@junghanacs/entwurf 0.20.0 → 0.21.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -34,8 +34,19 @@
  * Every candidate is collected and validated BEFORE one is chosen. A first-match loop would make
  * the answer depend on which pid or backend happened to be read first; here lookup order carries
  * no meaning, and two live identities are a refusal rather than a race.
+ *
+ * A SECOND RAIL LIVES BELOW THE MARKER RAIL, and it does not share this one's join key.
+ * Codex names its caller on EVERY `tools/call` (`_meta.threadId` plus an
+ * `x-codex-turn-metadata.{session_id,thread_id}` block), and its parent pid cannot separate
+ * citizens at all: in the delivery-capable launch mode every hook and every MCP child of N
+ * live threads resolves to the ONE app-server pid, so a pid marker would be one marker for N
+ * citizens — exactly what the store's `nativeSessionId` uniqueness forbids (measured
+ * 2026-09-08, `scripts/raw-codex-measure/README.md` S1b-C/S1b-D). So the codex resolver is
+ * REQUEST-scoped, not process-scoped: see {@link resolveCodexRequestSenderIdentity}. The two
+ * rails never merge — `codex` is deliberately absent from {@link META_SENDER_BACKENDS}, since
+ * a backend listed there is one whose hook writes a pid marker, and codex birth writes none.
  */
-import { isPlausibleOwnerPid, metaRecordExistsByGardenId, parentPid, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
+import { defaultMetaSessionsDir, describe, isPlausibleOwnerPid, listAllMetaIdentities, makeStoreRecordReader, metaRecordExistsByGardenId, parentPid, readActiveStoreEntries, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /** Every native backend that mints a garden-id from its own hook and writes a sender marker.
  *
@@ -180,3 +191,218 @@ export async function probeNativeSenderAlive(identity, deps = {}) {
     const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
     return probe.status === "alive";
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// REQUEST-SCOPED SENDER IDENTITY — codex
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * The provenance label the MANAGED codex MCP entry carries (`ENTWURF_BRIDGE_NATIVE_HOST=codex`
+ * under `[mcp_servers.entwurf-bridge]` in the codex config the entwurf config writer owns).
+ *
+ * It is an OWNERSHIP/DRIFT atom, not authentication: any process able to write that config, or
+ * to set that env on a child, can spell it. What it buys is the thing a codex bridge child
+ * genuinely cannot observe otherwise — that THIS child was launched from an entwurf-managed
+ * entry, so the request-scoped rail below is admitted deliberately rather than by sniffing.
+ * The value travels to this resolver as an EXPLICIT ARGUMENT: nothing here reads the
+ * environment, and in particular nothing here reads `ENTWURF_BRIDGE_EXTERNAL_AGENT_ID`, which
+ * is the omp root-policy label with its own policy attached (`applyOmpBridgeChildRootPolicy`)
+ * and must never double as a codex admission.
+ */
+export const CODEX_BRIDGE_PROVENANCE_LABEL = "codex";
+/**
+ * `clientInfo.name` every codex MCP client sends, and it is a FIXED VENDOR LITERAL —
+ * `Implementation::new("codex-mcp-client", CARGO_PKG_VERSION).with_title("Codex")`
+ * (`codex-mcp/src/rmcp_client.rs:1035-1039`, read at 0.153.4). `initialize` carries no
+ * identity at all and is byte-identical between two children of two different threads, so this
+ * name is a HOST-KIND gate and never an identity: it says "the peer on this stdio is a codex
+ * client", which is precisely as much as startup can honestly say.
+ */
+export const CODEX_MCP_CLIENT_NAME = "codex-mcp-client";
+/** The `_meta` member carrying the vendor turn-metadata block (`core/src/mcp_tool_call.rs`
+ * `build_mcp_tool_call_request_meta`, :1238-1263). A dash-cased key, hence the string form. */
+const CODEX_TURN_METADATA_KEY = "x-codex-turn-metadata";
+/**
+ * The codex caller's identity metadata is PRESENT but does not hold together: a `threadId` that
+ * is not a nonempty string, a missing/foreign turn-metadata block, or three ids that disagree.
+ *
+ * WHY THIS IS LOUD AND NOT `null`. `null` on this rail means "no identity claim reached me" —
+ * the bridge then refuses the send as anonymous, and the prescription is "open the session
+ * through the installed codex birth hook". A HALF claim is a different fact with a different
+ * cause (a vendor `_meta` shape that moved, or something imitating the codex client), and both
+ * ids exist precisely so neither has to be trusted alone: `threadId` and
+ * `x-codex-turn-metadata.session_id` are built by two different vendor call sites, and the
+ * hook's `session_id` is byte-identical to both (measured 2026-09-08, S1b-D/D3). Selecting a
+ * record from one field while its corroborator is absent or disagrees would address a citizen on
+ * an unverified id — the SE-1 shape — so the disagreement is reported instead.
+ */
+export class EntwurfCodexIdentityMetadataError extends Error {
+    constructor(reason) {
+        super("entwurf-bridge refused: this codex tool call carries identity metadata that does not hold " +
+            `together — ${reason} A codex caller names itself on every call with THREE ids that must be one ` +
+            `string: \`_meta.threadId\`, \`_meta.${CODEX_TURN_METADATA_KEY}.session_id\` and \`.thread_id\`. ` +
+            "Selecting a garden citizen from a partial or self-contradicting claim would send under an " +
+            "identity nothing vouched for. Report it; do not work around it — if the vendor `_meta` shape " +
+            "moved, the measurement in scripts/raw-codex-measure/README.md (S1b-D) must be re-taken.");
+        this.name = "EntwurfCodexIdentityMetadataError";
+    }
+}
+/**
+ * The codex `threadId` selected exactly one V3 record — and that record is NOT a codex citizen.
+ *
+ * This is corruption of the native→garden mapping, never a miss: the store says some other
+ * backend's session carries this exact native id. Returning `null` would report "no record for
+ * this thread" and prescribe re-opening the session, which would mint a SECOND record for the
+ * same `nativeSessionId` and turn a readable defect into the duplicate the certification
+ * refuses. Sending under the foreign citizen is worse still — it would attribute a codex
+ * caller's message to a claude-code/agy/pi session.
+ */
+export class EntwurfCodexIdentityBackendError extends Error {
+    gardenId;
+    constructor(identity) {
+        super(`entwurf-bridge refused: codex thread ${identity.nativeSessionId} selected meta-record ` +
+            `${identity.gardenId}, but that citizen's backend is "${identity.backend}", not "codex". One ` +
+            "native id is bound to one backend for the life of the record, so this store cannot say who the " +
+            "caller is — and neither re-opening the codex session nor sending under the foreign citizen is a " +
+            "fix. The record must be corrected (a fresh generation) before this thread can send.");
+        this.name = "EntwurfCodexIdentityBackendError";
+        this.gardenId = identity.gardenId;
+    }
+}
+/** A JSON OBJECT, as a narrowing guard — `typeof value === "object"` alone admits `null` and
+ * arrays, and every codex identity field is read through a member access that both would
+ * survive silently (`[]._meta` is `undefined`, not a type error). */
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Read the caller's thread id out of ONE request, or refuse.
+ *
+ * `null` — this is not an admitted codex identity claim at all: no managed provenance, a peer
+ * that is not the codex client, no `_meta` object, or an `_meta` with no `threadId` member
+ * (`tools/list`, `initialize`, a non-turn call). All four are ordinary and carry no defect.
+ *
+ * THROWS {@link EntwurfCodexIdentityMetadataError} — a claim exists and is broken. The line
+ * between the two is the PRESENCE of `threadId`: absent is a call that never claimed identity,
+ * present-but-unusable is a claim that failed, and collapsing them would report "no identity"
+ * for a caller that named itself.
+ *
+ * Pure: no fs, no env, no clock. The store lookup is the next function's job on purpose — this
+ * half is the wire contract and can be pinned without a store at all.
+ */
+export function readCodexRequestThreadId(opts) {
+    if (opts.provenance !== CODEX_BRIDGE_PROVENANCE_LABEL)
+        return null;
+    if (!isJsonObject(opts.clientInfo) || opts.clientInfo.name !== CODEX_MCP_CLIENT_NAME)
+        return null;
+    const meta = opts.requestMeta;
+    if (!isJsonObject(meta))
+        return null;
+    if (!("threadId" in meta))
+        return null;
+    const threadId = meta.threadId;
+    if (typeof threadId !== "string" || threadId.length === 0) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.threadId\` is present but is not a nonempty string (got ${describe(threadId)}).`);
+    }
+    const turn = meta[CODEX_TURN_METADATA_KEY];
+    if (!isJsonObject(turn)) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.threadId\` names ${threadId} but \`_meta.${CODEX_TURN_METADATA_KEY}\` is ${describe(turn)}, not an ` +
+            "object, so the second, independently-built id that corroborates it is missing.");
+    }
+    const sessionId = turn.session_id;
+    const turnThreadId = turn.thread_id;
+    if (typeof sessionId !== "string" || sessionId.length === 0) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.${CODEX_TURN_METADATA_KEY}.session_id\` is not a nonempty string (got ${describe(sessionId)}) — ` +
+            "that field is the one the birth hook also sees, so without it nothing joins the wire to a record.");
+    }
+    if (typeof turnThreadId !== "string" || turnThreadId.length === 0) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.${CODEX_TURN_METADATA_KEY}.thread_id\` is not a nonempty string (got ${describe(turnThreadId)}).`);
+    }
+    if (sessionId !== threadId || turnThreadId !== threadId) {
+        throw new EntwurfCodexIdentityMetadataError(`the three ids disagree (threadId=${threadId}, session_id=${sessionId}, thread_id=${turnThreadId}); ` +
+            "on a healthy codex turn they are one byte-identical string.");
+    }
+    return threadId;
+}
+/**
+ * Resolve the ONE codex citizen a request names, or refuse.
+ *
+ * `null` — no admitted claim ({@link readCodexRequestThreadId}), or no record holds that
+ * `nativeSessionId`. The second case is the ordinary pre-birth window: codex birth is
+ * first-turn, not window-open, so a thread whose hook has not minted a record yet simply has no
+ * citizen, and the bridge's default anonymous refusal already names the fix.
+ *
+ * THROWS — every knowable defect, unfolded: a broken claim
+ * ({@link EntwurfCodexIdentityMetadataError}), a foreign-backend record
+ * ({@link EntwurfCodexIdentityBackendError}), or a store that cannot be certified
+ * (`MetaRecordError` from the strict listing — an unreadable/previous-generation record
+ * anywhere in the store, a duplicated `nativeSessionId`, or a store this process cannot read).
+ *
+ * THE LOOKUP IS THE STRICT STORE-WIDE LISTING, NOT A NARROW SCAN. `nativeSessionId` → garden id
+ * is the store's own authority (there is no index, by design), and the same reason
+ * `upsertMetaSession` certifies the WHOLE store before writing applies to a read that turns an
+ * id into an ADDRESS: a narrow "find my thread" pass would answer happily beside a duplicate,
+ * drifted or symlinked neighbour that the doctor refuses, so the runtime would hold the weaker
+ * contract exactly where a message gets attributed. `mode: "strict"` is what makes an
+ * unreadable record a refusal instead of an invisible one — a duplicate of THIS thread's id
+ * would otherwise be dropped from `identities` and read as "no record".
+ */
+export function resolveCodexRequestSenderIdentity(opts = {}) {
+    const threadId = readCodexRequestThreadId(opts);
+    if (threadId === null)
+        return null;
+    const dir = opts.sessionsDir ?? defaultMetaSessionsDir();
+    const { identities } = listAllMetaIdentities(readActiveStoreEntries(dir), makeStoreRecordReader(dir), {
+        mode: "strict",
+    });
+    const identity = identities.find((record) => record.nativeSessionId === threadId);
+    if (!identity)
+        return null;
+    if (identity.backend !== "codex")
+        throw new EntwurfCodexIdentityBackendError(identity);
+    return { identity, threadId, provenance: CODEX_BRIDGE_PROVENANCE_LABEL };
+}
+/**
+ * Two rails claim this MCP process for DIFFERENT addresses. Sibling of
+ * {@link EntwurfSenderIdentityAmbiguityError} and deliberately not the same error: that one is
+ * about two pid MARKERS on one owner pid, while this is about rails that do not even share a
+ * join key — a planted `PI_SESSION_ID` in a native host's environment, a pid marker inherited
+ * from a host whose child we are not, a codex `_meta` naming a thread while a marker names
+ * someone else. Which is right is unknowable here, and both are visible, so neither is used.
+ */
+export class EntwurfSenderIdentityConflictError extends Error {
+    claims;
+    constructor(claims) {
+        super("entwurf-bridge refused: conflicting sender identity. This MCP process holds authoritative " +
+            `identity claims from more than one rail, naming DIFFERENT addresses (${claims
+                .map((claim) => `${claim.rail}=${claim.id}`)
+                .join(", ")}), so which one is calling cannot be determined. A send under the wrong identity ` +
+            "is worse than no send. Report it; do not work around it.");
+        this.name = "EntwurfSenderIdentityConflictError";
+        this.claims = [...claims];
+    }
+}
+/**
+ * Fold every rail's answer into ONE address, or refuse.
+ *
+ * 0 claims → `null` (anonymous; the bridge's default refusal owns that outcome).
+ * 1+ claims that AGREE on the id → that address, carrying every rail that named it. Agreement is
+ *   the normal shape of an overlap, not a conflict: a codex citizen's request-scoped claim and a
+ *   pid marker for the same garden id are two views of one identity.
+ * claims that DISAGREE → throw {@link EntwurfSenderIdentityConflictError}.
+ *
+ * Every claim is collected and compared BEFORE one is chosen — the same rule the marker rail
+ * holds one layer up. A rail-priority order would answer even when the truth is unknown, which
+ * is the failure this exists to prevent, so callers must pass ALL rails they resolved rather
+ * than short-circuiting on the first one that answered.
+ */
+export function reconcileSenderIdentityClaims(claims) {
+    if (claims.length === 0)
+        return null;
+    const ids = new Set(claims.map((claim) => claim.id));
+    if (ids.size > 1)
+        throw new EntwurfSenderIdentityConflictError(claims);
+    const [id] = ids;
+    return {
+        id,
+        rails: [...new Set(claims.map((claim) => claim.rail))].sort(),
+    };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -1,7 +1,8 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller.
+ * the launch argv, and let it name itself back to the caller. Codex is the one measured topology
+ * exception: an omitted seat selects the existing `codex` home session (#95), never a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -77,17 +78,19 @@
  */
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
+import { CODEX_PREFLIGHT_HINT } from "./codex-fresh-preflight.js";
 import { COPILOT_PREFLIGHT_HINT, copilotFreshPreflight, } from "./copilot-fresh-preflight.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
+import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.js";
 import { OMP_PREFLIGHT_HINT, ompFreshPreflight } from "./omp-fresh-preflight.js";
 import { classifyTmuxSessionName, resolveTmuxSessionId } from "./resolve-tmux-session.js";
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract, and
- * `omp` by #87 Bundle C under the same one. The set is joined to the citizen backends by
- * `check-harness-admission-parity`: a harness that mints records but is missing HERE is not an
- * unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp"];
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
+ * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
+ * missing HERE is not an unwired convenience, it is a release blocker. */
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"];
 /**
  * The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
  * than a compiled-in location: the official binary is whatever the operator's environment gives
@@ -115,6 +118,7 @@ export const FRESH_CALL_RUNTIME = {
     "claude-code": "claude",
     copilot: "entwurf",
     omp: "omp",
+    codex: "codex",
 };
 /**
  * The callback tool NAME differs per backend and that is not cosmetic: native pi exposes the
@@ -142,6 +146,7 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     "claude-code": "mcp__entwurf-bridge__entwurf_v2",
     copilot: "entwurf-bridge-entwurf_v2",
     omp: "mcp__entwurf_bridge_entwurf_v",
+    codex: "mcp__entwurf_bridge__entwurf_v2",
 };
 /** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
  * delivery surface, not a claim that a task of this size was measured through tmux. An argv
@@ -245,7 +250,7 @@ export function isSafeFreshCallModel(model) {
  * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
  * carrier would hand callers the launch-shaping power this rail exists to refuse.
  */
-export function buildBackendArgs(backend, composition, model) {
+export function buildBackendArgs(backend, composition, model, env = process.env) {
     switch (backend) {
         case "pi":
             return [composition.prompt, "--entwurf-control", "--model", model];
@@ -255,6 +260,15 @@ export function buildBackendArgs(backend, composition, model) {
             return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
         case "omp":
             return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
+        case "codex":
+            return [
+                "--remote",
+                `unix://${resolveCodexDefaultSocketPath(env)}`,
+                "--model",
+                model,
+                "--dangerously-bypass-approvals-and-sandbox",
+                composition.prompt,
+            ];
     }
 }
 /**
@@ -313,6 +327,20 @@ export function buildFreshCallPrompt(params) {
         params.task,
     ].join("\n");
 }
+/**
+ * Codex's explicit home topology (#95): the operator provides this one existing tmux session
+ * and seats the operator-owned app-server plus supported Codex TUIs there. This is a placement
+ * convention, not an address axis — `threadId` remains the native delivery address.
+ */
+export const CODEX_HOME_TMUX_SESSION = "codex";
+/** An explicit seat always wins. Only omitted Codex placement gets the fixed home. */
+export function selectFreshCallSeat(backend, placement) {
+    if (placement !== undefined)
+        return { tmuxSession: placement.tmuxSession, source: "requested" };
+    if (backend === "codex")
+        return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: "codex-home" };
+    return null;
+}
 /** Correlation tag only. Random, never derived from time, cwd or a peer listing — a nonce that
  * encoded any of those would invite exactly the guessing this rail exists to refuse. */
 export function mintNonce(randomHex = defaultRandomHex) {
@@ -337,9 +365,9 @@ function defaultRandomHex() {
  * for. That is sufficient and not a compromise: every reader of the carrier trims and tests
  * truthiness (`index.ts:212-217`), so empty and absent are the same answer by construction.
  *
- * It is applied to all four backends because the leak is a property of tmux, not of a vendor. A
+ * It is applied to all five backends because the leak is a property of tmux, not of a vendor. A
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
- * three are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
+ * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
  * exactly that after this argv has run. This is a fixed two-variable seam and deliberately NOT a
  * general env carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping
@@ -416,8 +444,10 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // without tmux, so an unresolvable name is answered before anything else runs. Whether that
     // session EXISTS is a tmux question and is asked below, after the caller's own context is
     // proven — a name check that needed a live server would refuse for the wrong reason on a
-    // host with no tmux at all.
-    const seat = params.placement?.tmuxSession;
+    // host with no tmux at all. Codex alone selects its fixed home when the caller omitted a seat;
+    // an explicit seat remains an expert override and is reported as such.
+    const selectedSeat = selectFreshCallSeat(params.backend, params.placement);
+    const seat = selectedSeat?.tmuxSession;
     if (seat !== undefined) {
         const badSeat = classifyTmuxSessionName(seat);
         if (badSeat)
@@ -473,7 +503,7 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         }),
         bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
     };
-    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model), cwd), env);
+    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model, env), cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -494,7 +524,9 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             backend: params.backend,
             model,
             ...(cwd === undefined ? {} : { cwd }),
-            ...(seat === undefined ? {} : { tmuxSession: seat }),
+            ...(selectedSeat === null
+                ? {}
+                : { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
             runtimePath,
             nonce,
         },
@@ -507,6 +539,7 @@ const REJECT_HINT = {
     // the sentence an operator reads cannot drift away from the predicate that produced it.
     ...COPILOT_PREFLIGHT_HINT,
     ...OMP_PREFLIGHT_HINT,
+    ...CODEX_PREFLIGHT_HINT,
     "no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
     "anchor-malformed": "TMUX_PANE is not a native pane id",
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -517,7 +550,7 @@ const REJECT_HINT = {
     "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
     "cwd-not-directory": "the requested cwd exists but is not a directory",
     "tmux-session-name-invalid": "the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
-    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
+    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again; Codex's omitted-placement home is the exact session name 'codex'",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "task-empty": "task is empty after trimming",
@@ -553,7 +586,9 @@ export function renderFreshCall(result) {
             (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
             (r.tmuxSession === undefined
                 ? ""
-                : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
+                : r.tmuxSessionSource === "codex-home"
+                    ? `  seat:     ${r.tmuxSession} (Codex home tmux session, resolved to ${r.sessionId})\n`
+                    : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +
             `  nonce:    ${r.nonce}\n` +

package/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/adapter.js

@@ -1,7 +1,7 @@
 /**
  * native-push adapter rail — the transport LEAF by which a native-push backend
- * (antigravity, the first) is (1) probed for a LIVE conversation and (2) direct-injected
- * with a message. Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
+ * is (1) probed for a LIVE native target and (2) direct-injected with a message.
+ * Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
  * /resolveAcpBackendAdapter): one interface, one registry, a fail-fast resolver.
  *
  * Purity contract (봉인 3):
@@ -23,6 +23,7 @@
 import { execFile } from "node:child_process";
 import * as os from "node:os";
 import * as path from "node:path";
+import { codexNativePushAdapter } from "./codex-ws-client.js";
 // The agy agentapi calls are bounded so a dead/stalled LS route cannot hang a dispatch
 // (raw-agy-send.sh used `timeout 8` — production had lost that; Q12 restores it). pgrep/ss
 // are fast local scans and stay unbounded.
@@ -120,6 +121,7 @@ export function createAntigravityAdapter(deps) {
     }
     return {
         id: "antigravity",
+        retriable: true,
         async probe(nativeSessionId) {
             let pids;
             try {
@@ -146,7 +148,7 @@ export function createAntigravityAdapter(deps) {
             for (const pid of pids) {
                 for (const lsAddress of portsByPid.get(pid) ?? []) {
                     if (await servesConversation(lsAddress, nativeSessionId)) {
-                        return { status: "alive", route: { lsAddress } };
+                        return { status: "alive", route: { backend: "antigravity", lsAddress } };
                     }
                 }
             }
@@ -159,22 +161,23 @@ export function createAntigravityAdapter(deps) {
             };
         },
         async send(route, nativeSessionId, content) {
+            if (route.backend !== "antigravity") {
+                throw new Error(`antigravity adapter received ${route.backend} route`);
+            }
             const r = await runner.exec([binary, "agentapi", "send-message", nativeSessionId, content], {
                 env: { ANTIGRAVITY_LS_ADDRESS: route.lsAddress },
                 timeoutMs: AGY_SEND_TIMEOUT_MS,
             });
-            // A non-zero code — including a timeout kill (124) on a stalled route — THROWS
-            // (fail-loud); the executor hand owns the 1-shot re-probe→re-send on that throw.
             if (r.code !== 0) {
                 throw new Error(`native-push send failed (agentapi send-message exit ${r.code}) via ${route.lsAddress}: ${r.stderr.trim() || "(no stderr)"}`);
             }
         },
     };
 }
-/** The production antigravity adapter (real runner + env-resolved binary). */
+/** Production adapters. */
 export const antigravityAdapter = createAntigravityAdapter({ runner: realNativePushRunner });
 // ── registry + fail-fast resolver (mirror resolveAcpBackendAdapter) ──────────
-const ADAPTERS = [antigravityAdapter];
+const ADAPTERS = [antigravityAdapter, codexNativePushAdapter];
 /**
  * Resolve the native-push adapter that owns backend `id`. Fail-fast, like
  * resolveAcpBackendAdapter: 0 matches → throw (unknown backend, no silent default);