@phnx-labs/agents-cli 1.20.76 → 1.20.77

package/dist/lib/daemon.js

@@ -13,10 +13,13 @@ import * as os from 'os';
 import { getDaemonDir as getDaemonDirRoot } from './state.js';
 import { isAlive, killTree, backgroundSpawnOptions } from './platform/index.js';
 import { listJobs as listAllJobs } from './routines.js';
+import { syncAllProjectRoutines } from './routines-project.js';
 import { JobScheduler } from './scheduler.js';
 import { MonitorEngine } from './monitors/engine.js';
 import { executeJobDetached, monitorRunningJobs } from './runner.js';
-import { detectOverdueJobs, notifyOverdue, notifyDesktop } from './overdue.js';
+import { detectOverdueJobs, notifyOverdue } from './overdue.js';
+import { notifyDesktop } from './menubar/notify-desktop.js';
+import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from './routine-notify.js';
 import { BrowserService } from './browser/service.js';
 import { BrowserIPCServer } from './browser/ipc.js';
 import { readAndResolveBundleEnv } from './secrets/bundles.js';
@@ -315,10 +318,23 @@ export async function runDaemon() {
     // secrets-agent and is otherwise absent (leaving the daemon on its existing
     // interactive OAuth session), matching the detached-start path. Never blocks.
     if (!process.env.CLAUDE_CODE_OAUTH_TOKEN) {
-        const oauthToken = readDaemonClaudeOAuthToken();
+        const bundleEnv = readDaemonClaudeBundleEnv();
+        const oauthToken = (bundleEnv[DAEMON_OAUTH_KEY] ?? '').trim();
         if (oauthToken) {
             process.env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
-            log('INFO', 'Loaded Claude OAuth token from secrets bundle for routine runs');
+            // Also inject each per-account CLAUDE_CODE_OAUTH_TOKEN_<slug> present in the
+            // bundle, so a routine authenticates its rotation-pinned account via that
+            // account's own long-lived, non-rotating setup-token (runner.ts
+            // buildRoutineSpawnEnv) instead of the interactive session that rotates and
+            // logs the fleet out (Claude Code #25609 / #56339).
+            let perAccount = 0;
+            for (const [k, v] of Object.entries(bundleEnv)) {
+                if (k.startsWith('CLAUDE_CODE_OAUTH_TOKEN_') && (v ?? '').trim() && !process.env[k]) {
+                    process.env[k] = v.trim();
+                    perAccount++;
+                }
+            }
+            log('INFO', `Loaded Claude OAuth token from secrets bundle for routine runs${perAccount ? ` (+${perAccount} per-account)` : ''}`);
         }
         else {
             // No token available (e.g. a headless macOS daemon whose keychain was
@@ -327,7 +343,11 @@ export async function runDaemon() {
             // with no signal. Make it loud: WARN in the log and fire a desktop alert.
             log('WARN', 'No Claude OAuth token available — Claude routine runs will fail auth on this host. ' +
                 'Restart the daemon with the keychain unlocked, or unlock the `claude` secrets bundle.');
-            notifyDesktop('agents daemon: no Claude credential', 'Claude routines will fail auth on this host. Restart the daemon with the keychain unlocked.');
+            notifyDesktop({
+                title: 'agents daemon: no Claude credential',
+                body: 'Claude routines will fail auth on this host. Restart the daemon with the keychain unlocked.',
+                action: 'routines:list',
+            });
         }
     }
     // Reap any stray duplicate daemon of this install that slipped past the start
@@ -372,14 +392,50 @@ export async function runDaemon() {
                 ? `workflow: ${config.workflow}`
                 : `agent: ${config.agent}`;
         log('INFO', `Triggering job '${config.name}' (${jobLabel})`);
+        // RUSH-2030: branded desktop notification on start (agent/workflow routines;
+        // suppressed for command housekeeping). Finish/output is fired from the
+        // onFinish hook below — executeJobDetached finalizes the run in-process, so
+        // the monitor tick never sees the live transition. Never let a notification
+        // failure break the trigger.
+        try {
+            notifyRoutineStart(config);
+        }
+        catch { /* best-effort */ }
         try {
-            const meta = await executeJobDetached(config);
+            const meta = await executeJobDetached(config, {
+                onFinish: (final) => {
+                    try {
+                        notifyRoutineFinish(final);
+                    }
+                    catch { /* best-effort */ }
+                },
+            });
             log('INFO', `Job '${config.name}' spawned (run: ${meta.runId}, PID: ${meta.pid})`);
         }
         catch (err) {
-            log('ERROR', `Job '${config.name}' failed to spawn: ${err.message}`);
+            const message = err.message;
+            log('ERROR', `Job '${config.name}' failed to spawn: ${message}`);
+            // RUSH-2030: the START ping already fired unconditionally above. A pre-spawn
+            // failure produces no run record and thus no onFinish, so send a synthetic
+            // "failed to start" finish here — otherwise the user is left with an orphaned
+            // "Routine started" and never told it failed.
+            try {
+                notifyRoutineStartFailed(config, message);
+            }
+            catch { /* best-effort */ }
         }
     });
+    // Materialise opted-in project routines into the user layer on every start
+    // so a fresh daemon picks up project YAML without a separate sync step.
+    try {
+        const result = syncAllProjectRoutines();
+        const n = result.projects.reduce((acc, p) => acc + p.synced.length, 0);
+        if (n > 0)
+            log('INFO', `Project routines sync: ${n} job(s) from ${result.projects.length} project(s)`);
+    }
+    catch (err) {
+        log('WARN', `Project routines sync failed: ${err.message}`);
+    }
     scheduler.loadAll();
     const scheduled = scheduler.listScheduled();
     log('INFO', `Loaded ${scheduled.length} jobs`);
@@ -721,6 +777,19 @@ export async function runDaemon() {
     const brokerSelfHealInterval = setInterval(() => { void runBrokerSelfHeal(); }, 60_000);
     const handleReload = () => {
         log('INFO', 'Reloading jobs (SIGHUP)');
+        // Refresh user-layer copies of opted-in project routines BEFORE the
+        // scheduler reloads, so YAML edits under `<project>/.agents/routines/`
+        // take effect on the next fire without a manual `routines sync`.
+        try {
+            const result = syncAllProjectRoutines();
+            const n = result.projects.reduce((acc, p) => acc + p.synced.length, 0);
+            if (n > 0 || result.missing.length > 0) {
+                log('INFO', `Project routines sync: ${n} updated, ${result.missing.length} missing roots`);
+            }
+        }
+        catch (err) {
+            log('WARN', `Project routines sync failed: ${err.message}`);
+        }
         scheduler.reloadAll();
         const reloaded = scheduler.listScheduled();
         log('INFO', `Reloaded ${reloaded.length} jobs`);
@@ -774,17 +843,26 @@ export async function runDaemon() {
  * token leaves the daemon on its existing interactive OAuth session.
  */
 export function readDaemonClaudeOAuthToken(opts = {}) {
+    const token = (readDaemonClaudeBundleEnv(opts)[DAEMON_OAUTH_KEY] ?? '').trim();
+    return token.length > 0 ? token : null;
+}
+/**
+ * Read the FULL `claude` bundle env — the main `CLAUDE_CODE_OAUTH_TOKEN` plus any
+ * per-account `CLAUDE_CODE_OAUTH_TOKEN_<slug>` setup-tokens. Same resolution and
+ * never-throws contract as {@link readDaemonClaudeOAuthToken}; returns `{}` when
+ * the bundle can't be read (broker-only headless miss, absent bundle, etc.).
+ */
+export function readDaemonClaudeBundleEnv(opts = {}) {
     try {
         const allowPrompt = opts.allowPrompt ?? Boolean(process.stdin.isTTY);
         const { env } = readAndResolveBundleEnv(DAEMON_OAUTH_BUNDLE, {
             caller: 'daemon',
             agentOnly: !allowPrompt,
         });
-        const token = (env[DAEMON_OAUTH_KEY] ?? '').trim();
-        return token.length > 0 ? token : null;
+        return env;
     }
     catch {
-        return null;
+        return {};
     }
 }
 /** Escape a string for safe inclusion in an XML <string> node. */
@@ -1012,11 +1090,20 @@ function startDaemonLocked(agentsBin) {
  * the daemon then passes it to every routine run it spawns. An already-set
  * value (e.g. inherited from launchd) is left untouched.
  */
-export function buildDetachedDaemonEnv(baseEnv = process.env, oauthToken = readDaemonClaudeOAuthToken()) {
+export function buildDetachedDaemonEnv(baseEnv = process.env, bundleEnv = readDaemonClaudeBundleEnv()) {
     const env = { ...baseEnv };
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
-        if (oauthToken)
-            env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
+        const main = (bundleEnv[DAEMON_OAUTH_KEY] ?? '').trim();
+        if (main)
+            env.CLAUDE_CODE_OAUTH_TOKEN = main;
+    }
+    // Per-account setup-tokens — same rationale as the runDaemon startup injection:
+    // a routine authenticates its rotation-pinned account via that account's own
+    // long-lived, non-rotating token. An already-set value wins.
+    for (const [k, v] of Object.entries(bundleEnv)) {
+        if (k.startsWith('CLAUDE_CODE_OAUTH_TOKEN_') && (v ?? '').trim() && !env[k]) {
+            env[k] = v.trim();
+        }
     }
     return env;
 }

package/dist/lib/devices/fleet.d.ts

@@ -136,5 +136,20 @@ export interface RunFleetOptions {
  * recorded as `failed` so one bad device never aborts the rest.
  */
 export declare function runFleet(targets: FleetTarget[], cmd: string[], opts?: RunFleetOptions): FleetRunResult[];
+export interface FanOutDeviceOptions {
+    /**
+     * Per-device deadline in milliseconds. When set, any probe that does not
+     * settle within this window is abandoned via `Promise.race` against a
+     * rejection timer and recorded as a `failed` result with the message
+     * `'timed out'`. There is no AbortController — the underlying probe
+     * continues running in the background; cancellation of the in-flight work
+     * is the caller's responsibility. In practice `probeRemoteAuth` relies on
+     * `sshExecAsync`'s own 15 s timer to kill the ssh child independently.
+     * The per-device ssh timeout passed directly to {@link sshExecAsync} is
+     * the first line of defence; this acts as a hard backstop so one slow
+     * device can never stall the entire fan-out past its budget.
+     */
+    perDeviceTimeoutMs?: number;
+}
 /** Run one async probe per device in parallel, preserving input order. */
-export declare function fanOutDevices<T, Target extends FanOutDeviceTarget = FanOutDeviceTarget>(targets: Target[], probe: (target: Target) => Promise<T>): Promise<FanOutDeviceResult<T>[]>;
+export declare function fanOutDevices<T, Target extends FanOutDeviceTarget = FanOutDeviceTarget>(targets: Target[], probe: (target: Target) => Promise<T>, opts?: FanOutDeviceOptions): Promise<FanOutDeviceResult<T>[]>;

package/dist/lib/devices/fleet.js

@@ -212,7 +212,7 @@ export function runFleet(targets, cmd, opts = {}) {
     return results;
 }
 /** Run one async probe per device in parallel, preserving input order. */
-export async function fanOutDevices(targets, probe) {
+export async function fanOutDevices(targets, probe, opts = {}) {
     return Promise.all(targets.map(async (target) => {
         if (target.skip) {
             return {
@@ -222,10 +222,18 @@ export async function fanOutDevices(targets, probe) {
             };
         }
         try {
+            let probePromise = probe(target);
+            if (opts.perDeviceTimeoutMs) {
+                const timeoutMs = opts.perDeviceTimeoutMs;
+                probePromise = Promise.race([
+                    probePromise,
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('timed out')), timeoutMs)),
+                ]);
+            }
             return {
                 name: target.name,
                 status: 'ok',
-                value: await probe(target),
+                value: await probePromise,
             };
         }
         catch (err) {

package/dist/lib/events.d.ts

@@ -12,7 +12,7 @@
  * - Performance tracking: withTiming() wrapper for any async function
  */
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'status.posted' | 'file.edited' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'error' | 'warn' | 'info' | 'debug';
 export declare function levelFor(event: EventType): EventLevel;
 export interface EventMeta {
     ts: string;

package/dist/lib/exec.d.ts

@@ -197,6 +197,22 @@ export declare function inferredInteractiveWithoutTty(options: Pick<ExecOptions,
 export declare function shouldTapStdout(interactive: boolean, piped: boolean, capsActive: boolean, captureTail?: boolean): boolean;
 /** Parse an array of KEY=VALUE strings into an env record. Returns undefined for empty input. */
 export declare function parseExecEnv(entries: string[]): Record<string, string> | undefined;
+/**
+ * Resolve the launch id a run exports as `AGENT_LAUNCH_ID`.
+ *
+ * The launch id is the stable correlation key the SessionStart hook records
+ * alongside the agent's real session id (terminals/sessions/<pid>.json), so it
+ * is what maps a launch to its exact session even when the hook runs under a
+ * different pid (tmux pane leaf / cmd.exe wrapper) — and, across an SSH hop, what
+ * lets a `--host` launcher resolve the remote-coined id for agents that never
+ * accept a forced `--session-id`.
+ *
+ * ADOPT a caller-supplied `AGENT_LAUNCH_ID` (a `--host` launcher forwards one via
+ * `--env` so it controls the key end-to-end); MINT a fresh one otherwise (every
+ * local run, which passes none). A malformed inbound value is ignored in favour
+ * of a fresh mint — the key must be a real correlation id, never an empty string.
+ */
+export declare function resolveLaunchId(envLaunchId: string | undefined): string;
 /**
  * Build the process environment for an agent invocation.
  * Pins CLAUDE_CONFIG_DIR for Claude, CODEX_HOME for Codex, and COPILOT_HOME

package/dist/lib/exec.js

@@ -218,6 +218,25 @@ export function parseExecEnv(entries) {
     }
     return Object.fromEntries(entries.map(parseExecEnvEntry));
 }
+/**
+ * Resolve the launch id a run exports as `AGENT_LAUNCH_ID`.
+ *
+ * The launch id is the stable correlation key the SessionStart hook records
+ * alongside the agent's real session id (terminals/sessions/<pid>.json), so it
+ * is what maps a launch to its exact session even when the hook runs under a
+ * different pid (tmux pane leaf / cmd.exe wrapper) — and, across an SSH hop, what
+ * lets a `--host` launcher resolve the remote-coined id for agents that never
+ * accept a forced `--session-id`.
+ *
+ * ADOPT a caller-supplied `AGENT_LAUNCH_ID` (a `--host` launcher forwards one via
+ * `--env` so it controls the key end-to-end); MINT a fresh one otherwise (every
+ * local run, which passes none). A malformed inbound value is ignored in favour
+ * of a fresh mint — the key must be a real correlation id, never an empty string.
+ */
+export function resolveLaunchId(envLaunchId) {
+    const inbound = envLaunchId?.trim();
+    return inbound ? inbound : randomUUID();
+}
 /**
  * Build the process environment for an agent invocation.
  * Pins CLAUDE_CONFIG_DIR for Claude, CODEX_HOME for Codex, and COPILOT_HOME
@@ -1172,15 +1191,19 @@ async function spawnAgent(options) {
     // timeout. Spend is recorded to the shared ledger in the close handler. The
     // watcher is dormant (and zero-cost) when no caps are configured.
     const cwd = options.cwd || process.cwd();
-    // Mint the launch id once. It doubles as the budget watcher's run id AND is
+    // Resolve the launch id once. It doubles as the budget watcher's run id AND is
     // exported to the child as AGENT_LAUNCH_ID, so the agent's SessionStart hook
     // records the SAME id in its own state file (terminals/sessions/<pid>.json).
     // That id is the join key that reconciles this launch's pid-registry entry
     // with the hook's authoritative session id even when the hook runs under a
     // different pid (tmux pane leaf / cmd.exe wrapper) — see pid-registry.ts and
-    // session/hook-sessions.ts. Injected into options.env so every downstream env
-    // build (the bare spawn below AND the tmux env prefix in runInTmux) carries it.
-    const launchId = randomUUID();
+    // session/hook-sessions.ts. ADOPT a launch id a `--host` launcher already
+    // forwarded (via `--env AGENT_LAUNCH_ID=…`) so ONE correlation key spans the
+    // SSH hop and the launcher can resolve this run's real session id for every
+    // agent, not just Claude (RUSH-2034); mint a fresh one for every local run.
+    // Injected into options.env so every downstream env build (the bare spawn
+    // below AND the tmux env prefix in runInTmux) carries it.
+    const launchId = resolveLaunchId(options.env?.AGENT_LAUNCH_ID);
     const runId = launchId;
     options = { ...options, env: { ...options.env, AGENT_LAUNCH_ID: launchId } };
     const watcherState = await setupBudgetWatcher(options, cwd, runId);

package/dist/lib/feed.d.ts

@@ -172,7 +172,7 @@ export declare function removeBlock(blockId: string, root?: string): boolean;
  * Embedded so it ships with the compiled CLI and can be installed to the
  * CLI-writable user hooks dir without a separate file in the npm tarball.
  */
-export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": datetime.now(timezone.utc).isoformat(),\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now_iso = datetime.now(timezone.utc).isoformat()\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior.\n    controls = payload.get(\"tool_input\", {}) if hook_event != \"Notification\" else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
+export declare const FEED_PUBLISH_HOOK_SCRIPT = "#!/usr/bin/env python3\n\"\"\"Publish and clear open-block records for `agents feed`.\n\nThe manifest invokes this script for top-level AskUserQuestion calls, waiting\nnotifications, question answers, and session lifecycle events. One atomic file\nper session means a new block replaces the previous block. Answer/resume/stop\nevents remove it so `agents feed` only lists decisions that are still open.\n\nSub-agent gate: when the PreToolUse payload carries `agent_type`, this is a\nTask/Agent subagent -- skip. Only the top-level agent publishes. Verified on\nClaude Code 2.1.170 (2026-07).\n\nFail-open: ANY error is swallowed so a feed hiccup never blocks a tool call.\n\"\"\"\nimport os\nimport sys\nimport json\nimport re\nimport socket\nimport tempfile\nfrom datetime import datetime, timezone\n\nWAITING_NOTIFICATION_TYPES = {\n    \"permission_prompt\",\n    \"idle_prompt\",\n    \"elicitation_dialog\",\n}\nCLEAR_EVENTS = {\n    \"PostToolUse\",\n    \"Stop\",\n    \"SessionEnd\",\n}\n# Codex emits a PermissionRequest event (not Claude's Notification) when it\n# blocks on an approval prompt. Claude never fires PermissionRequest, so the\n# same script handles both: PermissionRequest maps to an approval-class block\n# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.\n\n\ndef read_json(path):\n    try:\n        with open(path) as f:\n            return json.load(f)\n    except Exception:\n        return None\n\n\ndef write_json(path, value):\n    dir_name = os.path.dirname(path)\n    os.makedirs(dir_name, exist_ok=True)\n    fd, tmp = tempfile.mkstemp(dir=dir_name, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(value, f, indent=2)\n        os.replace(tmp, path)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\ndef main():\n    raw = sys.stdin.read()\n    try:\n        payload = json.loads(raw) if raw.strip() else {}\n    except Exception:\n        return\n\n    # Sub-agent gate.\n    if payload.get(\"agent_type\"):\n        return\n\n    session_id = payload.get(\"session_id\", \"\")\n    if not session_id:\n        return\n\n    safe_session_id = re.sub(r\"[^A-Za-z0-9._-]\", \"-\", session_id)\n    block_id = f\"block-{safe_session_id}\"\n    home = os.environ.get(\"HOME\") or os.path.expanduser(\"~\")\n    feed_dir = os.path.join(home, \".agents\", \".history\", \"feed\")\n    answered_dir = os.path.join(feed_dir, \"answered\")\n    asks_dir = os.path.join(feed_dir, \"asks\")\n    target = os.path.join(feed_dir, f\"{block_id}.json\")\n    hook_event = payload.get(\"hook_event_name\", \"PreToolUse\")\n\n    if hook_event in CLEAR_EVENTS:\n        # A matcher-less PostToolUse clear (registered for Codex so an approved\n        # tool clears its approval card) must NOT wipe an open AskUserQuestion\n        # while an unrelated tool runs mid-question -- those are cleared only by\n        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a\n        # 'question' block; approval/notification blocks clear once the tool runs.\n        if hook_event == \"PostToolUse\":\n            try:\n                with open(target) as existing_file:\n                    existing = json.load(existing_file)\n                if existing.get(\"kind\") == \"question\" and payload.get(\"tool_name\") != \"AskUserQuestion\":\n                    return\n            except Exception:\n                pass\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        # Also clear the answered marker so a future question for this session\n        # is not permanently locked.\n        try:\n            os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    # Terminal answers (human typed in the TUI) record an answered marker and\n    # remove the block file so the feed stops showing it within one poll cycle.\n    # The marker stays behind so a concurrent surface cannot double-answer.\n    if hook_event == \"UserPromptSubmit\":\n        os.makedirs(answered_dir, exist_ok=True)\n        marker = os.path.join(answered_dir, f\"{block_id}.json\")\n        try:\n            fd = os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o644)\n            record = {\n                \"answeredAt\": datetime.now(timezone.utc).isoformat(),\n                \"answeredFrom\": \"terminal\",\n            }\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(record, f, indent=2)\n        except FileExistsError:\n            pass\n        except Exception:\n            pass\n        # Remove the visible block so the feed drops the answered question.\n        try:\n            os.unlink(target)\n        except FileNotFoundError:\n            pass\n        except Exception:\n            pass\n        return\n\n    notification_type = None\n    codex_approval = False\n    if hook_event == \"Notification\":\n        notification_type = payload.get(\"notification_type\", \"\")\n        if notification_type not in WAITING_NOTIFICATION_TYPES:\n            return\n        # Claude emits a generic permission notification after presenting an\n        # AskUserQuestion. Keep the structured questions and options already\n        # published for this session instead of replacing them with that less\n        # useful notification text.\n        try:\n            with open(target) as existing_file:\n                existing = json.load(existing_file)\n            if existing.get(\"kind\") == \"question\":\n                return\n        except Exception:\n            pass\n        message = payload.get(\"message\", \"\")\n        if not message:\n            return\n        normalized_questions = [{\n            \"text\": message,\n            \"header\": payload.get(\"title\") or notification_type.replace(\"_\", \" \").title(),\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n    elif hook_event == \"PermissionRequest\":\n        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,\n        # tool_input) but carries no questions -- Codex is asking to run a tool,\n        # not asking the operator a multiple-choice question. Publish it as a\n        # notification-kind approval block naming the tool so the feed and the\n        # phone notifier can surface it, and so the Factory extension can bridge\n        # it to a VS Code notification.\n        tool_name = payload.get(\"tool_name\") or \"a tool\"\n        tool_input = payload.get(\"tool_input\", {})\n        command = \"\"\n        if isinstance(tool_input, dict):\n            command = (\n                tool_input.get(\"command\")\n                or tool_input.get(\"cmd\")\n                or tool_input.get(\"path\")\n                or \"\"\n            )\n            if isinstance(command, list):\n                command = \" \".join(str(c) for c in command)\n        detail = f\": {command}\" if command else \"\"\n        normalized_questions = [{\n            \"text\": f\"Codex needs approval to run {tool_name}{detail}\",\n            \"header\": \"Approval needed\",\n            \"multiSelect\": False,\n        }]\n        kind = \"notification\"\n        notification_type = \"permission_prompt\"\n        codex_approval = True\n    else:\n        tool_input = payload.get(\"tool_input\", {})\n        questions = tool_input.get(\"questions\", [])\n        if not questions:\n            return\n        normalized_questions = []\n        for q in questions:\n            if not isinstance(q, dict):\n                continue\n            question = {\n                \"text\": q.get(\"question\", q.get(\"header\", \"\")),\n                \"header\": q.get(\"header\"),\n                \"multiSelect\": q.get(\"multiSelect\", False),\n            }\n            raw_opts = q.get(\"options\", [])\n            if raw_opts:\n                question[\"options\"] = [\n                    {\"label\": o.get(\"label\", \"\"), \"description\": o.get(\"description\")}\n                    for o in raw_opts\n                    if isinstance(o, dict)\n                ]\n            normalized_questions.append(question)\n        if not normalized_questions:\n            return\n        kind = \"question\"\n\n    # Identity from env (set by agents-cli at spawn).\n    mailbox_id = os.path.basename(\n        os.environ.get(\"AGENTS_MAILBOX_DIR\", \"\").rstrip(\"/\")\n    ) or session_id\n\n    now_iso = datetime.now(timezone.utc).isoformat()\n    stats_path = os.path.join(asks_dir, f\"{safe_session_id}.json\")\n    stats = read_json(stats_path) or {}\n    recent = stats.get(\"recentAskTimestamps\") if isinstance(stats, dict) else []\n    if not isinstance(recent, list):\n        recent = []\n    recent.append(now_iso)\n    # Keep enough history for rolling one-hour needy detection without unbounded\n    # per-session files. The TypeScript reader applies the exact time window.\n    recent = recent[-200:]\n    write_json(stats_path, {\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"firstAskAt\": stats.get(\"firstAskAt\") or now_iso,\n        \"lastAskAt\": now_iso,\n        \"totalAskCount\": int(stats.get(\"totalAskCount\") or 0) + 1,\n        \"recentAskTimestamps\": recent,\n    })\n\n    hostname = os.environ.get(\"AGENTS_SYNC_MACHINE_ID\") or socket.gethostname()\n    host = hostname.split(\".\")[0].strip().lower()\n    host = re.sub(r\"[^a-z0-9_-]\", \"-\", host) or \"unknown\"\n\n    runtime = os.environ.get(\"AGENTS_RUNTIME\", \"headless\")\n\n    block = {\n        \"blockId\": block_id,\n        \"sessionId\": session_id,\n        \"mailboxId\": mailbox_id,\n        \"host\": host,\n        \"runtime\": runtime,\n        \"ts\": now_iso,\n        \"questions\": normalized_questions,\n        \"kind\": kind,\n    }\n    if notification_type:\n        block[\"notificationType\"] = notification_type\n\n    # A Codex PermissionRequest is a real approval gate: mark it approval-class\n    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent\n    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default\n    # 'medium') and pages the phone. A plain 'deny' is the safe default.\n    if codex_approval:\n        block[\"blockClass\"] = \"approval\"\n        block[\"costOfDelay\"] = \"high\"\n        block[\"safeDefault\"] = \"deny\"\n\n    # Optional multi-operator control metadata passed by the agent in the\n    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex\n    # PermissionRequest carries tool ARGS in tool_input (command/path), not\n    # operator controls, so it is excluded here -- its class/cost is stamped\n    # above from codex_approval.\n    controls = payload.get(\"tool_input\", {}) if hook_event not in (\"Notification\", \"PermissionRequest\") else {}\n    block_class = controls.get(\"blockClass\") if isinstance(controls, dict) else None\n    if block_class in (\"approval\", \"decision\"):\n        block[\"blockClass\"] = block_class\n    consequence = controls.get(\"consequence\") if isinstance(controls, dict) else None\n    if consequence:\n        block[\"consequence\"] = consequence\n    allowed = controls.get(\"allowedOperators\") if isinstance(controls, dict) else None\n    if isinstance(allowed, list):\n        block[\"allowedOperators\"] = [str(a) for a in allowed]\n    timeout = controls.get(\"timeoutMinutes\") if isinstance(controls, dict) else None\n    if isinstance(timeout, (int, float)) and timeout > 0:\n        block[\"timeoutMinutes\"] = int(timeout)\n    safe_default = controls.get(\"safeDefault\") if isinstance(controls, dict) else None\n    if isinstance(safe_default, str):\n        block[\"safeDefault\"] = safe_default\n    cost = controls.get(\"costOfDelay\") if isinstance(controls, dict) else None\n    if cost in (\"low\", \"medium\", \"high\"):\n        block[\"costOfDelay\"] = cost\n\n    # Publishing a new question clears any stale answered marker from the\n    # previous question in this session.\n    try:\n        os.unlink(os.path.join(answered_dir, f\"{block_id}.json\"))\n    except FileNotFoundError:\n        pass\n    except Exception:\n        pass\n\n    # Python's expanduser() ignores HOME on Windows, while agents-cli honors a\n    # HOME override on every platform. Use the same anchor so hooks and the CLI\n    # always read/write one feed store (including temp-home and sandbox runs).\n    os.makedirs(feed_dir, exist_ok=True)\n\n    fd, tmp = tempfile.mkstemp(dir=feed_dir, suffix=\".tmp\")\n    try:\n        with os.fdopen(fd, \"w\") as f:\n            json.dump(block, f, indent=2)\n        os.replace(tmp, target)\n    except Exception:\n        try:\n            os.unlink(tmp)\n        except Exception:\n            pass\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception:\n        pass  # fail open\n";
 /** Manifest entry for the feed-publish hook, matching the ManifestHook shape. */
 export declare const FEED_PUBLISH_HOOK_MANIFEST: {
     name: string;
@@ -188,6 +188,12 @@ export declare const FEED_NOTIFICATION_HOOK_MANIFEST: {
     script: string;
     timeout: number;
 };
+export declare const FEED_PERMISSION_HOOK_MANIFEST: {
+    name: string;
+    events: string[];
+    script: string;
+    timeout: number;
+};
 export declare const FEED_ANSWERED_HOOK_MANIFEST: {
     name: string;
     events: string[];

package/dist/lib/feed.js

@@ -348,6 +348,10 @@ CLEAR_EVENTS = {
     "Stop",
     "SessionEnd",
 }
+# Codex emits a PermissionRequest event (not Claude's Notification) when it
+# blocks on an approval prompt. Claude never fires PermissionRequest, so the
+# same script handles both: PermissionRequest maps to an approval-class block
+# with a high cost-of-delay so 'agents feed --dispatch' pages it as urgent.
 
 
 def read_json(path):
@@ -398,6 +402,19 @@ def main():
     hook_event = payload.get("hook_event_name", "PreToolUse")
 
     if hook_event in CLEAR_EVENTS:
+        # A matcher-less PostToolUse clear (registered for Codex so an approved
+        # tool clears its approval card) must NOT wipe an open AskUserQuestion
+        # while an unrelated tool runs mid-question -- those are cleared only by
+        # the AskUserQuestion-matched PostToolUse. So on PostToolUse, keep a
+        # 'question' block; approval/notification blocks clear once the tool runs.
+        if hook_event == "PostToolUse":
+            try:
+                with open(target) as existing_file:
+                    existing = json.load(existing_file)
+                if existing.get("kind") == "question" and payload.get("tool_name") != "AskUserQuestion":
+                    return
+            except Exception:
+                pass
         try:
             os.unlink(target)
         except FileNotFoundError:
@@ -442,6 +459,7 @@ def main():
         return
 
     notification_type = None
+    codex_approval = False
     if hook_event == "Notification":
         notification_type = payload.get("notification_type", "")
         if notification_type not in WAITING_NOTIFICATION_TYPES:
@@ -466,6 +484,34 @@ def main():
             "multiSelect": False,
         }]
         kind = "notification"
+    elif hook_event == "PermissionRequest":
+        # Codex approval prompt. The payload mirrors PreToolUse (tool_name,
+        # tool_input) but carries no questions -- Codex is asking to run a tool,
+        # not asking the operator a multiple-choice question. Publish it as a
+        # notification-kind approval block naming the tool so the feed and the
+        # phone notifier can surface it, and so the Factory extension can bridge
+        # it to a VS Code notification.
+        tool_name = payload.get("tool_name") or "a tool"
+        tool_input = payload.get("tool_input", {})
+        command = ""
+        if isinstance(tool_input, dict):
+            command = (
+                tool_input.get("command")
+                or tool_input.get("cmd")
+                or tool_input.get("path")
+                or ""
+            )
+            if isinstance(command, list):
+                command = " ".join(str(c) for c in command)
+        detail = f": {command}" if command else ""
+        normalized_questions = [{
+            "text": f"Codex needs approval to run {tool_name}{detail}",
+            "header": "Approval needed",
+            "multiSelect": False,
+        }]
+        kind = "notification"
+        notification_type = "permission_prompt"
+        codex_approval = True
     else:
         tool_input = payload.get("tool_input", {})
         questions = tool_input.get("questions", [])
@@ -535,9 +581,21 @@ def main():
     if notification_type:
         block["notificationType"] = notification_type
 
+    # A Codex PermissionRequest is a real approval gate: mark it approval-class
+    # with a high cost-of-delay so 'agents feed --dispatch' classifies it urgent
+    # (isPhoneUrgent gates on costOfDelay >= phoneNotifyThreshold, default
+    # 'medium') and pages the phone. A plain 'deny' is the safe default.
+    if codex_approval:
+        block["blockClass"] = "approval"
+        block["costOfDelay"] = "high"
+        block["safeDefault"] = "deny"
+
     # Optional multi-operator control metadata passed by the agent in the
-    # AskUserQuestion tool_input. Defaults keep the existing behavior.
-    controls = payload.get("tool_input", {}) if hook_event != "Notification" else {}
+    # AskUserQuestion tool_input. Defaults keep the existing behavior. A Codex
+    # PermissionRequest carries tool ARGS in tool_input (command/path), not
+    # operator controls, so it is excluded here -- its class/cost is stamped
+    # above from codex_approval.
+    controls = payload.get("tool_input", {}) if hook_event not in ("Notification", "PermissionRequest") else {}
     block_class = controls.get("blockClass") if isinstance(controls, dict) else None
     if block_class in ("approval", "decision"):
         block["blockClass"] = block_class
@@ -604,6 +662,15 @@ export const FEED_NOTIFICATION_HOOK_MANIFEST = {
     script: '10-feed-publish.py',
     timeout: 5,
 };
+// Codex fires PermissionRequest (not Claude's Notification) when it blocks on an
+// approval prompt. The same script handles it, publishing a high-cost approval
+// block so the feed dispatch pages the phone. PermissionRequest has no matcher.
+export const FEED_PERMISSION_HOOK_MANIFEST = {
+    name: 'feed-publish-permission',
+    events: ['PermissionRequest'],
+    script: '10-feed-publish.py',
+    timeout: 5,
+};
 export const FEED_ANSWERED_HOOK_MANIFEST = {
     name: 'feed-clear-answered',
     events: ['PostToolUse'],
@@ -644,28 +711,51 @@ export function ensureFeedPublishHook(userAgentsDir = getUserAgentsDir()) {
         }
         const desiredHooks = {
             'feed-publish': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['PreToolUse'],
                 matcher: 'AskUserQuestion',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
             'feed-publish-notification': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['Notification'],
                 matcher: 'permission_prompt|idle_prompt|elicitation_dialog',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
+            // Codex-specific approval gate: Codex emits PermissionRequest (Claude does
+            // not), so this hook is where a blocked Codex agent surfaces to the feed.
+            'feed-publish-permission': {
+                agents: ['claude', 'codex'],
+                events: ['PermissionRequest'],
+                script: '10-feed-publish.py',
+                timeout: 5,
+            },
             'feed-clear-answered': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['PostToolUse'],
                 matcher: 'AskUserQuestion',
                 script: '10-feed-publish.py',
                 timeout: 5,
             },
+            // Matcher-less PostToolUse clear: after Codex runs an approved tool, the
+            // approval card is stale, so clear it. Codex-only on purpose -- Claude
+            // never fires PermissionRequest, so it has no approval card to clear here,
+            // and a matcher-less PostToolUse for Claude would (1) re-run the script on
+            // every tool completion and (2) wipe Claude's notification-kind blocks
+            // (permission_prompt/idle_prompt/elicitation_dialog) the moment any later
+            // tool runs, instead of letting them persist to Stop/SessionEnd like they
+            // did before RUSH-2039. Registering it for codex alone keeps Claude's
+            // card lifetime exactly as it was.
+            'feed-clear-permission': {
+                agents: ['codex'],
+                events: ['PostToolUse'],
+                script: '10-feed-publish.py',
+                timeout: 5,
+            },
             'feed-clear-lifecycle': {
-                agents: ['claude'],
+                agents: ['claude', 'codex'],
                 events: ['Stop', 'UserPromptSubmit', 'SessionEnd'],
                 script: '10-feed-publish.py',
                 timeout: 5,

package/dist/lib/heal.d.ts

@@ -87,10 +87,13 @@ export declare function healChangedAnything(r: HealResult): boolean;
 /** One-line summary of a heal pass for daemon logs. */
 export declare function summarizeHeal(r: HealResult): string;
 /**
- * Fire a native desktop notification when a background heal did something
- * noteworthy. Best-effort — missing `osascript`/`notify-send` or no display is
- * swallowed. Silent when the pass auto-fixed everything and nothing needs the
- * operator (no point pinging them for routine self-healing).
+ * Fire a branded desktop notification when a background heal did something
+ * noteworthy. Routed through the MenubarHelper companion (notify-desktop.ts) so
+ * it carries the agents-cli mark; clicking opens the runs folder
+ * (~/.agents/.history/runs, via the `routines:list` action the companion
+ * understands). Best-effort — a missing
+ * notifier or no display is swallowed. Silent when the pass auto-fixed everything
+ * and nothing needs the operator (no point pinging them for routine self-healing).
  */
 export declare function notifyHeal(r: HealResult): void;
 /**