+      configText: deps.codexConfigText ?? (() => readCodexConfigText()),
+      gitTrustRoot,
+      isKnownModel: deps.isKnownCodexModel,
+      modelLabel: deps.codexModelLabel,
+    })
+    if (plan.source === 'fallback') logContinueFallback('codex posture unreadable', input.threadId, `fallback=${plan.sandbox}`)
+    return { plan, note: plan.note, reportedModel }
+  }
+  if (input.provider === 'cursor') {
+    const id = input.threadId.toLowerCase()
+    let chatDir: string | null = null
+    try { chatDir = deps.cursorChatDir(id) } catch { chatDir = null }
+    if (chatDir) {
+      const chat = await readCliChatFacts(chatDir)
+      const reportedModel = sanitizeReportedModel(chat?.model ?? null)
+      if (!full) return { note: killSwitchNote('cursor', 'read-only'), reportedModel }
+      if (input.noteAck !== true) return { note: CURSOR_ASK_UNACKED_NOTE, reportedModel }
+      const plan = planCursorContinue({
+        candidates: chat?.model ? [chat.model] : [],
+        isKnown: deps.isKnownCursorModel,
+        label: deps.cursorModelLabel,
+        askModeChat: chat?.mode === 'ask',
+      })
+      if (!plan.matched) logContinueFallback('cursor model unmatched', input.threadId, `model=${chat?.model ?? 'unread'} fallback=${plan.model}`)
+      return { plan, note: plan.note, reportedModel }
+    }
+    // An IDE composer: no plan (it is never resumed from outside), and its model is read
+    // from the composer record in a query of its own.
+    let facts = input.composerFacts?.get(id)
+    if (facts === undefined) {
+      try {
+        facts = (await readComposerFacts([id], deps.cursorComposerDb)).get(id) ?? null
+      } catch {
+        facts = null
+      }
+    }
+    const candidates = cursorSlugCandidates(facts?.modelConfig ?? null)
+    const listed = pickListedCursorModel(candidates, deps.isKnownCursorModel)
+    return { note: CURSOR_COMPOSER_NOTE, reportedModel: sanitizeReportedModel(listed ?? candidates[0] ?? null) }
+  }
+  return { note: null, reportedModel: null }
+}
+
+/** The two wire keys, omitted when unknown, so an older client sees the same payload. */
+export function continueFactsFields(facts: SessionContinueFacts | null | undefined): { reported_model?: string; continue_note?: string } {
+  if (!facts) return {}
+  return {
+    ...(facts.reportedModel ? { reported_model: facts.reportedModel } : {}),
+    ...(facts.note ? { continue_note: facts.note } : {}),
+  }
+}
+

package/server/lib/session-halt.ts

@@ -100,6 +100,44 @@ export function clearHaltMarker(sessionId: string, dir = haltDir()): boolean {
   }
 }
 
+/**
+ * 6.62.0 /qa (Q4): COS is about to start its OWN child on this thread (a Continue, a queue
+ * drain, or a fork). A marker left by an earlier desk cancel must not deny it: Cursor `-p`
+ * fires neither UserPromptSubmit nor SessionEnd, so until this a cancelled Cursor CLI chat
+ * refused every Continue for the marker's hour. The callers only reach here once the
+ * occupancy gate (Continue, drain) or an explicit probe (fork) says no desk run is working,
+ * so no live desk cancel is undone. True when a marker was removed.
+ */
+export function clearHaltForCosChild(sessionId: string, why: 'continue' | 'fork', dir = haltDir()): boolean {
+  const cleared = clearHaltMarker(sessionId, dir)
+  if (cleared) console.log(`[session-halt] marker cleared: COS starts its own ${why} child session=${String(sessionId).slice(0, 8)}`)
+  return cleared
+}
+
+/**
+ * The same deps with `spawn` clearing the thread's marker first, at the moment the child is
+ * created (after every gate and ban check), and only when `mayClear` says no desk run is
+ * working. A throwing `mayClear` clears nothing.
+ */
+export function clearingHaltOnSpawn<T extends { spawn: (request: never) => unknown }>(
+  deps: T,
+  sessionId: string,
+  why: 'continue' | 'fork',
+  mayClear: () => boolean = () => true,
+  dir = haltDir(),
+): T {
+  const spawn = deps.spawn as (request: unknown) => unknown
+  return {
+    ...deps,
+    spawn: ((request: unknown) => {
+      let clear = false
+      try { clear = mayClear() === true } catch { clear = false }
+      if (clear) clearHaltForCosChild(sessionId, why, dir)
+      return spawn(request)
+    }) as T['spawn'],
+  }
+}
+
 /**
  * Clear the marker because the SESSION ended, but only a marker written at or before the
  * event. A SessionEnd drained late from the spool must not remove a cancel written after
@@ -149,6 +187,11 @@ export function clearHaltMarkerOnSessionEnd(sessionId: string, endedAt: number,
 //     a halted desk run is the worse error, and the lens already said "at its next step".
 //   - LIMIT, stated: a desk prompt with exactly the delivered words, typed after the send and
 //     taken first, is indistinguishable from the delivered turn and re-arms.
+//
+// 6.62.0 (plan 3.6, W8): a Codex turn queued into the Codex app (`codex queue`, from the busy
+// fast path or the idle hop) is re-armed too. Codex hands the queued text to its own
+// UserPromptSubmit unchanged, with no peer wrapper, so that comparison is VERBATIM (only the
+// ends trimmed): no wrapper is taken off and no inner whitespace is collapsed.
 
 interface PendingRearm {
   marker: HaltMarker
@@ -157,6 +200,10 @@ interface PendingRearm {
   /** Prompts submitted before this are someone else's. */
   after: number
   until: number
+  /** 6.62.0: a Codex queued turn, compared verbatim (no peer unwrap). */
+  verbatim: boolean
+  /** The delivered text as sent, for the verbatim comparison. */
+  text: string
 }
 
 const pendingRearms = new Map<string, PendingRearm>()
@@ -171,12 +218,21 @@ const MAX_PENDING_REARMS = 64
 export function haltDeliveredTurn(
   sessionId: string,
   marker: HaltMarker,
-  turn: { prompt: string; after: number; rearm: boolean; now?: number; windowMs?: number },
+  turn: { prompt: string; after: number; rearm: boolean; now?: number; windowMs?: number; verbatim?: boolean; deferMarker?: boolean },
   dir = haltDir(),
 ): boolean {
-  if (!writeHaltMarker(sessionId, marker, dir)) return false
-  const id = sessionId.toLowerCase()
+  const id = typeof sessionId === 'string' ? sessionId.toLowerCase() : ''
   const words = normalizePromptWords(turn.prompt)
+  // 6.62.0 /qa (W3): `deferMarker` (a busy hop) writes NOTHING now: the session is still on
+  // the person's own turn, and a marker would stop it. Only the re-arm is registered, and it
+  // writes the marker when the delivered turn's own prompt arrives. A delivered turn that has
+  // already started (`rearm` false) is ours, so it is written at once as before.
+  const deferred = turn.deferMarker === true && turn.rearm && words.length > 0
+  if (deferred) {
+    if (haltMarkerPath(id, dir) === null) return false
+  } else if (!writeHaltMarker(sessionId, marker, dir)) {
+    return false
+  }
   if (!turn.rearm || words.length === 0) {
     pendingRearms.delete(id)
     return true
@@ -186,7 +242,7 @@ export function haltDeliveredTurn(
     ? Math.min(turn.windowMs, HALT_MARKER_TTL_MS)
     : HALT_MARKER_TTL_MS
   pendingRearms.delete(id)
-  pendingRearms.set(id, { marker, words, after: turn.after, until: now + windowMs })
+  pendingRearms.set(id, { marker, words, after: turn.after, until: now + windowMs, verbatim: turn.verbatim === true, text: turn.prompt })
   while (pendingRearms.size > MAX_PENDING_REARMS) {
     const oldest = pendingRearms.keys().next()
     if (oldest.done) break
@@ -204,7 +260,12 @@ export function normalizePromptWords(text: unknown): string {
  * Is `prompt` (a UserPromptSubmit's `prompt`) the delivered prompt? Equal words, compared
  * whole, after taking off Claude Code's peer wrapper when the prompt arrived in one.
  */
-export function isDeliveredPrompt(prompt: unknown, delivered: string): boolean {
+export function isDeliveredPrompt(prompt: unknown, delivered: string, options: { verbatim?: boolean } = {}): boolean {
+  if (options.verbatim === true) {
+    // 6.62.0: Codex's queued turn arrives as its own text. No wrapper to take off.
+    const want = typeof delivered === 'string' ? delivered.trim() : ''
+    return want.length > 0 && typeof prompt === 'string' && prompt.trim() === want
+  }
   const want = normalizePromptWords(delivered)
   if (want.length === 0 || typeof prompt !== 'string') return false
   return normalizePromptWords(unwrapPeerMessage(prompt) ?? prompt) === want
@@ -226,7 +287,7 @@ export function rearmHaltOnPrompt(sessionId: string, promptAt: number, prompt: u
   }
   if (!Number.isFinite(promptAt) || promptAt < pending.after) return false
   pendingRearms.delete(id)
-  if (!isDeliveredPrompt(prompt, pending.words)) {
+  if (!(pending.verbatim ? isDeliveredPrompt(prompt, pending.text, { verbatim: true }) : isDeliveredPrompt(prompt, pending.words))) {
     console.warn(`[session-halt] re-arm dropped: the first prompt after the hand-off was not the delivered turn session=${id.slice(0, 8)} clientCancelId=${pending.marker.clientCancelId}`)
     return false
   }