@lyupro/codex-bridge 0.6.2 → 0.6.4

package/CHANGELOG.md

@@ -4,6 +4,107 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.4] - 2026-09-21
+
+### Fixed
+
+- A refusal that spends no quota no longer leaves a run folder behind. A second writing run against a
+  busy tree was refused correctly, but its folder was created first — and in a repository that hosts
+  the run folders, the live writer's witness then spent every tool call ordering the orchestrator to
+  revert a directory the tool itself had made, or to stop an honest run. Neither is a safe action. The
+  misplaced check was the symptom: refusals sat on two sides of the registration boundary with no rule
+  about which side was which, and two gates of the same class already disagreed — a dead sandbox
+  refused without a folder, a busy tree with one. The quota-free host checks now live in a module that
+  is handed no run directory, so a check added there cannot register a run, and a table test holds
+  every refusal with its side and the reason for that side. A busy tree and an unavailable Codex CLI
+  therefore write nothing at all: they no longer produce an `aborted_pre_start` folder, and their
+  exit code stays 1, because the order was correct and the host or the tree was not.
+- The live witness and the final verdict judge one worktree by one definition. The witness read
+  `git status --porcelain` on its own while the verdict reads the recorded snapshot, so three kinds of
+  change were visible to one and invisible to the other: the run's own folder, the orchestrator's
+  environment writes, and gitignored working notes. The witness now composes the same chain as the
+  verdict, and its message says first that those three are already excluded — so what it lists is the
+  orchestrator's own edit — and only then offers the two actions. A structural test fails any hook that
+  spells a worktree query in an argument list; this drift went unnoticed for months and surfaced only
+  as a false accusation against a run that was doing its job.
+- A file moved inside its own scope is no longer a stray. The shared snapshot was read with git's
+  rename detection on, which prints one row spelled `old => new` — not a path, and matching no scope
+  pattern. The witness named that token at the orchestrator, and the verdict would have failed an
+  honest build for a `git mv` it was told to make. The snapshot is now read with `--no-renames`: a
+  rename is a deletion plus an addition, two real paths, each judged on its own merits.
+- A scope pattern that can only name a directory is refused before the run starts. A scope is compared
+  against file paths, never directories, so `muse/scripts` authorises one file that will never exist
+  while everything created inside the folder counts as a stray. Declared patterns escaped this by luck
+  — `git ls-files` prints no directories — but `--scope-new` is exempt from the existence check by
+  design, and a run ordered with `--scope-new muse/scripts` worked ten minutes, returned a filled
+  result, and was failed for the three files it created there. A trailing slash, a name that is a
+  directory on disk, and a glob-free name whose last segment has no extension are now refused before
+  the run folder exists, with the spelling that works named in the refusal. Patterns containing a glob
+  are never judged by these rules.
+
+## [0.6.3] - 2026-09-17
+
+### Added
+
+- A dead Codex sandbox refuses the run before it spends quota. On 2026-09-16 an unclean Windows
+  shutdown left the sandbox helper's state file as 22 zero bytes, and every delegated run after it
+  paid for a session in which not one command ran — one scout even came back `OK`. The launcher now
+  asks the sandbox to echo a marker before the run folder exists, and calls it dead only on double
+  evidence: the role's own flags and a flagless control both produce no marker, neither reports an
+  argument error, and the CLI still answers `--version`. Codex had already changed the shape of its
+  own sandbox command once, so anything the probe cannot judge lets the run start and is named in
+  the reply — a release that stops accepting the package's sandbox flags cannot turn the check off
+  silently. `stderr` is quoted for the operator and never parsed. The probe is bounded on every
+  path: a hung attempt stops the whole Codex tree rather than the `cmd.exe` in front of it, and a
+  capture that overflows is inconclusive, never dead. Windows and Linux are judged, each after both
+  outcomes were seen live on it; on Linux, where a dead sandbox is the ordinary state of a fresh
+  Ubuntu 23.10+ server, the refusal names the AppArmor profile that repairs it and warns against
+  lifting the restriction through `sysctl`. macOS is skipped — no outcome has been observed there.
+
+### Fixed
+
+- A scout that executed no command can no longer come back `OK`. On the dead sandbox of 2026-09-16
+  a scout was graded `OK` without reading a single file: its evidence explained that the files were
+  unreadable, and the coverage gate only checked that the evidence was a non-empty string. The
+  verdict now requires a fact before it judges coverage — at least one completed
+  `command_execution` in `events.jsonl`, with any status or exit code. Refused calls never enter the
+  stream, which is what makes the fact reliable; across 99 earlier successful scout runs it was
+  missing exactly twice, both on that sandbox.
+- Quoted text no longer reads as shell commands to the worktree lock. The write-intent scanner read
+  quotes three different ways, and its raw split on `;` and `|` cut inside them: an `awk` script
+  containing "Do not touch any file outside" was refused on 2026-09-16 as a write to `any`, `file`
+  and `outside` — the fourth refusal on one root after `node -e`, `sed` and a heredoc body. One
+  lexer now owns quotes, escapes and command boundaries for all three consumers, drops comments, and
+  opens subshells and `$(…)` only where the shell does.
+- An argument that happens to be a command name is not a write. `git log --grep rm -- README.md` and
+  `grep -rn touch src/` were refused while a build held the repository, because the scanner looked
+  for `rm` and `touch` in any word. A command name now counts only in command position — after
+  assignments, reserved words, leading redirections, a short list of launchers, and a `find -exec`
+  action up to its terminator.
+- A stop at the deadline cannot block the launcher forever. `stopCodex()` gave `taskkill` no timeout,
+  so a stalled `taskkill` held the event loop and every settlement timer with it. It now has ten
+  seconds, after which the direct child is killed.
+- The response guard judges a run by its own process, not by a bare pid. Without the run folder or
+  the recorded start time, a pid reused by another process after a reboot read as "the run is still
+  working", and the guard held the dispatcher on a dead run until the session's retry budget stopped
+  the session.
+- The project list no longer prints the raw `running` of a run whose worker died before writing
+  `meta.json`. A row without a verdict shows what closing the run would write: `abandoned` for a
+  dead or foreign process, `unverified` when the end cannot be proven. The "live now" column keeps
+  its fresh-heartbeat policy.
+
+### Changed
+
+- One module decides whether a recorded run is still live. Seven places answered that question on
+  their own through pid-first wrappers whose other inputs were optional — which is how the response
+  guard came to ask with a bare pid and the project list never to ask at all, although
+  `markAbandoned()` already held the exact rule. `src/home/lib/meta/run-liveness.mjs` now owns it,
+  and `tests/one-liveness-judge.test.mjs` fails the suite when another module asks a process
+  identity, re-exports one under a new name, or declares a pid-first wrapper again.
+- The rows a reply carries are rendered by one function. The Retention row had been copied into five
+  reply functions and was still missing from the runner's failure path, so a runner failure lost it;
+  a sixth copy for the sandbox row would have repeated that defect.
+
 ## [0.6.2] - 2026-09-07
 
 ### Fixed

package/README.md

@@ -62,7 +62,7 @@ If a global install and a clone coexist, you have two package copies. `codex-bri
 - **Every run leaves an audit folder.** The verbatim task, scope, before/after git state, events, report, verdict, and reason remain together.
 - **Zero runtime dependencies and zero build steps.** The package is plain `.mjs` on the Node.js standard library.
 
-The current suite contains **975 automated tests: 974 passing and 1 skipped**.
+The current suite contains **1177 automated tests: 1176 passing and 1 skipped**.
 
 ## Verify
 

package/cli/runs-inventory.mjs

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { liveRuns } from '../src/home/hooks/live-runs.mjs';
 import { readJsonFileSync } from '../src/home/lib/json-file.mjs';
+import { runLiveness } from '../src/home/lib/meta/run-liveness.mjs';
 import { runsRoot } from '../src/home/lib/runner/runs-root.mjs';
 
 const record = (value) => value && typeof value === 'object' && !Array.isArray(value);
@@ -108,7 +109,7 @@ function readRun(runDir, livePaths) {
   return {
     run: path.basename(runDir),
     agent: text(facts?.agent),
-    verdict: live ? 'running' : text(meta ? meta.status : status?.state),
+    verdict: live ? 'running' : text(meta ? meta.status : runLiveness({ runDir, status }).state),
     tokens: meta ? number(meta.tokens) : null,
     size: recursiveSize(runDir),
     timestamp: runTimestamp(path.basename(runDir), meta, status),
@@ -131,8 +132,9 @@ function publicRun(run) {
 
 function buildProject(projectDir) {
   const runDirs = directoryEntries(projectDir).map((entry) => path.join(projectDir, entry.name));
-  // live-runs owns PID and status interpretation after the 2026-08-05 live probe incident;
-  // this module only maps its result back to the corresponding inventory row.
+  // live-runs owns the `live` column (a fresh heartbeat) after the 2026-08-05 live probe incident.
+  // A row without a verdict shows what closing it would write — the judge's `abandoned` rather than
+  // the raw `running` a dead run keeps in status.json forever (Plan_57 D27).
   const livePaths = new Set(liveRuns(projectDir).map(({ dir }) => pathKey(dir)));
   const details = runDirs.map((runDir) => readRun(runDir, livePaths));
   // Sum what is known instead of blanking the column. One archived run without accounting used to

package/cli/stop.mjs

@@ -2,12 +2,12 @@
 import path from 'node:path';
 import { stopCodex } from '../src/home/lib/runner/codex-cmd.mjs';
 import { git, worktreeSnapshot } from '../src/home/lib/runner/git-state.mjs';
+import { runLiveness } from '../src/home/lib/meta/run-liveness.mjs';
 import {
   IDENTITY_ALIVE,
   IDENTITY_FOREIGN,
   IDENTITY_UNVERIFIED,
   processAlive,
-  processIdentity,
 } from '../src/home/lib/process-identity.mjs';
 import { markAbandoned, readJson } from '../src/home/lib/write-meta.mjs';
 import { runsRoot } from '../src/home/lib/runner/runs-root.mjs';
@@ -72,7 +72,7 @@ export async function stop({
     return result(1, `Run ${runDir} has no valid recorded pid; it was not changed.`);
   }
 
-  const identity = processIdentity({ runDir, status, commandRunner });
+  const { identity } = runLiveness({ runDir, status, commandRunner });
   if (identity === IDENTITY_UNVERIFIED || identity === IDENTITY_FOREIGN) {
     return result(
       1,

package/cli/unlock.mjs

@@ -3,11 +3,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { formatSilence, heartbeatAge, HEARTBEAT_STALE_MS } from '../src/home/lib/heartbeat.mjs';
+import { runLiveness } from '../src/home/lib/meta/run-liveness.mjs';
 import { markAbandoned } from '../src/home/lib/meta/run-state.mjs';
 import {
   IDENTITY_ALIVE,
   IDENTITY_UNVERIFIED,
-  processIdentity,
 } from '../src/home/lib/process-identity.mjs';
 import { git } from '../src/home/lib/runner/git-state.mjs';
 import { resolveProjectRunsDir } from '../src/home/lib/runner/project-dir.mjs';
@@ -144,7 +144,7 @@ function inspectRuns(project, options) {
       age: runAge(status.started_at, now),
       silence: formatSilence(silenceAge),
       silenceAge,
-      identity: processIdentity(identityOptions(dir, status, options, now)),
+      identity: runLiveness(identityOptions(dir, status, options, now)).identity,
       state: status.state,
     });
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.2",
-  "description": "Claude Code-to-Codex delegation with 6 guards, 975 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.4",
+  "description": "Claude Code-to-Codex delegation with 6 guards, 1177 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",

package/src/home/hooks/live-runs.mjs

@@ -9,34 +9,17 @@
  *
  * The heartbeat is required here and deliberately NOT in meta/run-state.mjs: releasing a lock
  * early costs an operator one knowing edit, while closing a record early makes a second writer
- * of its meta.json. See the comment above pidAlive() there.
+ * of its meta.json. See the comment above markAbandoned() in meta/run-state.mjs.
  */
 import fs from 'node:fs';
 import path from 'node:path';
 import { heartbeatAge, isHeartbeatFresh } from '../lib/heartbeat.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
-import {
-  IDENTITY_ALIVE,
-  IDENTITY_DEAD,
-  IDENTITY_FOREIGN,
-  processIdentity,
-} from '../lib/process-identity.mjs';
+import { runLiveness } from '../lib/meta/run-liveness.mjs';
+import { IDENTITY_ALIVE } from '../lib/process-identity.mjs';
 
 export const RECENT_RUN_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
 
-/**
- * The hook requires pid judgment plus a fresh heartbeat. Identity uncertainty stays live here
- * (fail-open), while the identity module deliberately treats a missing heartbeat as unverified;
- * isHeartbeatFresh() keeps its pre-Plan_20 missing-file compatibility for this separate question.
- */
-// Plan_31 needs confirmed process identity before warning about paid work that TaskStop leaves
-// behind; existing lock/reply guards retain the fail-open default for uncertain identities.
-export const isPidAlive = (pid, runDir, status = {}, options = {}) => {
-  const identity = processIdentity({ runDir, status: { ...status, pid } });
-  if (options.requireConfirmedIdentity === true) return identity === IDENTITY_ALIVE;
-  return identity !== IDENTITY_DEAD && identity !== IDENTITY_FOREIGN;
-};
-
 /**
  * Match the package's repository comparison without resolving symlinks: Windows realpath adds
  * `\\?\\` and UNC spellings, turning equal paths into unequal ones. A null result is uncertainty,
@@ -58,9 +41,24 @@ function isNonEmptyString(value) {
   return typeof value === 'string' && Boolean(value.trim());
 }
 
+/**
+ * The hook requires pid judgment plus a fresh heartbeat. Identity uncertainty stays live here
+ * (fail-open), while the identity module deliberately treats a missing heartbeat as unverified;
+ * isHeartbeatFresh() keeps its pre-Plan_20 missing-file compatibility for this separate question.
+ */
 function recognizedStatus(runDir, status, options) {
   const heartbeatFresh = isHeartbeatFresh(runDir)
     && (options.requireConfirmedIdentity !== true || heartbeatAge(runDir) !== null);
+  // Judged last: an identity probe can spawn PowerShell, and every hook call scans every project,
+  // so a record already ruled out by its fields or a stale heartbeat must never pay for one.
+  const judged = () => {
+    const liveness = runLiveness({ runDir, status });
+    // Plan_31 needs confirmed process identity before warning about paid work that TaskStop leaves
+    // behind; existing lock/reply guards retain the fail-open default for uncertain identities.
+    return options.requireConfirmedIdentity === true
+      ? liveness.identity === IDENTITY_ALIVE
+      : liveness.processMayBeAlive === true;
+  };
   return Boolean(status)
     && typeof status === 'object'
     && !Array.isArray(status)
@@ -70,7 +68,7 @@ function recognizedStatus(runDir, status, options) {
     && isNonEmptyString(status.slug)
     && isNonEmptyString(status.repo)
     && heartbeatFresh
-    && isPidAlive(status.pid, runDir, status, options);
+    && judged();
 }
 
 function readStatus(runDir) {

package/src/home/hooks/reply-guard.mjs

@@ -33,9 +33,10 @@ import { AGENTS } from '../lib/agents.mjs';
 import { runOrderMismatch, transcriptOrderId } from '../lib/dispatcher-order.mjs';
 import { recognizeHostRefusal } from '../lib/host-refusal.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
+import { runLiveness } from '../lib/meta/run-liveness.mjs';
 import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
-import { isPidAlive, liveRuns, normalizePath, recentRuns } from './live-runs.mjs';
+import { liveRuns, normalizePath, recentRuns } from './live-runs.mjs';
 import { FORM, MAX_STATE_BLOCKS, STATE, takeTry } from './guard-tries.mjs';
 import { parseReply } from './reply-parser.mjs';
 import {
@@ -233,7 +234,9 @@ if (fs.existsSync(statusPath)) {
   }
 
   if (runStatus?.state === 'running') {
-    if (isPidAlive(runStatus.pid)) {
+    // Plan_57 D5/D27: a bare pid mistook a reused foreign process for this run's worker.
+    // The shared judge uses run identity and keeps unverified processes live (fail open).
+    if (runLiveness({ runDir, status: runStatus }).processMayBeAlive) {
       blockState(
         liveRunReason,
         liveRunStop(MAX_STATE_BLOCKS, runStatus, runDir),