@junghanacs/entwurf 0.20.1 → 0.22.0

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -64,16 +64,17 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { codexCallerFreshPreflight, codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.js";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
-import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
+import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
-import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
+import { probeNativeSenderAlive, reconcileSenderIdentityClaims, resolveCodexRequestSenderIdentity, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
 import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
@@ -128,11 +129,11 @@ function textErr(msg) {
 const server = new McpServer({ name: "entwurf-bridge", version: "0.1.0" });
 // Transparency envelope.
 //
-// Record-backed pi and trusted native-marker senders carry a structured envelope
-// so the receiver renders WHO (agentId, sessionId), FROM WHERE (cwd), and WHEN
-// (timestamp UTC, displayed in KST). `entwurf_self` is identity-required: pi's env
-// is a child carrier for the garden id established by record birth; a native sender
-// marker is accepted only through its backing record. Plain anonymous external hosts
+// Record-backed pi, pid-marker native senders, and request-scoped Codex senders carry a
+// structured envelope so the receiver renders WHO (agentId, sessionId), FROM WHERE (cwd), and
+// WHEN (timestamp UTC, displayed in KST). `entwurf_self` is identity-required: pi's env is a
+// child carrier for the garden id established by record birth; a native sender marker or Codex
+// request selector is accepted only through its backing record. Plain anonymous external hosts
 // fail. #50 C4: v2 delivery is identity-REQUIRED by default — "if we don't know
 // who sent it, we don't send it" holds on every install surface, not only where
 // an installer remembered to set a flag. The ONE documented escape hatch is
@@ -144,27 +145,25 @@ const server = new McpServer({ name: "entwurf-bridge", version: "0.1.0" });
 class EntwurfEnvelopeWiringError extends Error {
     constructor(missing) {
         super(`entwurf sender envelope wiring incomplete — missing env: ${missing.join(", ")}, ` +
-            "and no trusted meta-sender marker was found. This MCP child should either inherit " +
-            "PI_SESSION_ID + PI_AGENT_ID (from an entwurf-control pi session), " +
-            "or run inside a garden-native meta-session whose own native hook wrote a live " +
-            "sender marker (Claude Code writes it from SessionStart, Antigravity from PreInvocation). " +
-            "entwurf_self is only callable when one of those authoritative identity paths is present.");
+            "and no record-backed native sender claim was found. This MCP child should inherit " +
+            "PI_SESSION_ID + PI_AGENT_ID from an entwurf-control pi session, carry a live sender marker " +
+            "written by its native hook, or be the managed Codex MCP child whose current tool request " +
+            "names a thread backed by a Codex citizen record. entwurf_self is callable only while one of " +
+            "those authoritative identity paths is present.");
     }
 }
-// #50 C4: anonymous sends are refused BY DEFAULT — a send with no pi-session
-// identity AND no trusted meta-sender marker does not go out as anonymous
-// external-mcp unless the operator explicitly wired the escape hatch.
+// #50 C4: anonymous sends are refused BY DEFAULT — a send with no pi-session identity,
+// trusted pid marker, or request-scoped Codex record does not go out as anonymous external-mcp
+// unless the operator explicitly wired the escape hatch.
 // "If we don't know who sent it, we don't send it."
 class EntwurfSenderIdentityError extends Error {
     constructor() {
         super("entwurf-bridge refused: no authoritative sender identity. Anonymous external sends are " +
-            "refused by default, and no pi-session env (PI_SESSION_ID + PI_AGENT_ID) or live meta-sender " +
-            "marker was found for this process. Each native backend writes that marker from its OWN hook, keyed " +
-            "by the native host's parent pid + start-time (Claude Code from SessionStart, Antigravity from " +
-            "PreInvocation) — open this session through the installed meta-bridge so your garden id is " +
-            "registered, then retry. A deliberately-anonymous external MCP host may set " +
-            "ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1 (explicit operator wiring; the send is then marked " +
-            "external/non-replyable).");
+            "refused by default, and this request has no complete pi-session env, live record-backed " +
+            "sender marker, or managed Codex thread selector backed by a Codex citizen record. Open the " +
+            "session through its installed birth/MCP integration, then retry. A deliberately-anonymous " +
+            "external MCP host may set ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER=1 (explicit operator wiring; " +
+            "the send is then marked external/non-replyable).");
     }
 }
 function buildStrictPiSenderEnvelope() {
@@ -203,41 +202,7 @@ function buildStrictPiSenderEnvelope() {
         replyable: self.replyable,
     };
 }
-async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
-    // No pi-session identity. Try the meta-sender marker: a native backend that minted a
-    // garden-id from its own hook (Claude SessionStart / agy PreInvocation). The marker is
-    // keyed by the shared parent pid — this MCP child's process.ppid IS the native host the
-    // hook ran under (NOT cwd inference). A trusted marker promotes this process from
-    // anonymous external-mcp to a meta-session sender addressed by its garden-id.
-    const trusted = resolveTrustedMetaSenderIdentity({
-        markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
-    });
-    if (!trusted)
-        return null;
-    const { marker, identity } = trusted;
-    // Identity is trusted — but `replyable` is a SEPARATE fact, and WHICH fact depends on the
-    // rail a reply would ride (보정①). THREE values, not a native-push-or-self-fetch binary:
-    //   native-push ← nativePushSupported(backend). NOT wakeMode: `direct-inject` also covers
-    //     codex/pi, which have no native-push adapter.
-    //   self-fetch  ← resolveMailboxWakeModeCapability (the decider's mailbox seam — one owner
-    //     with dispatch). A new hardcoded backend list would drift the moment the registry
-    //     admits another self-fetch citizen.
-    //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
-    //     this as self-fetch printed a mailboxPath nothing drains.
-    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
-    //     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
-    //     uses, so a citizen's self-reported replyability can never disagree with what dispatch
-    //     decides about it. It reads the presence marker (a dead/reused owner already folds to
-    //     null) AND, where the watch owner is the sender-marker process, the #101 join that says
-    //     the owner is still serving THIS garden rather than one it switched away from.
-    //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
-    //     live app-server conversation, so only an adapter probe can answer. Composing the
-    //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
-    //     every agy citizen would report replyable:false forever.
-    // Either way an inactive/unreachable citizen STILL returns its identity (who-sent must
-    // survive; degrading to null would erase the sender) — only with replyable:false.
-    // The rail, named ONCE and reused for both the predicate and the caller's rendering —
-    // so entwurf_self can never re-derive it differently from what decided `replyable`.
+async function buildMetaSenderEnvelope(identity, cwd, trustedMarker) {
     const metaDeliveryDomain = nativePushSupported(identity.backend)
         ? "native-push"
         : resolveMailboxWakeModeCapability(identity)
@@ -252,6 +217,9 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         }
         : metaDeliveryDomain === "self-fetch"
             ? (() => {
+                if (!trustedMarker) {
+                    throw new Error(`entwurf-bridge: ${identity.backend} resolved as self-fetch without the sender marker its receiver join requires`);
+                }
                 const receiver = resolveMailboxReceiverFacts(identity, {
                     readReceiverMarker: (gardenId) => readMetaReceiverMarker({ gardenId }),
                     readSenderMarker: (backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
@@ -274,7 +242,7 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         envelope: {
             sessionId: identity.gardenId,
             agentId: `meta-session/${identity.backend}`,
-            cwd: marker.cwd || cwd,
+            cwd,
             timestamp: new Date().toISOString(),
             origin: "meta-session",
             replyable: self.replyable,
@@ -282,17 +250,43 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         metaDeliveryDomain,
     };
 }
-// async only for the native-push branch's adapter probe: a pi sender and a claude-code
-// sender still resolve from files alone, so their cost is unchanged.
-async function buildAuthoritativeSelfEnvelope() {
+async function resolveAuthoritativeSender(context, cwd = process.cwd()) {
+    const sessionId = process.env.PI_SESSION_ID?.trim();
+    const agentId = process.env.PI_AGENT_ID?.trim();
+    const pi = sessionId && agentId && cwd ? buildStrictPiSenderEnvelope() : null;
+    const marker = resolveTrustedMetaSenderIdentity({
+        markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
+    });
+    const codex = resolveCodexRequestSenderIdentity({
+        provenance: process.env.ENTWURF_BRIDGE_NATIVE_HOST,
+        clientInfo: server.server.getClientVersion(),
+        requestMeta: context.requestMeta,
+    });
+    const selected = reconcileSenderIdentityClaims([
+        ...(pi ? [{ rail: "pi-session", id: pi.sessionId }] : []),
+        ...(marker ? [{ rail: "meta-sender-marker", id: marker.identity.gardenId }] : []),
+        ...(codex ? [{ rail: "codex-request", id: codex.identity.gardenId }] : []),
+    ]);
+    if (!selected)
+        return null;
+    if (codex && codex.identity.gardenId === selected.id) {
+        return { ...(await buildMetaSenderEnvelope(codex.identity, codex.identity.cwd)), codexThreadId: codex.threadId };
+    }
+    if (marker && marker.identity.gardenId === selected.id) {
+        return buildMetaSenderEnvelope(marker.identity, marker.marker.cwd || cwd, marker);
+    }
+    if (pi && pi.sessionId === selected.id)
+        return { envelope: pi };
+    throw new Error(`entwurf-bridge: reconciled sender ${selected.id} has no matching identity source`);
+}
+// Async only when the selected sender rides native-push: replyability is the adapter's live fact.
+async function buildAuthoritativeSelfEnvelope(context = {}) {
+    const resolved = await resolveAuthoritativeSender(context);
+    if (resolved)
+        return resolved;
     const sessionId = process.env.PI_SESSION_ID?.trim();
     const agentId = process.env.PI_AGENT_ID?.trim();
     const cwd = process.cwd();
-    if (sessionId && agentId && cwd)
-        return { envelope: buildStrictPiSenderEnvelope() };
-    const meta = await buildTrustedMetaSenderEnvelope(cwd);
-    if (meta)
-        return meta;
     const missing = [];
     if (!sessionId)
         missing.push("PI_SESSION_ID");
@@ -302,18 +296,11 @@ async function buildAuthoritativeSelfEnvelope() {
         missing.push("cwd");
     throw new EntwurfEnvelopeWiringError(missing);
 }
-async function buildSendSenderEnvelope() {
-    const sessionId = process.env.PI_SESSION_ID?.trim();
-    const agentId = process.env.PI_AGENT_ID?.trim();
+async function buildSendSenderEnvelope(context = {}) {
+    const resolved = await resolveAuthoritativeSender(context);
+    if (resolved)
+        return resolved.envelope;
     const cwd = process.cwd();
-    if (sessionId && agentId && cwd)
-        return buildStrictPiSenderEnvelope();
-    const meta = await buildTrustedMetaSenderEnvelope(cwd);
-    // Delivery takes the WIRE envelope only — the rail axis is rendering-local.
-    if (meta)
-        return meta.envelope;
-    // No marker. #50 C4: anonymous external is refused UNLESS the operator wired the
-    // explicit escape hatch — identity-required is the default, not an install flag.
     if (process.env.ENTWURF_BRIDGE_ALLOW_ANONYMOUS_SENDER !== "1") {
         throw new EntwurfSenderIdentityError();
     }
@@ -365,12 +352,11 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     "outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
     "entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
     "citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
-    '"no control-socket probe" — and the decider picks its own rail: a self-fetch backend (e.g. Claude Code) ' +
-    "gets the mailbox, a native-push backend (e.g. Antigravity) gets direct injection and has NO mailbox at " +
-    "all. THERE IS A THIRD RESULT: the mailbox delivers only to a DELIVERABLE citizen, so a terminated " +
-    "session, or a backend with no adapter here (e.g. codex), is mailbox-undeliverable, not queued for an " +
-    "inbox nobody drains. The native-push probe is 3-valued: alive → injected; dead → " +
-    "native-push-target-dead; indeterminate → native-push-probe-indeterminate (unestablished ≠ gone). " +
+    '"no control-socket probe." The decider resolves the actual rail at dispatch time: a self-fetch ' +
+    "mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, " +
+    "or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; " +
+    "native-push has NO mailbox: dead → native-push-target-dead; indeterminate → " +
+    "native-push-probe-indeterminate. " +
     "DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
     "— same receiver rule as the mailbox, no active drainer means no delivery. " +
     "The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
@@ -402,11 +388,11 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         "follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
         "effect on those rails."),
     wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
-}, async ({ target, intent, message, mode, wants_reply }) => {
+}, async ({ target, intent, message, mode, wants_reply }, extra) => {
     try {
         // Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
         // + the mailbox body sender share one envelope. No replyability gate (see above).
-        const sender = await buildSendSenderEnvelope();
+        const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
         const rendered = await runAndRenderEntwurfV2FromSurface({ target, intent, message, mode, wants_reply }, 
         // No trust-preflight inputs are passed, and none exist to pass: the preflight on this
         // path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
@@ -424,15 +410,14 @@ server.tool("entwurf_self", "Return this caller's authoritative identity envelop
     "degrading it to nothing would erase who-sent. Use to confirm WHO you " +
     "are (agentId, sessionId), FROM WHERE (cwd), and WHEN this snapshot was taken. " +
     "Works for pi sessions (PI_SESSION_ID / PI_AGENT_ID) and for garden-native meta-sessions, whose " +
-    "garden id comes from a trusted sender marker their OWN native hook wrote (Claude Code from " +
-    "SessionStart, Antigravity from PreInvocation). For a meta-session it also reports WHICH rail a " +
-    "reply rides, because that differs by backend: a self-fetch citizen (Claude Code) has a drainable " +
-    "mailbox and its path is shown, while a native-push citizen (Antigravity) has NO mailbox at all — " +
-    "a reply is injected straight into its live conversation. Do not expect a mailbox just because " +
-    "origin is meta-session. Throws for plain anonymous external MCP hosts because they have no " +
-    "authoritative reply address.", {}, async () => {
+    "garden id comes from the matching record plus either a trusted native process marker or Codex's " +
+    "request-scoped thread selector. For a meta-session it also reports WHICH rail a reply rides, " +
+    "because that differs by backend: a self-fetch citizen has a drainable mailbox, while a " +
+    "native-push citizen has NO mailbox at all — a reply is injected straight into its live native " +
+    "conversation/thread. Do not expect a mailbox just because origin is meta-session. Throws for " +
+    "plain anonymous external MCP hosts because they have no authoritative reply address.", {}, async (_args, request) => {
     try {
-        const self = await buildAuthoritativeSelfEnvelope();
+        const self = await buildAuthoritativeSelfEnvelope({ requestMeta: request._meta });
         const sender = self.envelope;
         const kst = formatKstTimestamp(sender.timestamp);
         const extra = {};
@@ -522,6 +507,9 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
             readRecord: makeStoreRecordReader(sessionsDir),
             // Socket axis: the same dir dispatch uses (grammar SSOT), scan-internal only.
             socket: { dir: ENTWURF_DIR },
+            // #112: observe only rows this human surface can render. Full store facts,
+            // diagnostics, liveness, and machine payload remain intact.
+            observationLimit: ENTWURF_PEERS_RENDER_LIMIT,
         });
         const { text } = renderEntwurfPeers(result);
         return textOk(text);
@@ -610,29 +598,29 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 // its own garden id, a fresh cell answered with its uuidv7 `PI_SESSION_ID` value read out of the
 // environment by an MCP server it had spawned itself — confidently, and wrong. A sibling launched
 // against that answer would call home to a garden id nobody holds.
-server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Four fixed " +
-    "backends only: pi, claude-code, copilot, omp. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
+server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operator's tmux and hand it a first task. Five fixed " +
+    "backends only: pi, claude-code, copilot, omp, codex. The sibling's FIRST action is a callback to you carrying a nonce, and the " +
     "sender envelope of that callback is its garden id — that is how you learn the address of something that " +
     "did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
     "else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
-    "for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
+    "for the callback; if it never arrives the window is visible. For EXISTING " +
     "citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
     "is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
-    "or `auto` for copilot; a fuzzy model pattern for omp). A copilot launch goes through entwurf's own managed " +
-    "invocation and is refused BEFORE any window opens if this host lacks the Copilot birth, MCP, receiver or " +
-    "visible-footer units; an omp launch is refused the same way if this host lacks the OMP birth, MCP, receiver or " +
-    "visible-status units, or if omp's tools.xdev is not false (the vendor default hides MCP tool schemas from the " +
-    "prompt, so the sibling could not call you back at all). An optional " +
+    "or `auto` for copilot; a fuzzy model pattern for omp or codex). Copilot, omp, and codex are refused BEFORE " +
+    "any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent; " +
+    "Codex also requires the operator-owned default app-server socket, which entwurf never starts. An optional " +
     "cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
-    "for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
-    "An optional placement.tmuxSession opens it in ONE EXISTING session of this agent's own tmux server; an " +
-    "absent SESSION is tmux-session-missing and NOTHING is created. Omit placement for the caller's own session. " +
+    "for a dormant record's cwd. Omitted/empty cwd means the caller's own directory. " +
+    "An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own " +
+    "tmux server, and it ALWAYS wins. Omitted, the seat follows the CALLER: a CODEX CALLER opens beside its own " +
+    "TUI pane (matched by thread-id in that pane's title; 0 or 2+ matches REFUSE, never fall back), and every " +
+    "other caller opens in its own session. " +
+    "A missing named session is tmux-session-missing and NOTHING is created. " +
     "There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
-    "same-user processes on this host. Requires that this agent itself runs " +
-    "inside tmux: without a pane anchor there is no session to open a sibling beside.", {
+    "same-user processes on this host. Requires that this agent itself runs inside tmux.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot", "omp"])
-        .describe("Which fixed runtime to open. Only these four; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp", "codex"])
+        .describe("Which fixed runtime to open. Only these five; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -646,7 +634,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         // as an unused suppression while the escape goes back to being fixable.
         // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot model name (or auto)."),
+        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
     task: z
         .string()
         .min(1)
@@ -655,7 +643,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
     cwd: z
         .string()
         .optional()
-        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation."),
+        .describe("Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). Omit or pass \"\" to start where the CALLER is: its own directory, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed."),
     placement: z
         .object({
         tmuxSession: z
@@ -663,12 +651,26 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
             .describe("EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid."),
     })
         .optional()
-        .describe("Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id."),
-}, async ({ backend, model, task, cwd, placement }) => {
+        .describe("Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id."),
+}, async ({ backend, model, task, cwd, placement }, extra) => {
     let callerGardenId = null;
+    // Present exactly when the reconciled caller is a record-backed codex citizen. Its ONLY
+    // consumer is the placement below: a Codex caller with no explicit seat opens its sibling
+    // beside its own TUI pane, found by that thread's terminal title (#95 lane B).
+    let callerNativeSessionId;
+    // The SAME citizen's record cwd, set under the SAME condition and carrying no further
+    // authority: `envelope.cwd` is only the record's directory when the selected sender is
+    // that codex citizen, so the two are derived from one fact rather than read separately.
+    // It exists because `process.cwd()` here is the operator-owned APP-SERVER's directory —
+    // this bridge is its MCP child — so a codex caller that names no cwd would otherwise open
+    // every sibling in the app-server's repo (#95 lane C §1). The composition consults it only
+    // when the tool call requested no cwd of its own.
+    let callerCwd;
     try {
-        const self = await buildAuthoritativeSelfEnvelope();
+        const self = await buildAuthoritativeSelfEnvelope({ requestMeta: extra._meta });
         callerGardenId = self.envelope.sessionId;
+        callerNativeSessionId = self.codexThreadId;
+        callerCwd = self.codexThreadId === undefined ? undefined : self.envelope.cwd;
     }
     catch (err) {
         // ONE error is a legitimate answer here: this host has no authoritative identity at all
@@ -683,7 +685,21 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling in the operato
         callerGardenId = null;
     }
     try {
-        const rendered = renderFreshCall(freshCall({ backend, model, task, cwd, placement, callerGardenId }));
+        // TWO capability axes, in this order, both pre-mutation and neither standing in for
+        // the other. The TARGET axis first — "entwurf cannot open a Codex sibling here at
+        // all" is the more fundamental answer than "and it would not know where to put it".
+        // The CALLER axis second, and only when the seat anchor will actually be consulted:
+        // a codex caller that named an explicit placement never reads a pane title, so
+        // refusing it for a missing `thread-id` would refuse an unused capability.
+        const targetMissing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
+        const callerMissing = targetMissing === null && callerNativeSessionId !== undefined && placement === undefined
+            ? codexCallerFreshPreflight(process.env)
+            : null;
+        const missing = targetMissing ?? callerMissing;
+        const result = missing
+            ? { ok: false, reason: missing }
+            : freshCall({ backend, model, task, cwd, placement, callerGardenId, callerNativeSessionId, callerCwd });
+        const rendered = renderFreshCall(result);
         return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
     }
     catch (err) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/codex-caller-seat.js

@@ -0,0 +1,174 @@
+/**
+ * codex-caller-seat — the ONE resolution of a Codex caller's `threadId` into the tmux pane its
+ * TUI is sitting in. Narrow leaf of the fresh-call composition (#95 lane B); it owns the title
+ * anchor and the pane count and NOTHING else — it never runs tmux (the runner is injected),
+ * never phrases a placement decision, never reads a record, and has no fallback seat.
+ *
+ * Same shape and same discipline as `resolve-tmux-session.ts` and `classify-tmux-cwd.ts`: this
+ * file imports nothing at all, not even a node builtin, so it stays deletable on its own and
+ * cannot acquire an opinion about mux, entwurf, identity or delivery. The injected runner is
+ * matched STRUCTURALLY to `mux-placement.TmuxRun` rather than by a type import, for the same
+ * reason.
+ *
+ * ── WHAT THIS IS NOT ──
+ *
+ * A pane title is OPERATOR-WRITABLE and forgeable: any process in any pane can emit the same
+ * OSC 0 string. So this leaf's answer is a PLACEMENT INPUT and nothing else — the `$session`
+ * it returns may only reach a `-t` target. Identity, delivery and liveness keep the record +
+ * `_meta` join they already have (AGENTS.md Hard Rule 16). Nothing here reads screen text,
+ * sends keys, or infers that a citizen is alive.
+ *
+ * ── THE ANCHOR, AND WHY IT IS NOT THE BARE UUID ──
+ *
+ * With `thread-id` in `[tui].terminal_title` (the `entwurf install-codex-terminal-title` atom)
+ * the vendor renders the thread UUID into the terminal title — but TRUNCATED. `[측정]
+ * 2026-09-16, thinkpad, codex-cli 0.153.4: a live TUI's `#{pane_title}` read back
+ * `tmp | 01a0a7f9-ed9c-7aa2-a4dd-b1a39...`, not the 36-char id. Source at `rust-v0.153.4`:
+ * `codex-rs/tui/src/chatwidget/status_surfaces.rs:892-894` renders `TerminalTitleItem::SessionId`
+ * through `truncate_terminal_title_part(value, 32)`, and `:1027-1043` keeps 29 graphemes and
+ * appends `...`. So the anchor set is TWO strings: the truncated form the vendor emits today,
+ * and the full id — accepted so that a vendor which later stops truncating passes unchanged
+ * rather than silently resolving nothing.
+ *
+ * `[측정]` 29 leading chars of a thread UUID are ASCII (`01a09ec6-e6de-7643-8571-f3261`, 29
+ * code points, 29 bytes — terra#1 2026-09-16 item 8), so counting code points here and
+ * graphemes there is the same count for every id this rail will ever see.
+ *
+ * `[측정]` `rust-v0.154.0` is unchanged on all three axes — the `thread-id` item
+ * (`title_setup.rs:81-83`), the 32-char truncation (`status_surfaces.rs:930-934`) and the
+ * ` | ` separator (`title_setup.rs:187-195`) — so this anchor is not pinned to one release.
+ *
+ * ── WHY TOKENS AND NOT ` | ` SEGMENTS ──
+ *
+ * The obvious rule is "one ` | `-separated segment equals the anchor". It has a vendor hole.
+ * `title_setup.rs:183-193 separator_from_previous` joins adjacent items with ` | ` EXCEPT when
+ * either side is the `activity` item (`Spinner`, `title_setup.rs:47-48`), which gets a plain
+ * space — and `status_surfaces.rs:330-343` computes that `previous` from the last RENDERED
+ * item, skipping any that resolved to `None`. So on a host whose operator list ends in
+ * `activity`, the installed atom appends `thread-id` right after it and a WORKING TUI renders
+ * `<spinner text> 01a0a7f9-…`: one segment, two values. Splitting each segment on a space and
+ * comparing TOKENS closes that hole and cannot open a new one — a false positive would need
+ * some other title item to render a string byte-identical to this thread's own id.
+ *
+ * ── WHY THE COUNT IS OVER PANES, NOT TOKENS ──
+ *
+ * One pane can legitimately show the same thread twice: an operator whose `terminal_title` also
+ * carries `thread-title` sees the full 36-char id there whenever the thread is unnamed
+ * (`status_surfaces.rs:776-786`), beside our truncated one. Two tokens, one pane, one thread —
+ * not an ambiguity. Ambiguity is TWO PANES claiming the same thread, and that is refused
+ * because picking either would seat a sibling by guess.
+ */
+/** The repair text for each refusal, owned by the leaf that decides it so the sentence an
+ * operator reads cannot drift away from the predicate that produced it (the same rule the
+ * Copilot/OMP/Codex preflight hints follow). */
+export const CODEX_CALLER_SEAT_HINT = {
+    "codex-caller-seat-unresolved": "no pane on this agent's own tmux server shows this Codex thread in its title, so there is no caller seat to open a sibling beside — the TUI may be on another tmux server or outside tmux entirely, its config may not carry `thread-id` in [tui].terminal_title (run `entwurf install-codex-terminal-title`, then `entwurf doctor-codex-terminal-title`), or that server may have `allow-set-title off`, which replaces every pane title with the hostname and hides the id [측정 2026-09-16]",
+    "codex-caller-seat-ambiguous": "more than one pane on this agent's own tmux server shows this Codex thread in its title, so which one is the caller cannot be decided — nothing is opened rather than guessing a seat; close the stale duplicate and call again",
+};
+/** The vendor's per-item ceiling for `thread-id` (`status_surfaces.rs:892-894`). */
+export const CODEX_TITLE_ITEM_MAX_CHARS = 32;
+/** The two separators a rendered title can put between items: ` | ` for an ordinary pair, and a
+ * bare space when either neighbour is the `activity` indicator (`title_setup.rs:183-193`). */
+const TITLE_SEGMENT_SEPARATOR = " | ";
+const TITLE_TOKEN_SEPARATOR = " ";
+/**
+ * The vendor's `truncate_terminal_title_part`, reproduced (`status_surfaces.rs:1027-1043`).
+ * Code points stand in for graphemes — measured identical for every thread id (see header).
+ */
+export function truncateTerminalTitlePart(value, maxChars) {
+    const chars = [...value];
+    if (chars.length <= maxChars || maxChars <= 3)
+        return chars.slice(0, maxChars).join("");
+    return `${chars.slice(0, maxChars - 3).join("")}...`;
+}
+/**
+ * Every string a title may legitimately carry for this thread. The truncated form is what the
+ * vendor emits today; the full id is accepted so a future vendor that stops truncating keeps
+ * working without a code change here.
+ */
+export function codexTitleAnchors(threadId) {
+    if (threadId.length === 0) {
+        throw new Error("codex-caller-seat: refusing to build an anchor for an empty threadId");
+    }
+    const truncated = truncateTerminalTitlePart(threadId, CODEX_TITLE_ITEM_MAX_CHARS);
+    return truncated === threadId ? [threadId] : [threadId, truncated];
+}
+/** Does this ONE pane title name the thread? Segment first, then token — see the header for the
+ * `activity`-adjacency hole a segment-only rule leaves open. */
+export function titleNamesThread(title, anchors) {
+    for (const segment of title.split(TITLE_SEGMENT_SEPARATOR)) {
+        for (const token of segment.split(TITLE_TOKEN_SEPARATOR)) {
+            if (anchors.includes(token))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * The lookup argv. `-a` is the whole server because a Codex TUI is not required to be in the
+ * caller's own session — that asymmetry is exactly what this leaf exists to remove. The three
+ * fields are tab-separated so a title containing spaces (a project name, the spinner text)
+ * cannot be read as a new column.
+ */
+export function buildCodexCallerSeatArgs() {
+    return ["list-panes", "-a", "-F", "#{pane_id}\t#{session_id}\t#{pane_title}"];
+}
+/** One `list-panes` line back into its three fields, or `null` when it is not one. The title
+ * takes EVERYTHING after the second tab: splitting on every tab would truncate a title that
+ * ever carried one. */
+function parsePaneLine(line) {
+    const firstTab = line.indexOf("\t");
+    if (firstTab < 0)
+        return null;
+    const secondTab = line.indexOf("\t", firstTab + 1);
+    if (secondTab < 0)
+        return null;
+    const paneId = line.slice(0, firstTab);
+    const sessionId = line.slice(firstTab + 1, secondTab);
+    if (paneId.length === 0 || sessionId.length === 0)
+        return null;
+    return { paneId, sessionId, title: line.slice(secondTab + 1) };
+}
+/**
+ * Resolve the pane a Codex caller's thread is displayed in, on whatever server the runner's
+ * environment names.
+ *
+ * ONE BOUNDED IMPRECISION, STATED RATHER THAN LAUNDERED (the same one
+ * `resolve-tmux-session.ts` carries): rc≠0 also covers "no server running on this socket". This
+ * leaf reads every rc≠0 as `codex-caller-seat-unresolved`, so a server that died between the
+ * caller's context proof and this lookup is reported under the narrower word. That is safe —
+ * both readings are refusals that mutate nothing, and the hint above names both — and it is
+ * preferred over matching tmux's own stderr text, which would pin this leaf to one vendor
+ * version's wording.
+ */
+export function resolveCodexCallerSeat(threadId, run) {
+    const anchors = codexTitleAnchors(threadId);
+    const result = run(buildCodexCallerSeatArgs());
+    // A signalled call is not tmux answering — it carries no information about any pane at all,
+    // so it must never be read as "the caller's TUI is not here".
+    if (result.status === null) {
+        throw new Error(`codex-caller-seat: the pane listing was killed by a signal: ${result.stderr.trim()}`);
+    }
+    if (result.status !== 0)
+        return { ok: false, reason: "codex-caller-seat-unresolved" };
+    const matches = [];
+    for (const line of result.stdout.split("\n")) {
+        if (line.length === 0)
+            continue;
+        const pane = parsePaneLine(line);
+        // A line this leaf cannot read is NOT a pane it may skip quietly: the listing is the
+        // whole evidence base for "exactly one", and a dropped line could be the second match
+        // that should have refused.
+        if (pane === null) {
+            throw new Error(`codex-caller-seat: tmux printed a pane line this leaf cannot read: ${JSON.stringify(line)}`);
+        }
+        if (titleNamesThread(pane.title, anchors)) {
+            matches.push({ paneId: pane.paneId, sessionId: pane.sessionId, source: "codex-title-anchor" });
+        }
+    }
+    if (matches.length === 0)
+        return { ok: false, reason: "codex-caller-seat-unresolved" };
+    if (matches.length > 1)
+        return { ok: false, reason: "codex-caller-seat-ambiguous" };
+    return { ok: true, seat: matches[0] };
+}