@openrig/cli 0.6.11 → 0.6.13

package/daemon/dist/startup.js

@@ -1,3 +1,4 @@
+import { makeWatchdogDeliver, occurrenceAttempted, priorDigestAttempt } from "./domain/watchdog-delivery.js";
 import { fileURLToPath } from "node:url";
 import { discoverTailscaleSelfNames } from "./middleware/browser-boundary.js";
 import { configureShadowCapture } from "./domain/shadow-capture.js";
@@ -25,6 +26,8 @@ import { TmuxAdapter } from "./adapters/tmux.js";
 import { setDaemonTmuxServer, tmuxServerArgs } from "./adapters/tmux-server.js";
 import { CmuxAdapter } from "./adapters/cmux.js";
 import { execArgvCommand, execCommand } from "./adapters/tmux-exec.js";
+import { tmuxControlExec } from "./adapters/tmux-control.js";
+import { boundedProbeExec } from "./adapters/bounded-probe-exec.js";
 import { execPreflightCommand } from "./adapters/preflight-exec.js";
 import { createCmuxCliTransport } from "./adapters/cmux-transport.js";
 import { SnapshotRepository } from "./domain/snapshot-repository.js";
@@ -38,6 +41,9 @@ import { codexDaemonSupportProbe } from "./domain/codex-daemon-support.js";
 import { codexNetworkDefaultReader } from "./domain/codex-network-default.js";
 import { codexUsageReader } from "./domain/provider/codex-usage-reader.js";
 import { CodexUsageWindows } from "./domain/provider/codex-usage-windows.js";
+import { ProviderAccountReadingsStore } from "./domain/provider/provider-account-readings.js";
+import { claudeAuthStatusReader } from "./domain/provider/claude-auth-status-reader.js";
+import { ClaudeUsageWindows, latestClaudeWindowSamples } from "./domain/provider/claude-usage-windows.js";
 import { prepareCodexTeamWorkspace } from "./domain/codex-team-workspace.js";
 import { PiResumeAdapter } from "./adapters/pi-resume.js";
 import { OmpResumeAdapter } from "./adapters/omp-resume.js";
@@ -74,6 +80,7 @@ import { PodBundleSourceResolver } from "./domain/bundle-source-resolver.js";
 import { PsProjectionService } from "./domain/ps-projection.js";
 import { SeatActivityService } from "./domain/seat-activity-service.js";
 import { readClaudeSelfReportEvidence } from "./adapters/claude-code-adapter.js";
+import { replaceFile } from "./adapters/replace-file.js";
 import { SeatStructuralActivityService } from "./domain/seat-structural-activity-service.js";
 import { deriveSelfHostIdSource, SeatIdentityReconciler, reconcileSelfHostIdentity } from "./domain/seat-identity-reconciler.js";
 import { SeatIdentityStore, SelfHostIdentityStore } from "./domain/seat-identity-store.js";
@@ -85,8 +92,8 @@ import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
 import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
 import { observeClaudePaneStartedAt } from "./domain/native-process-lineage.js";
 import { TranscriptStore } from "./domain/transcript-store.js";
-import { resumeRunningTranscriptCaptures } from "./domain/transcript-capture.js";
-import { SessionTransport } from "./domain/session-transport.js";
+import { resumeRunningTranscriptCaptures, wireTranscriptCaptureStops } from "./domain/transcript-capture.js";
+import { probeSessionActivity, SessionTransport } from "./domain/session-transport.js";
 import { AgentActivityStore } from "./domain/agent-activity-store.js";
 import { HistoryQuery } from "./domain/history-query.js";
 import { AskService } from "./domain/ask-service.js";
@@ -108,7 +115,7 @@ import { wireViewEventBridge } from "./domain/view-event-bridge.js";
 import { WatchdogJobsRepository } from "./domain/watchdog-jobs-repository.js";
 import { WatchdogAutoRegistration } from "./domain/watchdog-auto-registration.js";
 import { WatchdogHistoryLog } from "./domain/watchdog-history-log.js";
-import { formatWatchdogDeliveryMessage, WatchdogPolicyEngine, } from "./domain/watchdog-policy-engine.js";
+import { WatchdogPolicyEngine, } from "./domain/watchdog-policy-engine.js";
 import { WatchdogScheduler } from "./domain/watchdog-scheduler.js";
 import { ContinuityPolicyMaterializer, createContinuityCutoverBaton, findClaudeTranscriptByToken, recordManagedWidthReceipt, } from "./domain/continuity-policy-materializer.js";
 import { WorkflowRuntime } from "./domain/workflow-runtime.js";
@@ -153,7 +160,9 @@ import { MissionControlNotificationDispatcher } from "./domain/mission-control/n
 import { NtfyNotificationAdapter } from "./domain/mission-control/notification-adapter-ntfy.js";
 import { WebhookNotificationAdapter } from "./domain/mission-control/notification-adapter-webhook.js";
 import { OPENRIG_HOME } from "./openrig-compat.js";
+import { homeIsolationAdvisory } from "./domain/home-isolation.js";
 import { materializeBuiltinPolicyReference } from "./domain/builtin-policy-reference.js";
+import { withCommunityHarnessResolver, withCommunityHarnesses } from "./adapters/community-harness-runtime-adapter.js";
 import { ensureActivityHookToken, writeActivityEndpointFile, deriveActivityUrl, readActivityEndpointFile } from "./domain/activity-endpoint.js";
 import { getCompatibleOpenRigPath, getDefaultOpenRigPath, readOpenRigEnv, } from "./openrig-compat.js";
 const KNOWN_PROVIDER_AUTH_ENV = new Set([
@@ -197,6 +206,7 @@ const OMP_PROVIDER_AUTH_ENV = Object.fromEntries([
     ...Object.values(OMP_PROVIDER_ENV_VARS),
     ...Object.values(OMP_PROVIDER_EXTRA_ENV_VARS).flat(),
 ].map((name) => [name, true]));
+/** Select configured provider credentials from the launch environment allowlist. */
 export function collectAllowlistedProviderAuthEnv(raw, env, runtime) {
     const admitOmp = runtime === "omp";
     const out = {};
@@ -215,6 +225,7 @@ export function collectAllowlistedProviderAuthEnv(raw, env, runtime) {
     }
     return out;
 }
+/** Assemble the daemon services and runtime adapters using the selected installation assets. */
 export async function createDaemon(opts) {
     const daemonHome = os.homedir();
     const configuredCodexHome = process.env.CODEX_HOME || undefined;
@@ -222,6 +233,9 @@ export async function createDaemon(opts) {
         throw new Error(`CODEX_HOME must be an absolute path for managed seats: ${configuredCodexHome}`);
     }
     const codexHome = configuredCodexHome || nodePath.join(daemonHome, ".codex");
+    const homeIsolation = homeIsolationAdvisory({ openrigHome: OPENRIG_HOME, home: daemonHome, codexHome: configuredCodexHome });
+    if (homeIsolation)
+        console.warn(homeIsolation);
     // Only the explicit selection overrides a pane rc or the legacy PID-home
     // reader. The resolved default remains the writer/network-reader/session root.
     const dbPath = opts?.dbPath ?? ":memory:";
@@ -409,8 +423,13 @@ export async function createDaemon(opts) {
     // boot without creating jobs: additive coverage stays loud, core boot stays live.
     watchdogAutoRegistration.assertLiveSeatCoverage();
     const watchdogHistoryLogInstance = new WatchdogHistoryLog(db);
-    const argvExec = opts?.argvExec
-        ?? (opts?.tmuxExec ? undefined : process.platform === "win32" ? execArgvCommand : undefined);
+    // An injected string exec keeps the shell path, so its fake sees every command. OPENRIG_TMUX_SHELL=1 keeps it too.
+    const spawnedArgvExec = opts?.argvExec
+        ?? (opts?.tmuxExec || (process.env.OPENRIG_TMUX_SHELL === "1" && process.platform !== "win32") ? undefined : execArgvCommand);
+    // OPENRIG_TMUX_CONTROL=1 drives the real tmux through one control-mode client (tmux-control.ts); by default a client
+    // is spawned per command. An injected exec is the test's own, and psmux has no control mode.
+    const argvExec = spawnedArgvExec === execArgvCommand && process.platform !== "win32" && process.env.OPENRIG_TMUX_CONTROL === "1"
+        ? tmuxControlExec(execArgvCommand) : spawnedArgvExec;
     const tmuxAdapter = new TmuxAdapter(opts?.tmuxExec ?? execCommand, undefined, argvExec);
     // The real tmux runs with this process's environment, so its server is the one $TMUX names.
     // An injected exec has no server of its own: printed attach commands stay in the default form.
@@ -427,6 +446,17 @@ export async function createDaemon(opts) {
     const seatActivityService = new SeatActivityService({
         tmux: tmuxAdapter,
         defaultWindowSeconds: 3,
+        permissionPromptReader: async (sessionName) => {
+            const activity = await probeSessionActivity({ sessionName, runtime: "codex", attachmentType: "tmux", tmuxAdapter });
+            if (activity.state === "unknown")
+                return null;
+            return activity.state === "needs_input" && ["permission_prompt", "selection_prompt"].includes(activity.reason);
+        },
+        permissionPromptChanged: (sessionName, confirmed) => {
+            const latest = agentActivityStore.getLatestForNode({ sessionName });
+            agentActivityStore.recordHookEvent({ sessionName, runtime: "codex", generation: latest?.generation,
+                hookEvent: confirmed ? "PermissionPromptConfirmed" : "PermissionPromptCleared" });
+        },
         eventBus,
         // S19 — the Claude self-report rung (pid.json), consulted per sweep for seats whose
         // declared inventory staffs it; unreadable = null = the ladder falls, never errors.
@@ -539,19 +569,39 @@ export async function createDaemon(opts) {
     const snapshotCapture = new SnapshotCapture({ db, rigRepo, sessionRegistry, eventBus, snapshotRepo, checkpointStore });
     const claudeManagedLaunch = new ClaudeManagedLaunch(db, { ...launchSessionEnv, CLAUDE_CONFIG_DIR: process.env.CLAUDE_CONFIG_DIR }, {
         OPENRIG_CLAUDE_DISABLE_ALTERNATE_SCREEN: process.env.OPENRIG_CLAUDE_DISABLE_ALTERNATE_SCREEN,
-    });
+    }, (session, key) => tmuxAdapter.getSessionEnv(session, key));
     const claudeResume = new ClaudeResumeAdapter(tmuxAdapter, { claudeManagedLaunch, seatLaunchEnvironment });
     // #275: one reader for both Codex launch adapters, with the PATH, HOME and CODEX_HOME a seat session gets.
     const readCodexNetworkDefault = codexNetworkDefaultReader({ launchPath: process.env.PATH, home: daemonHome, codexHome });
     const prepareTeamWorkspace = (sessionName) => prepareCodexTeamWorkspace(sessionName, new ContextPackSettingsStore().resolveConfig().workspaceRoot, process.env.OPENRIG_SHARED_DOCS_ROOT?.trim() || nodePath.join(daemonHome, ".openrig", "shared-docs"), daemonHome);
-    const codexResume = new CodexResumeAdapter(tmuxAdapter, { prepareTeamWorkspace, seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
+    const codexResume = new CodexResumeAdapter(tmuxAdapter, { ensureManagedConfig: () => codexAdapter.ensureManagedConfig(), prepareTeamWorkspace, seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
     // OPR.0.4.6.PI1 — the Pi seat-state root + the compiled runner entry (daemon
     // dist). Shared by the Pi runtime adapter, the resume adapter, and the
     // resume-token capture sidecar reader.
     const piStateRoot = nodePath.join(OPENRIG_HOME, "state", "pi");
     const ompStateRoot = nodePath.join(OPENRIG_HOME, "state", "omp");
     const piRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/pi-runner.js");
-    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath }, { seatLaunchEnvironment });
+    // OPR.0.7.0.2: Pi seats report cost facts from persisted entries only while usage.pi_cost_facts is on;
+    // read at each launch and resume, so the switch takes effect at the next one.
+    const piUsageFactsEnabled = () => {
+        try {
+            return new ContextPackSettingsStore().resolveOne("usage.pi_cost_facts").value === true;
+        }
+        catch {
+            return false;
+        }
+    };
+    // OPR.0.7.0.2 K4: Pi seats look up OpenRouter's actual charge only while usage.pi_openrouter_charge is on (and
+    // only alongside usage.pi_cost_facts); read at each launch and resume.
+    const piOpenRouterChargeEnabled = () => {
+        try {
+            return new ContextPackSettingsStore().resolveOne("usage.pi_openrouter_charge").value === true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath }, { seatLaunchEnvironment, usageFactsEnabled: piUsageFactsEnabled, openRouterChargeEnabled: piOpenRouterChargeEnabled });
     const ompResume = new OmpResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: ompStateRoot, runnerEntryPath: piRunnerEntryPath });
     // Services infrastructure (RigEnv) — created early so restore/bootstrap can use it
     const { ComposeServicesAdapter } = await import("./adapters/compose-services-adapter.js");
@@ -604,6 +654,7 @@ export async function createDaemon(opts) {
     // Transcript rotators are process-local. Reattach them after lifecycle
     // reconciliation so surviving tmux sessions keep ingesting across daemon
     // restarts while genuinely detached sessions stay excluded.
+    wireTranscriptCaptureStops(db, eventBus);
     try {
         await resumeRunningTranscriptCaptures(db, tmuxAdapter, transcriptStore);
     }
@@ -642,7 +693,9 @@ export async function createDaemon(opts) {
     // Phase 5: Bootstrap services
     const bootstrapRepo = new BootstrapRepository(db);
     const exec = opts?.tmuxExec ?? execCommand;
-    const runtimeVerifier = new RuntimeVerifier({ exec, db });
+    // Runtime --version/--help probes are bounded and end their process group: startup awaits the Codex probe
+    // before it listens (fresh DB), so a hung binary must not hold it. An injected test exec keeps probing as given.
+    const runtimeVerifier = new RuntimeVerifier({ exec, db, ...(opts?.tmuxExec ? {} : { probeExec: boundedProbeExec() }) });
     const probeRegistry = new RequirementsProbeRegistry(exec);
     const externalInstallPlanner = new ExternalInstallPlanner();
     const externalInstallExecutor = new ExternalInstallExecutor({ exec, db });
@@ -652,6 +705,7 @@ export async function createDaemon(opts) {
         exists: (p) => fs.existsSync(p),
         listFiles: (dirPath) => {
             const results = [];
+            /** Walk installation files and collect their relative paths. */
             function walk(dir, prefix) {
                 for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
                     if (entry.isDirectory())
@@ -688,27 +742,42 @@ export async function createDaemon(opts) {
     const { OmpRuntimeAdapter } = await import("./adapters/omp-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
     const runtimeSettings = new ContextPackSettingsStore().resolveConfig();
-    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, claudeManagedLaunch, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, claudeManagedLaunch, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: replaceFile, listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
             } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
-    const codexAdapter = new CodexRuntimeAdapter({ prepareTeamWorkspace, tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const codexAdapter = new CodexRuntimeAdapter({ prepareTeamWorkspace, tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), resolveHooksEnabled: async () => {
+            const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
+            return new SettingsStore().resolveOne("runtime.codex.hooks_enabled").value;
+        }, resolveManagedConfigSettings: async () => {
+            const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
+            const enabled = new SettingsStore().resolveOne("runtime.codex.hooks_enabled").value;
+            const row = db.prepare("SELECT version FROM runtime_verifications WHERE runtime = 'codex' ORDER BY verified_at DESC LIMIT 1").get();
+            if (row?.version)
+                return { enabled, codexVersion: row.version };
+            try {
+                return { enabled, codexVersion: (await runtimeVerifier.verifyCodex()).version ?? undefined };
+            }
+            catch {
+                return { enabled }; /* codex not available — skip feature flag */
+            }
+        } });
     // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
     // shape as the Codex adapter; seat isolation roots under piStateRoot.
-    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m) }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
-    const ompAdapter = new OmpRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m) }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath, usageFactsEnabled: piUsageFactsEnabled, openRouterChargeEnabled: piOpenRouterChargeEnabled });
+    const ompAdapter = new OmpRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
@@ -718,7 +787,7 @@ export async function createDaemon(opts) {
     // Same fsOps shape as Pi; the compiled runner entry lives in the daemon dist.
     const { StubRuntimeAdapter } = await import("./adapters/stub-runtime-adapter.js");
     const stubRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/stub-runner.js");
-    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const stubAdapter = new StubRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; /** Collect relative file paths recursively. */ /** Collect relative file paths recursively. */ function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
@@ -731,33 +800,16 @@ export async function createDaemon(opts) {
     // Operator can disable Codex hooks via OPENRIG_RUNTIME_CODEX_HOOKS_ENABLED
     // or rig config set runtime.codex.hooks_enabled false.
     try {
-        const { SettingsStore, ensureDefaultClaudeCompactionFiles, } = await import("./domain/user-settings/settings-store.js");
+        const { ensureDefaultClaudeCompactionFiles } = await import("./domain/user-settings/settings-store.js");
         ensureDefaultClaudeCompactionFiles(OPENRIG_HOME);
-        const settingsStore = new SettingsStore();
-        const enabled = settingsStore.resolveOne("runtime.codex.hooks_enabled").value;
-        let codexVersion;
-        const codexVersionRow = db.prepare("SELECT version FROM runtime_verifications WHERE runtime = 'codex' ORDER BY verified_at DESC LIMIT 1").get();
-        if (codexVersionRow?.version) {
-            codexVersion = codexVersionRow.version;
-        }
-        else {
-            try {
-                const verifyResult = await runtimeVerifier.verifyCodex();
-                codexVersion = verifyResult.version ?? undefined;
-            }
-            catch { /* codex not available — skip feature flag */ }
-        }
-        codexAdapter.ensureCodexFeatureFlag(enabled, { codexVersion });
-        // OPR.0.4.1.10 FR-A — project the OpenRig activity hooks into the Codex config
-        // layer so Codex seats are hook-PRIMARY for the rig-send prompt guard (and gain
-        // SessionStart/UserPromptSubmit/Stop observability) from clean shipped config.
-        // Same enable gate as the feature flag; trust is auto-cleared at launch.
-        if (enabled) {
-            codexAdapter.ensureCodexActivityHooks();
+        // The Codex config is the user's file: write it at boot only when this daemon already
+        // has a Codex seat; otherwise the first Codex launch ensures it (CodexRuntimeAdapter.prepareLaunch).
+        // A disabled hooks setting still strips a stale managed block at every boot.
+        if (db.prepare("SELECT 1 FROM nodes WHERE runtime = 'codex' LIMIT 1").get()) {
+            await codexAdapter.ensureManagedConfig();
         }
         else {
-            // OPR.0.4.1.10 B3 — durable disable: strip any previously-written managed [hooks] block.
-            codexAdapter.removeCodexActivityHooks();
+            await codexAdapter.stripManagedHooksIfDisabled();
         }
     }
     catch (err) {
@@ -779,6 +831,7 @@ export async function createDaemon(opts) {
             mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
             listFiles: (dir) => {
                 const r = [];
+                /** Collect relative file paths recursively. */
                 function w(d, pre) {
                     for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                         if (e.isDirectory())
@@ -927,7 +980,7 @@ export async function createDaemon(opts) {
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
-        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        adapters: withCommunityHarnesses({ "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() }, { tmux: tmuxAdapter, seatLaunchEnvironment }),
         tmuxAdapter,
         agentImageLibrary,
         continuityPolicyMaterializer,
@@ -1037,6 +1090,27 @@ export async function createDaemon(opts) {
         // generation) so a frozen pre-handover sample can't drive the threshold. null = UNKNOWN (inert).
         resolveOccupantBootAt: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.bootAt ?? null,
     });
+    // Shared, read-only current-occupant record path: reporting does not depend on a pin or transport.
+    const { CurrentModelReader } = await import("./domain/model-divergence/current-model-reader.js");
+    const { ProcessCensus: ModelProcessCensus } = await import("./domain/process-census.js");
+    const { CodexThreadIdResolver: ModelThreadResolver } = await import("./domain/codex-thread-id.js");
+    const modelCensus = new ModelProcessCensus();
+    const modelThreads = new ModelThreadResolver({ defaultHome: daemonHome, codexHome: configuredCodexHome });
+    const currentModelReader = new CurrentModelReader({
+        sessions: sessionRegistry, identities: new SeatIdentityStore(db), context: contextUsageStore,
+        census: modelCensus,
+        readAllPaneProcesses: () => tmuxAdapter.readAllPaneProcesses(),
+        native: {
+            getPanePid: async (target) => tmuxAdapter.getPanePid ? tmuxAdapter.getPanePid(target) : null,
+            listProcesses: () => modelCensus.list(),
+            readThreadIdByPid: (pid, identity) => identity === undefined
+                ? modelThreads.resolveUngatedLegacy(pid) : modelThreads.resolve(pid, identity),
+        },
+        codexRollout: (threadId, sessionName, reporting) => reporting
+            ? contextUsageStore.readCodexTranscriptPath(threadId)
+            : contextUsageStore.readCodexAndNormalize({ threadId, sessionName }).transcriptPath,
+        piRunner: (sessionName) => piAdapter.readRunnerSidecar(sessionName),
+    });
     const { HealthProjectionService, LiveContextHealthSource } = await import("./domain/health-detectors.js");
     const healthSettingsStore = new ContextPackSettingsStore();
     const contextHealthSource = new LiveContextHealthSource({
@@ -1136,6 +1210,14 @@ export async function createDaemon(opts) {
     // Capture compatibility before the spec-library initializer creates the primary directory.
     const userSpecLibraryRoot = getDefaultOpenRigPath("specs");
     const compatibleSpecLibraryRoot = getCompatibleOpenRigPath("specs");
+    const runtimeAdaptersMap = withCommunityHarnessResolver({
+        "claude-code": claudeAdapter,
+        "codex": codexAdapter,
+        "pi": piAdapter,
+        "omp": ompAdapter,
+        "stub": stubAdapter,
+        "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter(),
+    }, { tmux: tmuxAdapter, seatLaunchEnvironment });
     const deps = {
         rigRepo,
         sessionRegistry,
@@ -1160,11 +1242,18 @@ export async function createDaemon(opts) {
             listRigs: () => rigRepo.listRigs(),
             collectClaudeSignals: () => collectClaudeSignalsFromProviderUsageDirectory(providerUsageDirectory(OPENRIG_HOME), undefined, legacyProviderUsageDirectory(OPENRIG_HOME)),
             agentActivityStore,
-            // Slice 01: Codex usage windows, off unless provider.usage_windows is on (read per call). The reader
-            // runs only on an explicit refresh, with the PATH, HOME and CODEX_HOME a seat session gets.
+            // Slice 01: Codex and Claude usage windows, off unless provider.usage_windows is on (read per call). The native
+            // readers (Codex's app-server; Claude's auth status, for identity) run only on an explicit refresh, with the
+            // PATH, HOME, CODEX_HOME and CLAUDE_CONFIG_DIR a seat session gets. Claude's windows are the seats' status-line
+            // samples (usage_samples), read on every view.
             usageWindows: {
                 enabled: () => new ContextPackSettingsStore().resolveOne("provider.usage_windows").value === true,
-                windows: new CodexUsageWindows({ read: codexUsageReader({ launchPath: process.env.PATH, home: daemonHome, codexHome }) }),
+                windows: new CodexUsageWindows({ read: codexUsageReader({ launchPath: process.env.PATH, home: daemonHome, codexHome }),
+                    store: new ProviderAccountReadingsStore(db) }),
+                claude: new ClaudeUsageWindows({
+                    readIdentity: claudeAuthStatusReader({ launchPath: process.env.PATH, home: daemonHome, claudeConfigDir: process.env.CLAUDE_CONFIG_DIR }),
+                    listSamples: () => latestClaudeWindowSamples(db),
+                }),
             },
         }),
         restoreOrchestrator,
@@ -1206,7 +1295,7 @@ export async function createDaemon(opts) {
         }),
         podInstantiator,
         podBundleSourceResolver,
-        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        runtimeAdapters: runtimeAdaptersMap,
         transcriptStore,
         sessionTransport: (() => {
             const t = new SessionTransport({
@@ -1219,6 +1308,16 @@ export async function createDaemon(opts) {
                 slowOpRecorder,
                 activityEndpointFile: () => readActivityEndpointFile(OPENRIG_HOME),
                 captureObserver: shadow.capture?.observer,
+                runtimeAdapters: runtimeAdaptersMap,
+                // transport.verify_input_box, read at each verified Claude Code or Codex send (absent or unreadable = off).
+                verifyInputBox: () => {
+                    try {
+                        return new ContextPackSettingsStore().resolveOne("transport.verify_input_box").value === true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
             });
             // PL-004 Phase A revision (R1): wire QueueRepository's wake-path so
             // create / handoff / handoff-and-complete nudge by default.
@@ -1304,6 +1403,7 @@ export async function createDaemon(opts) {
         seatAttentionReconciler,
         activityHookToken: resolvedActivityHookToken,
         contextUsageStore,
+        currentModelReader,
         healthProjection,
         healthDiagnosis,
         healthPolicy,
@@ -1888,31 +1988,12 @@ export async function createDaemon(opts) {
             jobsRepo: watchdogJobsRepoInstance,
             historyLog: watchdogHistoryLogInstance,
             eventBus,
-            deliver: async ({ targetSession, message, continuityAction }, source) => {
-                let continuityActionCompleted = false;
-                try {
-                    if (continuityAction) {
-                        await createContinuityCutoverBaton(continuityAction, queueRepoInstance);
-                        continuityActionCompleted = true;
-                    }
-                    const deliveryId = `guard-watchdog-${source.occurrenceId ?? source.jobId}`;
-                    const previous = outboxHandlerInstance.getById(deliveryId);
-                    const payload = previous?.guardBinding ? previous.body : formatWatchdogDeliveryMessage(source, message);
-                    const result = await sessionTransport.send(targetSession, payload, { deliveryId, actorSession: "watchdog@system", auditPointer: source.jobId });
-                    if (result.outcome === "retained")
-                        return { status: "retained", outboxIds: result.outboxIds, continuityActionCompleted };
-                    return result.ok
-                        ? { status: "ok", continuityActionCompleted }
-                        : { status: "failed", error: result.error, continuityActionCompleted };
-                }
-                catch (err) {
-                    return {
-                        status: "failed",
-                        error: err instanceof Error ? err.message : String(err),
-                        continuityActionCompleted,
-                    };
-                }
-            },
+            deliver: makeWatchdogDeliver({
+                sessionTransport,
+                outbox: outboxHandlerInstance,
+                db,
+                createContinuityAction: (action) => createContinuityCutoverBaton(action, queueRepoInstance).then(() => { }),
+            }),
             // (i-c) fire-time target-generation gate: resolve the target's LIVE occupant-generation (P12
             // occupant_tenures) so a generation-bound wake is refused once the target has handed over.
             // UNKNOWN (null) fails open → deliver. A drop of this line disables the gate silently (gen-bound
@@ -1923,6 +2004,10 @@ export async function createDaemon(opts) {
             onWakeAttempt: ({ jobId, deliveryStatus }) => {
                 queueRepoInstance.recordWatchdogWakeAttempt(jobId, deliveryStatus);
             },
+            // Due parked-row reminders for one seat in one scheduler pass go as one message.
+            resolveDigestEntry: ({ jobId, message }) => queueRepoInstance.parkReminderDigestEntry(jobId, message),
+            priorDigestAttempt: (occurrenceId) => priorDigestAttempt(outboxHandlerInstance, occurrenceId),
+            occurrenceAttempted: (occurrenceId) => occurrenceAttempted(outboxHandlerInstance, occurrenceId),
             // PL-004 Phase D: register workflow-keepalive policy alongside
             // Phase C's three built-in policies. workflow-keepalive reads
             // SQLite workflow_instances directly via the new Phase D tables
@@ -1961,16 +2046,11 @@ export async function createDaemon(opts) {
                         const parkedDeps = {
                             getSeatState: (seatNodeId) => seatActivityService.getSeatState(seatNodeId),
                             listOpenObligations: (destinationSession, limit) => ({
-                                rows: queueRepoInstance
-                                    .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit })
-                                    .map((r) => ({
-                                    qitemId: r.qitemId,
-                                    state: r.state,
-                                    summary: r.summary ?? null,
-                                })),
+                                rows: queueRepoInstance.listOpenObligations(destinationSession, limit),
                                 limit,
                             }),
                             getParkWake: (qitemId) => queueRepoInstance.getParkWakeStatus(qitemId),
+                            servedByOwnReminder: (qitemId) => queueRepoInstance.parkWakeServedByOwnReminder(qitemId),
                         };
                         return diagnoseRigParked(parkedDeps, seats.map((s) => ({ seatNodeId: s.node_id, sessionName: s.session_name })));
                     },
@@ -1998,9 +2078,7 @@ export async function createDaemon(opts) {
                             return { ok: true };
                         },
                         recordNudgeResult: (qitemId, result) => queueRepoInstance.recordNudgeAttempt(qitemId, result),
-                        listOpenIds: (destinationSession) => queueRepoInstance
-                            .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit: 500 })
-                            .map((r) => r.qitemId),
+                        listOpenIds: (destinationSession) => queueRepoInstance.listOpenObligations(destinationSession, 500).map((r) => r.qitemId),
                     },
                     occupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
                 }),
@@ -2104,30 +2182,9 @@ export async function createDaemon(opts) {
         // (no daemon-side cross-host send seam exists yet — the deferral names that, never silence).
         {
             const { ModelDivergenceMonitor } = await import("./domain/model-divergence/model-divergence-monitor.js");
-            const { readClaudeEffectiveModel, readCodexEffectiveModel } = await import("./domain/model-divergence/effective-model-readers.js");
-            const { resolveIdentityVerifiedClaudeRecord, resolveLiveCodexThreadId } = await import("./domain/model-divergence/current-generation-record.js");
-            const { defaultListProcesses } = await import("./domain/resume-metadata-refresher.js");
-            const { readCodexThreadIdFromCandidateHomes, defaultResolveHomeDirByPid } = await import("./domain/codex-thread-id.js");
-            const nodeOs = await import("node:os");
-            const nodeFs = await import("node:fs");
-            const seatIdentityStore = new SeatIdentityStore(db);
-            // OPR.0.5.3.10 — ONE shared census + ONE PID-home resolver for the whole
-            // divergence surface: no more `ps -Ao` per seat per poll, no more `ps eww`
-            // per pid (default-home-first + bounded PID cache).
-            const { ProcessCensus } = await import("./domain/process-census.js");
-            const { CodexThreadIdResolver } = await import("./domain/codex-thread-id.js");
-            const divergenceCensus = new ProcessCensus();
-            const codexThreadIdResolver = new CodexThreadIdResolver({ defaultHome: nodeOs.homedir(), codexHome: configuredCodexHome });
-            const currentGenDeps = {
-                getPanePid: async (sessionTarget) => tmuxAdapter.getPanePid ? tmuxAdapter.getPanePid(sessionTarget) : null,
-                listProcesses: () => divergenceCensus.list(),
-                // S10 follow-on: identity REQUIRED on resolve(); the identity-less case routes EXPLICITLY
-                // through the named ungated escape hatch — never a silent fallback (r1 owed item 3).
-                readThreadIdByPid: (pid, identity) => identity === undefined ? codexThreadIdResolver.resolveUngatedLegacy(pid) : codexThreadIdResolver.resolve(pid, identity),
-            };
             const OVERSIGHT_SEAT = "watch-lead@oversight";
             const modelDivergenceMonitor = new ModelDivergenceMonitor({
-                processCensus: divergenceCensus,
+                processCensus: modelCensus,
                 listPinnedSeats: () => {
                     const rows = db.prepare(`
             SELECT n.id AS nodeId, r.id AS rigId, r.name AS rigName, n.runtime AS runtime, n.model AS pinnedModel,
@@ -2141,52 +2198,7 @@ export async function createDaemon(opts) {
                         .filter((row) => row.sessionName !== null)
                         .map((row) => ({ ...row, generation: sessionRegistry.currentOccupantGenerationForSession(row.sessionName) }));
                 },
-                // D-a / OPR.0.5.9.13 — the CURRENT GENERATION's record through the canonical binding and
-                // verified pane identity, never a name, registry token, or transcript recency lookup. A
-                // retained predecessor may keep writing under the canonical launch-time name forever.
-                // Every missing or ambiguous identity join is an explicit no-answer.
-                readEffectiveModel: async (seat, cycle) => {
-                    // OPR.0.5.3.10 mini-req 1 — the poll-scoped census (one ps per pass) when the
-                    // monitor threads it; the shared coalescing census otherwise.
-                    const genDeps = cycle ? { ...currentGenDeps, listProcesses: cycle.listProcesses } : currentGenDeps;
-                    if (seat.runtime === "codex") {
-                        const live = await resolveLiveCodexThreadId(seat.sessionName, genDeps);
-                        if (!live.ok)
-                            return { ok: false, reason: live.reason };
-                        const rollout = contextUsageStore.readCodexAndNormalize({ threadId: live.id, sessionName: seat.sessionName }).transcriptPath;
-                        if (!rollout)
-                            return { ok: false, reason: `live thread ${live.id.slice(0, 8)}… has no readable rollout` };
-                        const model = readCodexEffectiveModel(rollout);
-                        return model ? { ok: true, model } : { ok: false, reason: `no model signal in the bounded read of ${rollout}` };
-                    }
-                    if (seat.runtime === "claude-code") {
-                        const tenure = sessionRegistry.currentOccupantTenure(seat.nodeId);
-                        const sidecar = contextUsageStore.readSidecar(seat.sessionName);
-                        const binding = sessionRegistry.getBindingForNode(seat.nodeId);
-                        const selection = await resolveIdentityVerifiedClaudeRecord({
-                            sessionName: seat.sessionName,
-                            generation: seat.generation,
-                            occupantBootAt: tenure?.bootAt ?? null,
-                            binding: binding ? { tmuxSession: binding.tmuxSession, tmuxPane: binding.tmuxPane } : null,
-                            identity: seatIdentityStore.getForNode(seat.nodeId),
-                            sidecar: sidecar.ok ? sidecar.data : null,
-                        }, genDeps, (path) => {
-                            try {
-                                return nodeFs.statSync(path).isFile();
-                            }
-                            catch {
-                                return false;
-                            }
-                        });
-                        if (!selection.ok)
-                            return { ok: false, reason: selection.reason };
-                        const model = readClaudeEffectiveModel(selection.path);
-                        return model
-                            ? { ok: true, model }
-                            : { ok: false, reason: `no assistant turn yet in the current occupant record ${selection.path} (selected from ${selection.source})` };
-                    }
-                    return { ok: false, reason: `runtime ${seat.runtime ?? "unknown"} has no effective-model reader yet` };
-                },
+                readEffectiveModel: (seat, cycle) => currentModelReader.readEffectiveModel(seat, cycle),
                 sendToSession: async (target, message, deliveryId) => {
                     try {
                         const previous = deliveryId ? outboxHandlerInstance.getById(deliveryId) : null;