@scotthuang/agent-knock-knock 0.12.2 → 0.12.3

package/dist/src/cli-core.js

@@ -26,7 +26,7 @@ import { parseTerminalConversationId } from "./terminal-agent-adapter.js";
 import { associateTerminalEndpointEvidence, hasCanonicalTerminalEndpoint, sameTerminalControlEvidenceIncarnation, sameTerminalControlIncarnation, terminalControlEvidence, terminalControlEvidenceMatches, terminalEndpointFromControlRef, terminalEndpointIdentityFromEvidence, terminalEndpointIdentityKey, terminalLegacyRuntimeRoute, sameTerminalEndpointIdentity } from "./terminal-control-ref.js";
 import { createProductionTerminalAgentRegistry } from "./terminal-agent-registry.js";
 import { parseProcessElapsedSeconds, StaticTerminalProcessSource, SystemTerminalProcessSource } from "./terminal-process-source.js";
-import { isExactClaudeNativeInspectionIdleComposer, NativeInspectionSubmissionError, TerminalAgentBridge, TerminalInputNotStartedError } from "./terminal-agent-bridge.js";
+import { isExactClaudeIdleComposer, isExactClaudeNativeInspectionIdleComposer, NativeInspectionSubmissionError, TerminalAgentBridge, TerminalInputNotStartedError } from "./terminal-agent-bridge.js";
 import { evaluateApprovalPolicy } from "./approval-policy.js";
 import { evaluateDoctorCapabilities, runDoctorCapabilityProbes } from "./doctor-capabilities.js";
 import { runOpenClawChainDiagnostics } from "./openclaw-doctor.js";
@@ -2916,24 +2916,24 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
             });
         }
     }
-    let nativeAgentIdentity;
-    try {
-        nativeAgentIdentity = await resolveCurrentNativeAgentSessionIdentity({
-            options,
-            agent: session.agent,
-            pid: session.pid,
-            cwd: session.cwd ?? terminalControl.currentPath,
-            preferredSessionId: codexIdentityContext?.preferredSessionId,
-            allowedCompanionIdentity: codexIdentityContext?.companions.primary,
-            allowedAdditionalIdentities: codexIdentityContext?.companions.additional
-        });
-    }
-    catch (error) {
+    const nativeIdentityObservation = await observeCurrentNativeAgentSessionIdentity({
+        options,
+        agent: session.agent,
+        pid: session.pid,
+        cwd: session.cwd ?? terminalControl.currentPath,
+        preferredSessionId: codexIdentityContext?.preferredSessionId,
+        allowedCompanionIdentity: codexIdentityContext?.companions.primary,
+        allowedAdditionalIdentities: codexIdentityContext?.companions.additional
+    });
+    const nativeAgentIdentity = nativeIdentityObservation.status === "resolved"
+        ? nativeIdentityObservation.identity
+        : undefined;
+    if (nativeIdentityObservation.status === "unavailable") {
         runtimeLog("warn", "terminal_native_session_identity_unavailable", {
             agent: session.agent,
             terminal_target: terminalControl.target,
             pid: session.pid,
-            error: error instanceof Error ? error.message : String(error)
+            error: nativeIdentityObservation.reason
         });
     }
     let nativeProcessUuid = nativeAgentIdentity?.processUuid;
@@ -3002,24 +3002,24 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
     const nativeInspectionHasBlockingTurn = listConversations(storeDirFromOptions(options)).some((turn) => isDiscoverableTmuxConversation(turn) &&
         terminalControlsShareIncarnation(terminalControlForManagedConversation(turn), terminalControl) &&
         SESSION_SEND_BLOCKING_STATUSES.has(turn.status));
-    let nativeInspectionComposerReady = nativeInspectionComposerEmpty(session.agent, terminalState.screen_excerpt);
+    let automatedInputComposerReady = nativeInspectionComposerEmpty(session.agent, terminalState.screen_excerpt);
     if (session.agent === "codex" &&
-        terminalState.activity_state === "idle" &&
+        (terminalState.activity_state === "idle" ||
+            (terminalState.activity_state === "unknown" &&
+                nativeIdentityObservation.status === "verified_absent")) &&
         terminalState.approval_state.blocked !== true &&
-        nativeInspectionCapability.status === "supported" &&
-        nativeInspectionCapability.statusInspection === true &&
         terminalControl.capabilities.includes("send_keys") &&
         terminalControl.capabilities.includes("screen_status")) {
         try {
             const provider = createTerminalControlProvider(options);
             const resolvedTerminal = await provider.resolve(provider.endpoint(terminalControl));
             const styledScreen = await provider.capture(resolvedTerminal, { scrollbackLines: 40, preserveEscapes: true });
-            nativeInspectionComposerReady = codexStyledComposerEmpty(styledScreen);
+            automatedInputComposerReady = codexStyledComposerEmpty(styledScreen);
         }
         catch {
             // Advertising an input action is optional. The action itself repeats the
             // same styled composer proof under the terminal lock before any input.
-            nativeInspectionComposerReady = false;
+            automatedInputComposerReady = false;
         }
     }
     const entry = {
@@ -3040,6 +3040,14 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
         native_agent_process_birth: nativeProcessBirth,
         native_agent_rollout: nativeAgentIdentity?.rollout,
         native_agent_identity_evidence: nativeProcessEvidence,
+        native_agent_identity_observation: {
+            status: nativeIdentityObservation.status,
+            ...(nativeIdentityObservation.status === "unavailable"
+                ? { reason: nativeIdentityObservation.reason }
+                : nativeIdentityObservation.status === "verified_absent"
+                    ? { evidence: nativeIdentityObservation.evidence }
+                    : {})
+        },
         agent_version: agentVersion,
         native_thread_lifecycle: lifecycleCapability,
         native_inspection: nativeInspectionCapability,
@@ -3050,6 +3058,10 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
         approval_state: terminalState.approval_state,
         activity_state: terminalState.activity_state,
         activity_reason: terminalState.activity_reason,
+        // Internal action-projection evidence. terminalFirstListProjection strips
+        // this field after gating every automated-input action that can follow a
+        // human native-thread switch.
+        _automated_input_composer_ready: automatedInputComposerReady,
         ...(orphanedDispatch
             ? {
                 orphaned_terminal_dispatch: {
@@ -3080,7 +3092,8 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
                 codexLifecycleIncarnationAvailable,
             native_inspect: nativeInspectionCapability.status === "supported" &&
                 nativeInspectionCapability.statusInspection === true &&
-                nativeInspectionComposerReady &&
+                terminalState.activity_state === "idle" &&
+                automatedInputComposerReady &&
                 terminalControl.capabilities.includes("send_keys") &&
                 terminalControl.capabilities.includes("screen_status") &&
                 (session.agent === "codex"
@@ -3106,6 +3119,7 @@ function terminalFirstListProjection({ storeDir, terminals, managedSessions, ses
         return control ? [control] : [];
     });
     const projectedTerminals = terminals.map((terminal) => {
+        const { _automated_input_composer_ready: automatedInputComposerReady, ...publicTerminal } = terminal;
         const terminalControl = isRecord(terminal.terminal_control)
             ? terminal.terminal_control
             : undefined;
@@ -3269,6 +3283,71 @@ function terminalFirstListProjection({ storeDir, terminals, managedSessions, ses
             })
             : undefined;
         const blockingHandoffTurns = conflictingSessionTurns.filter((turn) => SESSION_SEND_BLOCKING_STATUSES.has(turn.status));
+        const nativeIdentityObservation = isRecord(terminal.native_agent_identity_observation)
+            ? terminal.native_agent_identity_observation
+            : undefined;
+        const verifiedEmptyProcessUuid = stringValue(terminal.native_agent_process_uuid);
+        const verifiedEmptyProcessBirth = stringValue(terminal.native_agent_process_birth);
+        const verifiedEmptyWorkspace = stringValue(terminal.workspace ?? terminal.cwd);
+        const verifiedEmptySourceNativeThreadId = stringValue(soleBindingConflict?.session.binding?.native_thread_id)?.toLowerCase();
+        const verifiedEmptySourceActiveElsewhere = Boolean(verifiedEmptySourceNativeThreadId &&
+            terminals.some((candidate) => candidate !== terminal &&
+                candidate.agent === "codex" &&
+                stringValue(candidate.native_agent_session_id)?.toLowerCase() ===
+                    verifiedEmptySourceNativeThreadId));
+        const verifiedEmptyRawSendAction = isRecord(rawActions.send)
+            ? rawActions.send
+            : {
+                tool: "agent_knock_knock_send",
+                arguments: { selector: stringValue(terminal.id) },
+                missing_required: ["request"]
+            };
+        const verifiedEmptyCodexHandoffEligible = Boolean(mutationsAllowed &&
+            terminal.agent === "codex" &&
+            terminalControl &&
+            discoveredOwnership.state === "none" &&
+            unresolvedSessionClaims.length === 0 &&
+            matchingSessions.length === 0 &&
+            soleBindingConflict?.kind === "unverifiable" &&
+            nativeIdentityObservation?.status === "verified_absent" &&
+            verifiedEmptyProcessUuid &&
+            verifiedEmptyProcessBirth &&
+            verifiedEmptyWorkspace &&
+            exactBoundCodexSourceForVerifiedEmptyHandoff({
+                session: soleBindingConflict.session,
+                terminalId: String(terminal.id),
+                terminalControl,
+                pid: Number(terminal.pid),
+                workspace: verifiedEmptyWorkspace,
+                processUuid: verifiedEmptyProcessUuid,
+                processBirth: verifiedEmptyProcessBirth
+            }) &&
+            ["idle", "unknown"].includes(String(terminal.activity_state)) &&
+            automatedInputComposerReady === true &&
+            !(isRecord(terminal.approval_state) &&
+                terminal.approval_state.blocked === true) &&
+            blockingHandoffTurns.length === 0 &&
+            !managedSessionHasUnresolvedNativeTransition(storeDir, soleBindingConflict.session) &&
+            !verifiedEmptySourceActiveElsewhere &&
+            terminal.orphaned_terminal_dispatch === undefined &&
+            terminalControl?.capabilities.includes("send_keys") &&
+            terminalControl.capabilities.includes("screen_status"));
+        const verifiedEmptyCodexSnapshotToken = verifiedEmptyCodexHandoffEligible &&
+            terminalControl &&
+            soleBindingConflict &&
+            verifiedEmptyProcessUuid &&
+            verifiedEmptyProcessBirth &&
+            verifiedEmptyWorkspace
+            ? verifiedEmptyCodexHandoffToken({
+                terminalId: String(terminal.id),
+                terminalControl,
+                pid: Number(terminal.pid),
+                workspace: verifiedEmptyWorkspace,
+                processUuid: verifiedEmptyProcessUuid,
+                processBirth: verifiedEmptyProcessBirth,
+                sourceSession: soleBindingConflict.session
+            })
+            : undefined;
         const reconcileBindingAction = mutationsAllowed &&
             discoveredOwnership.state === "none" &&
             unresolvedSessionClaims.length === 0 &&
@@ -3300,6 +3379,7 @@ function terminalFirstListProjection({ storeDir, terminals, managedSessions, ses
             unresolvedSessionClaims.length === 0 &&
             soleBindingConflict?.kind === "live_external_thread_change" &&
             terminal.activity_state === "idle" &&
+            automatedInputComposerReady === true &&
             !(isRecord(terminal.approval_state) &&
                 terminal.approval_state.blocked === true) &&
             !conflictingSessionTurns.some((turn) => SESSION_SEND_BLOCKING_STATUSES.has(turn.status)) &&
@@ -3455,6 +3535,19 @@ function terminalFirstListProjection({ storeDir, terminals, managedSessions, ses
                             }
                         }
                         : {}),
+                    ...(verifiedEmptyCodexSnapshotToken
+                        ? {
+                            send: {
+                                ...verifiedEmptyRawSendAction,
+                                arguments: {
+                                    ...(isRecord(verifiedEmptyRawSendAction.arguments)
+                                        ? verifiedEmptyRawSendAction.arguments
+                                        : {}),
+                                    expected_terminal_token: verifiedEmptyCodexSnapshotToken
+                                }
+                            }
+                        }
+                        : {}),
                     ...(reconcileBindingAction
                         ? { reconcile_binding: reconcileBindingAction }
                         : {})
@@ -3482,8 +3575,19 @@ function terminalFirstListProjection({ storeDir, terminals, managedSessions, ses
                 lifecycle_binding_token: managedSessionBindingToken(authoritativeSession)
             }
             : {};
+        const publicManagementConflict = ownership.state === "conflict" && verifiedEmptyCodexSnapshotToken
+            ? {
+                ...ownership.conflict,
+                kind: "verified_empty_native_session",
+                reason: "the previously bound Codex rollout is conclusively closed " +
+                    "while the same terminal process is at an exact empty prompt",
+                recovery: "use only the exact snapshot-bound send action listed for this terminal"
+            }
+            : ownership.state === "conflict"
+                ? ownership.conflict
+                : undefined;
         return {
-            ...terminal,
+            ...publicTerminal,
             ...authoritativeIdentity,
             management_state: ownership.state === "conflict"
                 ? "conflict"
@@ -3491,15 +3595,23 @@ function terminalFirstListProjection({ storeDir, terminals, managedSessions, ses
                     ? "managed"
                     : "unmanaged",
             ...(ownership.state === "conflict"
-                ? { management_conflict: ownership.conflict }
+                ? { management_conflict: publicManagementConflict }
                 : {}),
             ...(externalHandoffDetected
                 ? {
                     handoff_state: externalHandoffAdoptable
                         ? "external_handoff_adoptable"
-                        : "external_handoff_blocked"
+                        : "external_handoff_blocked",
+                    ...(automatedInputComposerReady !== true
+                        ? {
+                            handoff_blocked_reason: "the current terminal composer is not an exact empty idle frame"
+                        }
+                        : {})
                 }
                 : {}),
+            ...(verifiedEmptyCodexSnapshotToken
+                ? { handoff_state: "verified_empty_native_session_adoptable" }
+                : {}),
             ...(handoffDecision ? { handoff_decision: handoffDecision } : {}),
             managed: management,
             available_actions: availableActions
@@ -4199,13 +4311,13 @@ function managedListApprovalState(conversation) {
 }
 function listActionContracts() {
     return {
-        version: 8,
+        version: 9,
         instructions: [
             "Treat terminals[] as the primary resource and use only actions present in available_actions, except the snapshot-bound terminals[].handoff_decision.choices.take_over_current.action. That nested action requires explicit user confirmation; after it succeeds, refresh list before any follow-current send.",
             "An existing managed session's ordinary send targets session_id and creates a new turn. A turn id is never an ordinary send target.",
             "Read-only native-thread listing targets an exact terminal_id. Native-thread new/resume mutations also use the listed expected_binding_token and never create a Turn.",
             "Native inspection is a separate terminal action: use only its closed inspection enum and current exact terminal_id/token; AKK status does not execute a native slash command.",
-            "A verified, idle human native-thread switch may expose a terminal-scoped send with expected_terminal_token; that action atomically adopts the live context before creating its Turn. Other binding conflicts remain fail-closed and may expose only exact low-level reconcile_binding recovery.",
+            "A verified, idle human native-thread switch may expose a terminal-scoped send with expected_terminal_token; that action atomically adopts the live context before creating its Turn. A conclusively ended Codex rollout may expose the same snapshot-bound send only after AKK proves zero current rollout and an exact empty composer; it detaches the ended Session and creates an isolated virgin Session. Other binding conflicts remain fail-closed and may expose only exact low-level reconcile_binding recovery.",
             "List resumable threads before resume; use only a complete native_thread_id and the action returned for that candidate.",
             "Use a terminal selector only when explicitly named by the user or prefilled by that terminal row's send action. A handoff action also carries expected_terminal_token; never infer, guess, or reuse either value.",
             "Use respond only for an in-flight turn that is explicitly waiting for OpenClaw.",
@@ -4239,6 +4351,17 @@ function listActionContracts() {
                 meaning: "currently_safe_actions",
                 authoritative_for_tool_calls: true
             },
+            native_agent_identity_observation: {
+                meaning: "the latest bounded native identity probe; verified_absent is distinct from an unavailable resolver",
+                authoritative_for_tool_calls: false
+            },
+            management_conflict: {
+                verified_empty_native_session: "a previously bound Codex rollout is conclusively closed; only the exact snapshot-bound send in available_actions may detach it and create an isolated virgin Session"
+            },
+            handoff_state: {
+                meaning: "why a conflict-scoped follow-current send is available or blocked",
+                verified_empty_native_session_adoptable: "the exact current terminal snapshot permits the listed conflict send; availability is revalidated before terminal input"
+            },
             handoff_decision: {
                 meaning: "an explicit human choice required before superseding an active source Turn",
                 authoritative_action_path: "terminals[].handoff_decision.choices.take_over_current.action",
@@ -4262,7 +4385,7 @@ function listActionContracts() {
                     "agentHardTimeoutMinutes"
                 ],
                 unsupported: ["timeoutSeconds"],
-                ordinary_use: "Create a new managed turn in the exact Session. A live terminal selector can attach an unmanaged pane or adopt one verified human-selected native context; an explicit session_id never follows the pane."
+                ordinary_use: "Create a new managed turn in the exact Session. A live terminal selector can attach an unmanaged pane, adopt one verified human-selected native context, or use the exact listed conflict send to detach a verified-empty Codex source before an isolated virgin attach; an explicit session_id never follows the pane."
             },
             new_thread: {
                 tool: "agent_knock_knock_new_thread",
@@ -5652,6 +5775,218 @@ async function reattachManagedSessionForNativeIdentity({ options, terminal, iden
     }, { expectedRevision: managedSessionRevision(existing) });
 }
 const HUMAN_OBSERVED_HANDOFF_FINGERPRINT = nativeThreadCommandFingerprint("adopt_external_thread:human_observed:no_terminal_input:v1");
+function exactBoundCodexSourceForVerifiedEmptyHandoff({ session, terminalId, terminalControl, pid, workspace, processUuid, processBirth }) {
+    const binding = session.binding;
+    return Boolean(session.agent === "codex" &&
+        session.status === "bound" &&
+        binding &&
+        isExactNativeThreadId(binding.native_thread_id) &&
+        isCompleteNativeRollout(binding.native_process.rollout) &&
+        binding.native_process.process_uuid &&
+        binding.native_process.process_birth &&
+        binding.native_process.pid === pid &&
+        terminalControlAliasMatches(binding.terminal_id, binding.terminal_control, terminalId, terminalControl) &&
+        workspace &&
+        path.resolve(session.workspace) === path.resolve(workspace) &&
+        processIncarnationRelationship({
+            binding,
+            livePid: pid,
+            liveProcessUuid: processUuid,
+            liveProcessBirth: processBirth
+        }) === "same");
+}
+function verifiedEmptyCodexHandoffToken({ terminalId, terminalControl, pid, workspace, processUuid, processBirth, sourceSession }) {
+    const terminalToken = unmanagedTerminalBindingToken({
+        terminalId,
+        terminalControl,
+        agent: "codex",
+        pid,
+        workspace,
+        processUuid,
+        processBirth
+    });
+    return createHash("sha256")
+        .update(JSON.stringify({
+        version: 1,
+        kind: "verified_empty_codex_handoff",
+        terminal_token: terminalToken,
+        source_session_id: sourceSession.session_id,
+        source_revision: managedSessionRevision(sourceSession),
+        source_binding_token: managedSessionBindingToken(sourceSession),
+        observation: "verified_absent"
+    }))
+        .digest("hex");
+}
+async function assertVerifiedEmptyCodexHandoffBoundary({ options, terminal, sourceSession, expectedSourceStatus, requireNoDispatch, requireEmptyComposer = true }) {
+    const currentSource = loadManagedSession(storeDirFromOptions(options), sourceSession.session_id);
+    if (currentSource.status !== expectedSourceStatus ||
+        currentSource.revision !== sourceSession.revision ||
+        managedSessionBindingToken(currentSource) !==
+            managedSessionBindingToken(sourceSession)) {
+        throw new Error("the verified-empty source Session changed; refresh AKK list");
+    }
+    const liveIncarnation = codexProcessIncarnationForPid(terminal.pid);
+    if (!exactBoundCodexSourceForVerifiedEmptyHandoff({
+        session: {
+            ...currentSource,
+            // The exact source binding remains authoritative after the monotonic
+            // detach; only the Session status changes.
+            status: "bound"
+        },
+        terminalId: terminal.conversationId,
+        terminalControl: terminal.terminalControl,
+        pid: terminal.pid,
+        workspace: terminal.terminalControl.currentPath,
+        processUuid: liveIncarnation.processUuid,
+        processBirth: liveIncarnation.processBirth
+    })) {
+        throw new Error("the verified-empty source binding no longer matches the terminal");
+    }
+    const observation = await observeCurrentNativeAgentSessionIdentity({
+        options,
+        agent: "codex",
+        pid: terminal.pid,
+        cwd: terminal.terminalControl.currentPath
+    });
+    if (observation.status === "unavailable") {
+        throw new Error(`Codex native identity observation is unavailable: ${observation.reason}`);
+    }
+    if (observation.status !== "verified_absent") {
+        throw new Error(`Codex materialized native thread ${observation.identity.sessionId}; ` +
+            "refresh AKK list before sending");
+    }
+    const status = await createTerminalAgentBridge(options).status("codex", terminal.terminalControl, {
+        runtime: terminalRuntimeForLiveIdentity({
+            terminal,
+            expectedEmptyNativeSession: true
+        })
+    });
+    if (status.reachable !== true ||
+        status.approval_state.blocked === true ||
+        !["idle", "unknown"].includes(status.activity_state)) {
+        throw new Error(`terminal ${terminal.terminalControl.target} is not at a verified ` +
+            `empty Codex prompt (${status.activity_state}: ${status.activity_reason})`);
+    }
+    if (requireNoDispatch) {
+        assertTerminalLifecycleReady({
+            options,
+            terminal,
+            // A fully styled empty/placeholder composer below is stronger prompt
+            // evidence than the plain-screen parser's conservative `unknown`.
+            terminalStatus: { ...status, activity_state: "idle" }
+        });
+    }
+    if (managedSessionHasUnresolvedNativeTransition(storeDirFromOptions(options), currentSource)) {
+        throw new Error(`managed Session ${currentSource.session_id} has an unresolved native-thread transition`);
+    }
+    if (requireEmptyComposer) {
+        await assertCodexComposerReadyForAutomatedInput({
+            options,
+            terminalControl: terminal.terminalControl
+        });
+    }
+}
+async function maybeDetachVerifiedEmptyCodexSource({ options, terminal, sourceSession, observation }) {
+    if (terminal.agent !== "codex" ||
+        !sourceSession?.binding ||
+        observation.status !== "verified_absent") {
+        return undefined;
+    }
+    const processUuid = sourceSession.binding.native_process.process_uuid;
+    const processBirth = sourceSession.binding.native_process.process_birth;
+    const workspace = terminal.terminalControl.currentPath;
+    const liveIncarnation = codexProcessIncarnationForPid(terminal.pid);
+    if (!processUuid ||
+        !processBirth ||
+        !workspace ||
+        !exactBoundCodexSourceForVerifiedEmptyHandoff({
+            session: sourceSession,
+            terminalId: terminal.conversationId,
+            terminalControl: terminal.terminalControl,
+            pid: terminal.pid,
+            workspace,
+            processUuid: liveIncarnation.processUuid,
+            processBirth: liveIncarnation.processBirth
+        })) {
+        return undefined;
+    }
+    const expectedToken = verifiedEmptyCodexHandoffToken({
+        terminalId: terminal.conversationId,
+        terminalControl: terminal.terminalControl,
+        pid: terminal.pid,
+        workspace,
+        processUuid,
+        processBirth,
+        sourceSession
+    });
+    if (stringValue(options.expectedTerminalToken) !== expectedToken) {
+        throw new Error("verified-empty Codex handoff requires the fresh exact terminal token " +
+            "advertised by AKK list");
+    }
+    await assertVerifiedEmptyCodexHandoffBoundary({
+        options,
+        terminal,
+        sourceSession,
+        expectedSourceStatus: "bound",
+        requireNoDispatch: true
+    });
+    await assertNativeThreadHasExclusiveOwnership({
+        options,
+        agent: "codex",
+        currentPid: terminal.pid,
+        nativeThreadId: sourceSession.binding.native_thread_id,
+        storeDir: storeDirFromOptions(options),
+        terminalControl: terminal.terminalControl,
+        excludedManagedSessionId: sourceSession.session_id
+    });
+    const detachedAt = cliNow().toISOString();
+    const detached = saveManagedSession(storeDirFromOptions(options), {
+        ...sourceSession,
+        status: "detached",
+        detached_at: detachedAt,
+        updated_at: detachedAt
+    }, {
+        expectedRevision: managedSessionRevision(sourceSession)
+    });
+    runtimeLog("info", "verified_empty_codex_source_detached", {
+        terminal_id: terminal.conversationId,
+        source_session_id: sourceSession.session_id,
+        native_thread_id: sourceSession.binding.native_thread_id,
+        process_uuid: processUuid,
+        process_birth: processBirth,
+        terminal_input_sent: false
+    });
+    return {
+        detached,
+        boundary: {
+            terminal,
+            detachedSourceSessionId: detached.session_id,
+            detachedSourceRevision: managedSessionRevision(detached),
+            detachedSourceBindingToken: managedSessionBindingToken(detached),
+            processUuid,
+            processBirth
+        }
+    };
+}
+async function assertVerifiedEmptyCodexTransportBoundary({ options, boundary, requireEmptyComposer }) {
+    const source = loadManagedSession(storeDirFromOptions(options), boundary.detachedSourceSessionId);
+    if (source.status !== "detached" ||
+        managedSessionRevision(source) !== boundary.detachedSourceRevision ||
+        managedSessionBindingToken(source) !==
+            boundary.detachedSourceBindingToken ||
+        source.binding?.native_process.process_uuid !== boundary.processUuid ||
+        source.binding.native_process.process_birth !== boundary.processBirth) {
+        throw new Error("verified-empty Codex source authority changed before text injection");
+    }
+    await assertVerifiedEmptyCodexHandoffBoundary({
+        options,
+        terminal: boundary.terminal,
+        sourceSession: source,
+        expectedSourceStatus: "detached",
+        requireNoDispatch: false,
+        requireEmptyComposer
+    });
+}
 function observedHandoffAuthorityToken({ terminal, identity, sourceSession, target }) {
     const exact = exactLifecycleProcessIdentity(terminal, identity);
     const terminalToken = unmanagedTerminalBindingToken({
@@ -9229,14 +9564,14 @@ async function runSend(options) {
                 })) {
                     return;
                 }
-                const claimedSession = soleBoundManagedSessionClaimForTerminal(rawStoreDir, terminalConversation);
-                const knownCodexCompanions = claimedSession
+                let claimedSession = soleBoundManagedSessionClaimForTerminal(rawStoreDir, terminalConversation);
+                let knownCodexCompanions = claimedSession
                     ? codexAllowedCompanionSetForManagedSession({
                         storeDir: rawStoreDir,
                         session: claimedSession
                     })
                     : { additional: [] };
-                let currentNativeIdentity = await resolveCurrentNativeAgentSessionIdentity({
+                const nativeIdentityObservation = await observeCurrentNativeAgentSessionIdentity({
                     options,
                     agent: terminalConversation.agent,
                     pid: terminalConversation.pid,
@@ -9247,6 +9582,26 @@ async function runSend(options) {
                     allowedCompanionIdentity: knownCodexCompanions.primary,
                     allowedAdditionalIdentities: knownCodexCompanions.additional
                 });
+                if (nativeIdentityObservation.status === "unavailable") {
+                    throw new Error(`native ${terminalConversation.agent} identity observation is ` +
+                        `unavailable: ${nativeIdentityObservation.reason}`);
+                }
+                let currentNativeIdentity = nativeIdentityObservation.status === "resolved"
+                    ? nativeIdentityObservation.identity
+                    : undefined;
+                const verifiedEmptyHandoff = await maybeDetachVerifiedEmptyCodexSource({
+                    options,
+                    terminal: terminalConversation,
+                    sourceSession: claimedSession,
+                    observation: nativeIdentityObservation
+                });
+                if (verifiedEmptyHandoff) {
+                    // The old rollout is conclusively closed.  Never carry it forward as
+                    // a pre-materialization companion for the new virgin Session.
+                    claimedSession = undefined;
+                    knownCodexCompanions = { additional: [] };
+                    currentNativeIdentity = undefined;
+                }
                 const physicalNativeIdentityBeforeHandoff = currentNativeIdentity;
                 const handoff = await maybeAdoptObservedExternalThread({
                     options,
@@ -9415,7 +9770,8 @@ async function runSend(options) {
                                 terminal: terminalConversation,
                                 transition: handoff.transition
                             }
-                            : undefined
+                            : undefined,
+                        verifiedEmptyCodexHandoff: verifiedEmptyHandoff?.boundary
                     });
                 }
                 finally {
@@ -10374,7 +10730,7 @@ async function runTerminalConversationApprove({ options, conversationId, agent,
         releaseTerminalLock();
     }
 }
-async function runTerminalControlSend({ options, conversation, nextConversation, statePath, logPath, executor, message, terminalControl, terminalSendLockHeld = false, terminalStateLockHeld = false, storeWriterLeaseHeld = false, recordMessageAfterSend = false, recordRawAttachmentAfterSend = false, onTerminalPreflightVerified = undefined, allowedPreMaterializationIdentity = undefined, allowedAdditionalIdentities = [], observedHandoff = undefined, continuingTurnResponse = false }) {
+async function runTerminalControlSend({ options, conversation, nextConversation, statePath, logPath, executor, message, terminalControl, terminalSendLockHeld = false, terminalStateLockHeld = false, storeWriterLeaseHeld = false, recordMessageAfterSend = false, recordRawAttachmentAfterSend = false, onTerminalPreflightVerified = undefined, allowedPreMaterializationIdentity = undefined, allowedAdditionalIdentities = [], observedHandoff = undefined, verifiedEmptyCodexHandoff = undefined, continuingTurnResponse = false }) {
     const bridge = terminalBridgeEnabled(conversation);
     if (!terminalSendLockHeld) {
         const releaseTerminalLock = acquireTerminalBridgeSendLock(storeDirFromOptions(options), terminalControl, { timeoutMs: 30000 });
@@ -10397,6 +10753,7 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
                 allowedPreMaterializationIdentity,
                 allowedAdditionalIdentities,
                 observedHandoff,
+                verifiedEmptyCodexHandoff,
                 continuingTurnResponse
             });
         }
@@ -10437,6 +10794,7 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
                 allowedPreMaterializationIdentity,
                 allowedAdditionalIdentities,
                 observedHandoff,
+                verifiedEmptyCodexHandoff,
                 continuingTurnResponse
             });
         }
@@ -10464,6 +10822,7 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
             allowedPreMaterializationIdentity,
             allowedAdditionalIdentities,
             observedHandoff,
+            verifiedEmptyCodexHandoff,
             continuingTurnResponse
         }));
     }
@@ -10645,7 +11004,18 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
             scrollbackLines: Number(options.scrollbackLines ?? 120),
             runtime: preSendRuntime
         });
-        assertSafeTerminalSend(executor.kind, status);
+        if (verifiedEmptyCodexHandoff) {
+            if (executor.kind !== "codex" ||
+                status.reachable !== true ||
+                status.approval_state.blocked === true ||
+                !["idle", "unknown"].includes(status.activity_state)) {
+                throw new Error(`Codex verified-empty handoff is not at a safe prompt ` +
+                    `(${status.activity_state}: ${status.activity_reason})`);
+            }
+        }
+        else {
+            assertSafeTerminalSend(executor.kind, status);
+        }
         if (executor.kind === "codex" && needsPostSendNativeBinding) {
             if (pendingManagedNativeBinding || allowedPreMaterializationIdentity) {
                 const expectedForegroundId = stringValue(sendTakeover?.terminal_agent_expected_session_id);
@@ -11015,7 +11385,8 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
     try {
         await terminalBridge.send(executor.kind, terminalControl, terminalPayload, {
             runtime: preSendRuntime,
-            requireExactComposerBeforeEnter: observedHandoff !== undefined,
+            requireExactComposerBeforeEnter: observedHandoff !== undefined ||
+                verifiedEmptyCodexHandoff !== undefined,
             beforeText: observedHandoff
                 ? async () => {
                     await assertObservedHandoffTransportBoundary({
@@ -11025,7 +11396,15 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
                         requireEmptyComposer: true
                     });
                 }
-                : undefined,
+                : verifiedEmptyCodexHandoff
+                    ? async () => {
+                        await assertVerifiedEmptyCodexTransportBoundary({
+                            options,
+                            boundary: verifiedEmptyCodexHandoff,
+                            requireEmptyComposer: true
+                        });
+                    }
+                    : undefined,
             beforeEnter: observedHandoff
                 ? async () => {
                     await assertObservedHandoffTransportBoundary({
@@ -11035,7 +11414,15 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
                         requireEmptyComposer: false
                     });
                 }
-                : undefined,
+                : verifiedEmptyCodexHandoff
+                    ? async () => {
+                        await assertVerifiedEmptyCodexTransportBoundary({
+                            options,
+                            boundary: verifiedEmptyCodexHandoff,
+                            requireEmptyComposer: false
+                        });
+                    }
+                    : undefined,
             async onTransportStage(event) {
                 const stageAt = cliNow().toISOString();
                 if (event.stage === "text_injected") {
@@ -11084,6 +11471,13 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
                         requireEmptyComposer: false
                     });
                 }
+                if (event.stage === "text_injected" && verifiedEmptyCodexHandoff) {
+                    await assertVerifiedEmptyCodexTransportBoundary({
+                        options,
+                        boundary: verifiedEmptyCodexHandoff,
+                        requireEmptyComposer: false
+                    });
+                }
                 try {
                     appendEvent(logPath, {
                         ts: stageAt,
@@ -12523,6 +12917,29 @@ async function resolveCurrentNativeAgentSessionIdentity({ options, agent, pid, c
         evidence: "claude_agents_exact_pid"
     };
 }
+/**
+ * Preserve the security-significant difference between a successful native
+ * identity probe that found no current Session and a probe that could not be
+ * completed.  `undefined` from the Codex provider is authoritative only after
+ * both the process-incarnation and open-rollout inspections succeeded.
+ */
+async function observeCurrentNativeAgentSessionIdentity(request) {
+    try {
+        const identity = await resolveCurrentNativeAgentSessionIdentity(request);
+        return identity
+            ? { status: "resolved", identity }
+            : {
+                status: "verified_absent",
+                evidence: "native_identity_resolver_verified_absent"
+            };
+    }
+    catch (error) {
+        return {
+            status: "unavailable",
+            reason: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
 function nativeAgentIdentityMatchesTurn(conversation, currentIdentity) {
     const takeover = isRecord(conversation.native_session_takeover)
         ? conversation.native_session_takeover
@@ -18232,14 +18649,7 @@ function claudeComposerVisible(screen) {
         .some((line) => /^\s*❯(?:\s|$)/u.test(line));
 }
 function claudeComposerEmpty(screen) {
-    const lines = String(screen ?? "").split(/\r?\n/u);
-    while (lines.length > 0 && lines.at(-1)?.trim() === "") {
-        lines.pop();
-    }
-    const composers = lines
-        .slice(-8)
-        .filter((line) => /^\s*❯(?:\s|$)/u.test(line));
-    return composers.length === 1 && /^\s*❯\s*$/u.test(composers[0]);
+    return isExactClaudeIdleComposer(String(screen ?? ""));
 }
 function assertManualLifecycleProcessIncarnation(transition, live) {
     if (live.processUuid !== transition.before_process_uuid ||