@openrig/cli 0.6.10 → 0.6.12

package/daemon/dist/startup.js

@@ -25,6 +25,8 @@ import { TmuxAdapter } from "./adapters/tmux.js";
 import { setDaemonTmuxServer, tmuxServerArgs } from "./adapters/tmux-server.js";
 import { CmuxAdapter } from "./adapters/cmux.js";
 import { execArgvCommand, execCommand } from "./adapters/tmux-exec.js";
+import { tmuxControlExec } from "./adapters/tmux-control.js";
+import { boundedProbeExec } from "./adapters/bounded-probe-exec.js";
 import { execPreflightCommand } from "./adapters/preflight-exec.js";
 import { createCmuxCliTransport } from "./adapters/cmux-transport.js";
 import { SnapshotRepository } from "./domain/snapshot-repository.js";
@@ -36,6 +38,10 @@ import { ClaudeResumeAdapter } from "./adapters/claude-resume.js";
 import { CodexResumeAdapter } from "./adapters/codex-resume.js";
 import { codexDaemonSupportProbe } from "./domain/codex-daemon-support.js";
 import { codexNetworkDefaultReader } from "./domain/codex-network-default.js";
+import { codexUsageReader } from "./domain/provider/codex-usage-reader.js";
+import { CodexUsageWindows } from "./domain/provider/codex-usage-windows.js";
+import { claudeAuthStatusReader } from "./domain/provider/claude-auth-status-reader.js";
+import { ClaudeUsageWindows, latestClaudeWindowSamples } from "./domain/provider/claude-usage-windows.js";
 import { prepareCodexTeamWorkspace } from "./domain/codex-team-workspace.js";
 import { PiResumeAdapter } from "./adapters/pi-resume.js";
 import { OmpResumeAdapter } from "./adapters/omp-resume.js";
@@ -72,6 +78,7 @@ import { PodBundleSourceResolver } from "./domain/bundle-source-resolver.js";
 import { PsProjectionService } from "./domain/ps-projection.js";
 import { SeatActivityService } from "./domain/seat-activity-service.js";
 import { readClaudeSelfReportEvidence } from "./adapters/claude-code-adapter.js";
+import { replaceFile } from "./adapters/replace-file.js";
 import { SeatStructuralActivityService } from "./domain/seat-structural-activity-service.js";
 import { deriveSelfHostIdSource, SeatIdentityReconciler, reconcileSelfHostIdentity } from "./domain/seat-identity-reconciler.js";
 import { SeatIdentityStore, SelfHostIdentityStore } from "./domain/seat-identity-store.js";
@@ -83,8 +90,8 @@ import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
 import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
 import { observeClaudePaneStartedAt } from "./domain/native-process-lineage.js";
 import { TranscriptStore } from "./domain/transcript-store.js";
-import { resumeRunningTranscriptCaptures } from "./domain/transcript-capture.js";
-import { SessionTransport } from "./domain/session-transport.js";
+import { resumeRunningTranscriptCaptures, wireTranscriptCaptureStops } from "./domain/transcript-capture.js";
+import { probeSessionActivity, SessionTransport } from "./domain/session-transport.js";
 import { AgentActivityStore } from "./domain/agent-activity-store.js";
 import { HistoryQuery } from "./domain/history-query.js";
 import { AskService } from "./domain/ask-service.js";
@@ -151,7 +158,9 @@ import { MissionControlNotificationDispatcher } from "./domain/mission-control/n
 import { NtfyNotificationAdapter } from "./domain/mission-control/notification-adapter-ntfy.js";
 import { WebhookNotificationAdapter } from "./domain/mission-control/notification-adapter-webhook.js";
 import { OPENRIG_HOME } from "./openrig-compat.js";
+import { homeIsolationAdvisory } from "./domain/home-isolation.js";
 import { materializeBuiltinPolicyReference } from "./domain/builtin-policy-reference.js";
+import { withCommunityHarnessResolver, withCommunityHarnesses } from "./adapters/community-harness-runtime-adapter.js";
 import { ensureActivityHookToken, writeActivityEndpointFile, deriveActivityUrl, readActivityEndpointFile } from "./domain/activity-endpoint.js";
 import { getCompatibleOpenRigPath, getDefaultOpenRigPath, readOpenRigEnv, } from "./openrig-compat.js";
 const KNOWN_PROVIDER_AUTH_ENV = new Set([
@@ -195,6 +204,7 @@ const OMP_PROVIDER_AUTH_ENV = Object.fromEntries([
     ...Object.values(OMP_PROVIDER_ENV_VARS),
     ...Object.values(OMP_PROVIDER_EXTRA_ENV_VARS).flat(),
 ].map((name) => [name, true]));
+/** Select configured provider credentials from the launch environment allowlist. */
 export function collectAllowlistedProviderAuthEnv(raw, env, runtime) {
     const admitOmp = runtime === "omp";
     const out = {};
@@ -213,6 +223,7 @@ export function collectAllowlistedProviderAuthEnv(raw, env, runtime) {
     }
     return out;
 }
+/** Assemble the daemon services and runtime adapters using the selected installation assets. */
 export async function createDaemon(opts) {
     const daemonHome = os.homedir();
     const configuredCodexHome = process.env.CODEX_HOME || undefined;
@@ -220,6 +231,9 @@ export async function createDaemon(opts) {
         throw new Error(`CODEX_HOME must be an absolute path for managed seats: ${configuredCodexHome}`);
     }
     const codexHome = configuredCodexHome || nodePath.join(daemonHome, ".codex");
+    const homeIsolation = homeIsolationAdvisory({ openrigHome: OPENRIG_HOME, home: daemonHome, codexHome: configuredCodexHome });
+    if (homeIsolation)
+        console.warn(homeIsolation);
     // Only the explicit selection overrides a pane rc or the legacy PID-home
     // reader. The resolved default remains the writer/network-reader/session root.
     const dbPath = opts?.dbPath ?? ":memory:";
@@ -407,8 +421,13 @@ export async function createDaemon(opts) {
     // boot without creating jobs: additive coverage stays loud, core boot stays live.
     watchdogAutoRegistration.assertLiveSeatCoverage();
     const watchdogHistoryLogInstance = new WatchdogHistoryLog(db);
-    const argvExec = opts?.argvExec
-        ?? (opts?.tmuxExec ? undefined : process.platform === "win32" ? execArgvCommand : undefined);
+    // An injected string exec keeps the shell path, so its fake sees every command. OPENRIG_TMUX_SHELL=1 keeps it too.
+    const spawnedArgvExec = opts?.argvExec
+        ?? (opts?.tmuxExec || (process.env.OPENRIG_TMUX_SHELL === "1" && process.platform !== "win32") ? undefined : execArgvCommand);
+    // OPENRIG_TMUX_CONTROL=1 drives the real tmux through one control-mode client (tmux-control.ts); by default a client
+    // is spawned per command. An injected exec is the test's own, and psmux has no control mode.
+    const argvExec = spawnedArgvExec === execArgvCommand && process.platform !== "win32" && process.env.OPENRIG_TMUX_CONTROL === "1"
+        ? tmuxControlExec(execArgvCommand) : spawnedArgvExec;
     const tmuxAdapter = new TmuxAdapter(opts?.tmuxExec ?? execCommand, undefined, argvExec);
     // The real tmux runs with this process's environment, so its server is the one $TMUX names.
     // An injected exec has no server of its own: printed attach commands stay in the default form.
@@ -425,6 +444,17 @@ export async function createDaemon(opts) {
     const seatActivityService = new SeatActivityService({
         tmux: tmuxAdapter,
         defaultWindowSeconds: 3,
+        permissionPromptReader: async (sessionName) => {
+            const activity = await probeSessionActivity({ sessionName, runtime: "codex", attachmentType: "tmux", tmuxAdapter });
+            if (activity.state === "unknown")
+                return null;
+            return activity.state === "needs_input" && ["permission_prompt", "selection_prompt"].includes(activity.reason);
+        },
+        permissionPromptChanged: (sessionName, confirmed) => {
+            const latest = agentActivityStore.getLatestForNode({ sessionName });
+            agentActivityStore.recordHookEvent({ sessionName, runtime: "codex", generation: latest?.generation,
+                hookEvent: confirmed ? "PermissionPromptConfirmed" : "PermissionPromptCleared" });
+        },
         eventBus,
         // S19 — the Claude self-report rung (pid.json), consulted per sweep for seats whose
         // declared inventory staffs it; unreadable = null = the ladder falls, never errors.
@@ -537,19 +567,39 @@ export async function createDaemon(opts) {
     const snapshotCapture = new SnapshotCapture({ db, rigRepo, sessionRegistry, eventBus, snapshotRepo, checkpointStore });
     const claudeManagedLaunch = new ClaudeManagedLaunch(db, { ...launchSessionEnv, CLAUDE_CONFIG_DIR: process.env.CLAUDE_CONFIG_DIR }, {
         OPENRIG_CLAUDE_DISABLE_ALTERNATE_SCREEN: process.env.OPENRIG_CLAUDE_DISABLE_ALTERNATE_SCREEN,
-    });
+    }, (session, key) => tmuxAdapter.getSessionEnv(session, key));
     const claudeResume = new ClaudeResumeAdapter(tmuxAdapter, { claudeManagedLaunch, seatLaunchEnvironment });
     // #275: one reader for both Codex launch adapters, with the PATH, HOME and CODEX_HOME a seat session gets.
     const readCodexNetworkDefault = codexNetworkDefaultReader({ launchPath: process.env.PATH, home: daemonHome, codexHome });
     const prepareTeamWorkspace = (sessionName) => prepareCodexTeamWorkspace(sessionName, new ContextPackSettingsStore().resolveConfig().workspaceRoot, process.env.OPENRIG_SHARED_DOCS_ROOT?.trim() || nodePath.join(daemonHome, ".openrig", "shared-docs"), daemonHome);
-    const codexResume = new CodexResumeAdapter(tmuxAdapter, { prepareTeamWorkspace, seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
+    const codexResume = new CodexResumeAdapter(tmuxAdapter, { ensureManagedConfig: () => codexAdapter.ensureManagedConfig(), prepareTeamWorkspace, seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
     // OPR.0.4.6.PI1 — the Pi seat-state root + the compiled runner entry (daemon
     // dist). Shared by the Pi runtime adapter, the resume adapter, and the
     // resume-token capture sidecar reader.
     const piStateRoot = nodePath.join(OPENRIG_HOME, "state", "pi");
     const ompStateRoot = nodePath.join(OPENRIG_HOME, "state", "omp");
     const piRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/pi-runner.js");
-    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath }, { seatLaunchEnvironment });
+    // OPR.0.7.0.2: Pi seats report cost facts from persisted entries only while usage.pi_cost_facts is on;
+    // read at each launch and resume, so the switch takes effect at the next one.
+    const piUsageFactsEnabled = () => {
+        try {
+            return new ContextPackSettingsStore().resolveOne("usage.pi_cost_facts").value === true;
+        }
+        catch {
+            return false;
+        }
+    };
+    // OPR.0.7.0.2 K4: Pi seats look up OpenRouter's actual charge only while usage.pi_openrouter_charge is on (and
+    // only alongside usage.pi_cost_facts); read at each launch and resume.
+    const piOpenRouterChargeEnabled = () => {
+        try {
+            return new ContextPackSettingsStore().resolveOne("usage.pi_openrouter_charge").value === true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath }, { seatLaunchEnvironment, usageFactsEnabled: piUsageFactsEnabled, openRouterChargeEnabled: piOpenRouterChargeEnabled });
     const ompResume = new OmpResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: ompStateRoot, runnerEntryPath: piRunnerEntryPath });
     // Services infrastructure (RigEnv) — created early so restore/bootstrap can use it
     const { ComposeServicesAdapter } = await import("./adapters/compose-services-adapter.js");
@@ -602,6 +652,7 @@ export async function createDaemon(opts) {
     // Transcript rotators are process-local. Reattach them after lifecycle
     // reconciliation so surviving tmux sessions keep ingesting across daemon
     // restarts while genuinely detached sessions stay excluded.
+    wireTranscriptCaptureStops(db, eventBus);
     try {
         await resumeRunningTranscriptCaptures(db, tmuxAdapter, transcriptStore);
     }
@@ -640,7 +691,9 @@ export async function createDaemon(opts) {
     // Phase 5: Bootstrap services
     const bootstrapRepo = new BootstrapRepository(db);
     const exec = opts?.tmuxExec ?? execCommand;
-    const runtimeVerifier = new RuntimeVerifier({ exec, db });
+    // Runtime --version/--help probes are bounded and end their process group: startup awaits the Codex probe
+    // before it listens (fresh DB), so a hung binary must not hold it. An injected test exec keeps probing as given.
+    const runtimeVerifier = new RuntimeVerifier({ exec, db, ...(opts?.tmuxExec ? {} : { probeExec: boundedProbeExec() }) });
     const probeRegistry = new RequirementsProbeRegistry(exec);
     const externalInstallPlanner = new ExternalInstallPlanner();
     const externalInstallExecutor = new ExternalInstallExecutor({ exec, db });
@@ -650,6 +703,7 @@ export async function createDaemon(opts) {
         exists: (p) => fs.existsSync(p),
         listFiles: (dirPath) => {
             const results = [];
+            /** Walk installation files and collect their relative paths. */
             function walk(dir, prefix) {
                 for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
                     if (entry.isDirectory())
@@ -686,27 +740,42 @@ export async function createDaemon(opts) {
     const { OmpRuntimeAdapter } = await import("./adapters/omp-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
     const runtimeSettings = new ContextPackSettingsStore().resolveConfig();
-    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, claudeManagedLaunch, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, claudeManagedLaunch, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: replaceFile, listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
             } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
-    const codexAdapter = new CodexRuntimeAdapter({ prepareTeamWorkspace, tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const codexAdapter = new CodexRuntimeAdapter({ prepareTeamWorkspace, tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), resolveHooksEnabled: async () => {
+            const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
+            return new SettingsStore().resolveOne("runtime.codex.hooks_enabled").value;
+        }, resolveManagedConfigSettings: async () => {
+            const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
+            const enabled = new SettingsStore().resolveOne("runtime.codex.hooks_enabled").value;
+            const row = db.prepare("SELECT version FROM runtime_verifications WHERE runtime = 'codex' ORDER BY verified_at DESC LIMIT 1").get();
+            if (row?.version)
+                return { enabled, codexVersion: row.version };
+            try {
+                return { enabled, codexVersion: (await runtimeVerifier.verifyCodex()).version ?? undefined };
+            }
+            catch {
+                return { enabled }; /* codex not available — skip feature flag */
+            }
+        } });
     // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
     // shape as the Codex adapter; seat isolation roots under piStateRoot.
-    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m) }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
-    const ompAdapter = new OmpRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m) }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath, usageFactsEnabled: piUsageFactsEnabled, openRouterChargeEnabled: piOpenRouterChargeEnabled });
+    const ompAdapter = new OmpRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
@@ -716,7 +785,7 @@ export async function createDaemon(opts) {
     // Same fsOps shape as Pi; the compiled runner entry lives in the daemon dist.
     const { StubRuntimeAdapter } = await import("./adapters/stub-runtime-adapter.js");
     const stubRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/stub-runner.js");
-    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
@@ -729,33 +798,16 @@ export async function createDaemon(opts) {
     // Operator can disable Codex hooks via OPENRIG_RUNTIME_CODEX_HOOKS_ENABLED
     // or rig config set runtime.codex.hooks_enabled false.
     try {
-        const { SettingsStore, ensureDefaultClaudeCompactionFiles, } = await import("./domain/user-settings/settings-store.js");
+        const { ensureDefaultClaudeCompactionFiles } = await import("./domain/user-settings/settings-store.js");
         ensureDefaultClaudeCompactionFiles(OPENRIG_HOME);
-        const settingsStore = new SettingsStore();
-        const enabled = settingsStore.resolveOne("runtime.codex.hooks_enabled").value;
-        let codexVersion;
-        const codexVersionRow = db.prepare("SELECT version FROM runtime_verifications WHERE runtime = 'codex' ORDER BY verified_at DESC LIMIT 1").get();
-        if (codexVersionRow?.version) {
-            codexVersion = codexVersionRow.version;
-        }
-        else {
-            try {
-                const verifyResult = await runtimeVerifier.verifyCodex();
-                codexVersion = verifyResult.version ?? undefined;
-            }
-            catch { /* codex not available — skip feature flag */ }
-        }
-        codexAdapter.ensureCodexFeatureFlag(enabled, { codexVersion });
-        // OPR.0.4.1.10 FR-A — project the OpenRig activity hooks into the Codex config
-        // layer so Codex seats are hook-PRIMARY for the rig-send prompt guard (and gain
-        // SessionStart/UserPromptSubmit/Stop observability) from clean shipped config.
-        // Same enable gate as the feature flag; trust is auto-cleared at launch.
-        if (enabled) {
-            codexAdapter.ensureCodexActivityHooks();
+        // The Codex config is the user's file: write it at boot only when this daemon already
+        // has a Codex seat; otherwise the first Codex launch ensures it (CodexRuntimeAdapter.prepareLaunch).
+        // A disabled hooks setting still strips a stale managed block at every boot.
+        if (db.prepare("SELECT 1 FROM nodes WHERE runtime = 'codex' LIMIT 1").get()) {
+            await codexAdapter.ensureManagedConfig();
         }
         else {
-            // OPR.0.4.1.10 B3 — durable disable: strip any previously-written managed [hooks] block.
-            codexAdapter.removeCodexActivityHooks();
+            await codexAdapter.stripManagedHooksIfDisabled();
         }
     }
     catch (err) {
@@ -777,6 +829,7 @@ export async function createDaemon(opts) {
             mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
             listFiles: (dir) => {
                 const r = [];
+                /** Collect relative file paths recursively. */
                 function w(d, pre) {
                     for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                         if (e.isDirectory())
@@ -925,7 +978,7 @@ export async function createDaemon(opts) {
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
-        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        adapters: withCommunityHarnesses({ "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() }, { tmux: tmuxAdapter, seatLaunchEnvironment }),
         tmuxAdapter,
         agentImageLibrary,
         continuityPolicyMaterializer,
@@ -1104,12 +1157,13 @@ export async function createDaemon(opts) {
     // than constructed with) so service construction order is untouched.
     {
         const { recordCodexLimitBanner } = await import("./domain/provider/codex-limit-banner.js");
-        seatStructuralActivityService.attachCodexLimitBanner((sessionName, banner) => {
+        seatStructuralActivityService.attachCodexLimitBanner((sessionName, banner, observedAt) => {
             recordCodexLimitBanner({
                 store: agentActivityStore,
                 resolveGeneration: (s) => sessionRegistry.currentOccupantGenerationForSession(s),
                 sessionName,
                 banner,
+                now: () => observedAt,
             });
         });
     }
@@ -1133,6 +1187,14 @@ export async function createDaemon(opts) {
     // Capture compatibility before the spec-library initializer creates the primary directory.
     const userSpecLibraryRoot = getDefaultOpenRigPath("specs");
     const compatibleSpecLibraryRoot = getCompatibleOpenRigPath("specs");
+    const runtimeAdaptersMap = withCommunityHarnessResolver({
+        "claude-code": claudeAdapter,
+        "codex": codexAdapter,
+        "pi": piAdapter,
+        "omp": ompAdapter,
+        "stub": stubAdapter,
+        "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter(),
+    }, { tmux: tmuxAdapter, seatLaunchEnvironment });
     const deps = {
         rigRepo,
         sessionRegistry,
@@ -1157,6 +1219,18 @@ export async function createDaemon(opts) {
             listRigs: () => rigRepo.listRigs(),
             collectClaudeSignals: () => collectClaudeSignalsFromProviderUsageDirectory(providerUsageDirectory(OPENRIG_HOME), undefined, legacyProviderUsageDirectory(OPENRIG_HOME)),
             agentActivityStore,
+            // Slice 01: Codex and Claude usage windows, off unless provider.usage_windows is on (read per call). The native
+            // readers (Codex's app-server; Claude's auth status, for identity) run only on an explicit refresh, with the
+            // PATH, HOME, CODEX_HOME and CLAUDE_CONFIG_DIR a seat session gets. Claude's windows are the seats' status-line
+            // samples (usage_samples), read on every view.
+            usageWindows: {
+                enabled: () => new ContextPackSettingsStore().resolveOne("provider.usage_windows").value === true,
+                windows: new CodexUsageWindows({ read: codexUsageReader({ launchPath: process.env.PATH, home: daemonHome, codexHome }) }),
+                claude: new ClaudeUsageWindows({
+                    readIdentity: claudeAuthStatusReader({ launchPath: process.env.PATH, home: daemonHome, claudeConfigDir: process.env.CLAUDE_CONFIG_DIR }),
+                    listSamples: () => latestClaudeWindowSamples(db),
+                }),
+            },
         }),
         restoreOrchestrator,
         resumeMetadataRefresher, // OPR.0.4.3.20 FR-4 — manual snapshot refresh-before-serialize
@@ -1197,7 +1271,7 @@ export async function createDaemon(opts) {
         }),
         podInstantiator,
         podBundleSourceResolver,
-        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        runtimeAdapters: runtimeAdaptersMap,
         transcriptStore,
         sessionTransport: (() => {
             const t = new SessionTransport({
@@ -1210,6 +1284,16 @@ export async function createDaemon(opts) {
                 slowOpRecorder,
                 activityEndpointFile: () => readActivityEndpointFile(OPENRIG_HOME),
                 captureObserver: shadow.capture?.observer,
+                runtimeAdapters: runtimeAdaptersMap,
+                // transport.verify_input_box, read at each verified Claude Code or Codex send (absent or unreadable = off).
+                verifyInputBox: () => {
+                    try {
+                        return new ContextPackSettingsStore().resolveOne("transport.verify_input_box").value === true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
             });
             // PL-004 Phase A revision (R1): wire QueueRepository's wake-path so
             // create / handoff / handoff-and-complete nudge by default.
@@ -1952,16 +2036,11 @@ export async function createDaemon(opts) {
                         const parkedDeps = {
                             getSeatState: (seatNodeId) => seatActivityService.getSeatState(seatNodeId),
                             listOpenObligations: (destinationSession, limit) => ({
-                                rows: queueRepoInstance
-                                    .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit })
-                                    .map((r) => ({
-                                    qitemId: r.qitemId,
-                                    state: r.state,
-                                    summary: r.summary ?? null,
-                                })),
+                                rows: queueRepoInstance.listOpenObligations(destinationSession, limit),
                                 limit,
                             }),
                             getParkWake: (qitemId) => queueRepoInstance.getParkWakeStatus(qitemId),
+                            servedByOwnReminder: (qitemId) => queueRepoInstance.parkWakeServedByOwnReminder(qitemId),
                         };
                         return diagnoseRigParked(parkedDeps, seats.map((s) => ({ seatNodeId: s.node_id, sessionName: s.session_name })));
                     },
@@ -1976,7 +2055,7 @@ export async function createDaemon(opts) {
                         recoveryOwnsWake: (qitemId) => queueRecoveryOwnsWake(db, queueRepoInstance.getById(qitemId)),
                         listTransitions: (qitemId) => queueRepoInstance
                             .listTransitions(qitemId)
-                            .map((t) => ({ ts: t.ts, transitionNote: t.transitionNote ?? null })),
+                            .map((t) => ({ ts: t.ts, transitionNote: t.transitionNote ?? null, actorSession: t.actorSession, state: t.state, transitionId: t.transitionId })),
                         appendNote: (qitemId, note) => {
                             const row = queueRepoInstance.getById(qitemId);
                             if (!row || !isBlockerLive(row.state))
@@ -1989,10 +2068,9 @@ export async function createDaemon(opts) {
                             return { ok: true };
                         },
                         recordNudgeResult: (qitemId, result) => queueRepoInstance.recordNudgeAttempt(qitemId, result),
-                        listOpenIds: (destinationSession) => queueRepoInstance
-                            .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit: 500 })
-                            .map((r) => r.qitemId),
+                        listOpenIds: (destinationSession) => queueRepoInstance.listOpenObligations(destinationSession, 500).map((r) => r.qitemId),
                     },
+                    occupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
                 }),
                 // OPR.0.5.6.1 AM-F1 — the delivery engine's two timing legs on THIS
                 // substrate. The gateway dispatch binds late (the subsystem is built
@@ -2095,7 +2173,7 @@ export async function createDaemon(opts) {
         {
             const { ModelDivergenceMonitor } = await import("./domain/model-divergence/model-divergence-monitor.js");
             const { readClaudeEffectiveModel, readCodexEffectiveModel } = await import("./domain/model-divergence/effective-model-readers.js");
-            const { resolveIdentityVerifiedClaudeRecord, resolveLiveCodexThreadId } = await import("./domain/model-divergence/current-generation-record.js");
+            const { readCurrentPiOccupantModel, resolveIdentityVerifiedClaudeRecord, resolveLiveCodexThreadId } = await import("./domain/model-divergence/current-generation-record.js");
             const { defaultListProcesses } = await import("./domain/resume-metadata-refresher.js");
             const { readCodexThreadIdFromCandidateHomes, defaultResolveHomeDirByPid } = await import("./domain/codex-thread-id.js");
             const nodeOs = await import("node:os");
@@ -2175,6 +2253,24 @@ export async function createDaemon(opts) {
                             ? { ok: true, model }
                             : { ok: false, reason: `no assistant turn yet in the current occupant record ${selection.path} (selected from ${selection.source})` };
                     }
+                    if (seat.runtime === "pi") {
+                        const binding = sessionRegistry.getBindingForNode(seat.nodeId);
+                        return readCurrentPiOccupantModel({
+                            sessionName: seat.sessionName,
+                            pinnedModel: seat.pinnedModel,
+                            generation: seat.generation,
+                            occupantBootAt: sessionRegistry.currentOccupantTenure(seat.nodeId)?.bootAt ?? null,
+                            binding: binding ? { tmuxSession: binding.tmuxSession, tmuxPane: binding.tmuxPane } : null,
+                            runner: piAdapter.readRunnerSidecar(seat.sessionName),
+                        }, genDeps, (path) => {
+                            try {
+                                return nodeFs.realpathSync(path);
+                            }
+                            catch {
+                                return null;
+                            }
+                        });
+                    }
                     return { ok: false, reason: `runtime ${seat.runtime ?? "unknown"} has no effective-model reader yet` };
                 },
                 sendToSession: async (target, message, deliveryId) => {