@junghanacs/entwurf 0.20.1 → 0.22.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -1,7 +1,9 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller.
+ * the launch argv, and let it name itself back to the caller. A Codex CALLER is the one measured
+ * exception to "the caller's own session": it opens beside its own TUI pane, found by that
+ * pane's terminal title (#95 lane B), never by a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -38,6 +40,14 @@
  *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
  *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
  *     only cwd authority this module knows.
+ *   - when a CODEX caller omits it, the surface supplies that citizen's own record cwd and it
+ *     becomes an explicit `-c` (#95 lane C). This is not a second authority: it is the same
+ *     caller, named more precisely, because a codex caller's PROCESS directory is the
+ *     operator-owned app-server's rather than its own. Every other caller keeps the inherited
+ *     directory and an unchanged argv.
+ *   - the chosen value reaches codex TWICE, and that is one value with two carriers rather than
+ *     two inputs: tmux `-c` places the pane, and codex `-C` places the THREAD, which a
+ *     `--remote` attachment would otherwise take from the app-server (see `buildBackendArgs`).
  *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
  *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
  *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
@@ -77,17 +87,20 @@
  */
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
+import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
+import { CODEX_CALLER_PREFLIGHT_HINT, CODEX_LAUNCH_CWD_PREFLIGHT_HINT, CODEX_PREFLIGHT_HINT, codexLaunchCwdFreshPreflight, } from "./codex-fresh-preflight.js";
 import { COPILOT_PREFLIGHT_HINT, copilotFreshPreflight, } from "./copilot-fresh-preflight.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
+import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.js";
 import { OMP_PREFLIGHT_HINT, ompFreshPreflight } from "./omp-fresh-preflight.js";
 import { classifyTmuxSessionName, resolveTmuxSessionId } from "./resolve-tmux-session.js";
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract, and
- * `omp` by #87 Bundle C under the same one. The set is joined to the citizen backends by
- * `check-harness-admission-parity`: a harness that mints records but is missing HERE is not an
- * unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp"];
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
+ * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
+ * missing HERE is not an unwired convenience, it is a release blocker. */
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"];
 /**
  * The fixed runtime each backend resolves on PATH. Same reason `mux-launch` uses PATH rather
  * than a compiled-in location: the official binary is whatever the operator's environment gives
@@ -115,6 +128,7 @@ export const FRESH_CALL_RUNTIME = {
     "claude-code": "claude",
     copilot: "entwurf",
     omp: "omp",
+    codex: "codex",
 };
 /**
  * The callback tool NAME differs per backend and that is not cosmetic: native pi exposes the
@@ -142,6 +156,7 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     "claude-code": "mcp__entwurf-bridge__entwurf_v2",
     copilot: "entwurf-bridge-entwurf_v2",
     omp: "mcp__entwurf_bridge_entwurf_v",
+    codex: "mcp__entwurf_bridge__entwurf_v2",
 };
 /** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
  * delivery surface, not a claim that a task of this size was measured through tmux. An argv
@@ -244,8 +259,33 @@ export function isSafeFreshCallModel(model) {
  * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
  * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
  * carrier would hand callers the launch-shaping power this rail exists to refuse.
+ *
+ * CODEX ALONE CARRIES A DIRECTORY IN ITS ARGV, AND OMITTING IT IS A WRONG ANSWER RATHER THAN A
+ * NEUTRAL ONE. `[source rust-v0.153.4]` an explicit `--remote <endpoint>` — which this argv
+ * always passes — resolves to `AppServerTarget::Remote` (`codex-rs/tui/src/lib.rs:875-876`;
+ * `LocalDaemon` is only the IMPLICIT no-flag reuse path), and a Remote target takes its new
+ * thread's directory from `remote_cwd_override` ALONE: `thread_cwd_from_config`
+ * (`codex-rs/tui/src/app_server_session.rs:2022-2033`) answers `None` without it, and the
+ * app-server then opens the thread in ITS OWN directory. That override is exactly `-C/--cd`,
+ * retained only for a remote target (`codex-rs/tui/src/startup_orchestration.rs:191-194`), and
+ * the flag lives on the shared interactive options this argv already uses for
+ * `--dangerously-bypass-approvals-and-sandbox` (`codex-rs/utils/cli/src/shared_options.rs:53-68`)
+ * — not only on the `agents` subcommand that also spells it (`codex-rs/cli/src/main.rs:334`).
+ *
+ * `[측정 2026-09-16]` with the flag absent, three citizens of one chain (pi → Codex → Claude
+ * Code) all recorded the app-server's `~/repos/gh/entwurf` while the panes themselves sat in
+ * `~/repos/gh/agent-config`, and the birth hook wrote that vendor-supplied cwd into each record
+ * honestly (#95 lane C §1). So the token is ALWAYS present for codex: ONE directory, TWO
+ * CARRIERS — tmux `-c` places the PANE, codex `-C` places the THREAD, and `launchCwd` is the
+ * single value both receive. It is not a new input axis: the value is chosen by the cwd rules
+ * this module already has, one layer up.
  */
-export function buildBackendArgs(backend, composition, model) {
+export function buildBackendArgs(backend, composition, model, env = process.env, 
+/** Where the sibling will actually start: the directory `freshCall` chose when it chose one,
+ * and otherwise THIS process's own — which is what tmux gives a window opened with no `-c`
+ * (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+ * convenience, so a caller that omits it still names the truth to codex. */
+launchCwd = process.cwd()) {
     switch (backend) {
         case "pi":
             return [composition.prompt, "--entwurf-control", "--model", model];
@@ -255,6 +295,17 @@ export function buildBackendArgs(backend, composition, model) {
             return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
         case "omp":
             return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
+        case "codex":
+            return [
+                "--remote",
+                `unix://${resolveCodexDefaultSocketPath(env)}`,
+                "-C",
+                launchCwd,
+                "--model",
+                model,
+                "--dangerously-bypass-approvals-and-sandbox",
+                composition.prompt,
+            ];
     }
 }
 /**
@@ -313,6 +364,32 @@ export function buildFreshCallPrompt(params) {
         params.task,
     ].join("\n");
 }
+/**
+ * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
+ *
+ *   1. an explicit `placement` — the expert override, and it wins over everything below.
+ *   2. a CODEX CALLER with placement omitted — the sibling opens beside the caller's own TUI
+ *      pane, found by the title anchor (#95 lane B). This one is NOT a named seat and is
+ *      therefore not decided here: it resolves to a native `$id` with no name in between, so
+ *      `freshCall` owns it directly (see the anchor step below) and this function answers
+ *      `null` so the name grammar and the name→id lookup stay out of a path that has neither.
+ *   3. anything else — the caller's own session, with no named seat at all.
+ *
+ * THE SEAT FOLLOWS THE CALLER, NEVER THE BACKEND BEING OPENED. #95 first shipped a fourth rule —
+ * an omitted-placement Codex TARGET selected a fixed existing session named `codex`, where the
+ * operator seated the app-server and their TUIs — and #95 D1 retired it (GLG, 2026-09-16). It
+ * was a workaround for a mapping that did not exist yet: nothing could find the pane a Codex
+ * caller was sitting in, so the operator was asked to keep every Codex in one known room. Rule 2
+ * is that mapping, so the room is no longer load-bearing, and keeping it would have meant Codex
+ * alone answering "where does a sibling open?" differently from every other backend. The
+ * operator-owned app-server keeps its own seat wherever the operator puts it; Entwurf still
+ * never creates, moves or supervises it.
+ */
+export function selectFreshCallSeat(placement) {
+    if (placement !== undefined)
+        return { tmuxSession: placement.tmuxSession, source: "requested" };
+    return null;
+}
 /** Correlation tag only. Random, never derived from time, cwd or a peer listing — a nonce that
  * encoded any of those would invite exactly the guessing this rail exists to refuse. */
 export function mintNonce(randomHex = defaultRandomHex) {
@@ -337,9 +414,9 @@ function defaultRandomHex() {
  * for. That is sufficient and not a compromise: every reader of the carrier trims and tests
  * truthiness (`index.ts:212-217`), so empty and absent are the same answer by construction.
  *
- * It is applied to all four backends because the leak is a property of tmux, not of a vendor. A
+ * It is applied to all five backends because the leak is a property of tmux, not of a vendor. A
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
- * three are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
+ * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
  * exactly that after this argv has run. This is a fixed two-variable seam and deliberately NOT a
  * general env carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping
@@ -388,6 +465,20 @@ export function buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cw
  * `callerGardenId` is supplied by the SURFACE that registered this tool, from its own
  * record-backed context. It is not a tool parameter and this module never derives, validates
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
+ *
+ * `callerNativeSessionId` is supplied by the same surface under the same rule, and its PRESENCE
+ * is the whole signal: it is set exactly when the reconciled sender is a record-backed codex
+ * citizen, and it carries that citizen's `nativeSessionId` (the `_meta.threadId` the vendor put
+ * on this very request). This module never resolves it, never reads `_meta`, and never asks a
+ * store who is calling — it only turns a thread id into a pane, and only for placement.
+ *
+ * `callerCwd` rides the same surface rule and the same condition: it is that codex citizen's
+ * RECORD cwd, and it exists because a codex caller's process directory is NOT its own (the
+ * bridge runs as a child of the operator-owned app-server, so the directory that process
+ * reports is the app-server's — #95 lane C §2). It is consulted only when the caller requested
+ * no cwd, so an
+ * explicit request always wins, and this module never looks a cwd up, resolves it, or infers it
+ * from a seat, a workspace map or a project name.
  */
 export function freshCall(params, env = process.env, nonce = mintNonce()) {
     if (typeof params.callerGardenId !== "string" || params.callerGardenId.length === 0) {
@@ -405,8 +496,26 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         return { ok: false, reason: "task-too-long" };
     // ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
     // value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-    // classification below instead of being silently repaired into a different directory.
-    const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    // classification below instead of being silently repaired into a different directory. The
+    // caller's own record directory answers the SAME two-value emptiness rule and is consulted
+    // ONLY second: an explicit request always wins, and a caller that supplies neither leaves the
+    // pane to inherit this process's directory exactly as before — a pi caller's argv is
+    // byte-identical, because its process directory IS its own and a `-c` token would change
+    // nothing about where that window lands.
+    const requestedCwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
+    const chosenCwd = requestedCwd !== undefined
+        ? { value: requestedCwd, source: "requested" }
+        : callerCwd !== undefined
+            ? { value: callerCwd, source: "codex-caller-record" }
+            : undefined;
+    const cwd = chosenCwd?.value;
+    // SEAM (#95 lane C): a caller-record directory is classified by the SAME shared leaf and
+    // answers the same four `cwd-*` reasons, whose hint text says REQUESTED. When a codex
+    // caller's recorded directory has since been deleted, the repair that hint points at is
+    // still the right one — that directory does not exist — but the noun belongs to the caller
+    // rather than to the request. Kept shared on purpose: doubling the reason set for a wording
+    // difference would double the refusal contract two surfaces and one leaf already agree on.
     if (cwd !== undefined) {
         const badCwd = classifyTmuxCwd(cwd);
         if (badCwd)
@@ -416,8 +525,11 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // without tmux, so an unresolvable name is answered before anything else runs. Whether that
     // session EXISTS is a tmux question and is asked below, after the caller's own context is
     // proven — a name check that needed a live server would refuse for the wrong reason on a
-    // host with no tmux at all.
-    const seat = params.placement?.tmuxSession;
+    // host with no tmux at all. An explicit seat is an expert override and is reported as such; a
+    // CODEX CALLER's own pane is deliberately not a name at all, so it is absent here and
+    // resolved after the context proof below — see `selectFreshCallSeat` for the three-rule order.
+    const selectedSeat = selectFreshCallSeat(params.placement);
+    const seat = selectedSeat?.tmuxSession;
     if (seat !== undefined) {
         const badSeat = classifyTmuxSessionName(seat);
         if (badSeat)
@@ -458,12 +570,28 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
     // absent seat refuses with no window anywhere.
     let targetSessionId = placement.sessionId;
+    let anchoredSeat = false;
     if (seat !== undefined) {
         const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
         if (!resolved.ok)
             return { ok: false, reason: resolved.reason };
         targetSessionId = resolved.sessionId;
     }
+    else if (params.placement === undefined && params.callerNativeSessionId !== undefined) {
+        // Rule 2: the caller is a codex citizen and named no seat, so the sibling belongs beside
+        // the caller's own TUI. The pane is found by the title anchor and ONLY its `$session`
+        // continues — a pane title is forgeable, so it may never become an address, a liveness
+        // claim or a delivery input (Hard Rule 16). `params.placement` is re-read here rather
+        // than inferred from `seat === undefined`: "an explicit seat always wins" is the one
+        // invariant a later edit must not be able to lose by accident.
+        // STILL PRE-MUTATION: 0 or 2+ matching panes refuse with no window anywhere and no
+        // fallback to any other session.
+        const anchor = resolveCodexCallerSeat(params.callerNativeSessionId, (args) => runTmux(args, env));
+        if (!anchor.ok)
+            return { ok: false, reason: anchor.reason };
+        targetSessionId = anchor.seat.sessionId;
+        anchoredSeat = true;
+    }
     const composition = {
         prompt: buildFreshCallPrompt({
             backend: params.backend,
@@ -473,7 +601,36 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         }),
         bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
     };
-    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model), cwd), env);
+    const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
+    // THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a
+    // Codex sibling opened into a directory this Codex has no answer for stops on the vendor's
+    // folder-consent screen: no first turn, no rollout, no callback. It is tempting to refuse
+    // that, and refusing is the wrong product. The consent screen is SELF-REPAIRING when a human
+    // is there — one answer and the vendor records the directory, so every later launch runs —
+    // and an operator at the keyboard is exactly who a visible-first rail is built for. A refusal
+    // would replace that one answer with "no window, go run codex yourself, then call again", and
+    // it would have to be right about a decision this process cannot fully see (the vendor merges
+    // system, managed and cloud layers around the file this leaf reads). So the launch proceeds
+    // and says what it saw.
+    //
+    // The UNATTENDED case is not answered here and must not be: a gate with nobody at the keyboard
+    // needs its precondition named before it spends a model turn, which is its own oracle's job —
+    // `smoke-codex-fresh-live` asserts this same leaf up front, so a missing answer reads as a
+    // named precondition instead of a callback timeout.
+    //
+    // The directory asked about is READ BACK off codex's own `-C` token rather than recomputed:
+    // one resolution, one authority, and no way for the note to name a directory the thread will
+    // not start in (this module is deliberately not allowed to resolve the inherited default a
+    // second time — `FRESHCALL-CWD-CALLER-ONLY`).
+    if (params.backend === "codex") {
+        const at = backendArgs.indexOf("-C");
+        const launchCwd = backendArgs[at + 1] ?? "";
+        const unanswered = codexLaunchCwdFreshPreflight(env, launchCwd);
+        if (unanswered) {
+            console.error(`[fresh-call] ${unanswered}: ${launchCwd}\n` + `            ${CODEX_LAUNCH_CWD_PREFLIGHT_HINT[unanswered]}`);
+        }
+    }
+    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -493,8 +650,12 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             ...fields,
             backend: params.backend,
             model,
-            ...(cwd === undefined ? {} : { cwd }),
-            ...(seat === undefined ? {} : { tmuxSession: seat }),
+            ...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),
+            ...(selectedSeat === null
+                ? anchoredSeat
+                    ? { tmuxSessionSource: "codex-title-anchor" }
+                    : {}
+                : { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
             runtimePath,
             nonce,
         },
@@ -507,6 +668,9 @@ const REJECT_HINT = {
     // the sentence an operator reads cannot drift away from the predicate that produced it.
     ...COPILOT_PREFLIGHT_HINT,
     ...OMP_PREFLIGHT_HINT,
+    ...CODEX_PREFLIGHT_HINT,
+    ...CODEX_CALLER_PREFLIGHT_HINT,
+    ...CODEX_CALLER_SEAT_HINT,
     "no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
     "anchor-malformed": "TMUX_PANE is not a native pane id",
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -550,10 +714,16 @@ export function renderFreshCall(result) {
         text: `[entwurf fresh call →]\n` +
             `  backend:  ${r.backend} (${r.runtimePath})\n` +
             `  model:    ${r.model} (requested on the runtime CLI)\n` +
-            (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
-            (r.tmuxSession === undefined
+            (r.cwd === undefined
+                ? ""
+                : r.cwdSource === "codex-caller-record"
+                    ? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\n`
+                    : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+            (r.tmuxSessionSource === undefined
                 ? ""
-                : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
+                : r.tmuxSessionSource === "codex-title-anchor"
+                    ? `  seat:     ${r.sessionId} (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session, not a requested name)\n`
+                    : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +
             `  nonce:    ${r.nonce}\n` +

package/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/adapter.js

@@ -1,7 +1,7 @@
 /**
  * native-push adapter rail — the transport LEAF by which a native-push backend
- * (antigravity, the first) is (1) probed for a LIVE conversation and (2) direct-injected
- * with a message. Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
+ * is (1) probed for a LIVE native target and (2) direct-injected with a message.
+ * Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
  * /resolveAcpBackendAdapter): one interface, one registry, a fail-fast resolver.
  *
  * Purity contract (봉인 3):
@@ -23,6 +23,7 @@
 import { execFile } from "node:child_process";
 import * as os from "node:os";
 import * as path from "node:path";
+import { codexNativePushAdapter } from "./codex-ws-client.js";
 // The agy agentapi calls are bounded so a dead/stalled LS route cannot hang a dispatch
 // (raw-agy-send.sh used `timeout 8` — production had lost that; Q12 restores it). pgrep/ss
 // are fast local scans and stay unbounded.
@@ -120,6 +121,7 @@ export function createAntigravityAdapter(deps) {
     }
     return {
         id: "antigravity",
+        retriable: true,
         async probe(nativeSessionId) {
             let pids;
             try {
@@ -146,7 +148,7 @@ export function createAntigravityAdapter(deps) {
             for (const pid of pids) {
                 for (const lsAddress of portsByPid.get(pid) ?? []) {
                     if (await servesConversation(lsAddress, nativeSessionId)) {
-                        return { status: "alive", route: { lsAddress } };
+                        return { status: "alive", route: { backend: "antigravity", lsAddress } };
                     }
                 }
             }
@@ -159,22 +161,23 @@ export function createAntigravityAdapter(deps) {
             };
         },
         async send(route, nativeSessionId, content) {
+            if (route.backend !== "antigravity") {
+                throw new Error(`antigravity adapter received ${route.backend} route`);
+            }
             const r = await runner.exec([binary, "agentapi", "send-message", nativeSessionId, content], {
                 env: { ANTIGRAVITY_LS_ADDRESS: route.lsAddress },
                 timeoutMs: AGY_SEND_TIMEOUT_MS,
             });
-            // A non-zero code — including a timeout kill (124) on a stalled route — THROWS
-            // (fail-loud); the executor hand owns the 1-shot re-probe→re-send on that throw.
             if (r.code !== 0) {
                 throw new Error(`native-push send failed (agentapi send-message exit ${r.code}) via ${route.lsAddress}: ${r.stderr.trim() || "(no stderr)"}`);
             }
         },
     };
 }
-/** The production antigravity adapter (real runner + env-resolved binary). */
+/** Production adapters. */
 export const antigravityAdapter = createAntigravityAdapter({ runner: realNativePushRunner });
 // ── registry + fail-fast resolver (mirror resolveAcpBackendAdapter) ──────────
-const ADAPTERS = [antigravityAdapter];
+const ADAPTERS = [antigravityAdapter, codexNativePushAdapter];
 /**
  * Resolve the native-push adapter that owns backend `id`. Fail-fast, like
  * resolveAcpBackendAdapter: 0 matches → throw (unknown backend, no silent default);