@gotcos/glasses-server 6.61.7 → 6.63.0

package/server/lib/codex-rollout-state.ts

@@ -0,0 +1,90 @@
+// What a Codex rollout's tail says about the thread RIGHT NOW (6.62.0, plan 1.3 and 1.9), for
+// the session rows: is a turn open, and when did the newest context compaction finish.
+//
+// A DISPLAY HINT ONLY. The write gate keeps its own reading (`codex-turn-clock.ts`, the
+// occupancy probe); nothing here can let a Continue through or hold one back.
+//
+// The turn rule is the queue's (`transcriptTurnVerdict` / `turnFromTail('codex')`): a
+// `task_started` opens a turn, `task_complete` / `turn_complete` / `turn_aborted` close it.
+// It reads the last 512 KiB synchronously, so it is MEMOIZED on (path, mtime, size): a steady
+// list poll re-reads nothing, and only a rollout that changed is read again. A rollout not
+// written inside the hook-active cap is never read at all: whatever its tail says, it is not
+// working now (the cap decides), and a cold list stays free.
+
+import { statSync } from 'node:fs'
+import { turnFromTail, type TurnFromTail } from './session-stream-events.js'
+import { TURN_END_TAIL_BYTES, readTranscriptTailLines } from './thread-turn-queue-store.js'
+
+/** Hook or transcript evidence counts as "working" for this long after the last event (plan 1.1-1.3, W5). */
+export const HOOK_ACTIVE_CAP_MS = 5 * 60_000
+
+export interface CodexRolloutFacts {
+  /** The tail's verdict; null when the tail was not read (cold) or could not be. */
+  reason: TurnFromTail['reason'] | null
+  /** A turn is open in the tail AND the file was written inside the cap. */
+  open: boolean
+  mtimeMs: number
+  /** When the newest `ContextCompaction` item completed, from the tail; null when none is there. */
+  compactedAt: number | null
+}
+
+const MEMO_MAX = 256
+const memo = new Map<string, { mtimeMs: number; size: number; reason: TurnFromTail['reason'] | null; compactedAt: number | null }>()
+let reads = 0
+
+/**
+ * The newest completed context compaction in a tail. Codex writes the `ContextCompaction` item
+ * (and its `compacted` replacement) only when a compaction is OVER: nothing in a rollout marks
+ * one starting, so this can close a compaction the PreCompact hook opened, never open one.
+ */
+export function newestCompactionAt(lines: readonly string[]): number | null {
+  let newest: number | null = null
+  for (const line of lines) {
+    if (!line.includes('ContextCompaction')) continue
+    let record: Record<string, unknown>
+    try { record = JSON.parse(line) as Record<string, unknown> } catch { continue }
+    const payload = record.payload as Record<string, unknown> | undefined
+    const item = payload?.item as Record<string, unknown> | undefined
+    if (record.type !== 'event_msg' || payload?.type !== 'item_completed' || item?.type !== 'ContextCompaction') continue
+    const at = typeof payload.completed_at_ms === 'number' ? payload.completed_at_ms : Date.parse(String(record.timestamp))
+    if (Number.isFinite(at) && (newest === null || at > newest)) newest = at
+  }
+  return newest
+}
+
+export function codexRolloutFacts(path: string | null | undefined, now = Date.now()): CodexRolloutFacts | null {
+  if (!path) return null
+  let mtimeMs: number
+  let size: number
+  try {
+    const st = statSync(path)
+    mtimeMs = st.mtimeMs
+    size = st.size
+  } catch {
+    return null
+  }
+  const fresh = now - mtimeMs <= HOOK_ACTIVE_CAP_MS
+  if (!fresh) return { reason: null, open: false, mtimeMs, compactedAt: null }
+  let hit = memo.get(path)
+  if (!hit || hit.mtimeMs !== mtimeMs || hit.size !== size) {
+    const lines = readTranscriptTailLines(path, TURN_END_TAIL_BYTES)
+    reads++
+    hit = { mtimeMs, size, reason: lines === null ? null : turnFromTail('codex', lines).reason, compactedAt: lines === null ? null : newestCompactionAt(lines) }
+    memo.delete(path)
+    if (memo.size >= MEMO_MAX) {
+      const oldest = memo.keys().next().value
+      if (oldest !== undefined) memo.delete(oldest)
+    }
+    memo.set(path, hit)
+  }
+  return { reason: hit.reason, open: hit.reason === 'prompt_open', mtimeMs, compactedAt: hit.compactedAt }
+}
+
+/** Test seams. */
+export function __resetCodexRolloutStateForTests(): void {
+  memo.clear()
+  reads = 0
+}
+export function codexRolloutReads(): number {
+  return reads
+}

package/server/lib/codex-session-posture.ts

@@ -0,0 +1,528 @@
+// What a Codex session runs with, read from its own rollout (6.62.0, plan 3.2).
+//
+// WHY. `codex exec resume <id>` does NOT keep the session's settings. Canary C11
+// (2026-10-05): a thread created `-s danger-full-access -m gpt-5.6-luna` (effort low)
+// resumed with no flags ran turn 2 on `gpt-6.1-sol high workspace-write`, which are the
+// CONFIG defaults. So a Continue that should carry the session's own permissions (D1)
+// has to pass the session's model, effort and sandbox explicitly, and those live in the
+// rollout's newest `turn_context` row.
+//
+// WHERE THAT ROW IS. Not in the tail a list read takes. Desktop rollout 01a10197 is 297 MB;
+// its newest `turn_context` sat 3.23 MB from the end, with gaps up to 16 MB between them
+// (validation W3). So the read scans BACKWARDS in 1 MB chunks up to a 64 MB cap, and the
+// answer is cached by (path, size): rollouts only append, so the next read scans just the
+// bytes written since (plus a small overlap for a row that was mid-write last time).
+//
+// WHAT IT NEVER DOES. It never broadens. No posture, or a posture this build does not
+// recognise, plans the 6.61 sandbox (`getCodexTrustMode()`, normally read-only) with an
+// honest note. `danger-full-access` passes through ONLY when the session ran with it AND
+// Codex itself already trusts the folder in `~/.codex/config.toml`. Codex writes a permanent
+// `[projects."…"] trust_level = "trusted"` entry when a NEW session starts with a writable
+// sandbox in an untrusted folder (canaries C11/C12/K4; a resume does not write one, K4), and
+// a trusted entry loads that repo's own hooks and config, so COS never relies on it.
+//
+// WHICH FOLDER (6.62.0 /qa W5, canary K7). Codex trusts the cwd itself or its GIT ROOT, not
+// any parent: a session in a nested repo under a trusted folder wrote its own entry. So the
+// rule is: trusted iff the cwd, or its `git rev-parse --show-toplevel`, is a trusted entry;
+// a LINKED worktree resolves to its MAIN worktree (`git worktree list --porcelain`, first
+// entry), never `--git-common-dir`'s parent (this repo's git dir lives outside the tree).
+// The config is parsed read-only, with a regex, and never written.
+
+import { open, stat } from 'node:fs/promises'
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+/** One backward read. */
+export const POSTURE_CHUNK_BYTES = 1024 * 1024
+/** How far back a cold read looks before it gives up and plans the fallback. */
+export const POSTURE_SCAN_CAP_BYTES = 64 * 1024 * 1024
+/** Re-read before the cached size, so a row mid-write at the last read is seen whole. */
+const POSTURE_REREAD_OVERLAP_BYTES = 64 * 1024
+/** A `turn_context` row is about 4 KB; any line longer than this is something else. */
+const MAX_TURN_CONTEXT_LINE_BYTES = 256 * 1024
+const MAX_CACHE_ENTRIES = 256
+const TURN_CONTEXT_MARKER = Buffer.from('"type":"turn_context"')
+
+export type CodexSandboxType = 'read-only' | 'workspace-write' | 'danger-full-access'
+
+export interface CodexSessionPosture {
+  model: string | null
+  effort: string | null
+  sandboxType: CodexSandboxType | null
+  /** `sandbox_policy.network_access` for workspace-write; true for danger-full-access. */
+  networkAccess: boolean | null
+  approvalPolicy: string | null
+  cwd: string | null
+}
+
+const MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/
+const EFFORT_RE = /^[a-z]{2,16}$/
+
+/** One rollout row to a posture, or null when it is not a usable `turn_context`. */
+export function parseTurnContextLine(line: string): CodexSessionPosture | null {
+  let row: any
+  try {
+    row = JSON.parse(line)
+  } catch {
+    return null
+  }
+  if (!row || typeof row !== 'object' || row.type !== 'turn_context') return null
+  const payload = row.payload
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return null
+  const policy = payload.sandbox_policy
+  const rawType = policy && typeof policy === 'object' ? policy.type : null
+  const sandboxType: CodexSandboxType | null = rawType === 'read-only' || rawType === 'workspace-write' || rawType === 'danger-full-access'
+    ? rawType
+    : null
+  let networkAccess: boolean | null = null
+  if (sandboxType === 'danger-full-access') networkAccess = true
+  else if (sandboxType === 'workspace-write' && typeof policy.network_access === 'boolean') networkAccess = policy.network_access
+  else if (sandboxType === 'read-only') networkAccess = false
+  const model = typeof payload.model === 'string' && MODEL_RE.test(payload.model) ? payload.model : null
+  const effortRaw = typeof payload.effort === 'string'
+    ? payload.effort
+    : typeof payload?.collaboration_mode?.settings?.reasoning_effort === 'string'
+      ? payload.collaboration_mode.settings.reasoning_effort
+      : null
+  const effort = effortRaw && EFFORT_RE.test(effortRaw) ? effortRaw : null
+  return {
+    model,
+    effort,
+    sandboxType,
+    networkAccess,
+    approvalPolicy: typeof payload.approval_policy === 'string' ? payload.approval_policy.slice(0, 32) : null,
+    cwd: typeof payload.cwd === 'string' && payload.cwd.startsWith('/') ? payload.cwd : null,
+  }
+}
+
+/**
+ * The newest `turn_context` row in `[lower, upper)` of an open file, scanning backwards.
+ * Null when there is none. A line whose start lies before `lower` is not looked at: it
+ * cannot be judged whole.
+ */
+async function scanBackwards(
+  handle: { read: (buffer: Buffer, offset: number, length: number, position: number) => Promise<{ bytesRead: number }> },
+  lower: number,
+  upper: number,
+): Promise<CodexSessionPosture | null> {
+  let end = upper
+  // Bytes after the first newline of the chunk we just read and before the newline that
+  // ended the last line we judged: the start of a line that began in an earlier chunk.
+  let carry: Buffer = Buffer.alloc(0)
+  // The carry outgrew any turn_context row; skip until that line's start is found.
+  let oversized = false
+  while (end > lower) {
+    const start = Math.max(lower, end - POSTURE_CHUNK_BYTES)
+    const chunk = Buffer.alloc(end - start)
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, start)
+    const data = bytesRead === chunk.length ? chunk : chunk.subarray(0, bytesRead)
+    const buffer = carry.length > 0 ? Buffer.concat([data, carry]) : data
+    // The tail of THIS buffer (after its last newline) is the line that was carried.
+    let lineEnd = buffer.length
+    let cursor = buffer.lastIndexOf(0x0a, lineEnd - 1)
+    while (cursor >= 0) {
+      const line = buffer.subarray(cursor + 1, lineEnd)
+      if (!oversized && line.length <= MAX_TURN_CONTEXT_LINE_BYTES && line.indexOf(TURN_CONTEXT_MARKER) >= 0) {
+        const posture = parseTurnContextLine(line.toString('utf8'))
+        if (posture) return posture
+      }
+      oversized = false
+      lineEnd = cursor
+      cursor = lineEnd > 0 ? buffer.lastIndexOf(0x0a, lineEnd - 1) : -1
+    }
+    // What is left (before the first newline) began earlier; carry it, within bounds.
+    const rest = buffer.subarray(0, lineEnd)
+    if (start === 0) {
+      // The file's first line: whole by definition.
+      if (!oversized && rest.length <= MAX_TURN_CONTEXT_LINE_BYTES && rest.indexOf(TURN_CONTEXT_MARKER) >= 0) {
+        return parseTurnContextLine(rest.toString('utf8'))
+      }
+      return null
+    }
+    if (oversized || rest.length > MAX_TURN_CONTEXT_LINE_BYTES) {
+      carry = Buffer.alloc(0)
+      oversized = true
+    } else {
+      carry = Buffer.from(rest)
+    }
+    end = start
+  }
+  return null
+}
+
+interface PostureCacheEntry {
+  size: number
+  posture: CodexSessionPosture | null
+}
+
+const postureCache = new Map<string, PostureCacheEntry>()
+
+/** Tests only. */
+export function __resetCodexPostureCacheForTests(): void {
+  postureCache.clear()
+  postureReadStats.reads = 0
+  postureReadStats.bytes = 0
+}
+
+/** How much work the reader did: lets a test prove the cache and the incremental read. */
+export const postureReadStats = { reads: 0, bytes: 0 }
+
+/**
+ * The session's newest posture, or null when the rollout carries none within the cap or
+ * cannot be read. Never throws.
+ */
+export async function readCodexSessionPosture(
+  path: string | null | undefined,
+  options: { capBytes?: number } = {},
+): Promise<CodexSessionPosture | null> {
+  // The cap is injectable so a test can prove it bounds the scan without a 64 MB fixture.
+  const cap = typeof options.capBytes === 'number' && options.capBytes > 0 ? options.capBytes : POSTURE_SCAN_CAP_BYTES
+  if (typeof path !== 'string' || !path.startsWith('/')) return null
+  let size: number
+  try {
+    const st = await stat(path)
+    if (!st.isFile()) return null
+    size = st.size
+  } catch {
+    return null
+  }
+  const cached = postureCache.get(path)
+  if (cached && cached.size === size) return cached.posture
+
+  let lower = Math.max(0, size - cap)
+  // Grown since the last read: only the new bytes (plus the overlap) can hold a newer row.
+  const incremental = !!cached && cached.size < size
+  if (incremental) lower = Math.max(lower, cached!.size - POSTURE_REREAD_OVERLAP_BYTES)
+
+  let found: CodexSessionPosture | null = null
+  try {
+    const handle = await open(path, 'r')
+    try {
+      postureReadStats.reads += 1
+      postureReadStats.bytes += size - lower
+      found = await scanBackwards(handle, lower, size)
+    } finally {
+      await handle.close()
+    }
+  } catch {
+    return cached?.posture ?? null
+  }
+  const posture = found ?? (incremental ? cached!.posture : null)
+  postureCache.delete(path)
+  postureCache.set(path, { size, posture })
+  while (postureCache.size > MAX_CACHE_ENTRIES) {
+    const oldest = postureCache.keys().next()
+    if (oldest.done) break
+    postureCache.delete(oldest.value)
+  }
+  return posture
+}
+
+// ---------------------------------------------------------------------------
+// Trust: which folders Codex itself already trusts
+// ---------------------------------------------------------------------------
+
+/** `~/.codex/config.toml`, honouring CODEX_HOME like the rest of the server. */
+export function codexConfigPath(env: NodeJS.ProcessEnv = process.env): string {
+  return join(env.CODEX_HOME?.trim() || join(homedir(), '.codex'), 'config.toml')
+}
+
+/** The live config's text, or null. Read-only; never written by COS. */
+export function readCodexConfigText(path = codexConfigPath()): string | null {
+  try {
+    return readFileSync(path, 'utf8')
+  } catch {
+    return null
+  }
+}
+
+function unescapeTomlBasic(value: string): string {
+  return value.replace(/\\(["\\])/g, '$1')
+}
+
+/**
+ * Every `[projects."<path>"]` table whose `trust_level` is `"trusted"`. A regex parse on
+ * purpose (the server has no TOML dependency): table headers in basic or literal strings,
+ * the key read only up to the next table header.
+ */
+export function trustedCodexProjects(configText: string | null): string[] {
+  if (typeof configText !== 'string' || configText.length === 0) return []
+  const trusted: string[] = []
+  const header = /^\s*\[\s*projects\s*\.\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)')\s*\]\s*$/gm
+  let match: RegExpExecArray | null
+  while ((match = header.exec(configText)) !== null) {
+    const projectPath = match[1] !== undefined ? unescapeTomlBasic(match[1]) : match[2]!
+    const bodyStart = header.lastIndex
+    const next = configText.slice(bodyStart).search(/^\s*\[/m)
+    const body = next < 0 ? configText.slice(bodyStart) : configText.slice(bodyStart, bodyStart + next)
+    if (/^\s*trust_level\s*=\s*["']trusted["']\s*(?:#.*)?$/m.test(body) && projectPath.startsWith('/')) {
+      trusted.push(projectPath.replace(/\/+$/, '') || '/')
+    }
+  }
+  return trusted
+}
+
+const normalizeFolder = (path: string): string => path.replace(/\/+$/, '') || '/'
+
+/**
+ * K7's rule: trusted iff the cwd itself, or its git trust root (the repo's top level, or the
+ * MAIN worktree for a linked one; `codexGitTrustRoot`), is a trusted `[projects]` entry.
+ * Exact folders only: a trusted parent does not cover a repo nested under it.
+ */
+export function codexFolderTrusted(cwd: string, gitTrustRoot: string | null, configText: string | null): boolean {
+  if (typeof cwd !== 'string' || !cwd.startsWith('/')) return false
+  const trusted = new Set(trustedCodexProjects(configText).map(normalizeFolder))
+  if (trusted.has(normalizeFolder(cwd))) return true
+  return typeof gitTrustRoot === 'string' && gitTrustRoot.startsWith('/') && trusted.has(normalizeFolder(gitTrustRoot))
+}
+
+// ---------------------------------------------------------------------------
+// The git trust root (K7), bounded in time and cached
+// ---------------------------------------------------------------------------
+
+/** One git call's budget. A folder git cannot answer for in this long is not a repo here. */
+export const CODEX_GIT_TIMEOUT_MS = 2_000
+const GIT_ROOT_TTL_MS = 60_000
+export type GitRunner = (args: readonly string[], cwd: string, timeoutMs: number) => Promise<string>
+export type GitRunnerSync = (args: readonly string[], cwd: string, timeoutMs: number) => string
+
+const gitRootCache = new Map<string, { at: number; root: string | null }>()
+
+/** Tests only. */
+export function __resetCodexGitRootCacheForTests(): void {
+  gitRootCache.clear()
+}
+
+/** From `git rev-parse --show-toplevel` and `git worktree list --porcelain` output to the root. */
+export function gitTrustRootFrom(toplevel: string, worktreeList: string | null): string | null {
+  const top = toplevel.trim()
+  if (!top.startsWith('/')) return null
+  // The first `worktree <path>` record is the MAIN worktree, whichever one asked.
+  const main = typeof worktreeList === 'string' ? /^worktree (.+)$/m.exec(worktreeList)?.[1]?.trim() : undefined
+  return main && main.startsWith('/') ? main : top
+}
+
+function cachedRoot(cwd: string, now: number): { hit: boolean; root: string | null } {
+  const entry = gitRootCache.get(cwd)
+  if (entry && now - entry.at < GIT_ROOT_TTL_MS) return { hit: true, root: entry.root }
+  return { hit: false, root: null }
+}
+
+function rememberRoot(cwd: string, root: string | null, now: number): string | null {
+  gitRootCache.delete(cwd)
+  gitRootCache.set(cwd, { at: now, root })
+  while (gitRootCache.size > 256) {
+    const oldest = gitRootCache.keys().next()
+    if (oldest.done) break
+    gitRootCache.delete(oldest.value)
+  }
+  return root
+}
+
+/** The git trust root for `cwd`, or null (not a repo, git missing, or too slow). Never throws. */
+export async function codexGitTrustRoot(cwd: string, run: GitRunner, now = Date.now()): Promise<string | null> {
+  if (typeof cwd !== 'string' || !cwd.startsWith('/')) return null
+  const hit = cachedRoot(cwd, now)
+  if (hit.hit) return hit.root
+  let root: string | null = null
+  try {
+    const top = await run(['rev-parse', '--show-toplevel'], cwd, CODEX_GIT_TIMEOUT_MS)
+    let list: string | null = null
+    try { list = await run(['worktree', 'list', '--porcelain'], cwd, CODEX_GIT_TIMEOUT_MS) } catch { list = null }
+    root = gitTrustRootFrom(top, list)
+  } catch {
+    root = null
+  }
+  return rememberRoot(cwd, root, now)
+}
+
+/** The same, synchronously, for the adapter's spawn-time re-check (a fresh cache entry answers). */
+export function codexGitTrustRootSync(cwd: string, run: GitRunnerSync, now = Date.now()): string | null {
+  if (typeof cwd !== 'string' || !cwd.startsWith('/')) return null
+  const hit = cachedRoot(cwd, now)
+  if (hit.hit) return hit.root
+  let root: string | null = null
+  try {
+    const top = run(['rev-parse', '--show-toplevel'], cwd, CODEX_GIT_TIMEOUT_MS)
+    let list: string | null = null
+    try { list = run(['worktree', 'list', '--porcelain'], cwd, CODEX_GIT_TIMEOUT_MS) } catch { list = null }
+    root = gitTrustRootFrom(top, list)
+  } catch {
+    root = null
+  }
+  return rememberRoot(cwd, root, now)
+}
+
+// ---------------------------------------------------------------------------
+// The plan: what one Codex Continue runs with
+// ---------------------------------------------------------------------------
+
+export interface CodexContinuePlan {
+  provider: 'codex'
+  sandbox: CodexSandboxType
+  /** `-m`, only when the model is in the full app-server list. */
+  model: string | null
+  /** `-c model_reasoning_effort="…"`. */
+  effort: string | null
+  /** `-c sandbox_workspace_write.network_access=…`, for workspace-write only. */
+  networkAccess: boolean | null
+  /** `session`: read from the rollout. `fallback`: the 6.61 sandbox, nothing else. */
+  source: 'session' | 'fallback'
+  /** At most 60 characters (plan 3.12). */
+  note: string
+}
+
+export interface CodexPlanDeps {
+  /** The 6.61 posture: `getCodexTrustMode()`. */
+  fallbackSandbox: () => 'read-only' | 'workspace-write'
+  /** The config text, read at plan time (never cached across turns). */
+  configText: () => string | null
+  /** 6.62.0 /qa (W5): the cwd's git trust root, already resolved (`codexGitTrustRoot`). */
+  gitTrustRoot?: string | null
+  /** Is this model in the full app-server list? */
+  isKnownModel: (model: string) => boolean
+  /** A display name for a known model (`gpt-6.1-sol` to `GPT-6.1 Sol`). */
+  modelLabel?: (model: string) => string | null
+}
+
+export const CONTINUE_NOTE_MAX = 60
+
+/**
+ * Measured on the lens (integrator, 2026-10-05): a real note fits one line (the longest,
+ * "This Codex session's full access, GPT-6.1 Sol High.", is 440 of ~546 px), but 60
+ * characters of wide glyphs can wrap two or three. So a note that would pass this many
+ * characters with the model's DISPLAY name names the model by its short id instead.
+ */
+export const CONTINUE_NOTE_SOFT_MAX = 45
+
+/**
+ * A note that names a model: the display-name form when it stays within the soft budget,
+ * else the short-id form, else the model-free fallback. Never past CONTINUE_NOTE_MAX.
+ */
+export function fitModelNote(
+  template: (model: string) => string,
+  display: string | null,
+  shortId: string | null,
+  fallback: string,
+): string {
+  const pretty = display ? template(display) : null
+  if (pretty && pretty.length <= CONTINUE_NOTE_SOFT_MAX) return pretty
+  const short = shortId ? template(shortId) : null
+  if (short && short.length <= CONTINUE_NOTE_MAX) return short
+  if (!shortId && pretty && pretty.length <= CONTINUE_NOTE_MAX) return pretty
+  return fitNote(fallback)
+}
+
+/** The first candidate that fits the lens budget. The last one must always fit. */
+export function fitNote(...candidates: Array<string | null | undefined>): string {
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.length > 0 && candidate.length <= CONTINUE_NOTE_MAX) return candidate
+  }
+  const last = candidates.filter((c): c is string => typeof c === 'string' && c.length > 0).pop() ?? ''
+  return last.slice(0, CONTINUE_NOTE_MAX)
+}
+
+const EFFORT_LABELS: Record<string, string> = {
+  minimal: 'Minimal', low: 'Low', medium: 'Medium', high: 'High', xhigh: 'Extra High', max: 'Max', ultra: 'Ultra',
+}
+
+export function effortLabel(effort: string | null): string | null {
+  if (!effort) return null
+  return EFFORT_LABELS[effort] ?? effort.charAt(0).toUpperCase() + effort.slice(1)
+}
+
+/** `gpt-6.1-sol` to `GPT-6.1 Sol`, used when the catalog has no display name. */
+export function defaultCodexModelLabel(model: string): string {
+  return model
+    .split('-')
+    .map((part, index) => (index === 0 && /^gpt$/i.test(part) ? 'GPT' : part.charAt(0).toUpperCase() + part.slice(1)))
+    .join('-')
+    .replace(/^GPT-(\d+(?:\.\d+)*)-/, 'GPT-$1 ')
+}
+
+/**
+ * The plan for one Codex Continue. Pure over its deps: every branch is a test.
+ *
+ * `posture` null (unreadable, or no `turn_context` within the cap) or with no sandbox this
+ * build recognises: the fallback, never broader than 6.61 and never the config defaults.
+ */
+export function planCodexContinue(posture: CodexSessionPosture | null, cwd: string, deps: CodexPlanDeps): CodexContinuePlan {
+  const fallback = (): CodexContinuePlan => {
+    let sandbox: 'read-only' | 'workspace-write' = 'read-only'
+    try {
+      sandbox = deps.fallbackSandbox() === 'workspace-write' ? 'workspace-write' : 'read-only'
+    } catch {
+      sandbox = 'read-only'
+    }
+    return {
+      provider: 'codex',
+      sandbox,
+      model: null,
+      effort: null,
+      networkAccess: null,
+      source: 'fallback',
+      note: sandbox === 'read-only' ? 'Read-only: session settings unreadable.' : 'Workspace write: session settings unreadable.',
+    }
+  }
+  if (!posture || posture.sandboxType === null) return fallback()
+
+  let known = false
+  try {
+    known = posture.model !== null && deps.isKnownModel(posture.model) === true
+  } catch {
+    known = false
+  }
+  const model = known ? posture.model : null
+  const effort = posture.effort
+  let label: string | null = null
+  if (model) {
+    try {
+      label = deps.modelLabel?.(model) ?? null
+    } catch {
+      label = null
+    }
+    label = label || defaultCodexModelLabel(model)
+  }
+  // Display form (`GPT-6.1 Sol High`) and short form (`gpt-6.1-sol high`), for fitModelNote.
+  const display = model ? [label, effortLabel(effort)].filter(Boolean).join(' ') : 'Codex default model'
+  const shortId = model ? [model, effort].filter(Boolean).join(' ') : null
+
+  if (posture.sandboxType === 'danger-full-access') {
+    let trusted = false
+    try {
+      trusted = codexFolderTrusted(cwd, deps.gitTrustRoot ?? null, deps.configText())
+    } catch {
+      trusted = false
+    }
+    if (trusted) {
+      return {
+        provider: 'codex', sandbox: 'danger-full-access', model, effort, networkAccess: true, source: 'session',
+        note: fitModelNote(m => `This Codex session's full access, ${m}.`, display, shortId, "This Codex session's full access."),
+      }
+    }
+    // The session ran with full access, but Codex has not trusted this folder: passing it
+    // would make Codex trust it permanently. Workspace write, said plainly.
+    return {
+      provider: 'codex', sandbox: 'workspace-write', model, effort, networkAccess: true, source: 'session',
+      note: fitNote('Workspace write: Codex has not trusted this folder.'),
+    }
+  }
+  if (posture.sandboxType === 'workspace-write') {
+    return {
+      provider: 'codex', sandbox: 'workspace-write', model, effort,
+      networkAccess: posture.networkAccess, source: 'session',
+      note: fitModelNote(m => `This Codex session's workspace access, ${m}.`, display, shortId, "This Codex session's workspace access."),
+    }
+  }
+  return {
+    provider: 'codex', sandbox: 'read-only', model, effort, networkAccess: null, source: 'session',
+    note: fitModelNote(m => `Read-only, as this Codex session runs, ${m}.`, display, shortId, 'Read-only, as this Codex session runs.'),
+  }
+}
+
+/** `reported_model` for a Codex row (plan 1.8): `<model> <effort>`, or null. */
+export function codexReportedModel(posture: CodexSessionPosture | null): string | null {
+  if (!posture?.model) return null
+  return posture.effort ? `${posture.model} ${posture.effort}` : posture.model
+}