@lyupro/codex-bridge 0.6.2 → 0.6.4

package/src/home/lib/meta/launch-rows.mjs

@@ -0,0 +1,45 @@
+/** Reply rows about facts the launcher recorded in status.json before the run began. */
+import path from 'node:path';
+import { line, readJson } from './paths.mjs';
+
+function formatBytes(bytes) {
+  const units = ['B', 'KB', 'MB', 'GB'];
+  let value = bytes;
+  let index = 0;
+  while (value >= 1024 && index < units.length - 1) {
+    value /= 1024;
+    index += 1;
+  }
+  return `${value.toFixed(1)} ${units[index]}`;
+}
+
+function retentionReply(runDir) {
+  const retention = readJson(path.join(runDir, 'status.json'))?.retention;
+  const bytes = Number(retention?.bytes_freed);
+  const runs = Number(retention?.runs);
+  const days = Number(retention?.days);
+  if (!Number.isFinite(bytes) || bytes <= 0 || !Number.isFinite(runs) || runs <= 0
+    || !Number.isFinite(days) || days <= 0) return null;
+  return `Retention: freed ${formatBytes(bytes)} from ${runs} runs older than ${days} days`;
+}
+
+// Five copies of Retention missed writeFailure(), so both reply assemblers share this point.
+// The 2026-09-16 dead Codex sandbox incident is why the launcher probes the sandbox at all.
+export function launchRows(runDir) {
+  const retention = retentionReply(runDir);
+  const rows = retention ? [retention] : [];
+  const probe = readJson(path.join(runDir, 'status.json'))?.sandbox_probe;
+  if (probe?.outcome === 'inconclusive') {
+    const reason = line(probe.reason, 160) || 'no reason recorded';
+    rows.push(`Sandbox probe: inconclusive — ${reason} The run started without a sandbox check.`);
+  }
+  return rows;
+}
+
+export function withLaunchRows(rows, runDir) {
+  const launch = launchRows(runDir);
+  if (!launch.length) return rows;
+  let at = rows.findIndex((row) => row.includes('Log: '));
+  if (at === -1) at = rows.findIndex((row) => row.startsWith('Run: '));
+  return at === -1 ? [...rows, ...launch] : [...rows.slice(0, at), ...launch, ...rows.slice(at)];
+}

package/src/home/lib/meta/reply.mjs

@@ -12,7 +12,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { AGENTS as AGENT_DEFINITIONS } from '../agents.mjs';
-import { changedPaths, line, readJson, readText } from './paths.mjs';
+import { changedPaths, line, readText } from './paths.mjs';
 import { splitRunChanges } from './environment.mjs';
 import { scoutCoverage } from './verdict.mjs';
 
@@ -25,27 +25,6 @@ const runChanges = (runDir) =>
 
 const readCommand = (runDir) => `codex-bridge read ${runDir}`;
 
-function formatBytes(bytes) {
-  const units = ['B', 'KB', 'MB', 'GB'];
-  let value = bytes;
-  let index = 0;
-  while (value >= 1024 && index < units.length - 1) {
-    value /= 1024;
-    index += 1;
-  }
-  return `${value.toFixed(1)} ${units[index]}`;
-}
-
-function retentionReply(runDir) {
-  const retention = readJson(path.join(runDir, 'status.json'))?.retention;
-  const bytes = Number(retention?.bytes_freed);
-  const runs = Number(retention?.runs);
-  const days = Number(retention?.days);
-  if (!Number.isFinite(bytes) || bytes <= 0 || !Number.isFinite(runs) || runs <= 0
-    || !Number.isFinite(days) || days <= 0) return null;
-  return `Retention: freed ${formatBytes(bytes)} from ${runs} runs older than ${days} days`;
-}
-
 export const AGENTS = {
   'codex-scout': {
     ...AGENT_DEFINITIONS['codex-scout'],
@@ -69,14 +48,12 @@ function scoutReply(ctx) {
   const top = (r.findings || [])[0];
   const unknowns = (r.unknowns || []).filter(Boolean);
   const coverage = scoutCoverage(ctx.runDir, r);
-  const retention = retentionReply(ctx.runDir);
   return [
     `OK — ${line(r.answer, 160)}`,
     // Any explicit question gets a coverage line, including a valid one-question order.
     ...(coverage ? [`Coverage: ${coverage}`] : []),
     `Key finding: ${top ? `${line(top.fact, 130)} (${line(top.where, 60)})` : 'no findings listed'}`,
     `Unresolved: ${unknowns.length ? line(unknowns.join('; '), 160) : 'none'}`,
-    ...(retention ? [retention] : []),
     `Report: ${ctx.file('report.md')} · Log: ${readCommand(ctx.runDir)}`,
   ];
 }
@@ -107,7 +84,6 @@ function buildReply(ctx) {
   const files = ctx.carried
     ? `${paths ? `${paths} · ` : ''}changes were made by an earlier run of this task`
     : paths || 'worktree untouched';
-  const retention = retentionReply(ctx.runDir);
   return [
     `OK — ${line(r.summary, 300)}`,
     `Files: ${touchedPaths.length} changed · ${files}`,
@@ -118,7 +94,6 @@ function buildReply(ctx) {
       : []),
     `Verification: ${verify} — ${verdict}`,
     `Flags: ${flags.length ? `${flags.length} TODO/skip — ${line(flags.slice(0, 3).join(' | '), 140)}` : 'none'}`,
-    ...(retention ? [retention] : []),
     `Report: ${ctx.file('report.md')} · Log: ${readCommand(ctx.runDir)}`,
   ];
 }
@@ -130,12 +105,10 @@ function reviewReply(ctx) {
     if (counts[f.severity] !== undefined) counts[f.severity] += 1;
   });
   const top = (r.findings || []).find((f) => f.severity === 'critical' || f.severity === 'high');
-  const retention = retentionReply(ctx.runDir);
   return [
     `OK — verdict ${line(r.verdict, 40)}`,
     `Findings: critical ${counts.critical} · high ${counts.high} · medium ${counts.medium} · low ${counts.low}`,
     `Top: ${top ? `${top.severity} ${line(top.file, 80)}:${top.line_start} — ${line(top.title, 90)}` : 'no critical or high findings'}`,
-    ...(retention ? [retention] : []),
     `Report: ${ctx.file(path.basename(ctx.resultPath))} · Log: ${readCommand(ctx.runDir)}`,
   ];
 }
@@ -168,7 +141,6 @@ export function withProfileRow(rows, meta) {
 }
 
 export function failReply(ctx, meta) {
-  const retention = retentionReply(ctx.runDir);
   return [
     `FAIL — ${line(meta.reason, 170)}`,
     `Artifacts: events.jsonl ${meta.events_bytes} B · stderr.log ${meta.stderr_bytes} B · ${path.basename(ctx.resultPath)} ${meta.result_ok ? 'filled' : 'empty or missing'} · exit=${meta.exit}`,
@@ -177,7 +149,6 @@ export function failReply(ctx, meta) {
     // and the orchestrator has to know whether there is something to revert before it decides
     // anything else.
     ...(ctx.agent === 'codex-build' ? [`Worktree: ${worktreeState(ctx.runDir)}`] : []),
-    ...(retention ? [retention] : []),
     `Log: ${readCommand(ctx.runDir)}`,
   ];
 }
@@ -200,7 +171,6 @@ function worktreeState(runDir) {
 }
 
 export function limitReply(ctx, meta) {
-  const retention = retentionReply(ctx.runDir);
   const rows = [
     'LIMIT — ChatGPT quota exhausted, work not completed',
     `Signal: ${line(meta.reason, 170)}`,
@@ -211,7 +181,6 @@ export function limitReply(ctx, meta) {
       `Worktree: ${touched.length ? `has unfinished changes (${touched.length}), see git-after.txt` : 'no new changes'}`,
     );
   }
-  if (retention) rows.push(retention);
   rows.push(`Log: ${readCommand(ctx.runDir)}`);
   return rows;
 }

package/src/home/lib/meta/run-liveness.mjs

@@ -0,0 +1,64 @@
+/**
+ * Judges whether a recorded run is still live and what state its artifacts support.
+ *
+ * Plan_57 D27 centralizes this rule after reply-guard's bare-pid check mistook a reused
+ * Windows pid for a live run, while the project list printed `running` for a dead run.
+ * Requiring the run folder keeps identity and artifact evidence in every judgment.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { heartbeatAge } from '../heartbeat.mjs';
+import {
+  IDENTITY_ALIVE,
+  IDENTITY_DEAD,
+  IDENTITY_FOREIGN,
+  IDENTITY_UNVERIFIED,
+  processIdentity,
+} from '../process-identity.mjs';
+import { readJson } from './paths.mjs';
+
+// Fail open: treating an unverified process as dead could close a live run and make
+// markAbandoned a second writer of its meta.json, or let another paid run write into
+// the same tree (the 2026-08-05 incident). Only a known-dead writer permits either.
+function identityMayBeAlive(identity) {
+  return identity === IDENTITY_ALIVE || identity === IDENTITY_UNVERIFIED;
+}
+
+export function runLiveness({ runDir, status, ...identityOptions }) {
+  if (typeof runDir !== 'string' || !runDir.trim()) {
+    throw new TypeError('runLiveness requires a non-empty runDir string');
+  }
+  if (status === undefined) status = readJson(path.join(runDir, 'status.json'));
+  const recordedState = status && typeof status === 'object' && typeof status.state === 'string'
+    ? status.state
+    : null;
+  const heartbeatAgeMs = heartbeatAge(runDir, identityOptions.now);
+  if (recordedState !== 'running') {
+    return { recordedState, identity: null, processMayBeAlive: null, heartbeatAgeMs, state: recordedState };
+  }
+
+  const identity = processIdentity({ runDir, status, ...identityOptions });
+  const processMayBeAlive = identityMayBeAlive(identity);
+  let state = identity === IDENTITY_ALIVE ? 'running' : 'unverified';
+  if (identity === IDENTITY_DEAD || identity === IDENTITY_FOREIGN) {
+    const metaPath = path.join(runDir, 'meta.json');
+    const meta = readJson(metaPath);
+    state = meta ? 'finished' : fs.existsSync(metaPath) ? 'unverified' : 'abandoned';
+  }
+  return { recordedState, identity, processMayBeAlive, heartbeatAgeMs, state };
+}
+
+/**
+ * D28: a worker can still be writing reply.txt after status.json records finished.
+ * This is for waiting on that worker during the closing window, not deciding the
+ * record's state; runLiveness preserves already-closed records without probing.
+ * @returns {boolean} Whether the recorded worker may still be alive, regardless of status.state.
+ */
+export function workerMayBeAlive({ runDir, status, ...identityOptions }) {
+  if (typeof runDir !== 'string' || !runDir.trim()) {
+    throw new TypeError('workerMayBeAlive requires a non-empty runDir string');
+  }
+  if (status === undefined) status = readJson(path.join(runDir, 'status.json'));
+  if (!status || typeof status !== 'object') return false;
+  return identityMayBeAlive(processIdentity({ runDir, status, ...identityOptions }));
+}

package/src/home/lib/meta/run-state.mjs

@@ -10,22 +10,25 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { changedPaths, line, normalizePath, readJson, readText, size } from './paths.mjs';
-import {
-  IDENTITY_ALIVE,
-  IDENTITY_UNVERIFIED,
-  processIdentity,
-} from '../process-identity.mjs';
+import { withLaunchRows } from './launch-rows.mjs';
+import { runLiveness } from './run-liveness.mjs';
 
 /**
- * Is this pid still running for this run? Unknown identity remains live here: treating an
- * unverified process as dead would mark a live run abandoned, and readers must fail open.
+ * Run state on disk, merged over whatever is already there. A killed runner leaves no
+ * report and no meta.json, and four abandoned folders from one order were indistinguishable
+ * from four runs still working — status.json is what makes that difference visible.
+ *
+ * It writes status.json and nothing else. Housekeeping facts such as `retention` live here and
+ * are read from here; an earlier attempt also appended them to meta.json, which would have made
+ * two functions write the same artifact and put the documented artifact order (meta.json before
+ * status.json is closed) at the mercy of whoever ran last.
  */
-const isAliveIdentity = (identity) => identity === IDENTITY_ALIVE || identity === IDENTITY_UNVERIFIED;
-
-const pidAlive = (pid, runDir, status = {}) => {
-  const identity = processIdentity({ runDir, status: { ...status, pid } });
-  return isAliveIdentity(identity);
-};
+export function writeStatus(runDir, patch) {
+  const current = readJson(path.join(runDir, 'status.json')) || {};
+  const next = { ...current, ...patch };
+  fs.writeFileSync(path.join(runDir, 'status.json'), `${JSON.stringify(next, null, 2)}\n`);
+  return next;
+}
 
 /**
  * This module deliberately judges by the run's pid identity alone, while hooks/live-runs.mjs also
@@ -43,23 +46,6 @@ const pidAlive = (pid, runDir, status = {}) => {
  * records the verdict — one writer, in the right order.
  */
 
-/**
- * Run state on disk, merged over whatever is already there. A killed runner leaves no
- * report and no meta.json, and four abandoned folders from one order were indistinguishable
- * from four runs still working — status.json is what makes that difference visible.
- *
- * It writes status.json and nothing else. Housekeeping facts such as `retention` live here and
- * are read from here; an earlier attempt also appended them to meta.json, which would have made
- * two functions write the same artifact and put the documented artifact order (meta.json before
- * status.json is closed) at the mercy of whoever ran last.
- */
-export function writeStatus(runDir, patch) {
-  const current = readJson(path.join(runDir, 'status.json')) || {};
-  const next = { ...current, ...patch };
-  fs.writeFileSync(path.join(runDir, 'status.json'), `${JSON.stringify(next, null, 2)}\n`);
-  return next;
-}
-
 /**
  * Closes out runs whose runner died without writing a verdict. Called at the start of every
  * run, so a folder left by a killed dispatcher gets an explicit state instead of reading as
@@ -83,9 +69,12 @@ export function markAbandoned(runsRoot, currentTree) {
     const runDir = path.join(runsRoot, entry.name);
     const status = readJson(path.join(runDir, 'status.json'));
     if (!status || status.state !== 'running') continue;
-    if (pidAlive(status.pid, runDir, status)) continue;
+    const liveness = runLiveness({ runDir, status });
+    if (liveness.state !== 'abandoned' && liveness.state !== 'finished') continue;
     const metaPath = path.join(runDir, 'meta.json');
     const meta = readJson(metaPath);
+    // The judge read meta.json already; this is a second read, and a failure here must still never
+    // turn an existing verdict into an abandoned FAIL (review 2026-09-17, Plan_57 D28).
     if (!meta && fs.existsSync(metaPath)) continue;
     let patch = meta
       ? { state: 'finished', status: meta.status, finished_at: meta.finished_at }
@@ -159,8 +148,8 @@ export function activeRunDetails(runsRoot, repo, agent = 'codex-build') {
     const status = readJson(path.join(runDir, 'status.json'));
     if (!status || status.state !== 'running' || status.agent !== agent) continue;
     if (normalizePath(status.repo) !== wanted) continue;
-    const identity = processIdentity({ runDir, status });
-    if (isAliveIdentity(identity)) return { run: entry.name, identity };
+    const { identity, processMayBeAlive } = runLiveness({ runDir, status });
+    if (processMayBeAlive) return { run: entry.name, identity };
   }
   return null;
 }
@@ -230,6 +219,9 @@ export function writeFailure(runDir, agent, reason, extraLines = [], preStart =
     status: 'FAIL',
     finished_at: meta.finished_at,
   });
-  const reply = [`FAIL — ${meta.reason}`, ...extraLines, `Run: ${runDir}`].join('\n');
+  const reply = withLaunchRows(
+    [`FAIL — ${meta.reason}`, ...extraLines, `Run: ${runDir}`],
+    runDir,
+  ).join('\n');
   return { meta, reply };
 }

package/src/home/lib/meta/verdict.mjs

@@ -315,6 +315,17 @@ export function resolveStatus({ resultOk, exit, agent, result, runDir, events })
   // Answers that never arrived, or arrived as coordinates. Scout-only, and per-question
   // only when questions.json is absent — see scoutCoverageGap().
   if (agent === 'codex-scout') {
+    // The 2026-09-16 dead sandbox produced nonempty evidence without reading code. Require an
+    // execution fact first: checking whether evidence paths existed falsely rejected 64/151 runs.
+    // Only a run that left a stream can prove it: an archived run from before `--json` has none and
+    // is judged by the contract of its day; a `--json` run missing its stream already failed above.
+    if (eventData.hasStream && eventData.commands_executed === 0) {
+      return {
+        status: 'FAIL',
+        reason: 'scout executed no command, so no answer rests on reading the code; '
+          + 'check stderr.log for sandbox refusals before changing the order',
+      };
+    }
     const gap = scoutCoverageGap(runDir, result);
     if (gap) return { status: 'FAIL', reason: gap };
   }

package/src/home/lib/runner/args.mjs

@@ -13,15 +13,18 @@ import { firstShellUnsafeSequence } from '../shell-unsafe.mjs';
 import { parseTaskDocument } from './task-file.mjs';
 
 export class RunnerUsageError extends Error {
-  constructor(message) {
+  // 2 says the order itself is wrong and has to be rewritten. A refusal about the state of the
+  // host or the worktree passes 1: the order was fine, nothing about it needs changing, and
+  // Plan_58 moved two such refusals here from a code path that already answered 1.
+  constructor(message, exitCode = 2) {
     super(message);
-    this.exitCode = 2;
+    this.exitCode = exitCode;
   }
 }
 
-export function die(message) {
+export function die(message, exitCode = 2) {
   console.error(`run-codex: ${message}`);
-  throw new RunnerUsageError(message);
+  throw new RunnerUsageError(message, exitCode);
 }
 
 export function readTaskDocument(opts) {

package/src/home/lib/runner/attach.mjs

@@ -2,7 +2,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { readJsonFileSync } from '../json-file.mjs';
-import { IDENTITY_DEAD, IDENTITY_FOREIGN, processAlive, processIdentity } from '../process-identity.mjs';
+import { workerMayBeAlive } from '../meta/run-liveness.mjs';
+import { processAlive } from '../process-identity.mjs';
 import { exitCodeFor, writeFailure, chainRuns } from '../write-meta.mjs';
 import { conflictingOrderOwner, runsForOrder } from './order-owner.mjs';
 
@@ -52,15 +53,6 @@ export const readJsonFile = (file) => {
   }
 };
 
-/**
- * Is this pid still running for this run? Unknown identity remains live so an attach does not
- * declare a worker dead merely because the identity probe was unavailable.
- */
-export const alive = (pid, runDir, status = {}) => {
-  const identity = processIdentity({ runDir, status: { ...status, pid } });
-  return identity !== IDENTITY_DEAD && identity !== IDENTITY_FOREIGN;
-};
-
 /**
  * Blocks until the worker's reply exists, or until the worker is provably gone without one.
  *
@@ -69,9 +61,9 @@ export const alive = (pid, runDir, status = {}) => {
  * probe for the whole length of a 20-minute run. Inside the loop the question is only whether the
  * number is still busy, which signal 0 answers for free.
  */
-export async function waitForReply(runDir, workerPid, status = {}) {
+export async function waitForReply(runDir, workerPid, status) {
   const replyPath = path.join(runDir, 'reply.txt');
-  if (!alive(workerPid, runDir, status)) {
+  if (!workerMayBeAlive({ runDir, status })) {
     return fs.existsSync(replyPath) ? fs.readFileSync(replyPath, 'utf8').replace(/\s+$/, '') : null;
   }
   let pollsSinceDeath = 0;
@@ -136,7 +128,7 @@ export async function attach({ runsRoot, repo, slug, taskHash, orderId, chain, i
       console.log(fs.readFileSync(path.join(dir, 'reply.txt'), 'utf8').replace(/\s+$/, ''));
       return exitCodeFor(readJsonFile(path.join(dir, 'meta.json'))?.status);
     }
-    if (alive(entry.status.pid, dir, entry.status)) {
+    if (workerMayBeAlive({ runDir: dir, status: entry.status })) {
       candidate = entry;
       break;
     }

package/src/home/lib/runner/codex-args.mjs

@@ -60,7 +60,15 @@ export function runProfile(opts) {
   };
 }
 
+// Plan_57: the preflight must probe the same permissions that the role will request.
+export function sandboxModeFor(agent) {
+  if (agent === 'codex-build') return 'workspace-write';
+  if (agent === 'codex-scout' || agent === 'codex-review') return 'read-only';
+  throw new Error(`unknown agent for sandbox mode: ${agent}`);
+}
+
 export function codexArgs(opts, runDir, isGitRepo) {
+  const sandboxMode = sandboxModeFor(opts.agent);
   const schema = path.join(runDir, 'schema.json');
   const profile = runProfile(opts);
   const effort = `model_reasoning_effort=${profile.effort}`;
@@ -80,7 +88,7 @@ export function codexArgs(opts, runDir, isGitRepo) {
       ...platformSandboxArgs(),
       ...modelArgs,
       '--sandbox',
-      'read-only',
+      sandboxMode,
       '--skip-git-repo-check',
       '-C',
       opts.repo,
@@ -105,7 +113,7 @@ export function codexArgs(opts, runDir, isGitRepo) {
       ...platformSandboxArgs(),
       ...modelArgs,
       '--sandbox',
-      'workspace-write',
+      sandboxMode,
       '-C',
       opts.repo,
       ...(isGitRepo ? [] : ['--skip-git-repo-check']),
@@ -139,7 +147,7 @@ export function codexArgs(opts, runDir, isGitRepo) {
     ...platformSandboxArgs(),
     ...modelArgs,
     '--sandbox',
-    'read-only',
+    sandboxMode,
     '-C',
     opts.repo,
     '--output-schema',

package/src/home/lib/runner/codex-cmd.mjs

@@ -11,7 +11,6 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createHeartbeat, HEARTBEAT_INTERVAL_MS } from '../heartbeat.mjs';
-import { writeFailure } from '../write-meta.mjs';
 import { MAX_LOG } from './git-state.mjs';
 
 // Thirty seconds, not a fraction of one: after `exit` the pipe still holds whatever Codex wrote
@@ -20,6 +19,8 @@ import { MAX_LOG } from './git-state.mjs';
 // left no event". The grace exists to bound a grandchild holding stdio open forever (2026-08-06,
 // run 2026-08-06_204007_build waited 25 minutes), and thirty seconds bounds that just as well.
 const STDIO_DRAIN_GRACE_MS = 30_000;
+// Plan_57 D28: a stalled taskkill must not block probe or paid-run deadline settlement forever.
+const TASKKILL_TIMEOUT_MS = 10_000;
 
 /**
  * An argument cmd.exe cannot be handed safely, or undefined. `%` is fatal because cmd
@@ -30,6 +31,17 @@ const STDIO_DRAIN_GRACE_MS = 30_000;
 export const unsafeForCmd = (args) =>
   ['codex', ...args].find((a) => a.includes('%') || a.includes('"'));
 
+// Plan_57: preflight and paid runs must use the same Windows quoting and npm shim path.
+export function codexSpawnSpec(args, platform = process.platform) {
+  if (platform !== 'win32') return { command: 'codex', args, options: {} };
+  const cmdline = ['codex', ...args].map((a) => (/[\s&|<>^]/.test(a) ? `"${a}"` : a)).join(' ');
+  return {
+    command: process.env.ComSpec || 'cmd.exe',
+    args: ['/d', '/s', '/c', `"${cmdline}"`],
+    options: { windowsVerbatimArguments: true, windowsHide: true },
+  };
+}
+
 /**
  * Stop the process that owns the Codex invocation. On Windows that process is cmd.exe, so
  * child.kill() would reap only the shell and leave Codex spending quota as its grandchild —
@@ -44,10 +56,91 @@ export function stopCodex(child, onWindows = process.platform === 'win32') {
   const killed = spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], {
     stdio: 'ignore',
     windowsHide: true,
+    timeout: TASKKILL_TIMEOUT_MS,
   });
   if (killed.error || killed.status !== 0) child.kill();
 }
 
+// Plan_57 D28: keep spawnSync's 1 MiB default (stdout head, stderr tail); overflow is inconclusive, never dead.
+const CAPTURE_LIMIT_BYTES = 1024 * 1024;
+const CAPTURE_CLOSE_GRACE_MS = 2_000;
+const CAPTURE_STOP_GRACE_MS = 5_000;
+
+/**
+ * Plan_57 D24: async capture lets the deadline stop the whole Windows process tree,
+ * preventing the 2026-07-31 orphan that spawnSync's shell-only timeout leaves behind.
+ * Bounded pipe draining also prevents the inherited-stdio hang of 2026-08-06.
+ */
+export function spawnCaptured(command, args, options) {
+  const { timeout, encoding, shell, ...rest } = options ?? {};
+  if (typeof timeout !== 'number' || !Number.isFinite(timeout) || timeout <= 0) {
+    throw new TypeError('spawnCaptured requires a finite timeout greater than zero');
+  }
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { ...rest, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    let captureError = null;
+    let settled = false;
+    let stopped = false;
+    let deadlineTimer;
+    let closeTimer;
+    let stopTimer;
+    const finish = (status, signal, error, destroyStreams = false) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadlineTimer);
+      clearTimeout(closeTimer);
+      clearTimeout(stopTimer);
+      if (destroyStreams) {
+        child.stdout.destroy();
+        child.stderr.destroy();
+        child.unref();
+      }
+      resolve({ status, signal, error, stdout: stdout.toString('utf8'), stderr: stderr.toString('utf8') });
+    };
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      stopCodex(child);
+    };
+    const onPipeError = (error) => {
+      if (settled) return;
+      stop();
+      finish(null, null, error, true);
+    };
+    child.stdout.on('error', onPipeError);
+    child.stderr.on('error', onPipeError);
+    child.stdout.on('data', (chunk) => {
+      const incoming = Buffer.from(chunk);
+      const room = CAPTURE_LIMIT_BYTES - stdout.length;
+      if (incoming.length > room && !captureError) {
+        captureError = Object.assign(new Error(`stdout exceeded ${CAPTURE_LIMIT_BYTES} bytes`), { code: 'ENOBUFS' });
+      }
+      if (room > 0) stdout = Buffer.concat([stdout, incoming.subarray(0, room)]);
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr = Buffer.concat([stderr, Buffer.from(chunk)]);
+      if (stderr.length > CAPTURE_LIMIT_BYTES) stderr = stderr.subarray(-CAPTURE_LIMIT_BYTES);
+    });
+    child.on('error', (error) => finish(null, null, error, true));
+    child.on('close', (code, signal) => finish(code, signal, captureError));
+    child.on('exit', (code, signal) => {
+      if (settled) return;
+      clearTimeout(deadlineTimer);
+      clearTimeout(stopTimer);
+      closeTimer = setTimeout(() => finish(code, signal, captureError, true), CAPTURE_CLOSE_GRACE_MS);
+    });
+    deadlineTimer = setTimeout(() => {
+      captureError = Object.assign(new Error(`timed out after ${timeout} ms`), { code: 'ETIMEDOUT' });
+      stop();
+      if (!settled) {
+        stopTimer = setTimeout(() => finish(null, null, captureError, true), CAPTURE_STOP_GRACE_MS);
+      }
+    }, timeout);
+  });
+}
+
 /**
  * Windows npm ships `codex` as codex.cmd, and Node refuses to spawn .cmd without a
  * shell. One command line through cmd.exe keeps a single code path; every argument is
@@ -129,21 +222,17 @@ export function runCodex(args, taskText, eventsPath, budgetMinutes, graceMs = ST
     return { append, finish };
   })();
 
-  let child;
   if (onWindows) {
     // Thrown rather than died: in the worker a bare exit would leave the run open, while a
     // throw goes through the crash handler and closes it with meta.json like any failure.
     const bad = unsafeForCmd(args);
     if (bad) throw new Error(`argument unsafe for cmd.exe (contains % or "): ${bad}`);
-    const cmdline = ['codex', ...args].map((a) => (/[\s&|<>^]/.test(a) ? `"${a}"` : a)).join(' ');
-    child = spawn(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `"${cmdline}"`], {
-      windowsVerbatimArguments: true,
-      windowsHide: true,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-  } else {
-    child = spawn('codex', args, { stdio: ['pipe', 'pipe', 'pipe'] });
   }
+  const spec = codexSpawnSpec(args);
+  const child = spawn(spec.command, spec.args, {
+    ...spec.options,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
 
   return new Promise((resolve) => {
     let failed = false;
@@ -249,20 +338,17 @@ export function runCodex(args, taskText, eventsPath, budgetMinutes, graceMs = ST
 
 /**
  * Codex missing or not authorised is a deterministic FAIL, never a reason to improvise.
- * Runs after the folder exists so this failure is recorded like any other.
+ * Plan_58, 2026-09-19: return a reason for refusal before registration, like the dead-sandbox
+ * probe. One no-quota question must not have two answers about whether it leaves a folder.
  */
-export function requireCodex(runDir, agent) {
+export function codexUnavailableReason() {
   const probe = spawnSync(
     process.platform === 'win32' ? process.env.ComSpec || 'cmd.exe' : 'codex',
     process.platform === 'win32' ? ['/d', '/s', '/c', 'codex --version'] : ['--version'],
     { encoding: 'utf8' },
   );
   if (probe.error || probe.status !== 0) {
-    const why = (probe.stderr || probe.error?.message || 'codex --version is not responding').trim();
-    const { reply } = writeFailure(runDir, agent, `Codex CLI unavailable: ${why}`, [
-      'Operator check: codex --version (and codex login if authorization is rejected)',
-    ], true);
-    console.log(reply);
-    process.exit(1);
+    return (probe.stderr || probe.error?.message || 'codex --version is not responding').trim();
   }
+  return null;
 }

package/src/home/lib/runner/git-state.mjs

@@ -40,7 +40,12 @@ export function worktreeSnapshot(repo) {
   const skip = runsPrefixInside(repo);
   // The path is the third tab-separated field in both git outputs used here.
   const mine = (line) => Boolean(skip) && (line.split('\t')[2] || '').startsWith(skip);
-  const tracked = (git(repo, ['diff', 'HEAD', '--numstat']).stdout || '')
+  // `--no-renames` because every reader of this snapshot compares paths against a scope: with
+  // rename detection on, numstat prints one row spelled `old => new` (or `dir/{a => b}/file`),
+  // which is not a path and matches no pattern — an in-scope rename would be judged a stray, and
+  // the witness named that token at the orchestrator on 2026-09-20. Without it a rename is a
+  // deletion plus an addition: two rows, both real paths, both judged on their own merits.
+  const tracked = (git(repo, ['diff', 'HEAD', '--numstat', '--no-renames']).stdout || '')
     .split(/\r?\n/)
     .filter((line) => line.trim() && !mine(line))
     .join('\n')