@openrig/cli 0.6.13 → 0.7.0

package/daemon/dist/adapters/codex-runtime-adapter.js

@@ -2,6 +2,8 @@ import { operationalLaunchArg } from "./kernel-authority.js";
 import nodePath from "node:path";
 import fs from "node:fs";
 import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { createRequire } from "node:module";
 import os from "node:os";
 import { parse as parseToml } from "smol-toml";
 import { codexPostureArg } from "./yolo-mode.js";
@@ -16,9 +18,25 @@ import { mergeManagedBlock } from "../domain/managed-blocks.js";
 import { excludeNewGeneratedFiles } from "../domain/generated-file-hygiene.js";
 import { codexQueueStateRoot, codexTeamWorkspaceArg } from "../domain/codex-team-workspace.js";
 import { shellQuote } from "./shell-quote.js";
-import { runSyncSite } from "../domain/sync-site-wrap.js";
+import { execRuntimeProbe } from "./runtime-probe-exec.js";
 import { resolveReadinessTimeoutMs } from "../domain/readiness-timeout.js";
+import { CODEX_CORE_MARKETPLACE, CODEX_CORE_PLUGIN, CODEX_CORE_PLUGIN_KEY, CODEX_MARKETPLACE_MANIFEST_PATH, codexCoreMarketplaceManifest, codexCorePluginEnablement, codexReadableConfigLayers, recordedMarketplaceSource, userLayerEnablesCorePlugin, } from "../domain/codex-core-plugin-install.js";
+const defaultCodexCli = (args, env) => new Promise((resolve) => {
+    execFile("codex", args, { env, timeout: 120_000, maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => {
+        const status = error ? (typeof error.code === "number" ? error.code : null) : 0;
+        // A spawn failure (ENOENT, EACCES) has no exit code and empty output: keep its message as the reason.
+        const err = String(stderr ?? "");
+        resolve({ status, stdout: String(stdout ?? ""), stderr: err.trim() || !error ? err : error.message });
+    });
+});
+// Codex's hook trust recipe (the key and hash Codex records for a trusted hook), kept in one script.
+const codexHookTrust = createRequire(import.meta.url)("../../assets/plugins/openrig-core/hooks/scripts/codex-hook-trust.cjs");
 import { listNativeProcesses, observeCodexPaneProcess, observeCodexForkProcess, verifyPaneIdleShell } from "../domain/native-process-lineage.js";
+// The managed resume check's poll window: a quick phase, then an extended one for a slow boot.
+const RESUME_QUICK_ATTEMPTS = 6;
+const RESUME_EXTENDED_ATTEMPTS = 24;
+const RESUME_QUICK_SLEEP_MS = 200;
+const RESUME_EXTENDED_SLEEP_MS = 500;
 /**
  * Codex runtime adapter. Projects resources to .agents/ targets (preserving
  * existing Codex filesystem contract) and delivers startup files.
@@ -30,6 +48,8 @@ export class CodexRuntimeAdapter {
     fs;
     listProcesses;
     readThreadIdByPid;
+    readResumeEvidence;
+    resumeProofWindowMs;
     readinessSettings;
     sleep;
     resolveHomeDirByPid;
@@ -59,7 +79,20 @@ export class CodexRuntimeAdapter {
     // (FR-A) to write config-layer [hooks] command entries that are cwd-independent and
     // version-matched to the running daemon (NOT ${PLUGIN_ROOT}, NOT a per-cwd copy).
     activityRelayPath;
+    // The vendored openrig-core plugin directory, resolved when the install step runs (vendoring happens at startup).
+    resolveCorePluginDir;
+    // Whether a node's resolved plugin selection includes openrig-core (the test that also gives it OPENRIG_SEAT_PROJECT_DIR).
+    resolveCorePluginSelected;
+    runCodexCli;
+    // One Codex config.toml per adapter: launches, the boot step and resume all write it (and Codex's install writes it too),
+    // so each of those runs its whole setup under this one lock, one after another.
+    configLock = Promise.resolve();
+    codexSystemConfigDir;
     constructor(deps) {
+        this.resolveCorePluginDir = deps.resolveCorePluginDir;
+        this.resolveCorePluginSelected = deps.resolveCorePluginSelected;
+        this.runCodexCli = deps.runCodexCli ?? defaultCodexCli;
+        this.codexSystemConfigDir = deps.codexSystemConfigDir ?? "/etc/codex";
         this.tmux = deps.tmux;
         this.resolveManagedConfigSettings = deps.resolveManagedConfigSettings;
         this.resolveHooksEnabled = deps.resolveHooksEnabled;
@@ -80,6 +113,18 @@ export class CodexRuntimeAdapter {
         });
         this.readThreadIdByPid = deps.readThreadIdByPid ?? ((pid, identity) => identity === undefined
             ? this.readThreadIdFromLogs(pid) : threadIdResolver.resolveForkChild(pid, identity));
+        // A just-launched resume may log only inside its start second, so this reads like a fork child's ("by-process").
+        this.readResumeEvidence = deps.readResumeEvidence ?? (deps.readThreadIdByPid
+            ? async (pid, identity) => {
+                const threadId = (await deps.readThreadIdByPid(pid, identity))?.trim();
+                return threadId ? { threadId } : { reason: "no_log_row" };
+            }
+            : async (pid, identity) => {
+                let reason;
+                const threadId = (await threadIdResolver.resolveForkChild(pid, identity, (d) => { reason = d.reason; }))?.trim();
+                return threadId ? { threadId } : { reason: reason ?? "no_log_row" };
+            });
+        this.resumeProofWindowMs = deps.resumeProofWindowMs ?? RESUME_QUICK_ATTEMPTS * RESUME_QUICK_SLEEP_MS + RESUME_EXTENDED_ATTEMPTS * RESUME_EXTENDED_SLEEP_MS;
         this.readinessSettings = deps.readinessSettings;
         this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
         this.verifyProfilePreflight = deps.verifyProfilePreflight
@@ -93,8 +138,17 @@ export class CodexRuntimeAdapter {
      * not block the launch.
      */
     async ensureManagedConfig() {
+        return this.withConfigLock(() => this.applyManagedConfig());
+    }
+    /** Run `task` after every earlier config setup on this adapter has finished, whatever its outcome. */
+    withConfigLock(task) {
+        const run = this.configLock.then(task, task);
+        this.configLock = run.catch(() => undefined);
+        return run;
+    }
+    async applyManagedConfig() {
         if (!this.resolveManagedConfigSettings)
-            return;
+            return undefined;
         try {
             const { enabled, codexVersion } = await this.resolveManagedConfigSettings();
             this.ensureCodexFeatureFlag(enabled, { codexVersion });
@@ -102,11 +156,162 @@ export class CodexRuntimeAdapter {
                 this.ensureCodexActivityHooks();
             else
                 this.removeCodexActivityHooks();
+            return { hooksEnabled: enabled };
         }
         catch (err) {
             console.error(`[openrig] runtime setup warning: ${err.message}`);
+            return undefined;
         }
     }
+    /**
+     * Boot step, run after the plugin is vendored: install openrig-core into Codex only when hooks are enabled and some
+     * Codex seat's resolved selection includes it. A daemon whose Codex seats didn't select it never installs it.
+     */
+    async ensureCodexCorePluginAtBoot(anySeatSelected) {
+        if (!anySeatSelected || !this.resolveHooksEnabled)
+            return;
+        const resolveHooksEnabled = this.resolveHooksEnabled;
+        await this.withConfigLock(async () => {
+            try {
+                if (await resolveHooksEnabled())
+                    await this.ensureCodexCorePlugin();
+            }
+            catch (err) {
+                console.error(`[openrig] runtime setup warning: ${err.message}`);
+            }
+        });
+    }
+    /**
+     * Install the vendored openrig-core plugin into Codex through Codex's own commands, so a seat that selected it gets its
+     * refocus and skills, trusting only exact shipped hooks on its first install. It runs only when the person's config
+     * doesn't disable the plugin (codexCorePluginEnablement), and only when the installed version differs from the vendored
+     * one. Codex owns its plugin cache; OpenRig writes the marketplace manifest and first-install exact-hook trust.
+     */
+    async ensureCodexCorePlugin() {
+        const report = (outcome, reason) => {
+            if (outcome !== "current")
+                console.error(`[openrig] codex core plugin ${outcome}: ${reason}`);
+            return { outcome, reason };
+        };
+        const pluginDir = this.resolveCorePluginDir?.();
+        if (!pluginDir)
+            return { outcome: "skipped", reason: "the openrig-core plugin isn't vendored" };
+        let version;
+        try {
+            version = JSON.parse(this.fs.readFile(nodePath.join(pluginDir, ".codex-plugin", "plugin.json"))).version;
+        }
+        catch {
+            return report("skipped", "the vendored plugin has no readable Codex manifest");
+        }
+        if (typeof version !== "string" || !/^[0-9A-Za-z._-]+$/.test(version))
+            return report("skipped", "the vendored plugin's Codex manifest has no usable version");
+        const shipped = nodePath.resolve(import.meta.dirname, "../../assets/plugins/openrig-core");
+        const ownFiles = [];
+        const collect = (dir, relative = "hooks") => {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                const child = nodePath.join(relative, entry.name);
+                if (entry.isDirectory())
+                    collect(nodePath.join(dir, entry.name), child);
+                else
+                    ownFiles.push(child);
+            }
+        };
+        collect(nodePath.join(shipped, "hooks"));
+        ownFiles.push(".codex-plugin/plugin.json");
+        const matchesShipped = (dir) => ownFiles.every(relative => {
+            try {
+                return fs.readFileSync(nodePath.join(dir, relative)).equals(fs.readFileSync(nodePath.join(shipped, relative)));
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!matchesShipped(pluginDir))
+            return report("skipped", "vendored hook files differ from this daemon's shipped plugin; existing choices are left alone");
+        const codexHome = nodePath.dirname(this.resolveCodexConfigPath());
+        const layers = codexReadableConfigLayers(codexHome, this.codexSystemConfigDir).map((layer) => {
+            if (!this.fs.exists(layer.path))
+                return { ...layer, state: "absent" };
+            try {
+                return { ...layer, state: "read", content: this.fs.readFile(layer.path) };
+            }
+            catch (error) {
+                return { ...layer, state: "unreadable", reason: error.message };
+            }
+        });
+        const enablement = codexCorePluginEnablement(layers);
+        if (enablement.decision !== "allow")
+            return report("skipped", enablement.reason);
+        const pluginsDir = nodePath.dirname(pluginDir);
+        const userLayer = layers.find((layer) => layer.name === "user config");
+        const userConfig = userLayer?.state === "read" ? userLayer.content : null;
+        const recorded = recordedMarketplaceSource(userConfig);
+        // Compared as real paths, so a marketplace recorded through a symlink to the plugins folder is the same source.
+        const canonical = (p) => { try {
+            return fs.realpathSync.native(nodePath.resolve(p));
+        }
+        catch {
+            return nodePath.resolve(p);
+        } };
+        if (recorded !== undefined && (recorded === null || canonical(recorded) !== canonical(pluginsDir))) {
+            return report("skipped", `a marketplace named ${CODEX_CORE_MARKETPLACE} is already configured with another source; it's left alone`);
+        }
+        // Current only when Codex would load it: the vendored version is in its store AND the user config still registers it
+        // (our marketplace, and an explicit enabled = true, which Codex's install writes). Codex loads only configured
+        // plugins, so a cache left behind after the entry or the marketplace was removed is installed again.
+        const cacheRoot = nodePath.join(codexHome, "plugins", "cache", CODEX_CORE_MARKETPLACE, CODEX_CORE_PLUGIN);
+        const cachedDir = nodePath.join(cacheRoot, version);
+        const cached = this.fs.exists(cachedDir);
+        // Codex's "continue without trusting" choice writes no state. An existing install/configuration may therefore be a
+        // decline even with no hooks.state entry. Only the very first installation earns automatic trust; reinstalls and
+        // upgrades retain whatever native choices already exist, including an unrecorded decline.
+        const firstInstall = !this.fs.exists(cacheRoot) && !layers.some(layer => layer.state === "read"
+            && Object.hasOwn((parseToml(layer.content).plugins ?? {}), CODEX_CORE_PLUGIN_KEY));
+        if (cached && recorded !== undefined && userLayerEnablesCorePlugin(userConfig)) {
+            return report("current", `${CODEX_CORE_PLUGIN_KEY} ${version} is installed and registered`);
+        }
+        const manifestPath = nodePath.join(pluginsDir, CODEX_MARKETPLACE_MANIFEST_PATH);
+        const manifest = codexCoreMarketplaceManifest();
+        if (!this.fs.exists(manifestPath) || this.fs.readFile(manifestPath) !== manifest) {
+            this.fs.mkdirp(nodePath.dirname(manifestPath));
+            this.fs.writeFile(manifestPath, manifest);
+        }
+        const env = { ...process.env, CODEX_HOME: codexHome, ...(this.launchPath ? { PATH: this.launchPath } : {}) };
+        if (recorded === undefined) {
+            const added = await this.runCodexCli(["plugin", "marketplace", "add", pluginsDir], env);
+            if (added.status !== 0)
+                return report("skipped", `codex plugin marketplace add failed: ${(added.stderr || added.stdout).trim() || `exit ${added.status}`}`);
+        }
+        const installed = await this.runCodexCli(["plugin", "add", CODEX_CORE_PLUGIN_KEY], env);
+        if (installed.status !== 0)
+            return report("skipped", `codex plugin add failed: ${(installed.stderr || installed.stdout).trim() || `exit ${installed.status}`}`);
+        // Trust is over normalized definitions, not script contents. Byte equality is an additional pre-grant check;
+        // Codex remains responsible for later native review if definitions change. No cache files are rewritten here.
+        if (firstInstall && matchesShipped(cachedDir)) {
+            let content = this.fs.readFile(this.resolveCodexConfigPath());
+            const hookManifest = JSON.parse(fs.readFileSync(nodePath.join(shipped, "hooks/codex.json"), "utf8"));
+            for (const [event, groups] of Object.entries(hookManifest.hooks)) {
+                groups.forEach((group, groupIndex) => group.hooks.forEach((handler, handlerIndex) => {
+                    const { key, hash } = codexHookTrust.computeCodexHookTrust(event, {
+                        ...handler, timeoutSec: handler.timeout, matcher: group.matcher,
+                        keySource: `${CODEX_CORE_PLUGIN_KEY}:hooks/codex.json`, groupIndex, handlerIndex,
+                    });
+                    // Any existing choice in any readable layer/profile wins; never overwrite enabled=false or an old hash.
+                    const hasChoice = (doc) => {
+                        if (!doc || typeof doc !== "object")
+                            return false;
+                        const value = doc;
+                        return Object.hasOwn(value.hooks?.state ?? {}, key) || Object.values(doc).some(hasChoice);
+                    };
+                    if (!hasChoice(parseToml(content)) && !layers.some(layer => layer.state === "read" && hasChoice(parseToml(layer.content)))) {
+                        content = upsertCodexHookTrust(content, key, hash);
+                    }
+                }));
+            }
+            this.fs.writeFile(this.resolveCodexConfigPath(), content);
+        }
+        return report("installed", `${CODEX_CORE_PLUGIN_KEY} ${version} through Codex's own install (${enablement.reason})`);
+    }
     /**
      * Boot step for a daemon without Codex seats: when runtime.codex.hooks_enabled is false,
      * strip OpenRig's managed hooks block, as every boot did before. Removal writes only when
@@ -339,7 +544,8 @@ export class CodexRuntimeAdapter {
             return { ok: false, error: "resumeToken and forkSource are mutually exclusive — pick one" };
         }
         const updatePrompt = { handled: false };
-        const prepared = await this.prepareLaunch(binding, opts.name);
+        // Only a launch that starts a conversation may install the core plugin; a resume never does.
+        const prepared = await this.prepareLaunch(binding, opts.name, undefined, { installCorePlugin: !opts.resumeToken });
         if (!prepared.ok)
             return prepared;
         const { modelArg, effortArg, appliedLaunch, postureArg, queueStateDirArg, daemonArg, networkArg } = prepared;
@@ -415,7 +621,8 @@ export class CodexRuntimeAdapter {
             const verification = await this.verifyResumeLaunch(binding.tmuxSession, updatePrompt, { resumeToken: opts.resumeToken });
             if (!verification.ok)
                 return verification;
-            return { ok: true, resumeToken: opts.resumeToken, resumeType: "codex_id", appliedLaunch };
+            return { ok: true, resumeToken: opts.resumeToken, resumeType: "codex_id", appliedLaunch,
+                ...(verification.resumedProcess ? { resumedProcess: verification.resumedProcess } : {}) };
         }
         const threadId = await this.captureFreshThreadId(binding, updatePrompt);
         if (updatePrompt.failure)
@@ -430,7 +637,8 @@ export class CodexRuntimeAdapter {
     async buildResumeCommand(binding, opts) {
         if (!binding.tmuxSession)
             return { ok: false, error: "No tmux session bound — cannot build a Codex resume command" };
-        const prepared = await this.prepareLaunch(binding, opts.name, opts.running);
+        // Building a resume command (the in-place restart's) never installs the core plugin.
+        const prepared = await this.prepareLaunch(binding, opts.name, opts.running, { installCorePlugin: false });
         if (!prepared.ok)
             return prepared;
         const core = this.resumeCore(prepared, opts.resumeToken, binding);
@@ -455,8 +663,20 @@ export class CodexRuntimeAdapter {
     }
     /** Launch flags shared by fresh, fork and resume, decided once per launch. With `running`, the probed and
      *  prepared parts come from the running Codex instead, and no Codex process is started to decide them. */
-    async prepareLaunch(binding, name, running) {
-        await this.ensureManagedConfig();
+    async prepareLaunch(binding, name, running, opts) {
+        // The config write and, for a seat that selected openrig-core, its install run as one step under the config lock, so
+        // concurrent launches never interleave them. An unselected seat's launch never installs.
+        await this.withConfigLock(async () => {
+            const managed = await this.applyManagedConfig();
+            if (opts.installCorePlugin && managed?.hooksEnabled && this.resolveCorePluginSelected?.(binding.nodeId)) {
+                try {
+                    await this.ensureCodexCorePlugin();
+                }
+                catch (err) {
+                    console.error(`[openrig] runtime setup warning: ${err.message}`);
+                }
+            }
+        });
         const model = binding.model?.trim();
         const modelArg = model ? ` -m ${shellQuote(model)}` : "";
         const effort = binding.effort?.trim();
@@ -904,11 +1124,88 @@ export class CodexRuntimeAdapter {
         }
         return undefined;
     }
+    /**
+     * #1524 (b): whether the pane's resumed Codex process is proven to hold `resumeToken`. Codex's own records for that
+     * exact process (pid and start time) must name the token, read before `deadline`, with the same process observed
+     * before and after the read, so a reused pid or a replaced pane proves nothing. A different conversation is a
+     * mismatch; anything unread is unknown, never a mismatch or a match.
+     */
+    /** #1524 (b): `work` under the resume check's deadline. It isn't started at or after the deadline, it races the
+     *  deadline, and a value that arrives at or after it is not used (null). It cancels nothing: work already started
+     *  runs to its end (an async step may go on to its next read, and synchronous work such as the default record
+     *  reader's SQLite queries can't be interrupted at all), so the check can return after the deadline. */
+    async beforeResumeDeadline(work, deadline) {
+        if (Date.now() >= deadline)
+            return null;
+        const value = await this.withinDeadline(Promise.resolve().then(work), deadline);
+        return Date.now() >= deadline ? null : value;
+    }
+    async proveResumedProcess(tmuxSession, resumeToken, deadline) {
+        if (!this.tmux.getPanePid)
+            return { kind: "unknown", reason: "the pane's process can't be read" };
+        if (Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        const input = { target: tmuxSession, tmux: this.tmux,
+            listProcesses: this.listProcesses, expectedToken: resumeToken, requireResume: true };
+        const before = await this.beforeResumeDeadline(() => observeCodexPaneProcess(input), deadline);
+        if (!before && Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        if (!before)
+            return { kind: "unknown", reason: "no single Codex process resuming this conversation was observed in the pane" };
+        if (lstartToMinTs(before.process.startedAt) === undefined) {
+            return { kind: "unknown", reason: "the resumed Codex process has no readable start time" };
+        }
+        let evidence;
+        try {
+            evidence = await this.beforeResumeDeadline(() => this.readResumeEvidence(before.process.pid, before.process.startedAt), deadline);
+        }
+        catch (err) {
+            return { kind: "unknown", reason: `Codex's records couldn't be read (${err.message})` };
+        }
+        if (!evidence)
+            return { kind: "unknown", reason: "reading Codex's records didn't finish inside the resume window", windowEnded: true };
+        const after = await this.beforeResumeDeadline(() => observeCodexPaneProcess(input), deadline);
+        if (!after && Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        if (after?.fingerprint !== before.fingerprint) {
+            return { kind: "unknown", reason: "the resumed Codex process changed during the check" };
+        }
+        if (!evidence.threadId)
+            return { kind: "unknown", reason: evidence.reason ?? "no_log_row" };
+        // A decision is only as current as its last observation: at or past the deadline it decides nothing.
+        if (Date.now() >= deadline)
+            return { kind: "unknown", reason: "the resume window ended", windowEnded: true };
+        return evidence.threadId === resumeToken
+            ? { kind: "match", process: { pid: before.process.pid, startedAt: before.process.startedAt } }
+            : { kind: "mismatch", threadId: evidence.threadId };
+    }
     async verifyResumeLaunch(tmuxSession, updatePrompt, opts) {
-        const quickAttempts = 6;
-        const extendedAttempts = 24;
-        const quickSleepMs = 200;
-        const extendedSleepMs = 500;
+        const quickAttempts = RESUME_QUICK_ATTEMPTS;
+        const extendedAttempts = RESUME_EXTENDED_ATTEMPTS;
+        const quickSleepMs = RESUME_QUICK_SLEEP_MS;
+        const extendedSleepMs = RESUME_EXTENDED_SLEEP_MS;
+        // #1524 (b): a managed resume of a known conversation is proven from Codex's own records, inside one wall-clock
+        // deadline for the whole existing window. Why it is still unproven, for the attention text at the bound.
+        // With a conversation to prove, the deadline prevents acceptance of late wrapped poll or proof values, or of a late
+        // match or mismatch. Ordinary poll sleeps request at most the remaining time. Work already started is not cancelled,
+        // and scheduling or synchronous work can delay return. The existing update-prompt helper has its own reads,
+        // reporting and guarded one-key behaviour outside this deadline.
+        const resumeToken = opts?.resumeToken;
+        const deadline = Date.now() + this.resumeProofWindowMs;
+        let unproven = null;
+        // Ordinary poll sleeps request at most the remaining time; scheduling can delay their completion. False once no time
+        // is left.
+        const pause = async (ms) => {
+            if (!resumeToken) {
+                await this.sleep(ms);
+                return true;
+            }
+            const left = deadline - Date.now();
+            if (left <= 0)
+                return false;
+            await this.sleep(Math.min(ms, left));
+            return Date.now() < deadline;
+        };
         // OPR.0.3.3.21 (FR-2): process-alive is NOT proof of a restored
         // conversation. verifyResumeLaunch must NOT return ok:true unless the probe
         // proves `resumed`. Unresolved operator-action gates (update/trust/model)
@@ -939,8 +1236,21 @@ export class CodexRuntimeAdapter {
             if (attempt >= quickAttempts && (sawRealGate || lastUnresolved?.code !== "awaiting_runtime")) {
                 break;
             }
-            const paneCommand = await this.tmux.getPaneCommand(tmuxSession);
-            const paneContent = await this.captureProbeScreen(tmuxSession);
+            // #1524 (b): with a conversation to prove, no capture starts at or after the deadline, and one that ends after it
+            // isn't used (a capture already started isn't cancelled: its second read may still run, its value discarded).
+            let paneCommand;
+            let paneContent;
+            if (resumeToken) {
+                const captured = await this.beforeResumeDeadline(async () => ({ command: await this.tmux.getPaneCommand(tmuxSession), content: await this.captureProbeScreen(tmuxSession) }), deadline);
+                if (!captured)
+                    break;
+                paneCommand = captured.command;
+                paneContent = captured.content;
+            }
+            else {
+                paneCommand = await this.tmux.getPaneCommand(tmuxSession);
+                paneContent = await this.captureProbeScreen(tmuxSession);
+            }
             lastPaneContent = paneContent;
             let probe = assessNativeResumeProbe({
                 runtime: "codex",
@@ -976,12 +1286,35 @@ export class CodexRuntimeAdapter {
                     evidence: paneContent.split("\n").slice(-12).join("\n"),
                 };
             }
-            if (probe.status === "resumed") {
-                return {
-                    ok: true,
-                    resumeToken: opts?.resumeToken,
-                    resumeType: opts?.resumeToken ? "codex_id" : undefined,
-                };
+            if (probe.status === "resumed" && !resumeToken) {
+                return { ok: true, resumeToken: undefined, resumeType: undefined };
+            }
+            if (probe.status === "resumed" && resumeToken) {
+                const proof = await this.proveResumedProcess(tmuxSession, resumeToken, deadline);
+                if (proof.kind === "match")
+                    return { ok: true, resumeToken, resumeType: "codex_id", resumedProcess: proof.process };
+                if (proof.kind === "mismatch") {
+                    return {
+                        ok: false,
+                        error: `Codex resume opened a different conversation: the resumed process's records name ${proof.threadId}, not the requested ${resumeToken}. The session was preserved; nothing was restarted.`,
+                        recovery: "attention_required",
+                        resumeMismatch: { opened: proof.threadId },
+                        verifierInput: verifierInput(),
+                        evidence: paneContent.split("\n").slice(-12).join("\n"),
+                    };
+                }
+                // Unknown is not a failure yet: keep polling inside the window, as a boot still in progress does. The
+                // window ending says nothing new, so it doesn't replace the last reason a read gave.
+                if (!("windowEnded" in proof) || !unproven)
+                    unproven = proof.reason;
+                lastUnresolved = { status: "inconclusive", code: "awaiting_runtime", detail: `Codex resume not yet proven: ${proof.reason}.` };
+                report = { probe, paneContent };
+                if (Date.now() >= deadline)
+                    break;
+                const sleepMs = attempt < quickAttempts ? quickSleepMs : extendedSleepMs;
+                if (attempt < totalAttempts - 1 && !(await pause(sleepMs)))
+                    break;
+                continue;
             }
             report = { probe, paneContent }; // resumed returned above, so this screen is unresolved
             if (probe.code === "update_gate") {
@@ -997,8 +1330,8 @@ export class CodexRuntimeAdapter {
                     lastUnresolved = null;
                     sawRealGate = false;
                     const sleepMs = attempt < quickAttempts ? quickSleepMs : extendedSleepMs;
-                    if (attempt < totalAttempts - 1)
-                        await this.sleep(sleepMs);
+                    if (attempt < totalAttempts - 1 && !(await pause(sleepMs)))
+                        break;
                     continue;
                 }
                 lastUnresolved = probe;
@@ -1011,13 +1344,16 @@ export class CodexRuntimeAdapter {
                 }
             }
             const sleepMs = attempt < quickAttempts ? quickSleepMs : extendedSleepMs;
-            if (attempt < totalAttempts - 1)
-                await this.sleep(sleepMs);
+            if (attempt < totalAttempts - 1 && !(await pause(sleepMs)))
+                break;
         }
         // Report the newest screen observed; a resumed or booting one names no gate. The loop's own decisions above used
         // lastUnresolved. The text follows the newest screen too, so an older gate's text never stands for a newer screen.
         const shown = report && report.probe.status !== "resumed" && report.probe.code !== "awaiting_runtime" ? report : null;
-        const newestText = shown ? shown.probe.detail
+        const unprovenText = unproven && report?.probe.status === "resumed"
+            ? `Codex resume could not be proven within the resume window: ${unproven}. The session was preserved; nothing was restarted.`
+            : null;
+        const newestText = unprovenText ? unprovenText : shown ? shown.probe.detail
             : report?.probe.status === "resumed" ? "Codex resume could not be confirmed: the last screen observed looked ready, but the resume check ended before proving a restored conversation."
                 : report ? report.probe.detail
                     : lastUnresolved?.detail;
@@ -1029,6 +1365,9 @@ export class CodexRuntimeAdapter {
             // The gate on that screen, if any. A boot still in progress names no gate.
             ...(shown ? gateFields(shown.probe, shown.paneContent) : {}),
             ...(shown?.beforeInput ? { screenBeforeInput: true } : {}),
+            // With a conversation to prove and no gate on the newest screen, the end is "not proven": whatever the last frame
+            // was (a boot, a ready screen, or no capture at all before the deadline), the resumed Codex may be running.
+            ...(resumeToken && !shown ? { resumeUnproven: true } : {}),
             verifierInput: verifierInput(),
             evidence: (report?.paneContent ?? lastPaneContent).split("\n").slice(-12).join("\n"),
         };
@@ -1120,19 +1459,6 @@ function upsertCodexProjectTrust(content, projectPath) {
 //   CONFIDENCE: the HASH is fully deterministic from the open source (JSON+sha256) — HIGH.
 //   The KEY's exact key_source canonical form + the positional indices are what the VM
 //   read-back must confirm — PROVISIONAL until then.
-/** Recursively sort object keys (mirrors codex-rs fingerprint.rs `canonical_json`). */
-function canonicalizeJsonValue(value) {
-    if (Array.isArray(value))
-        return value.map(canonicalizeJsonValue);
-    if (value !== null && typeof value === "object") {
-        const src = value;
-        const out = {};
-        for (const key of Object.keys(src).sort())
-            out[key] = canonicalizeJsonValue(src[key]);
-        return out;
-    }
-    return value;
-}
 const CODEX_HOOK_EVENT_KEY_LABEL = {
     SessionStart: "session_start",
     UserPromptSubmit: "user_prompt_submit",
@@ -1149,28 +1475,16 @@ export function computeCodexHookTrust(event, input) {
     const groupIndex = input.groupIndex ?? 0;
     const handlerIndex = input.handlerIndex ?? 0;
     const key = `${input.keySource}:${label}:${groupIndex}:${handlerIndex}`;
-    // Build NormalizedHookIdentity exactly as `TomlValue::try_from` would: None fields dropped.
-    const handler = {
-        type: "command",
-        command: input.command,
-        timeout: input.timeoutSec,
-        async: false,
-    };
-    if (input.statusMessage != null)
-        handler.statusMessage = input.statusMessage;
-    const identity = { event_name: label, hooks: [handler] };
-    if (input.matcher != null)
-        identity.matcher = input.matcher;
-    const serialized = JSON.stringify(canonicalizeJsonValue(identity));
-    const hex = createHash("sha256").update(serialized, "utf8").digest("hex");
-    return { key, hash: `sha256:${hex}` };
+    // NormalizedHookIdentity exactly as `TomlValue::try_from` would build it (None fields dropped), hashed by the shared
+    // recipe in codex-hook-trust.cjs.
+    return { key, hash: codexHookTrust.codexHookHash(label, input) };
 }
 /**
  * OPR.0.4.3.33 — idempotent, non-clobbering, section-scoped writer for a single
  * `[hooks.state."<key>"] trusted_hash = "<hash>"` record. Mirrors upsertCodexProjectTrust:
  * find/create the exact table header, splice ONLY its `trusted_hash` line, leave every other
  * `[hooks.state]` / `[projects]` entry and the managed hook block byte-identical. Same key+hash
- * ⇒ no-op. Only ever called for OUR 4 authored hook keys (never a blanket/wildcard trust).
+ * ⇒ no-op. Only called for our authored inline or exact first-install plugin keys (never blanket trust).
  */
 export function upsertCodexHookTrust(content, key, hash) {
     const header = `[hooks.state.${JSON.stringify(key)}]`;
@@ -1574,15 +1888,12 @@ function escapeRegExp(value) {
 }
 // Module-private (P1 pin — NEVER exported). The REAL Codex profile-LOAD probe,
 // extracted verbatim from launchHarness: dynamic imports keep it lazy for
-// production, execFn runs the real `codex -p <profile> mcp list` via execSync
-// (utf-8, piped stdio, 10s timeout). Injected as the adapter's default
-// verifyProfilePreflight; tests substitute a controlled stub.
+// production, execFn runs the real `codex -p <profile> mcp list` through
+// execRuntimeProbe (utf-8, 10s bound, off the event loop). Injected as the
+// adapter's default verifyProfilePreflight; tests substitute a controlled stub.
 async function defaultProfilePreflight(profile, selected) {
     const { verifyCodexProfileLoads } = await import("../domain/codex-profile-preflight.js");
-    const { execSync } = await import("node:child_process");
-    const execFn = async (cmd) => runSyncSite("codex.runtime.profile_preflight", () => execSync(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 10_000,
-        ...(selected ? { cwd: selected.cwd, env: { ...process.env, CODEX_HOME: selected.codexHome, ...(selected.launchPath ? { PATH: selected.launchPath } : {}) } } : {}),
-    }));
+    const execFn = (cmd) => execRuntimeProbe("codex.runtime.profile_preflight", cmd, selected ? { cwd: selected.cwd, env: { ...process.env, CODEX_HOME: selected.codexHome, ...(selected.launchPath ? { PATH: selected.launchPath } : {}) } } : {});
     return verifyCodexProfileLoads(profile, execFn, undefined, selected?.codexHome);
 }
 // Exported for unit test (B12-T): the REAL async sampling path — the anti-vacuity test drives