@junghanacs/entwurf 0.20.1 → 0.22.0

package/mcp/entwurf-bridge/src/index.ts

@@ -65,11 +65,11 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-
+import { codexCallerFreshPreflight, codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.ts";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
-import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
+import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
 import { computeSelfAddressability, type MetaDeliveryDomain } from "../../../pi-extensions/lib/entwurf-self-address.ts";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.ts";
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.ts";
@@ -81,8 +81,12 @@ import {
 	visibleResume,
 } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.ts";
 import {
+	type CodexRequestSender,
 	probeNativeSenderAlive,
+	reconcileSenderIdentityClaims,
+	resolveCodexRequestSenderIdentity,
 	resolveTrustedMetaSenderIdentity,
+	type TrustedMetaSender,
 } from "../../../pi-extensions/lib/meta-sender-identity.ts";
 import {
 	applyOmpBridgeChildRootPolicy,
@@ -157,11 +161,11 @@ const server = new McpServer({ name: "entwurf-bridge", version: "0.1.0" });
 
 // Transparency envelope.
 //
-// Record-backed pi and trusted native-marker senders carry a structured envelope
-// so the receiver renders WHO (agentId, sessionId), FROM WHERE (cwd), and WHEN
-// (timestamp UTC, displayed in KST). `entwurf_self` is identity-required: pi's env
-// is a child carrier for the garden id established by record birth; a native sender
-// marker is accepted only through its backing record. Plain anonymous external hosts
+// Record-backed pi, pid-marker native senders, and request-scoped Codex senders carry a
+// structured envelope so the receiver renders WHO (agentId, sessionId), FROM WHERE (cwd), and
+// WHEN (timestamp UTC, displayed in KST). `entwurf_self` is identity-required: pi's env is a
+// child carrier for the garden id established by record birth; a native sender marker or Codex
+// request selector is accepted only through its backing record. Plain anonymous external hosts
 // fail. #50 C4: v2 delivery is identity-REQUIRED by default — "if we don't know
 // who sent it, we don't send it" holds on every install surface, not only where
 // an installer remembered to set a flag. The ONE documented escape hatch is
@@ -174,11 +178,11 @@ class EntwurfEnvelopeWiringError extends Error {
 	constructor(missing: string[]) {
 		super(
 			`entwurf sender envelope wiring incomplete — missing env: ${missing.join(", ")}, ` +
-				"and no trusted meta-sender marker was found. This MCP child should either inherit " +
-				"PI_SESSION_ID + PI_AGENT_ID (from an entwurf-control pi session), " +
-				"or run inside a garden-native meta-session whose own native hook wrote a live " +
-				"sender marker (Claude Code writes it from SessionStart, Antigravity from PreInvocation). " +
-				"entwurf_self is only callable when one of those authoritative identity paths is present.",
+				"and no record-backed native sender claim was found. This MCP child should inherit " +
+				"PI_SESSION_ID + PI_AGENT_ID from an entwurf-control pi session, carry a live sender marker " +
+				"written by its native hook, or be the managed Codex MCP child whose current tool request " +
+				"names a thread backed by a Codex citizen record. entwurf_self is callable only while one of " +
+				"those authoritative identity paths is present.",
 		);
 	}
 }
@@ -192,21 +196,19 @@ interface SenderEnvelope {
 	replyable?: boolean;
 }
 
-// #50 C4: anonymous sends are refused BY DEFAULT — a send with no pi-session
-// identity AND no trusted meta-sender marker does not go out as anonymous
-// external-mcp unless the operator explicitly wired the escape hatch.
+// #50 C4: anonymous sends are refused BY DEFAULT — a send with no pi-session identity,
+// trusted pid marker, or request-scoped Codex record does not go out as anonymous external-mcp
+// unless the operator explicitly wired the escape hatch.
 // "If we don't know who sent it, we don't send it."
 class EntwurfSenderIdentityError extends Error {
 	constructor() {
 		super(
 			"entwurf-bridge refused: no authoritative sender identity. Anonymous external sends are " +
-				"refused by default, and no pi-session env (PI_SESSION_ID + PI_AGENT_ID) or live meta-sender " +
-				"marker was found for this process. Each native backend writes that marker from its OWN hook, keyed " +
-				"by the native host's parent pid + start-time (Claude Code from SessionStart, Antigravity from " +
-				"PreInvocation) — open this session through the installed meta-bridge so your garden id is " +
-				"registered, then retry. A deliberately-anonymous external MCP host may set " +
-				"ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1 (explicit operator wiring; the send is then marked " +
-				"external/non-replyable).",
+				"refused by default, and this request has no complete pi-session env, live record-backed " +
+				"sender marker, or managed Codex thread selector backed by a Codex citizen record. Open the " +
+				"session through its installed birth/MCP integration, then retry. A deliberately-anonymous " +
+				"external MCP host may set ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1 (explicit operator wiring; " +
+				"the send is then marked external/non-replyable).",
 		);
 	}
 }
@@ -252,43 +254,26 @@ interface AuthoritativeSelf {
 	envelope: SenderEnvelope;
 	/** meta-session only: WHICH rail carries a reply back. Never inferred from `origin`. */
 	metaDeliveryDomain?: MetaDeliveryDomain;
+	/**
+	 * meta-session/codex ONLY: the `_meta.threadId` that named this caller on THIS request, and
+	 * which the reconciliation above already proved equal to the selected citizen's
+	 * `nativeSessionId`. It rides here for exactly one consumer — the fresh-call PLACEMENT,
+	 * which turns it into the caller's own tmux pane through its title (#95 lane B). It is not
+	 * an address, not a reply rail, and not part of the sender envelope: `sessionId` is the only
+	 * thing anyone may send to.
+	 */
+	codexThreadId?: string;
 }
 
-async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Promise<AuthoritativeSelf | null> {
-	// No pi-session identity. Try the meta-sender marker: a native backend that minted a
-	// garden-id from its own hook (Claude SessionStart / agy PreInvocation). The marker is
-	// keyed by the shared parent pid — this MCP child's process.ppid IS the native host the
-	// hook ran under (NOT cwd inference). A trusted marker promotes this process from
-	// anonymous external-mcp to a meta-session sender addressed by its garden-id.
-	const trusted = resolveTrustedMetaSenderIdentity({
-		markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
-	});
-	if (!trusted) return null;
-	const { marker, identity } = trusted;
-
-	// Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
-	// rail a reply would ride (보정①). THREE values, not a native-push-or-self-fetch binary:
-	//   native-push ← nativePushSupported(backend). NOT wakeMode: `direct-inject` also covers
-	//     codex/pi, which have no native-push adapter.
-	//   self-fetch  ← resolveMailboxWakeModeCapability (the decider's mailbox seam — one owner
-	//     with dispatch). A new hardcoded backend list would drift the moment the registry
-	//     admits another self-fetch citizen.
-	//   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
-	//     this as self-fetch printed a mailboxPath nothing drains.
-	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
-	//     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
-	//     uses, so a citizen's self-reported replyability can never disagree with what dispatch
-	//     decides about it. It reads the presence marker (a dead/reused owner already folds to
-	//     null) AND, where the watch owner is the sender-marker process, the #101 join that says
-	//     the owner is still serving THIS garden rather than one it switched away from.
-	//   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
-	//     live app-server conversation, so only an adapter probe can answer. Composing the
-	//     receiver atom here would demand `watchArmed` from a backend that never arms one, and
-	//     every agy citizen would report replyable:false forever.
-	// Either way an inactive/unreachable citizen STILL returns its identity (who-sent must
-	// survive; degrading to null would erase the sender) — only with replyable:false.
-	// The rail, named ONCE and reused for both the predicate and the caller's rendering —
-	// so entwurf_self can never re-derive it differently from what decided `replyable`.
+interface SenderRequestContext {
+	requestMeta?: unknown;
+}
+
+async function buildMetaSenderEnvelope(
+	identity: TrustedMetaSender["identity"],
+	cwd: string,
+	trustedMarker?: TrustedMetaSender,
+): Promise<AuthoritativeSelf> {
 	const metaDeliveryDomain: MetaDeliveryDomain = nativePushSupported(identity.backend)
 		? "native-push"
 		: resolveMailboxWakeModeCapability(identity)
@@ -304,6 +289,11 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 				}
 			: metaDeliveryDomain === "self-fetch"
 				? (() => {
+						if (!trustedMarker) {
+							throw new Error(
+								`entwurf-bridge: ${identity.backend} resolved as self-fetch without the sender marker its receiver join requires`,
+							);
+						}
 						const receiver = resolveMailboxReceiverFacts(identity, {
 							readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId }),
 							readSenderMarker: (backend: string, ownerPid: number) =>
@@ -323,12 +313,11 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 						recordBacked: true,
 					};
 	const self = computeSelfAddressability(facts);
-
 	return {
 		envelope: {
 			sessionId: identity.gardenId,
 			agentId: `meta-session/${identity.backend}`,
-			cwd: marker.cwd || cwd,
+			cwd,
 			timestamp: new Date().toISOString(),
 			origin: "meta-session",
 			replyable: self.replyable,
@@ -337,17 +326,44 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 	};
 }
 
-// async only for the native-push branch's adapter probe: a pi sender and a claude-code
-// sender still resolve from files alone, so their cost is unchanged.
-async function buildAuthoritativeSelfEnvelope(): Promise<AuthoritativeSelf> {
+async function resolveAuthoritativeSender(
+	context: SenderRequestContext,
+	cwd: string = process.cwd(),
+): Promise<AuthoritativeSelf | null> {
 	const sessionId = process.env.PI_SESSION_ID?.trim();
 	const agentId = process.env.PI_AGENT_ID?.trim();
-	const cwd = process.cwd();
-	if (sessionId && agentId && cwd) return { envelope: buildStrictPiSenderEnvelope() };
-
-	const meta = await buildTrustedMetaSenderEnvelope(cwd);
-	if (meta) return meta;
+	const pi = sessionId && agentId && cwd ? buildStrictPiSenderEnvelope() : null;
+	const marker = resolveTrustedMetaSenderIdentity({
+		markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
+	});
+	const codex: CodexRequestSender | null = resolveCodexRequestSenderIdentity({
+		provenance: process.env.ENTWURF_BRIDGE_NATIVE_HOST,
+		clientInfo: server.server.getClientVersion(),
+		requestMeta: context.requestMeta,
+	});
+	const selected = reconcileSenderIdentityClaims([
+		...(pi ? [{ rail: "pi-session" as const, id: pi.sessionId }] : []),
+		...(marker ? [{ rail: "meta-sender-marker" as const, id: marker.identity.gardenId }] : []),
+		...(codex ? [{ rail: "codex-request" as const, id: codex.identity.gardenId }] : []),
+	]);
+	if (!selected) return null;
+	if (codex && codex.identity.gardenId === selected.id) {
+		return { ...(await buildMetaSenderEnvelope(codex.identity, codex.identity.cwd)), codexThreadId: codex.threadId };
+	}
+	if (marker && marker.identity.gardenId === selected.id) {
+		return buildMetaSenderEnvelope(marker.identity, marker.marker.cwd || cwd, marker);
+	}
+	if (pi && pi.sessionId === selected.id) return { envelope: pi };
+	throw new Error(`entwurf-bridge: reconciled sender ${selected.id} has no matching identity source`);
+}
 
+// Async only when the selected sender rides native-push: replyability is the adapter's live fact.
+async function buildAuthoritativeSelfEnvelope(context: SenderRequestContext = {}): Promise<AuthoritativeSelf> {
+	const resolved = await resolveAuthoritativeSender(context);
+	if (resolved) return resolved;
+	const sessionId = process.env.PI_SESSION_ID?.trim();
+	const agentId = process.env.PI_AGENT_ID?.trim();
+	const cwd = process.cwd();
 	const missing: string[] = [];
 	if (!sessionId) missing.push("PI_SESSION_ID");
 	if (!agentId) missing.push("PI_AGENT_ID");
@@ -355,18 +371,10 @@ async function buildAuthoritativeSelfEnvelope(): Promise<AuthoritativeSelf> {
 	throw new EntwurfEnvelopeWiringError(missing);
 }
 
-async function buildSendSenderEnvelope(): Promise<SenderEnvelope> {
-	const sessionId = process.env.PI_SESSION_ID?.trim();
-	const agentId = process.env.PI_AGENT_ID?.trim();
+async function buildSendSenderEnvelope(context: SenderRequestContext = {}): Promise<SenderEnvelope> {
+	const resolved = await resolveAuthoritativeSender(context);
+	if (resolved) return resolved.envelope;
 	const cwd = process.cwd();
-	if (sessionId && agentId && cwd) return buildStrictPiSenderEnvelope();
-
-	const meta = await buildTrustedMetaSenderEnvelope(cwd);
-	// Delivery takes the WIRE envelope only — the rail axis is rendering-local.
-	if (meta) return meta.envelope;
-
-	// No marker. #50 C4: anonymous external is refused UNLESS the operator wired the
-	// explicit escape hatch — identity-required is the default, not an install flag.
 	if (process.env.ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER !== "1") {
 		throw new EntwurfSenderIdentityError();
 	}
@@ -421,12 +429,11 @@ server.tool(
 		"outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
 		"entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
 		"citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
-		'"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
-		"gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
-		"all. THERE IS A THIRD RESULT: the mailbox delivers only to a DELIVERABLE citizen, so a terminated " +
-		"session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
-		"inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
-		"native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
+		'"no control-socket probe." The decider resolves the actual rail at dispatch time: a self-fetch ' +
+		"mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, " +
+		"or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; " +
+		"native-push has NO mailbox: dead → native-push-target-dead; indeterminate → " +
+		"native-push-probe-indeterminate. " +
 		"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
 		"— same receiver rule as the mailbox, no active drainer means no delivery. " +
 		"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
@@ -466,11 +473,11 @@ server.tool(
 			),
 		wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
 	},
-	async ({ target, intent, message, mode, wants_reply }) => {
+	async ({ target, intent, message, mode, wants_reply }, extra) => {
 		try {
 			// Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
 			// + the mailbox body sender share one envelope. No replyability gate (see above).
-			const sender = await buildSendSenderEnvelope();
+			const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
 			const rendered = await runAndRenderEntwurfV2FromSurface(
 				{ target, intent, message, mode, wants_reply },
 				// No trust-preflight inputs are passed, and none exist to pass: the preflight on this
@@ -493,17 +500,16 @@ server.tool(
 		"degrading it to nothing would erase who-sent. Use to confirm WHO you " +
 		"are (agentId, sessionId), FROM WHERE (cwd), and WHEN this snapshot was taken. " +
 		"Works for pi sessions (PI_SESSION_ID / PI_AGENT_ID) and for garden-native meta-sessions, whose " +
-		"garden id comes from a trusted sender marker their OWN native hook wrote (Claude Code from " +
-		"SessionStart, Antigravity from PreInvocation). For a meta-session it also reports WHICH rail a " +
-		"reply rides, because that differs by backend: a self-fetch citizen (Claude Code) has a drainable " +
-		"mailbox and its path is shown, while a native-push citizen (Antigravity) has NO mailbox at all — " +
-		"a reply is injected straight into its live conversation. Do not expect a mailbox just because " +
-		"origin is meta-session. Throws for plain anonymous external MCP hosts because they have no " +
-		"authoritative reply address.",
+		"garden id comes from the matching record plus either a trusted native process marker or Codex's " +
+		"request-scoped thread selector. For a meta-session it also reports WHICH rail a reply rides, " +
+		"because that differs by backend: a self-fetch citizen has a drainable mailbox, while a " +
+		"native-push citizen has NO mailbox at all — a reply is injected straight into its live native " +
+		"conversation/thread. Do not expect a mailbox just because origin is meta-session. Throws for " +
+		"plain anonymous external MCP hosts because they have no authoritative reply address.",
 	{},
-	async () => {
+	async (_args, request) => {
 		try {
-			const self = await buildAuthoritativeSelfEnvelope();
+			const self = await buildAuthoritativeSelfEnvelope({ requestMeta: request._meta });
 			const sender = self.envelope;
 			const kst = formatKstTimestamp(sender.timestamp);
 			const extra: Record<string, string> = {};
@@ -598,6 +604,9 @@ server.tool(
 				readRecord: makeStoreRecordReader(sessionsDir),
 				// Socket axis: the same dir dispatch uses (grammar SSOT), scan-internal only.
 				socket: { dir: ENTWURF_DIR },
+				// #112: observe only rows this human surface can render. Full store facts,
+				// diagnostics, liveness, and machine payload remain intact.
+				observationLimit: ENTWURF_PEERS_RENDER_LIMIT,
 			});
 			const { text } = renderEntwurfPeers(result);
 			return textOk(text);
@@ -707,30 +716,30 @@ server.tool(
 // against that answer would call home to a garden id nobody holds.
 server.tool(
 	"entwurf_fresh_call",
-	"Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed " +
-		"backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+	"Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Five fixed " +
+		"backends only: pi, claude-code, copilot, omp, codex. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
 		"sender envelope of that callback is its garden id — that is how you learn the address of something that " +
 		"did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
 		"else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
-		"for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
+		"for the callback; if it never arrives the window is visible. For EXISTING " +
 		"citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
 		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-		"or `auto` for copilot; a fuzzy model pattern for omp). A copilot launch goes through entwurf's own managed " +
-		"invocation and is refused BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or " +
-		"visible-footer units; an omp launch is refused the same way if this host lacks the OMP birth, MCP, receiver or " +
-		"visible-status units, or if omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the " +
-		"prompt, so the sibling could not call you back at all). An optional " +
+		"or `auto` for copilot; a fuzzy model pattern for omp or codex). Copilot, omp, and codex are refused BEFORE " +
+		"any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent; " +
+		"Codex also requires the operator-owned default app-server socket, which entwurf never starts. An optional " +
 		"cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
-		"for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
-		"An optional placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an " +
-		"absent SESSION is tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. " +
+		"for a dormant record's cwd. Omitted/empty cwd means the caller's own directory. " +
+		"An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own " +
+		"tmux server, and it ALWAYS wins. Omitted, the seat follows the CALLER: a CODEX CALLER opens beside its own " +
+		"TUI pane (matched by thread-id in that pane's title; 0 or 2+ matches REFUSE, never fall back), and every " +
+		"other caller opens in its own session. " +
+		"A missing named session is tmux-session-missing and NOTHING is created. " +
 		"There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
-		"same-user processes on this host. Requires that this agent itself runs " +
-		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
+		"same-user processes on this host. Requires that this agent itself runs inside tmux.",
 	{
 		backend: z
-			.enum(["pi", "claude-code", "copilot", "omp"])
-			.describe("Which fixed runtime to open. Only these four; there is no arbitrary command."),
+			.enum(["pi", "claude-code", "copilot", "omp", "codex"])
+			.describe("Which fixed runtime to open. Only these five; there is no arbitrary command."),
 		model: z
 			.string()
 			.min(1)
@@ -745,7 +754,7 @@ server.tool(
 			// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
 			.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
 			.describe(
-				"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto).",
+				"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.",
 			),
 		task: z
 			.string()
@@ -758,7 +767,7 @@ server.tool(
 			.string()
 			.optional()
 			.describe(
-				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
+				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). Omit or pass \"\" to start where the CALLER is: its own directory, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed.",
 			),
 		placement: z
 			.object({
@@ -770,14 +779,28 @@ server.tool(
 			})
 			.optional()
 			.describe(
-				"Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id.",
+				"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id.",
 			),
 	},
-	async ({ backend, model, task, cwd, placement }) => {
+	async ({ backend, model, task, cwd, placement }, extra) => {
 		let callerGardenId: string | null = null;
+		// Present exactly when the reconciled caller is a record-backed codex citizen. Its ONLY
+		// consumer is the placement below: a Codex caller with no explicit seat opens its sibling
+		// beside its own TUI pane, found by that thread's terminal title (#95 lane B).
+		let callerNativeSessionId: string | undefined;
+		// The SAME citizen's record cwd, set under the SAME condition and carrying no further
+		// authority: `envelope.cwd` is only the record's directory when the selected sender is
+		// that codex citizen, so the two are derived from one fact rather than read separately.
+		// It exists because `process.cwd()` here is the operator-owned APP-SERVER's directory —
+		// this bridge is its MCP child — so a codex caller that names no cwd would otherwise open
+		// every sibling in the app-server's repo (#95 lane C §1). The composition consults it only
+		// when the tool call requested no cwd of its own.
+		let callerCwd: string | undefined;
 		try {
-			const self = await buildAuthoritativeSelfEnvelope();
+			const self = await buildAuthoritativeSelfEnvelope({ requestMeta: extra._meta });
 			callerGardenId = self.envelope.sessionId;
+			callerNativeSessionId = self.codexThreadId;
+			callerCwd = self.codexThreadId === undefined ? undefined : self.envelope.cwd;
 		} catch (err) {
 			// ONE error is a legitimate answer here: this host has no authoritative identity at all
 			// (no pi carrier inherited, no trusted marker written), so the sibling would have nowhere
@@ -790,7 +813,22 @@ server.tool(
 			callerGardenId = null;
 		}
 		try {
-			const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, placement, callerGardenId }));
+			// TWO capability axes, in this order, both pre-mutation and neither standing in for
+			// the other. The TARGET axis first — "entwurf cannot open a Codex sibling here at
+			// all" is the more fundamental answer than "and it would not know where to put it".
+			// The CALLER axis second, and only when the seat anchor will actually be consulted:
+			// a codex caller that named an explicit placement never reads a pane title, so
+			// refusing it for a missing `thread-id` would refuse an unused capability.
+			const targetMissing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
+			const callerMissing =
+				targetMissing === null && callerNativeSessionId !== undefined && placement === undefined
+					? codexCallerFreshPreflight(process.env)
+					: null;
+			const missing = targetMissing ?? callerMissing;
+			const result = missing
+				? ({ ok: false, reason: missing } as const)
+				: freshCall({ backend, model, task, cwd, placement, callerGardenId, callerNativeSessionId, callerCwd });
+			const rendered = renderFreshCall(result);
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
 		} catch (err) {
 			return textErr(`entwurf_fresh_call error: ${err instanceof Error ? err.message : String(err)}`);

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -114,6 +114,14 @@
 	// the marker-less native-push quiesce row) are lib leaves the bridge graph already
 	// tolerates — the adapter is a 봉인-3 leaf (node builtins + type-only contract), and
 	// register_native already pulls both into this emit.
+	// WHY codex-socket-path rides THIS build (#95): `entwurf codex-app-server` is a bash
+	// launcher that cannot import the socket resolver, and its first version re-derived the
+	// address instead — measurably diverging from `resolveCodexDefaultSocketPath` on a BOM-only
+	// CODEX_HOME and on path normalization. The launcher now ASKS this leaf through run_ts, so on
+	// an installed host it resolves under node_modules where strip-types is refused and a missing
+	// twin would make the one-command launch die before its first line. Its only repo import is
+	// native-push/codex-ws-client.ts, ALREADY emitted for meta-bridge-hook-codex, so this adds ONE
+	// leaf JS and ZERO new deps.
 	// WHY meta-bridge-omp rides THIS build (#87): `install-omp-bridge` explicitly SELECTS
 	// `dist/pi-extensions/meta-bridge-omp.js` when REPO_DIR is under node_modules — the same
 	// strip-types fence the Claude and Copilot birth entries cross — and
@@ -135,8 +143,10 @@
 		"../../scripts/meta-bridge-fresh-cut.ts",
 		"../../scripts/meta-facts.ts",
 		"../../scripts/omp-receive-facts.ts",
+		"../../scripts/codex-socket-path.ts",
 		"../../pi-extensions/meta-bridge-hook.ts",
 		"../../pi-extensions/meta-bridge-hook-copilot.ts",
+		"../../pi-extensions/meta-bridge-hook-codex.ts",
 		"../../pi-extensions/meta-bridge-omp.ts",
 		"../../pi-extensions/meta-bridge-receive-omp.ts"
 	]

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.20.1",
-	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, and Antigravity; Claude and Snowflake Cortex Code ACP backends. Codex has verified delivery-probe evidence, not a managed native-citizen lane.",
+	"version": "0.22.0",
+	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
 		"name": "Junghan Kim",
@@ -86,6 +86,7 @@
 		"@agentclientprotocol/sdk": "1.4.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
+		"smol-toml": "^1.8.0",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
@@ -142,6 +143,14 @@
 		"smoke-omp-fresh-live": "./run.sh smoke-omp-fresh-live",
 		"check-omp-receive-arm": "./run.sh check-omp-receive-arm",
 		"check-omp-fresh-preflight": "./run.sh check-omp-fresh-preflight",
+		"check-codex-sender-identity": "./run.sh check-codex-sender-identity",
+		"check-codex-native-push": "./run.sh check-codex-native-push",
+		"check-codex-bridge-identity": "./run.sh check-codex-bridge-identity",
+		"check-codex-birth-hook": "./run.sh check-codex-birth-hook",
+		"check-codex-fresh-preflight": "./run.sh check-codex-fresh-preflight",
+		"smoke-codex-birth": "./run.sh smoke-codex-birth",
+		"smoke-codex-config-state": "./run.sh smoke-codex-config-state",
+		"smoke-codex-fresh-live": "./run.sh smoke-codex-fresh-live",
 		"check-hook-launch-topology": "./run.sh check-hook-launch-topology",
 		"check-meta-hook-session-switch": "./run.sh check-meta-hook-session-switch",
 		"check-acp-carrier-augment": "./run.sh check-acp-carrier-augment",
@@ -165,8 +174,8 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
-		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {