@humwick/runner 0.130.5 → 0.130.6

package/src/adapters/codex-agent-message-capture.ts

@@ -1,28 +1,20 @@
 type EmitAgentMessage = (body: string) => void;
-type ResponseEntry = { itemId?: string; body: string };
+type ResponseEntry = { itemId?: string; body: string; phase?: unknown };
 type CompleteItemOptions = { includeInResponse?: boolean; phase?: unknown };
 
-const MAX_CAPTURED_RESPONSE_CHARS = 16_000;
-// `\s` is defined as exactly the character set String#trim strips, so this tests
-// `text.trim() !== ""` without allocating the trimmed copy. It is NOT free — matching forces a
-// flatten of the accumulated buffer's rope — so it must stay off the per-delta hot path and is
-// only used where the pre-#2504 whitespace guard actually changed the outcome.
-const NON_WHITESPACE = /\S/;
-const TRUNCATION_MARKER_PREFIX = "[truncated:";
-
 export class CodexAgentMessageCapture {
   private segments: ResponseEntry[][] = [];
   private currentSegment: ResponseEntry[] = [];
   private readonly buffers = new Map<string, string>();
   private readonly flushedLengths = new Map<string, number>();
-  private readonly responseRecordedLengths = new Map<string, number>();
+  private readonly responseItems = new Map<string, ResponseEntry>();
 
   reset(): void {
     this.segments = [];
     this.currentSegment = [];
     this.buffers.clear();
     this.flushedLengths.clear();
-    this.responseRecordedLengths.clear();
+    this.responseItems.clear();
   }
 
   appendDelta(itemId: string | undefined, delta: string): void {
@@ -36,7 +28,7 @@ export class CodexAgentMessageCapture {
     if (options.includeInResponse === false || options.phase === "commentary") {
       this.forgetResponseItem(itemId);
     } else {
-      this.recordResponseText(itemId, fullText);
+      this.recordResponseText(itemId, fullText, options.phase);
     }
     if (!itemId) return;
     this.buffers.delete(itemId);
@@ -51,20 +43,22 @@ export class CodexAgentMessageCapture {
   }
 
   // Deterministic turn-final response: prefer the trailing structured report span, not a generic
-  // post-handoff coda. The original #1079/#1086 trailing-run rule correctly kept early narration
+  // post-handoff coda. The original trailing-run rule correctly kept early narration
   // out, but it over-trimmed Codex turns shaped "summary -> workspace ready -> Landed..." and made
-  // report-up deliver only the coda (#1136). We still drop leading narration; we just let structured
+  // report-up deliver only the coda. We still drop leading narration; we just let structured
   // report markers beat a terse final status line.
   finish(emit: EmitAgentMessage): string | undefined {
     this.closeSegment(emit);
-    const trailingSegment = selectFinalResponseSegments(this.segments);
+    // explicit provider phases outrank wording-based selection for older Codex versions.
+    const finalItems = this.segments.flat().filter((entry) => entry.phase === "final_answer");
+    const selected = finalItems.length ? [finalItems] : selectFinalResponseSegments(this.segments);
     this.segments = [];
-    const text = trailingSegment ? trailingSegment.map(segmentBody).join("\n\n").trim() : undefined;
-    return truncateCapturedResponse(text);
+    this.responseItems.clear();
+    return selected ? selected.map(segmentBody).join("\n\n").trim() : undefined;
   }
 
   private flushPending(emit: EmitAgentMessage): void {
-    // #2504 hot path: EVERY reasoning/plan delta calls closeSegment -> flushPending, so this runs
+    // hot path: EVERY reasoning/plan delta calls closeSegment -> flushPending, so this runs
     // thousands of times per turn. Bail before the defensive entry-array copy when there is no
     // open agentMessage buffer (the common case) — that snapshot exists only so `emit` re-entering
     // and mutating `buffers` cannot disturb the iteration, and there is nothing to iterate here.
@@ -78,7 +72,7 @@ export class CodexAgentMessageCapture {
   private flushText(itemId: string | undefined, text: string | undefined, emit: EmitAgentMessage): void {
     if (!text) return;
     const offset = itemId ? (this.flushedLengths.get(itemId) ?? 0) : 0;
-    // #2504: `text` is the WHOLE accumulated item buffer and this is re-entered on every
+    // `text` is the WHOLE accumulated item buffer and this is re-entered on every
     // reasoning/plan delta. `.length` is O(1) on a rope, `.slice()`/`.trim()` are not — they
     // flatten and copy the entire buffer. Skip both when nothing new has arrived, which is the
     // overwhelmingly common case. Equivalent to the old code: slicing at/past the end yields ""
@@ -95,52 +89,26 @@ export class CodexAgentMessageCapture {
     emit(body);
   }
 
-  // #2504 root cause. This used to open with `const body = text.trim()` — a full flatten+copy of
-  // the entire accumulated agentMessage buffer — before branching, and on the itemId path `body`
-  // was then DEAD: that branch computes its own incremental `chunk` and pushes that. Because every
-  // reasoning/plan delta re-enters here via closeSegment -> flushPending with the same growing
-  // buffer, the copy ran per delta over the whole buffer: O(N^2) transient-string churn that
-  // fragmented the runner's allocator into multi-GB RSS bun never returned. Work here is now
-  // bounded by the number of NEW characters, and is O(1) when nothing new arrived.
-  private recordResponseText(itemId: string | undefined, text: string | undefined): void {
+  // segment boundaries may arrive mid-item. Keep one entry holding the whole item,
+  // rather than selecting independently trimmed tails. Updating the buffer reference is O(1),
+  // including on the per-reasoning-delta hot path that keeps free of full-text copies.
+  private recordResponseText(itemId: string | undefined, text: string | undefined, phase?: unknown): void {
     if (!text) return;
-    if (itemId) {
-      const offset = this.responseRecordedLengths.get(itemId) ?? 0;
-      // THE hot path — every reasoning/plan delta lands here with an unchanged buffer. `.length`
-      // is O(1); the pre-fix full-buffer trim was not, and its outcome was always "record
-      // nothing" anyway (slicing at the end yields an empty chunk, and rewriting the offset to
-      // the value it already holds is a no-op).
-      if (text.length === offset) return;
-      if (text.length < offset) {
-        // The item's text got SHORTER than what we recorded — a buffer re-opened by fresh deltas
-        // after completeItem, which clears `buffers` but deliberately keeps this offset. Nothing
-        // can be recorded from it; the pre-fix code only rewound the offset, and only for
-        // non-blank text.
-        if (NON_WHITESPACE.test(text)) this.responseRecordedLengths.set(itemId, text.length);
-        return;
-      }
-      // Only the NEW tail is examined. `slice` on the accumulated buffer is rope-aware in JSC and
-      // stays proportional to the tail; a regex probe over `text` would NOT be — it forces a full
-      // flatten of the rope on every delta, which is the very cost this fix exists to remove.
-      const chunk = text.slice(offset).trim();
-      // The pre-fix guard was `if (!text.trim()) return` — skip the offset advance while the item
-      // is still ENTIRELY whitespace. A non-blank chunk already proves the text is non-blank (the
-      // chunk is a substring of it), so the whole-text probe below is only reached for an all-blank
-      // tail, and then it stops at the buffer's first real character.
-      if (!chunk && !NON_WHITESPACE.test(text)) return;
-      this.responseRecordedLengths.set(itemId, text.length);
-      if (!chunk) return;
-      this.currentSegment.push({ itemId, body: chunk });
+    const entry = itemId ? this.responseItems.get(itemId) : undefined;
+    if (entry) {
+      entry.body = text;
+      if (phase !== undefined) entry.phase = phase;
       return;
     }
-    const body = text.trim();
-    if (!body) return;
-    this.currentSegment.push({ body });
+    if (!/\S/.test(text)) return;
+    const created: ResponseEntry = { itemId, body: text, phase };
+    if (itemId) this.responseItems.set(itemId, created);
+    this.currentSegment.push(created);
   }
 
   private forgetResponseItem(itemId: string | undefined): void {
     if (!itemId) return;
-    this.responseRecordedLengths.delete(itemId);
+    this.responseItems.delete(itemId);
     this.currentSegment = this.currentSegment.filter((entry) => entry.itemId !== itemId);
     this.segments = this.segments
       .map((segment) => segment.filter((entry) => entry.itemId !== itemId))
@@ -182,8 +150,3 @@ function isGenericFinalCoda(body: string): boolean {
   const trimmed = body.trim();
   return trimmed.length <= 180 && GENERIC_FINAL_CODA.test(trimmed) && !isReportBoundarySegment(trimmed);
 }
-
-function truncateCapturedResponse(text: string | undefined): string | undefined {
-  if (!text || text.length <= MAX_CAPTURED_RESPONSE_CHARS) return text;
-  return `${text.slice(0, MAX_CAPTURED_RESPONSE_CHARS).trimEnd()}\n\n${TRUNCATION_MARKER_PREFIX} showing first ${MAX_CAPTURED_RESPONSE_CHARS} of ${text.length} chars]`;
-}

package/src/adapters/codex-app-server.ts

@@ -5,7 +5,7 @@ import { CodexAppClient } from "./codex-client";
 const STARTUP_TIMEOUT_MS = 60_000;
 const STDERR_TAIL_CHARS = 8_192;
 
-/** Connect only after our child announces its bound socket, not after a guessed delay (#3225). */
+/** Connect only after our child announces its bound socket, not after a guessed delay. */
 export async function spawnCodexAppServer(args: SpawnArgs, signal?: AbortSignal) {
   signal?.throwIfAborted();
   const appServerUrl = args.env.CODEX_APP_SERVER_URL!;

package/src/adapters/codex-client.ts

@@ -81,7 +81,7 @@ interface AccountRateLimitsResponse {
 
 export const CODEX_APP_CLIENT_EVENT_CAP = 5_000;
 
-// #2504: the frame ring is diagnostic-only (getEvents()), but a COUNT cap alone bounds nothing —
+// the frame ring is diagnostic-only (getEvents), but a COUNT cap alone bounds nothing —
 // a single app-server frame can carry a whole file diff or a large tool payload, so 5,000 frames
 // is an unbounded number of bytes. Cap the retained frame text too and evict oldest-first. The
 // budget is charged in raw frame characters; the parsed objects retained alongside them cost a
@@ -90,7 +90,7 @@ export const CODEX_APP_CLIENT_EVENT_CAP = 5_000;
 export const CODEX_APP_CLIENT_EVENT_BYTE_CAP = 4_000_000;
 
 /**
- * #2539 Phase A — a JSON-RPC error response from the app-server, kept STRUCTURED. The client
+ * Phase A — a JSON-RPC error response from the app-server, kept STRUCTURED. The client
  * used to flatten every error into `"<message> (<code>)"`, which forced callers to classify
  * rejections by message substring and made the turn/steer fallbacks (not-steerable vs
  * stale-turn vs transport) indistinguishable from real faults. The message keeps the old
@@ -107,7 +107,7 @@ export class CodexRpcError extends Error {
   }
 }
 
-// #1339: every JSON-RPC method the app-server exposes acknowledges promptly — turn/start
+// every JSON-RPC method the app-server exposes acknowledges promptly — turn/start
 // returns the created turn immediately (turn progress/completion arrive later as separate
 // notifications), compact/start acks and reports completion via thread/compacted, etc. So a
 // request whose response never arrives (a half-open socket, a lost frame, an app-server that
@@ -172,8 +172,8 @@ export class CodexAppClient {
   async initialize(): Promise<unknown> {
     return this.request("initialize", {
       clientInfo: {
-        name: "agent-relay-runner-codex",
-        title: "Agent Relay Codex Runner",
+        name: "humwick-runner-codex",
+        title: "Humwick Codex Runner",
         version: "0.1.0",
       },
       capabilities: {
@@ -240,7 +240,7 @@ export class CodexAppClient {
       threadId,
       expectedTurnId: turnId,
       input: [{ type: "text", text }],
-      // #2539 Phase A — stable acceptance-correlation id (echoed back as the userMessage
+      // Phase A — stable acceptance-correlation id (echoed back as the userMessage
       // item's clientId). Absent keeps the legacy wire shape.
       ...(clientUserMessageId ? { clientUserMessageId } : {}),
     });
@@ -275,7 +275,7 @@ export class CodexAppClient {
     const id = this.nextId++;
     const payload: JsonRpcRequest = { id, method, params };
     const promise = new Promise<T>((resolve, reject) => {
-      // #1339: cap the wait so a response that never arrives can't hang forever. The timer
+      // cap the wait so a response that never arrives can't hang forever. The timer
       // is armed here and cleared by settle() the moment the matching frame lands (or the
       // socket closes and onclose rejects every pending). unref so a pending request never
       // by itself keeps the process alive.
@@ -312,7 +312,7 @@ export class CodexAppClient {
       if (pending) {
         this.pending.delete(parsed.id);
         if (parsed.error) {
-          // #2539 Phase A — reject with the STRUCTURED error (code + data preserved) so the
+          // Phase A — reject with the STRUCTURED error (code + data preserved) so the
           // adapter can classify turn/steer rejections; the message keeps the legacy shape.
           pending.reject(new CodexRpcError(parsed.error.code, parsed.error.message, parsed.error.data));
         } else {
@@ -339,7 +339,7 @@ export class CodexAppClient {
     this.eventBytes += size;
     // Decide how many oldest frames both ceilings require dropping, then drop them in ONE splice —
     // this runs on every received frame, so a second shift of a 5,000-entry array would itself be
-    // the kind of steady per-frame churn #2504 is about.
+    // the kind of steady per-frame churn is about.
     let drop = Math.max(0, this.events.length - CODEX_APP_CLIENT_EVENT_CAP);
     let bytes = this.eventBytes;
     for (let i = 0; i < drop; i++) bytes -= this.events[i]!.size;

package/src/adapters/codex-effective-config.ts

@@ -19,7 +19,7 @@ export function readCodexConfig(configArgs: string[], codexHome?: string, cwd?:
       if (existsSync(join(dir, ".git")) || dirname(dir) === dir) break;
     }
     const projects = isRecord(config.projects) ? config.projects : {};
-    // #3476 — no repository means cwd-only settings; trust in a nested cwd never trusts its ancestors.
+    // no repository means cwd-only settings; trust in a nested cwd never trusts its ancestors.
     if (!existsSync(join(dirs.at(-1)!, ".git"))) dirs.splice(1);
     let projectTrusted = false;
     for (const dir of dirs.reverse()) {

package/src/adapters/codex-launch-config.ts

@@ -1,6 +1,6 @@
 // Codex launch/config-arg construction: the `-c` override builders, CLI command
 // resolution (shim detection), and the tool-output token limit. Extracted from
-// codex.ts (file-size ratchet, epic #291); codex.ts re-exports these so existing
+// codex.ts; codex.ts re-exports these so existing
 // consumers + tests keep their import path.
 import { accessSync, constants, realpathSync } from "node:fs";
 import { basename, join } from "node:path";
@@ -15,7 +15,7 @@ import { tomlString } from "../relay-mcp";
 
 export const DEFAULT_CODEX_TOOL_OUTPUT_TOKEN_LIMIT = 12_000;
 
-// #1248 — default background-terminal poll window (300000ms/5min) is too short for
+// default background-terminal poll window (300000ms/5min) is too short for
 // our long-running commands (tests/releases run 5+ min), forcing agents to poll
 // instead of just waiting. Verified against installed codex-cli's source (rust-v0.144.0):
 // `background_terminal_max_timeout` is a top-level Config field — it replaced the older
@@ -29,7 +29,7 @@ export const DEFAULT_CODEX_TOOL_OUTPUT_TOKEN_LIMIT = 12_000;
 // "empty polls wait 5000-300000 ms by default" — that never reflects this override, so a
 // model sees no signal it may request more and keeps polling at ~300000ms. That's why a
 // live probe still saw ~300.001s polls after this override landed. We deliberately do NOT
-// advertise longer polls to the model (#2776): agents are steered to end the turn and take the wake.
+// advertise longer polls to the model: agents are steered to end the turn and take the wake.
 const CODEX_BACKGROUND_TERMINAL_MAX_TIMEOUT_MS = 900000;
 
 export function codexModelConfigArgs(model?: string, effort?: string, record?: ResolvedModelRecord): string[] {
@@ -55,7 +55,7 @@ export function codexApprovalConfigArgs(approvalMode?: string): string[] {
   ];
 }
 
-// #1248 — see CODEX_BACKGROUND_TERMINAL_MAX_TIMEOUT_MS above.
+// see CODEX_BACKGROUND_TERMINAL_MAX_TIMEOUT_MS above.
 export function codexManagedConfigArgs(): string[] {
   return [
     "-c",
@@ -122,7 +122,7 @@ function realPath(path: string): string {
 }
 
 function isHumwickCodexShim(path: string): boolean {
-  return path.includes("/.agent-relay/codex/bin/codex");
+  return path.includes("/.humwick/codex/bin/codex") || path.includes("/.agent-relay/codex/bin/codex");
 }
 
 export function codexAppServerConfigArgs(...argLists: string[][]): string[] {

package/src/adapters/codex-rollout-context.ts

@@ -11,7 +11,7 @@ import { incrementalFileNeedsReset, readIncrementalFileRangeSync, splitIncrement
  *  codexTokenUsageReport (codex-token-usage-capture.ts) read out of a token-usage
  *  payload — the app-server's `thread/tokenUsage/updated` params or a rollout
  *  `token_count` payload share the same field-name variants (camelCase live,
- *  snake_case in the rollout). One resolver so the variant list can't drift (#2483). */
+ *  snake_case in the rollout). One resolver so the variant list can't drift. */
 export interface CodexUsageSections {
   usage: Record<string, unknown>;
   total?: Record<string, unknown>;
@@ -197,7 +197,7 @@ export function findCodexRolloutPath(threadId: string): string | undefined {
 }
 
 /**
- * Fallback model resolution (#2483 review F2) for when the spawn config carries no
+ * Fallback model resolution for when the spawn config carries no
  * `model` — a managed-policy/restart Codex spawn resolves with no explicit model
  * (`skipDefaultWhenEmpty:true`), so the token-usage capture would otherwise skip
  * every report for that agent forever, silently. The rollout records the resolved

package/src/adapters/codex-skill-discovery.ts

@@ -2,7 +2,7 @@ import { errMessage } from "@humwick/sdk";
 import type { CodexAppClient } from "./codex-client";
 
 /** Register once before any thread starts. Codex owns catalog rendering; updating these
- * roots later can re-inject its full catalog (#3694), so Relay supplies the complete set here. */
+ * roots later can re-inject its full catalog, so Relay supplies the complete set here. */
 export async function registerCodexSkillRoots(
   client: Pick<CodexAppClient, "skillsSetExtraRoots">,
   roots: string[],

package/src/adapters/codex-token-usage-capture.ts

@@ -1,6 +1,6 @@
-// #2483 — per-turn Codex token-usage capture: the runner-side half of the token-usage spine's
-// Codex capture seam (sibling to claude-token-usage-capture.ts's #2482 seam, proven live via
-// #2482/#2491). Unlike Claude's transcript-tail (no flush hook exists for Codex, so the runner
+// per-turn Codex token-usage capture: the runner-side half of the token-usage spine's
+// Codex capture seam (sibling to claude-token-usage-capture.ts's seam, proven live).
+// Unlike Claude's transcript-tail (no flush hook exists for Codex, so the runner
 // has to read whatever bytes have been appended), Codex's app-server pushes usage LIVE on its
 // JSON-RPC event stream (`thread/tokenUsage/updated`, already parsed once by handleCodexEvent
 // for context-state tracking via codexTokenUsageContext) — no flush race, so this reads directly
@@ -12,27 +12,27 @@
 // completed) token usage, each with input/cached-input/cache-write-input/output/reasoning-output
 // breakdowns. `last` is what we report — it matches the spine's per-turn semantics.
 //
-// #2483 review round 1, F1 — Codex's buckets are NOT disjoint (cachedInputTokens ⊂ inputTokens,
+// review round 1, F1 — Codex's buckets are NOT disjoint (cachedInputTokens ⊂ inputTokens,
 // reasoningOutputTokens ⊂ outputTokens; a live fixture confirms input+output alone equals
-// totalTokens). The spine's convention (locked by src/db/token-usage.test.ts, set by Claude's
-// #2482) is DISJOINT buckets — its aggregate sums input+output+cacheRead+cacheWrite+reasoning as
+// totalTokens). The spine's convention (locked by src/db/token-usage.test.ts, set by Claude's)
+// is DISJOINT buckets — its aggregate sums input+output+cacheRead+cacheWrite+reasoning as
 // the total. Posting Codex's raw inputTokens/outputTokens double-counts the cache/reasoning
 // sub-portions (~2x on the live fixture) — so cachedInputTokens/cacheWriteInputTokens are
 // subtracted out of inputTokens, and reasoningOutputTokens out of outputTokens, before posting.
 //
-// #2483 review round 1, F4 — the dedupe key needs `total.totalTokens` specifically (the
+// review round 1, F4 — the dedupe key needs `total.totalTokens` specifically (the
 // cumulative counter, which only ever grows within a thread — a compaction just mints a fresh
 // baseline, changing the key). Falling back to `last.totalTokens` when `total` doesn't carry a
 // usable totalTokens degrades to a key that can collide across two different exchanges (both
 // deltas the same size) and silently undercounts via the spine's ON CONFLICT collapse — so a
 // report with no usable cumulative total is dropped rather than posted under an unsafe key.
 //
-// #2483 review round 2, LOW-1 — a real-corpus check (0.3% of events) found `totalTokens > 0`
+// review round 2, LOW-1 — a real-corpus check (0.3% of events) found `totalTokens > 0`
 // with an all-zero input/output breakdown: the only shape that breaks the F1 sum invariant on
 // real data (a nothing-attributable row would post as all-zero, silently undercounting). Reported
-// as explicit unknown usage (#3351) rather than guessed at.
+// as explicit unknown usage rather than guessed at.
 //
-// #2483 review round 2, MED-1 — the F2 rollout fallback must cache a MISS too, not just a hit:
+// review round 2, MED-1 — the F2 rollout fallback must cache a MISS too, not just a hit:
 // an unresolvable model (the managed/restart no-model case) would otherwise re-run
 // findCodexRolloutPath (a recursive readdirSync of ~/.codex/sessions) + a synchronous ~1 MiB
 // read on EVERY thread/tokenUsage/updated event, forever, on the app-server event loop. The miss
@@ -41,7 +41,7 @@ import { isRecord, stringValue } from "@humwick/sdk";
 import type { ProviderTokenUsageRecord, ProviderTokenUsageReporter } from "../adapter";
 import { codexModelFromRolloutPath, codexUsageSections, findCodexRolloutPath, numberValue } from "./codex-rollout-context";
 
-/** The spine's turn-less report shape (POST /api/agents/:id/token-usage, #2485). */
+/** The spine's turn-less report shape. */
 export type CodexTokenUsageSpineRecord = ProviderTokenUsageRecord & { provider: "codex" };
 
 interface CodexTokenUsageBreakdown {
@@ -91,7 +91,7 @@ export function codexTokenUsageReport(
   const base = { sessionId: opts.sessionId, provider: "codex" as const, model: opts.model,
     dedupeKey: `${opts.sessionId}:${totalTokensCumulative}:${lastTotal}`, createdAt: opts.now ?? Date.now() };
   const lastBreakdown = breakdownFrom(sections.last);
-  // LOW-1 / #3351: positive usage without a readable input/output breakdown is real spend whose
+  // LOW-1: positive usage without a readable input/output breakdown is real spend whose
   // buckets are unknown; report it as unknown under the key a readable report would use.
   if (!lastBreakdown || (lastBreakdown.inputTokens === 0 && lastBreakdown.outputTokens === 0)) {
     return { ...base, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, usageStatus: "unknown" };
@@ -119,15 +119,15 @@ interface CodexTokenUsageModelProbe {
 
 function readModelProbe(meta: Record<string, unknown>, threadId: string): CodexTokenUsageModelProbe | undefined {
   const probe = meta.tokenUsageModelProbe;
-  if (!isRecord(probe) || probe.threadId !== threadId) return undefined; // #2483 review MED-1: keyed to
+  if (!isRecord(probe) || probe.threadId !== threadId) return undefined; // review MED-1: keyed to
   // threadId, so a thread change re-arms the probe immediately instead of inheriting a stale miss.
   return { threadId, model: stringValue(probe.model), missedAt: numberValue(probe.missedAt) };
 }
 
 /**
  * codex.ts's handleCodexEvent call site — kept to one line there so the reporter wiring doesn't
- * grow that file past its size ratchet (#291). Resolves the model (the spawn config's, falling
- * back to the rollout's most recent `turn_context.model` — #2483 review F2: a managed-
+ * grow that file past its size ratchet. Resolves the model (the spawn config's, falling
+ * back to the rollout's most recent `turn_context.model` — review F2: a managed-
  * policy/restart spawn resolves with no explicit model, and without this fallback every report
  * for that agent would silently, permanently skip), builds the record, and reports it
  * (best-effort; failures go to reportFailure).
@@ -155,7 +155,7 @@ export function reportCodexTokenUsage(
       }
     }
   }
-  // #3351 — an unresolved model is a label gap, not missing spend: report under "unknown".
+  // an unresolved model is a label gap, not missing spend: report under "unknown".
   if (!model) reporter.debug(`token-usage capture: no known model for Codex thread ${threadId}; reporting as unknown model`);
   const record = codexTokenUsageReport(params, { sessionId: threadId, model: model ?? "unknown", now });
   if (!record) return;

package/src/adapters/codex-tool-output.ts

@@ -12,7 +12,7 @@ export function codexMcpOutputRedactor(cwd: string): ((response: Response) => Pr
   return (response) => redactCodexMcpResponse(response, cwd);
 }
 
-// Codex's blocking PostToolUse replacement throws inside functions.exec (#3248).
+// Codex's blocking PostToolUse replacement throws inside functions.exec.
 // Replace at the transport boundary instead; the existing hook remains a backstop.
 export async function redactCodexMcpResponse(response: Response, cwd: string, env: NodeJS.ProcessEnv = process.env): Promise<Response> {
   let body: Record<string, unknown> = {};
@@ -24,17 +24,17 @@ export async function redactCodexMcpResponse(response: Response, cwd: string, en
     field = "result" in body ? "result" : "error";
     if (!(field in body)) return Response.json(body, { status: response.status });
     const input = JSON.stringify({ cwd, tool_name: "mcp__agent_relay__result", tool_response: body[field] });
-    const binary = join(agentRedactInstallDir(relayEnv(env, "AGENT_RELAY_HOME") || humwickHome()), AGENT_REDACT_FILES.binary);
+    const binary = join(agentRedactInstallDir(relayEnv(env, "HUMWICK_HOME") || humwickHome()), AGENT_REDACT_FILES.binary);
     // The Claude renderer preserves JSON shape; both adapters use the same collector/masker.
     const output = await new Promise<string>((resolve, reject) => {
       const child = execFile(binary, ["hook", "claude"], {
-        cwd, env: writeChildEnv({}, { ...env, AGENT_REDACT_CONFIG: env.AGENT_REDACT_CONFIG || agentRedactConfigPath() }),
+        cwd, env: writeChildEnv({}, { ...env, AGENT_REDACT_CONFIG: env.AGENT_REDACT_CONFIG || agentRedactConfigPath() }, []),
         timeout: 10_000, killSignal: "SIGKILL", maxBuffer: Math.max(16_384, Buffer.byteLength(input) * 3),
       }, (error, stdout, stderr) => error || stderr.trim() ? reject(new Error("masker failed")) : resolve(stdout));
       child.stdin?.on("error", () => reject(new Error("masker input failed")));
       child.stdin?.end(input);
     });
-    // A successful hook writes nothing when no strings needed masking (#3255).
+    // A successful hook writes nothing when no strings needed masking.
     const masked: unknown = JSON.parse(output.trim() || "{}");
     if (!isRecord(masked)) throw new Error("invalid masker output");
     if (Object.keys(masked).length) {

package/src/adapters/codex-version.ts

@@ -1,11 +1,11 @@
-// #1096 review, finding 4 — Codex hooks (CODEX_HOME/hooks.json with Claude-compatible
+// review, finding 4 — Codex hooks (CODEX_HOME/hooks.json with Claude-compatible
 // event names) are only consumed by Codex >= 0.124. An older Codex silently ignores the
 // file, so writing it and reporting `provisioning.hooks: applied` would be a lie. This
 // module probes the installed Codex version once and answers whether hook delivery is
 // actually honored, so the assembler can emit a truthful projection (a LOUD warning when
 // the guard cannot fire) instead of a silent absence.
 //
-// TODO(#1096): a post-deploy LIVE check is still owed — assert that a Codex >= 0.124 actually
+// TODO: a post-deploy LIVE check is still owed — assert that a Codex >= 0.124 actually
 // executes CODEX_HOME/hooks.json for these event names (Stop/PreToolUse/…), not just that the
 // version string clears the gate. The version probe is necessary but not sufficient.
 
@@ -44,7 +44,7 @@ function probeCodexVersion(command: string): string | null {
 }
 
 // Whether the installed Codex actually consumes managed hooks. An explicit
-// AGENT_RELAY_CODEX_VERSION override wins (deterministic tests + operator escape hatch);
+// HUMWICK_CODEX_VERSION override wins (deterministic tests + operator escape hatch);
 // otherwise the real `codex --version` is probed once and cached. An UNKNOWN version (probe
 // failed / Codex not installed) is treated as supported: we neither block launches nor cry
 // wolf on a machine that can't be inspected — we only claim "not applied" when we can PROVE