@junghanacs/entwurf 0.21.0 → 0.22.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -1,8 +1,9 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller. Codex is the one measured topology
- * exception: an omitted seat selects the existing `codex` home session (#95), never a TUI guess.
+ * the launch argv, and let it name itself back to the caller. A Codex CALLER is the one measured
+ * exception to "the caller's own session": it opens beside its own TUI pane, found by that
+ * pane's terminal title (#95 lane B), never by a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -39,6 +40,14 @@
  *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
  *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
  *     only cwd authority this module knows.
+ *   - when a CODEX caller omits it, the surface supplies that citizen's own record cwd and it
+ *     becomes an explicit `-c` (#95 lane C). This is not a second authority: it is the same
+ *     caller, named more precisely, because a codex caller's PROCESS directory is the
+ *     operator-owned app-server's rather than its own. Every other caller keeps the inherited
+ *     directory and an unchanged argv.
+ *   - the chosen value reaches codex TWICE, and that is one value with two carriers rather than
+ *     two inputs: tmux `-c` places the pane, and codex `-C` places the THREAD, which a
+ *     `--remote` attachment would otherwise take from the app-server (see `buildBackendArgs`).
  *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
  *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
  *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
@@ -78,7 +87,8 @@
  */
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
-import { CODEX_PREFLIGHT_HINT } from "./codex-fresh-preflight.js";
+import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
+import { CODEX_CALLER_PREFLIGHT_HINT, CODEX_LAUNCH_CWD_PREFLIGHT_HINT, CODEX_PREFLIGHT_HINT, codexLaunchCwdFreshPreflight, } from "./codex-fresh-preflight.js";
 import { COPILOT_PREFLIGHT_HINT, copilotFreshPreflight, } from "./copilot-fresh-preflight.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
@@ -249,8 +259,33 @@ export function isSafeFreshCallModel(model) {
  * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
  * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
  * carrier would hand callers the launch-shaping power this rail exists to refuse.
+ *
+ * CODEX ALONE CARRIES A DIRECTORY IN ITS ARGV, AND OMITTING IT IS A WRONG ANSWER RATHER THAN A
+ * NEUTRAL ONE. `[source rust-v0.153.4]` an explicit `--remote <endpoint>` — which this argv
+ * always passes — resolves to `AppServerTarget::Remote` (`codex-rs/tui/src/lib.rs:875-876`;
+ * `LocalDaemon` is only the IMPLICIT no-flag reuse path), and a Remote target takes its new
+ * thread's directory from `remote_cwd_override` ALONE: `thread_cwd_from_config`
+ * (`codex-rs/tui/src/app_server_session.rs:2022-2033`) answers `None` without it, and the
+ * app-server then opens the thread in ITS OWN directory. That override is exactly `-C/--cd`,
+ * retained only for a remote target (`codex-rs/tui/src/startup_orchestration.rs:191-194`), and
+ * the flag lives on the shared interactive options this argv already uses for
+ * `--dangerously-bypass-approvals-and-sandbox` (`codex-rs/utils/cli/src/shared_options.rs:53-68`)
+ * — not only on the `agents` subcommand that also spells it (`codex-rs/cli/src/main.rs:334`).
+ *
+ * `[측정 2026-09-16]` with the flag absent, three citizens of one chain (pi → Codex → Claude
+ * Code) all recorded the app-server's `~/repos/gh/entwurf` while the panes themselves sat in
+ * `~/repos/gh/agent-config`, and the birth hook wrote that vendor-supplied cwd into each record
+ * honestly (#95 lane C §1). So the token is ALWAYS present for codex: ONE directory, TWO
+ * CARRIERS — tmux `-c` places the PANE, codex `-C` places the THREAD, and `launchCwd` is the
+ * single value both receive. It is not a new input axis: the value is chosen by the cwd rules
+ * this module already has, one layer up.
  */
-export function buildBackendArgs(backend, composition, model, env = process.env) {
+export function buildBackendArgs(backend, composition, model, env = process.env, 
+/** Where the sibling will actually start: the directory `freshCall` chose when it chose one,
+ * and otherwise THIS process's own — which is what tmux gives a window opened with no `-c`
+ * (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+ * convenience, so a caller that omits it still names the truth to codex. */
+launchCwd = process.cwd()) {
     switch (backend) {
         case "pi":
             return [composition.prompt, "--entwurf-control", "--model", model];
@@ -264,6 +299,8 @@ export function buildBackendArgs(backend, composition, model, env = process.env)
             return [
                 "--remote",
                 `unix://${resolveCodexDefaultSocketPath(env)}`,
+                "-C",
+                launchCwd,
                 "--model",
                 model,
                 "--dangerously-bypass-approvals-and-sandbox",
@@ -328,17 +365,29 @@ export function buildFreshCallPrompt(params) {
     ].join("\n");
 }
 /**
- * Codex's explicit home topology (#95): the operator provides this one existing tmux session
- * and seats the operator-owned app-server plus supported Codex TUIs there. This is a placement
- * convention, not an address axis — `threadId` remains the native delivery address.
+ * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
+ *
+ *   1. an explicit `placement` — the expert override, and it wins over everything below.
+ *   2. a CODEX CALLER with placement omitted — the sibling opens beside the caller's own TUI
+ *      pane, found by the title anchor (#95 lane B). This one is NOT a named seat and is
+ *      therefore not decided here: it resolves to a native `$id` with no name in between, so
+ *      `freshCall` owns it directly (see the anchor step below) and this function answers
+ *      `null` so the name grammar and the name→id lookup stay out of a path that has neither.
+ *   3. anything else — the caller's own session, with no named seat at all.
+ *
+ * THE SEAT FOLLOWS THE CALLER, NEVER THE BACKEND BEING OPENED. #95 first shipped a fourth rule —
+ * an omitted-placement Codex TARGET selected a fixed existing session named `codex`, where the
+ * operator seated the app-server and their TUIs — and #95 D1 retired it (GLG, 2026-09-16). It
+ * was a workaround for a mapping that did not exist yet: nothing could find the pane a Codex
+ * caller was sitting in, so the operator was asked to keep every Codex in one known room. Rule 2
+ * is that mapping, so the room is no longer load-bearing, and keeping it would have meant Codex
+ * alone answering "where does a sibling open?" differently from every other backend. The
+ * operator-owned app-server keeps its own seat wherever the operator puts it; Entwurf still
+ * never creates, moves or supervises it.
  */
-export const CODEX_HOME_TMUX_SESSION = "codex";
-/** An explicit seat always wins. Only omitted Codex placement gets the fixed home. */
-export function selectFreshCallSeat(backend, placement) {
+export function selectFreshCallSeat(placement) {
     if (placement !== undefined)
         return { tmuxSession: placement.tmuxSession, source: "requested" };
-    if (backend === "codex")
-        return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: "codex-home" };
     return null;
 }
 /** Correlation tag only. Random, never derived from time, cwd or a peer listing — a nonce that
@@ -416,6 +465,20 @@ export function buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cw
  * `callerGardenId` is supplied by the SURFACE that registered this tool, from its own
  * record-backed context. It is not a tool parameter and this module never derives, validates
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
+ *
+ * `callerNativeSessionId` is supplied by the same surface under the same rule, and its PRESENCE
+ * is the whole signal: it is set exactly when the reconciled sender is a record-backed codex
+ * citizen, and it carries that citizen's `nativeSessionId` (the `_meta.threadId` the vendor put
+ * on this very request). This module never resolves it, never reads `_meta`, and never asks a
+ * store who is calling — it only turns a thread id into a pane, and only for placement.
+ *
+ * `callerCwd` rides the same surface rule and the same condition: it is that codex citizen's
+ * RECORD cwd, and it exists because a codex caller's process directory is NOT its own (the
+ * bridge runs as a child of the operator-owned app-server, so the directory that process
+ * reports is the app-server's — #95 lane C §2). It is consulted only when the caller requested
+ * no cwd, so an
+ * explicit request always wins, and this module never looks a cwd up, resolves it, or infers it
+ * from a seat, a workspace map or a project name.
  */
 export function freshCall(params, env = process.env, nonce = mintNonce()) {
     if (typeof params.callerGardenId !== "string" || params.callerGardenId.length === 0) {
@@ -433,8 +496,26 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         return { ok: false, reason: "task-too-long" };
     // ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
     // value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-    // classification below instead of being silently repaired into a different directory.
-    const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    // classification below instead of being silently repaired into a different directory. The
+    // caller's own record directory answers the SAME two-value emptiness rule and is consulted
+    // ONLY second: an explicit request always wins, and a caller that supplies neither leaves the
+    // pane to inherit this process's directory exactly as before — a pi caller's argv is
+    // byte-identical, because its process directory IS its own and a `-c` token would change
+    // nothing about where that window lands.
+    const requestedCwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+    const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
+    const chosenCwd = requestedCwd !== undefined
+        ? { value: requestedCwd, source: "requested" }
+        : callerCwd !== undefined
+            ? { value: callerCwd, source: "codex-caller-record" }
+            : undefined;
+    const cwd = chosenCwd?.value;
+    // SEAM (#95 lane C): a caller-record directory is classified by the SAME shared leaf and
+    // answers the same four `cwd-*` reasons, whose hint text says REQUESTED. When a codex
+    // caller's recorded directory has since been deleted, the repair that hint points at is
+    // still the right one — that directory does not exist — but the noun belongs to the caller
+    // rather than to the request. Kept shared on purpose: doubling the reason set for a wording
+    // difference would double the refusal contract two surfaces and one leaf already agree on.
     if (cwd !== undefined) {
         const badCwd = classifyTmuxCwd(cwd);
         if (badCwd)
@@ -444,9 +525,10 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // without tmux, so an unresolvable name is answered before anything else runs. Whether that
     // session EXISTS is a tmux question and is asked below, after the caller's own context is
     // proven — a name check that needed a live server would refuse for the wrong reason on a
-    // host with no tmux at all. Codex alone selects its fixed home when the caller omitted a seat;
-    // an explicit seat remains an expert override and is reported as such.
-    const selectedSeat = selectFreshCallSeat(params.backend, params.placement);
+    // host with no tmux at all. An explicit seat is an expert override and is reported as such; a
+    // CODEX CALLER's own pane is deliberately not a name at all, so it is absent here and
+    // resolved after the context proof below — see `selectFreshCallSeat` for the three-rule order.
+    const selectedSeat = selectFreshCallSeat(params.placement);
     const seat = selectedSeat?.tmuxSession;
     if (seat !== undefined) {
         const badSeat = classifyTmuxSessionName(seat);
@@ -488,12 +570,28 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     // native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
     // absent seat refuses with no window anywhere.
     let targetSessionId = placement.sessionId;
+    let anchoredSeat = false;
     if (seat !== undefined) {
         const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
         if (!resolved.ok)
             return { ok: false, reason: resolved.reason };
         targetSessionId = resolved.sessionId;
     }
+    else if (params.placement === undefined && params.callerNativeSessionId !== undefined) {
+        // Rule 2: the caller is a codex citizen and named no seat, so the sibling belongs beside
+        // the caller's own TUI. The pane is found by the title anchor and ONLY its `$session`
+        // continues — a pane title is forgeable, so it may never become an address, a liveness
+        // claim or a delivery input (Hard Rule 16). `params.placement` is re-read here rather
+        // than inferred from `seat === undefined`: "an explicit seat always wins" is the one
+        // invariant a later edit must not be able to lose by accident.
+        // STILL PRE-MUTATION: 0 or 2+ matching panes refuse with no window anywhere and no
+        // fallback to any other session.
+        const anchor = resolveCodexCallerSeat(params.callerNativeSessionId, (args) => runTmux(args, env));
+        if (!anchor.ok)
+            return { ok: false, reason: anchor.reason };
+        targetSessionId = anchor.seat.sessionId;
+        anchoredSeat = true;
+    }
     const composition = {
         prompt: buildFreshCallPrompt({
             backend: params.backend,
@@ -503,7 +601,36 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         }),
         bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
     };
-    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model, env), cwd), env);
+    const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
+    // THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a
+    // Codex sibling opened into a directory this Codex has no answer for stops on the vendor's
+    // folder-consent screen: no first turn, no rollout, no callback. It is tempting to refuse
+    // that, and refusing is the wrong product. The consent screen is SELF-REPAIRING when a human
+    // is there — one answer and the vendor records the directory, so every later launch runs —
+    // and an operator at the keyboard is exactly who a visible-first rail is built for. A refusal
+    // would replace that one answer with "no window, go run codex yourself, then call again", and
+    // it would have to be right about a decision this process cannot fully see (the vendor merges
+    // system, managed and cloud layers around the file this leaf reads). So the launch proceeds
+    // and says what it saw.
+    //
+    // The UNATTENDED case is not answered here and must not be: a gate with nobody at the keyboard
+    // needs its precondition named before it spends a model turn, which is its own oracle's job —
+    // `smoke-codex-fresh-live` asserts this same leaf up front, so a missing answer reads as a
+    // named precondition instead of a callback timeout.
+    //
+    // The directory asked about is READ BACK off codex's own `-C` token rather than recomputed:
+    // one resolution, one authority, and no way for the note to name a directory the thread will
+    // not start in (this module is deliberately not allowed to resolve the inherited default a
+    // second time — `FRESHCALL-CWD-CALLER-ONLY`).
+    if (params.backend === "codex") {
+        const at = backendArgs.indexOf("-C");
+        const launchCwd = backendArgs[at + 1] ?? "";
+        const unanswered = codexLaunchCwdFreshPreflight(env, launchCwd);
+        if (unanswered) {
+            console.error(`[fresh-call] ${unanswered}: ${launchCwd}\n` + `            ${CODEX_LAUNCH_CWD_PREFLIGHT_HINT[unanswered]}`);
+        }
+    }
+    const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
     assertTmuxOk("new-window", run);
     let fields;
     try {
@@ -523,9 +650,11 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
             ...fields,
             backend: params.backend,
             model,
-            ...(cwd === undefined ? {} : { cwd }),
+            ...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),
             ...(selectedSeat === null
-                ? {}
+                ? anchoredSeat
+                    ? { tmuxSessionSource: "codex-title-anchor" }
+                    : {}
                 : { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
             runtimePath,
             nonce,
@@ -540,6 +669,8 @@ const REJECT_HINT = {
     ...COPILOT_PREFLIGHT_HINT,
     ...OMP_PREFLIGHT_HINT,
     ...CODEX_PREFLIGHT_HINT,
+    ...CODEX_CALLER_PREFLIGHT_HINT,
+    ...CODEX_CALLER_SEAT_HINT,
     "no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
     "anchor-malformed": "TMUX_PANE is not a native pane id",
     "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -550,7 +681,7 @@ const REJECT_HINT = {
     "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
     "cwd-not-directory": "the requested cwd exists but is not a directory",
     "tmux-session-name-invalid": "the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
-    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again; Codex's omitted-placement home is the exact session name 'codex'",
+    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
     "model-empty": "model is empty after trimming; fresh calls require an explicit model",
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "task-empty": "task is empty after trimming",
@@ -583,11 +714,15 @@ export function renderFreshCall(result) {
         text: `[entwurf fresh call →]\n` +
             `  backend:  ${r.backend} (${r.runtimePath})\n` +
             `  model:    ${r.model} (requested on the runtime CLI)\n` +
-            (r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
-            (r.tmuxSession === undefined
+            (r.cwd === undefined
+                ? ""
+                : r.cwdSource === "codex-caller-record"
+                    ? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\n`
+                    : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+            (r.tmuxSessionSource === undefined
                 ? ""
-                : r.tmuxSessionSource === "codex-home"
-                    ? `  seat:     ${r.tmuxSession} (Codex home tmux session, resolved to ${r.sessionId})\n`
+                : r.tmuxSessionSource === "codex-title-anchor"
+                    ? `  seat:     ${r.sessionId} (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session, not a requested name)\n`
                     : `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
             `  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
             `  pane:     ${r.paneId} pid ${r.panePid}\n` +

package/mcp/entwurf-bridge/dist/scripts/codex-socket-path.js

@@ -0,0 +1,30 @@
+/**
+ * codex-socket-path — print the Codex app-server default control-socket path for THIS
+ * environment, and nothing else.
+ *
+ * WHY A LEAF EXISTS FOR ONE LINE. `entwurf codex-app-server` is a bash launcher, and bash
+ * cannot import `resolveCodexDefaultSocketPath`. Its first version re-derived the path
+ * instead — `${CODEX_HOME:-$HOME/.codex}` plus a POSIX `[:space:]` trim — and a gate compared
+ * the two spellings over four ASCII-normal inputs, which they agreed on.
+ *
+ * They did not agree everywhere. `[측정 2026-09-16]` with `CODEX_HOME=$''` the TS leaf
+ * trims (JS `String.prototype.trim` strips U+FEFF) and falls back to `$HOME/.codex`, while the
+ * bash trim keeps the byte and yields `<BOM>/app-server-control/app-server-control.sock`. Same
+ * for `path.join`'s normalization of a trailing slash or a `..` segment. Every one of those is
+ * a managed launch starting a server at an address delivery and preflight never look at — a
+ * false success of exactly the kind this repo refuses.
+ *
+ * So the second spelling is gone rather than widened. There is ONE implementation of this
+ * address, this leaf prints it, and the launcher asks. Matching a transcription against its
+ * original can only ever test the inputs somebody thought of.
+ *
+ * Reads `process.env` directly: the resolver's contract is the ambient environment of whoever
+ * is about to launch, and an argv seam here would be a way to redirect the address.
+ */
+import { resolveCodexDefaultSocketPath } from "../pi-extensions/lib/native-push/codex-ws-client.js";
+if (process.argv.length > 2) {
+    console.error("usage: codex-socket-path   (no arguments; the environment is the input)");
+    process.exit(2);
+}
+// No trailing newline: the caller substitutes this straight into an address.
+process.stdout.write(resolveCodexDefaultSocketPath(process.env));

package/mcp/entwurf-bridge/src/index.ts

@@ -65,7 +65,7 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.ts";
+import { codexCallerFreshPreflight, codexFreshPreflight } from "../../../pi-extensions/lib/codex-fresh-preflight.ts";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
@@ -254,6 +254,15 @@ interface AuthoritativeSelf {
 	envelope: SenderEnvelope;
 	/** meta-session only: WHICH rail carries a reply back. Never inferred from `origin`. */
 	metaDeliveryDomain?: MetaDeliveryDomain;
+	/**
+	 * meta-session/codex ONLY: the `_meta.threadId` that named this caller on THIS request, and
+	 * which the reconciliation above already proved equal to the selected citizen's
+	 * `nativeSessionId`. It rides here for exactly one consumer — the fresh-call PLACEMENT,
+	 * which turns it into the caller's own tmux pane through its title (#95 lane B). It is not
+	 * an address, not a reply rail, and not part of the sender envelope: `sessionId` is the only
+	 * thing anyone may send to.
+	 */
+	codexThreadId?: string;
 }
 
 interface SenderRequestContext {
@@ -339,7 +348,7 @@ async function resolveAuthoritativeSender(
 	]);
 	if (!selected) return null;
 	if (codex && codex.identity.gardenId === selected.id) {
-		return buildMetaSenderEnvelope(codex.identity, codex.identity.cwd);
+		return { ...(await buildMetaSenderEnvelope(codex.identity, codex.identity.cwd)), codexThreadId: codex.threadId };
 	}
 	if (marker && marker.identity.gardenId === selected.id) {
 		return buildMetaSenderEnvelope(marker.identity, marker.marker.cwd || cwd, marker);
@@ -712,21 +721,21 @@ server.tool(
 		"sender envelope of that callback is its garden id — that is how you learn the address of something that " +
 		"did not exist a moment ago. This returns a LAUNCH receipt (tmux window/pane plus that nonce) and nothing " +
 		"else: it does NOT mean the runtime started, the first turn ran, or the task was delivered. Nothing polls " +
-		"for the callback; if it never arrives the window is visible and can be read directly. For EXISTING " +
+		"for the callback; if it never arrives the window is visible. For EXISTING " +
 		"citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and " +
 		"is passed to the chosen runtime CLI (`provider/model` for pi; model id/alias for Claude Code; a model name " +
 		"or `auto` for copilot; a fuzzy model pattern for omp or codex). Copilot, omp, and codex are refused BEFORE " +
-		"any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent. " +
-		"Codex additionally requires the operator-owned default app-server socket; entwurf never starts or supervises it. " +
-		"An optional " +
+		"any window opens when their required birth, MCP, receive/delivery, or visible-identity units are absent; " +
+		"Codex also requires the operator-owned default app-server socket, which entwurf never starts. An optional " +
 		"cwd starts the sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume " +
-		"for a dormant record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. " +
-		"An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own tmux server. " +
-		"When omitted, Codex targets the exact existing `codex` home session; other backends target the caller's session. " +
-		"A missing named/home session is tmux-session-missing and NOTHING is created. " +
+		"for a dormant record's cwd. Omitted/empty cwd means the caller's own directory. " +
+		"An optional placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own " +
+		"tmux server, and it ALWAYS wins. Omitted, the seat follows the CALLER: a CODEX CALLER opens beside its own " +
+		"TUI pane (matched by thread-id in that pane's title; 0 or 2+ matches REFUSE, never fall back), and every " +
+		"other caller opens in its own session. " +
+		"A missing named session is tmux-session-missing and NOTHING is created. " +
 		"There are no arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to " +
-		"same-user processes on this host. Requires that this agent itself runs " +
-		"inside tmux: without a pane anchor there is no session to open a sibling beside.",
+		"same-user processes on this host. Requires that this agent itself runs inside tmux.",
 	{
 		backend: z
 			.enum(["pi", "claude-code", "copilot", "omp", "codex"])
@@ -758,7 +767,7 @@ server.tool(
 			.string()
 			.optional()
 			.describe(
-				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \"\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.",
+				"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). Omit or pass \"\" to start where the CALLER is: its own directory, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed.",
 			),
 		placement: z
 			.object({
@@ -770,14 +779,28 @@ server.tool(
 			})
 			.optional()
 			.describe(
-				"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server. When omitted, Codex selects the exact existing `codex` home session; other backends use the caller's session. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id.",
+				"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id.",
 			),
 	},
 	async ({ backend, model, task, cwd, placement }, extra) => {
 		let callerGardenId: string | null = null;
+		// Present exactly when the reconciled caller is a record-backed codex citizen. Its ONLY
+		// consumer is the placement below: a Codex caller with no explicit seat opens its sibling
+		// beside its own TUI pane, found by that thread's terminal title (#95 lane B).
+		let callerNativeSessionId: string | undefined;
+		// The SAME citizen's record cwd, set under the SAME condition and carrying no further
+		// authority: `envelope.cwd` is only the record's directory when the selected sender is
+		// that codex citizen, so the two are derived from one fact rather than read separately.
+		// It exists because `process.cwd()` here is the operator-owned APP-SERVER's directory —
+		// this bridge is its MCP child — so a codex caller that names no cwd would otherwise open
+		// every sibling in the app-server's repo (#95 lane C §1). The composition consults it only
+		// when the tool call requested no cwd of its own.
+		let callerCwd: string | undefined;
 		try {
 			const self = await buildAuthoritativeSelfEnvelope({ requestMeta: extra._meta });
 			callerGardenId = self.envelope.sessionId;
+			callerNativeSessionId = self.codexThreadId;
+			callerCwd = self.codexThreadId === undefined ? undefined : self.envelope.cwd;
 		} catch (err) {
 			// ONE error is a legitimate answer here: this host has no authoritative identity at all
 			// (no pi carrier inherited, no trusted marker written), so the sibling would have nowhere
@@ -790,10 +813,21 @@ server.tool(
 			callerGardenId = null;
 		}
 		try {
-			const missing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
+			// TWO capability axes, in this order, both pre-mutation and neither standing in for
+			// the other. The TARGET axis first — "entwurf cannot open a Codex sibling here at
+			// all" is the more fundamental answer than "and it would not know where to put it".
+			// The CALLER axis second, and only when the seat anchor will actually be consulted:
+			// a codex caller that named an explicit placement never reads a pane title, so
+			// refusing it for a missing `thread-id` would refuse an unused capability.
+			const targetMissing = backend === "codex" ? await codexFreshPreflight(process.env) : null;
+			const callerMissing =
+				targetMissing === null && callerNativeSessionId !== undefined && placement === undefined
+					? codexCallerFreshPreflight(process.env)
+					: null;
+			const missing = targetMissing ?? callerMissing;
 			const result = missing
 				? ({ ok: false, reason: missing } as const)
-				: freshCall({ backend, model, task, cwd, placement, callerGardenId });
+				: freshCall({ backend, model, task, cwd, placement, callerGardenId, callerNativeSessionId, callerCwd });
 			const rendered = renderFreshCall(result);
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
 		} catch (err) {

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -114,6 +114,14 @@
 	// the marker-less native-push quiesce row) are lib leaves the bridge graph already
 	// tolerates — the adapter is a 봉인-3 leaf (node builtins + type-only contract), and
 	// register_native already pulls both into this emit.
+	// WHY codex-socket-path rides THIS build (#95): `entwurf codex-app-server` is a bash
+	// launcher that cannot import the socket resolver, and its first version re-derived the
+	// address instead — measurably diverging from `resolveCodexDefaultSocketPath` on a BOM-only
+	// CODEX_HOME and on path normalization. The launcher now ASKS this leaf through run_ts, so on
+	// an installed host it resolves under node_modules where strip-types is refused and a missing
+	// twin would make the one-command launch die before its first line. Its only repo import is
+	// native-push/codex-ws-client.ts, ALREADY emitted for meta-bridge-hook-codex, so this adds ONE
+	// leaf JS and ZERO new deps.
 	// WHY meta-bridge-omp rides THIS build (#87): `install-omp-bridge` explicitly SELECTS
 	// `dist/pi-extensions/meta-bridge-omp.js` when REPO_DIR is under node_modules — the same
 	// strip-types fence the Claude and Copilot birth entries cross — and
@@ -135,6 +143,7 @@
 		"../../scripts/meta-bridge-fresh-cut.ts",
 		"../../scripts/meta-facts.ts",
 		"../../scripts/omp-receive-facts.ts",
+		"../../scripts/codex-socket-path.ts",
 		"../../pi-extensions/meta-bridge-hook.ts",
 		"../../pi-extensions/meta-bridge-hook-copilot.ts",
 		"../../pi-extensions/meta-bridge-hook-codex.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.21.0",
+	"version": "0.22.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
@@ -175,7 +175,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi-extensions/entwurf-control.ts

@@ -1583,9 +1583,9 @@ receive/delivery, or visible-identity units are absent. Codex additionally requi
 default app-server socket; entwurf never starts or supervises it. An optional cwd starts the
 sibling in ONE literal absolute existing directory (cross-repo fresh) — never pick resume for a dormant
 record's cwd; resume is continuity-only. Omitted/empty cwd means the caller's own directory. An optional
-placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own tmux server.
-When placement is omitted, Codex targets the exact existing \`codex\` home session; other backends target the
-caller's session. A missing named/home session is tmux-session-missing and NOTHING is created. There are no
+placement.tmuxSession is an expert override naming ONE EXISTING session on this agent's own tmux server and
+ALWAYS wins. Omitted, the seat follows the CALLER, never the backend being opened: every caller on this
+surface opens in its own session. A missing named session is tmux-session-missing and NOTHING is created. There are no
 arbitrary command/env knobs. Do not put secrets in the task — model and task argv are visible to same-user
 processes on this host.`,
 		parameters: Type.Object({
@@ -1621,7 +1621,7 @@ processes on this host.`,
 					},
 					{
 						description:
-							"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server. When omitted, Codex selects the exact existing `codex` home session; other backends use the caller's session. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id.",
+							"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: every caller on THIS surface opens in its own session (a pi session is never a Codex citizen, so the Codex caller-pane rule the MCP bridge carries cannot arise here). Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id.",
 					},
 				),
 			),