@scotthuang/agent-knock-knock 0.13.13 → 0.13.15

package/docs/codex-0.159.2-compatibility.md

@@ -0,0 +1,226 @@
+# Codex CLI 0.159.2 compatibility
+
+AKK 0.13.14 adds `codex-cli 0.159.2` and repairs the terminal-routing
+failures described in the [0.159.0 follow-up](codex-0.159.0-compatibility.md#local-terminal-routing-follow-up-2026-09-30-not-a-release).
+The native observations below were collected before publication. The user
+subsequently tested the locally installed candidate successfully; publication
+checks are recorded separately from those observations.
+
+The official source target is `rust-v0.159.2`, commit
+[`ff6aec96948b70d94983af2641a6b67c94faeff5`](https://github.com/openai/codex/tree/ff6aec96948b70d94983af2641a6b67c94faeff5).
+Compared with 0.159.0, the app-server protocol, paginated thread processor, and
+production TUI sources have no changes. TUI differences are confined to tests
+and snapshots; app-server implementation differences concern feedback reports.
+The terminal status, fullscreen Composer, async question, questionnaire, and
+model/plan profiles therefore use the existing 0.159 UI contract with an exact
+0.159.2 version identity.
+
+## Foreground and shared backend versions
+
+The foreground executable and shared daemon are independently installed. An
+already-open 0.159.0 process can remain connected to the existing 0.159.2 daemon
+after the standalone CLI is updated. `initialize.userAgent` and the thread's
+`cliVersion` describe that daemon; neither replaces physical process/version
+verification.
+
+AKK binds both versions. The only supported pairs are 0.158.0/0.158.0,
+0.159.0/0.159.0, 0.159.0/0.159.2, and 0.159.2/0.159.2. Initial negotiation
+permits only these reviewed pairs. Every subsequent read and answer pins the
+actual bound daemon version. A backend change invalidates that expectation; an
+old Watch is never silently migrated.
+
+The paginated task anchor keeps `codex_version` as the physical TUI version and
+uses an optional `backend_version` for a different daemon version. The field is
+covered by strict validation and the anchor fingerprint. Missing fields in old
+anchors retain same-version semantics. Older readers reject mixed-version
+anchors instead of interpreting them as same-version tasks. UI/terminal safety
+checks continue to use the physical version, exact process birth, and canonical
+terminal identity.
+
+## Terminal and answer corrections
+
+The original tmux failure was not caused by window size. With all locale
+variables absent, tmux 3.6b rendered the tab in the old dimension format as an
+underscore (`213_63`). The provider now requests a strictly parsed ASCII
+`213x63` format. Its diagnostics summarize command and socket identities with
+hashes rather than exposing their raw paths.
+
+Herdr 0.8 returns no text for `pane.read` with `lines: 0`. AKK now requests the
+visible viewport with that argument omitted when its caller requests zero
+scrollback lines. The native `/status` selection also uses truecolor foreground
+and background attributes instead of the reverse-video attribute expected by
+the old parser. The finite-state style check recognizes the observed native
+palette, verifies all visible selected-row cells, and rejects partial, dimmed,
+reset, or unknown selections.
+
+Normal output updates the macOS TTY device's change timestamp. Herdr viewport
+inspection no longer treats that timestamp as a device replacement. Device,
+inode, device number, owner, character-device type, non-symlink status, terminal
+identity, and process birth checks remain in force. Socket identity checks are
+unchanged.
+
+At 29 rows, a working indicator and tip can push the native status header above
+the visible viewport. Herdr's visible/detection reads cannot expose that hidden
+content by requesting more lines. The private paginated binding transaction now
+supports one native PageUp followed by Ctrl+End. It joins only a unique,
+nonblank overlap between captured frames, requires the real version header and
+complete strict status card, and verifies restoration of the original card tail
+before returning an identity. Every capture and key rechecks terminal identity.
+Drafts, selection mode, unknown history chrome, ambiguous overlap, or failed
+restoration stop the operation. The header is never synthesized from cached
+metadata. Native observations at 91 by 24 exercised clipping without creating a
+model task; the required existing Herdr session retains its 91 by 29 geometry.
+
+Herdr 0.8.0's key-name parser omits PageUp and End. Its official terminal
+encoder defines PageUp as `ESC [ 5 ~` and Ctrl+End as `ESC [ 1 ; 5 F`.
+For just these two singleton semantic keys, the provider uses the official
+`pane.send_text` direct-input endpoint with those fixed constants. Ordinary
+text retains `pane.send_input` and its bracketed-paste behavior. Mixed navigation
+batches are rejected before input; stable-resource resolution, socket identity,
+response correlation, and uncertain-delivery fencing are unchanged. No caller
+can provide arbitrary raw bytes through this key path.
+
+Working and queued-question chrome can remain visible while browsing history;
+the existing strict native suffix grammar separates it from the card. If the
+first PageUp exposes a compatible but non-overlapping partial status prefix,
+one optional closed WheelDown event advances three transcript rows. Eligibility
+uses the same strict card grammar, including a command-only prefix immediately
+before its header; that temporary adjacency never supplies binding evidence. It requires a freshly matching paused frame and
+exact viewport, targets the fixed transcript position (2,2), and exposes no
+caller-selected coordinates or bytes. Both providers send the official SGR
+wheel encoding without paste framing. Multiple candidate overlaps never
+authorize this fallback. A unique nonblank overlap and successful restoration
+are still required afterward. This is a bounded transaction, not an unbounded
+history scan or a relaxation of the identity parser.
+
+The native queued-question suffix can add or remove a 1–20 second countdown.
+That countdown is display state, not an automatic answer or popup timer; it is
+normalized only while comparing otherwise identical native chrome. The exact
+`New activity` paused-view prefix is also recognized. Restoration alone permits
+a known task-finished or question-count transition, while still requiring a
+fresh native paused footer, matching model/path, and an empty styled Composer.
+Unknown chrome or a draft forbids restoration input. A changed status card
+after restoration cannot return the earlier binding.
+
+This navigation is confined to the private closed binding used by Send/Watch
+and response preflight. Public `native_inspect(status)` remains idle-only; it
+still fails safely if its own full status card cannot fit. The ordinary 91 by
+29 public inspection was observed separately on both physical CLI versions.
+
+One native async answer was recorded about 7.4 seconds after submission, beyond
+the previous five-second confirmation window. Answer delivery now keeps the
+transport RPC deadline separate from a 15-second read-only receipt observation
+window. An RPC error or an early completed-turn status cannot establish that
+the answer was lost. Only the unique receipt matching the submitted client ID,
+payload, native turn, and question tuple confirms it. There is still exactly
+one answer submission; unresolved outcomes remain fenced against automatic
+retry.
+
+## Local upgrade and validation boundary
+
+The installed CLI uses the official standalone layout under
+`~/.codex/packages/standalone`; its visible entry is `~/.local/bin/codex`.
+The existing `mycodes` wrapper supplies the configured SOCKS proxy and remains
+unchanged. The existing latest update channel is retained. Updating the visible
+executable does not restart existing TUI processes or the shared daemon.
+
+The required old Herdr session is identified by its actual directory
+`~/workspace/herdr-codex`, stable terminal ID, PID, and process birth. It is not
+replaced by a different directory or silently restarted to make the version pair
+match. Separate owned tmux sessions exercise locale-free viewport access and the
+new executable without interrupting user sessions.
+
+Fast regressions and targeted native observations are distinct evidence. The original local task did not authorize the full/integration/release tier;
+the subsequently authorized publication uses the standard release gate. Native
+callbacks are collected locally, so this work does not establish external chat
+delivery. Managed native new/resume, unrecognized terminal styles, and a first
+Watch while an unbound blocking modal owns the terminal retain the documented
+0.159.0 limitations. The protected OpenClaw pane's previous task result is not
+part of this verification.
+
+
+## Combined candidate results (2026-09-30)
+
+The combined local candidate includes the Claude 2.1.285 adapter described in
+[its separate report](claude-2.1.285-compatibility.md). `npm run test:fast` passes
+**2,336 tests**, with zero failures, cancellations, or skips. The fast build also
+checks TypeScript and canonical Skill replicas. Architecture and refactor-evidence
+validators pass without increasing production size budgets.
+
+The tested runtime contains 238 JavaScript files under `dist/src`. SHA-256 is
+`e71abb37ee38717830b9acff4642f5c07c45670b6f76050897e46b08b59cb97f`, over sorted
+repository-relative paths followed by NUL, content, and NUL. The canonical Skill
+SHA-256 is `57c70aadbf8e48f05e11d2841c4889b7815d92bdee6fd20cedfa1e73e9da1eff`.
+These hashes identify a local candidate, not a release attestation.
+
+Native observations call compiled production terminal, Send, Watch, response,
+and durable callback components with real I/O, a private Store, and local callback
+collector. They are not unit mocks. All terminal mutations retain the global AKK
+ownership lock and verify the physical endpoint, process birth, and exact workspace.
+
+| Native scenario | Actual evidence |
+| --- | --- |
+| Existing Herdr `~/workspace/herdr-codex` | Physical 0.159.0, existing backend 0.159.2; original process and conversation retained |
+| Herdr Send and Watch | Auto Watch accepted the real prompt; an additional running-task Watch bound the same native turn |
+| Herdr question and answer | Exact single-select question notification; one native Yes response, durable receipt `confirmed` |
+| Herdr completion | Expected marker returned; each exact Watch delivered one completion callback; two extra reconciliations produced no duplicates |
+| New 0.159.2 tmux, locale variables absent | Real process launched through unchanged `mycodes --yolo`; exact Send binding, question, one confirmed Yes, and one exact completion callback passed |
+| 0.159.2 manual Watch after output settled | A fresh guarded probe bound the same running turn; auto and manual exact Watches each delivered the expected completion marker once |
+| Existing `akk:0.0` | Read-only fixed viewport query returned 213 by 63 under both locale-free and UTF-8 environments |
+| Public native status | Ordinary idle inspection at 91 by 29 observed the exact session on both physical CLI versions |
+
+The final Herdr turn is `01a0f17a-f838-7562-9c4a-dfc619c1d386`, with final marker
+`AKK159_HERDR_ROUTING_a22752f7`. The final 0.159.2 async-answer turn is
+`01a0f17a-cb8d-7b01-ad28-b3f3caa480fe`, with marker
+`AKK1592_TMUX_ROUTING_efe316c1`. The separate running-task manual-Watch turn is
+`01a0f17d-5f58-7dc2-8d5b-c3805d5e8aad`, with marker
+`AKK1592_TMUX_ROUTING_427687aa`; both exact completion callbacks passed after additional
+reconciliation without duplicates.
+
+One concurrent-output boundary remains: if fresh assistant text appears after
+the status card during a binding probe, the closed-card parser rejects that
+frame. A manual Watch then reports `terminal_activity` / `best_effort` explicitly;
+it must not be counted as an exact completion. Once output settles, a new,
+separately guarded status probe can bind the active task. The final tmux async
+scenario encountered this boundary for its extra manual Watch; its Send-created
+exact Watch still confirmed the answer and exact marker completion. The activity
+Watch's independent idle event is excluded from that result. No automatic answer
+retry or permissive parsing of intervening assistant prose was introduced.
+
+Earlier native attempts deliberately remain failed evidence: missing overlap,
+unsupported history keys, changing history chrome, and delayed receipt exposed
+the corrections above. A previous answer recorded after the old five-second
+window was never replayed. Attempts ending without an answer are not successful
+question tests, even when the daemon reports the turn completed.
+
+At the close of the compatibility work, the original working directory's 34
+dirty/untracked files, shell startup files, and Claude settings retained their
+pre-task hashes. The CLI upgrades were installed. AKK code was initially kept
+in the isolated compatibility worktree. Only the two owned Codex test tmux
+servers were stopped after completion, with their socket, sole pane, workspace,
+PID, and birth revalidated. The designated Herdr process retained its original
+91 by 29 viewport. A later user-authorized local installation updated the
+standalone CLI, plugin, and Skill to this exact runtime, restarted only the
+Gateway, and passed `agent-knock-knock doctor --timeout-ms 60000`. The user
+reported successful manual testing before authorizing publication.
+
+
+## Publication gate for 0.13.14
+
+After the user's successful local test and explicit publication authorization,
+`npm run test:release` passed on 2026-10-01:
+
+- Full suite: **2,851 passed**, zero failures, cancellations, or skips.
+- Isolated OpenClaw 2026.9.1: install, runtime loading, callback, Doctor, bundled
+  Skill, tmux fixture/diagnostics, update/reinstall, and uninstall passed.
+- ClawHub Plugin Inspector runtime validation: **PASS**, with the real SDK.
+- ClawHub publish dry-run: passed with the `herdr` topic retained.
+
+The first full run exposed seven old TAB-separated tmux viewport fixture
+responses across four test helpers, causing eleven failures. Those fixtures now
+return the requested ASCII `x` format and assert the exact format argument;
+negative malformed-viewport and native input safety assertions remain intact.
+The final run above includes those corrections. Production runtime and Skill
+hashes remained identical to the native-tested and user-tested candidate above.
+No additional credentialed native lifecycle smoke was run; the existing actual
+native observations and their limitations remain the evidence for that scope.

package/docs/quickstart-herdr.md

@@ -28,11 +28,11 @@ AKK enumerates every running local Herdr session, identifies a terminal by its s
 
 The v30 structured model contract carries semantic IDs only. Ordinary send is `send({session_id,request})` for strict continuation or `send({terminal_id,request})` for the current verified Herdr pane; the targets are mutually exclusive. An advertised `terminal_user_explicit` action keeps the user's Send independent of broken AKK management state and ordinary Composer visibility, stability, exactness, or existing draft contents. It requires the exact live terminal/process, a scanned non-blocked approval state, and no proven questionnaire, editor, menu, history search, or read-only viewer that owns input. The agent-neutral `terminal_user_explicit_composer_policy` advertises `replace_current_composer_and_submit`; the older Codex-named field remains a compatibility alias. Codex freezes the open-rollout candidate set and sends `C-u` once to replace the current Composer; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each then injects the request, waits through the paste window, and dispatches Enter exactly once without a post-text Composer veto. For Codex, a unique exact request acceptance promotes the provisional Session/Turn even when `/clear` delayed creation of the foreground rollout; zero or ambiguous matches never cause replay. If managed promotion cannot be prepared before input, AKK still sends once, best-effort attaches an exact Terminal Watch, and releases stale management. After exact request acceptance, that Watch can notify the owning controller of a questionnaire and broker one explicitly chosen response through Status plus `respond_interaction({watch_id,...})`; before acceptance, or when only best-effort activity evidence exists, it remains notification-only. Watch failure never changes delivery. Native inspection and lifecycle input remain exact-empty-only. Send results expose physical dispatch, agent acceptance, management, and observation separately. Watch and native/lifecycle actions likewise expose `terminal_id` (plus `inspection` or `native_thread_id` where applicable), never a pane route, selector, draft text, composer digest, token, fingerprint, revision, or binding generation. AKK resolves the current Herdr route and derives all opaque freshness fences privately, then revalidates them under lock before terminal input. Once clear or request input may have occurred, an uncertain result must not be retried automatically.
 
-For a physically exact, exact-empty idle Codex pane with ambiguous rollout identity, a fresh row may advertise `identify_foreground` and `identify_and_send`. The diagnostic action changes no AKK Store record but sends `/status` exactly once through the same visible Herdr pane; its 30-second proof grants no later authority. The atomic action retains the canonical Herdr terminal lock across the probe and one task, while exact request acceptance remains the only durable Session/Turn identity. List and Status never run the probe. Codex 0.158.0/0.159.0 exact Send and active-task Watch use a separate closed `/status` transaction to bind the foreground paginated thread. The three status axes remain independent: `screen_state` describes the live TUI, `native_identity_state` describes foreground identity resolution, and `durable_activity_state` describes exact artifact-backed work; legacy `activity_state` stays conservative for compatibility.
+For a physically exact, exact-empty idle Codex pane with ambiguous rollout identity, a fresh row may advertise `identify_foreground` and `identify_and_send`. The diagnostic action changes no AKK Store record but sends `/status` exactly once through the same visible Herdr pane; its 30-second proof grants no later authority. The atomic action retains the canonical Herdr terminal lock across the probe and one task, while exact request acceptance remains the only durable Session/Turn identity. List and Status never run the probe. Codex 0.158.0/0.159.0/0.159.2 exact Send and active-task Watch use a separate closed `/status` transaction to bind the foreground paginated thread. The three status axes remain independent: `screen_state` describes the live TUI, `native_identity_state` describes foreground identity resolution, and `durable_activity_state` describes exact artifact-backed work; legacy `activity_state` stays conservative for compatibility.
 
 To observe an exact Herdr Codex or Claude Code terminal, run a fresh `/akk list` and copy that row's complete `terminal_id`. Its advertised `watch` action is the recommended convenience, but missing advertisement does not veto an explicit user request. Both the structured action and `/akk watch <exact-terminal-id>` take only that exact ID. The result's `watch_id` is the sole target for `/akk status <watch-id>` and `/akk unwatch <watch-id>`.
 
-Watch follows the user's selected terminal. Codex 0.158.0/0.159.0 exact Watch creation types a closed `/status` command into an available main Composer to bind its foreground task; later observation is read-only. See the [compatibility boundaries](codex-0.159.0-compatibility.md). Coding-agent version or artifact uncertainty, missing binding metadata, managed ownership, and missing action advertisement are warnings rather than creation vetoes. AKK fails only when that exact Herdr terminal is absent, its endpoint/process cannot be identified, neither an exact durable task anchor nor a read-only screen-status path exists, or the durable Watch Store cannot be created. An existing managed monitor remains preferable for exact Turn attribution, but an explicit Watch can coexist without adopting or mutating it. New exact-task Watches default to `respond_when_exact`: each distinct supported native interaction emits an `interaction_required` wake-up, then Status in the owning controller conversation exposes a single-use response offer. Activity/best-effort Watches and unsupported or secret question shapes emit `interaction_manual_required` and remain `notify_only`.
+Watch follows the user's selected terminal. Codex 0.158.0/0.159.0/0.159.2 exact Watch creation types a closed `/status` command into an available main Composer to bind its foreground task; later observation is read-only. See the [compatibility boundaries](codex-0.159.2-compatibility.md). Coding-agent version or artifact uncertainty, missing binding metadata, managed ownership, and missing action advertisement are warnings rather than creation vetoes. AKK fails only when that exact Herdr terminal is absent, its endpoint/process cannot be identified, neither an exact durable task anchor nor a read-only screen-status path exists, or the durable Watch Store cannot be created. An existing managed monitor remains preferable for exact Turn attribution, but an explicit Watch can coexist without adopting or mutating it. New exact-task Watches default to `respond_when_exact`: each distinct supported native interaction emits an `interaction_required` wake-up, then Status in the owning controller conversation exposes a single-use response offer. Activity/best-effort Watches and unsupported or secret question shapes emit `interaction_manual_required` and remain `notify_only`.
 
 Status can also expose a Codex `kind="async_question"` while the observed task remains `working`. Its response requires the same exact managed `turn_id` or response-capable exact `watch_id`, semantic question/option IDs, and an optional advertised `delivery_mode` (default: `steer_current_turn`): `steer_current_turn` delivers to the running turn, while `queue_next_turn` queues it for the next turn. A blocking `kind="questionnaire"` never carries `delivery_mode`. Neither form accepts raw Herdr input, a shortcut chord, or a menu index. Codex 0.154.0 and 0.155.1 use separate version-bound TUI profiles; AKK does not attribute post-0.155.1 main-only notification or stable-question-identity wrappers to either released client.
 

package/docs/quickstart-tmux.md

@@ -118,9 +118,9 @@ verified Escape, but it never receives Enter authority.
 
 Codex declares `scope="current_and_new_sessions"`: the native selection changes the open session and persists the model for future sessions. Ordinary reasoning efforts through `max` persist too. `ultra` is the native exception—it applies to the current session, while Codex stores a non-Ultra effort fallback for new sessions. AKK therefore reports current `effective` and `new_session_defaults` separately and omits the future effort when the native TUI cannot expose its exact fallback value. Claude Code declares `scope="current_session"` and does not change its new-session default. AKK does not silently edit a configuration file to simulate either behavior. If the outcome is `uncertain` or `do_not_retry=true`, do not repeat the command; inspect the shared pane and refresh `/akk models` before a deliberate new attempt.
 
-AKK Turn status and the coding agent's native status are separate. `/akk status` and `agent_knock_knock_status` inspect AKK-managed state and a bounded current screen; they never type `/status`. For native status, start from `/akk list` and use only an advertised `agent_knock_knock_native_inspect({terminal_id,inspection:"status"})` action. AKK derives and revalidates the binding fence internally. Regression-tested profiles are Codex 0.146.0/0.146.1/0.147.0/0.148.0/0.149.1/0.150.1/0.151.0/0.153.0/0.153.4/0.154.0/0.155.1/0.158.0/0.159.0 and Claude Code 2.1.218/2.1.226/2.1.237/2.1.251/2.1.259/2.1.263/2.1.266/2.1.267. Other complete `x.y.z` versions remain callable through the generic runtime protocol and display a compatibility warning; a real UI/schema incompatibility fails at runtime and is never retried automatically. Claude's modal Status panel is parsed and dismissed before the action proves the original idle composer. The action creates no Session, Turn, receipt, monitor, or callback. Direct `/model`, `/usage`, `/cost`, `/stats`, `/usage-credits`, `/compact`, and arbitrary slash-command injection remain unavailable; use only the typed `/akk models` and `/akk set-model` model-control flow above. Bare Codex `/usage` is not read-only automation: it opens a menu whose later Enter can select an account-side usage-limit reset.
+AKK Turn status and the coding agent's native status are separate. `/akk status` and `agent_knock_knock_status` inspect AKK-managed state and a bounded current screen; they never type `/status`. For native status, start from `/akk list` and use only an advertised `agent_knock_knock_native_inspect({terminal_id,inspection:"status"})` action. AKK derives and revalidates the binding fence internally. Regression-tested profiles are Codex 0.146.0/0.146.1/0.147.0/0.148.0/0.149.1/0.150.1/0.151.0/0.153.0/0.153.4/0.154.0/0.155.1/0.158.0/0.159.0/0.159.2 and Claude Code 2.1.218/2.1.226/2.1.237/2.1.251/2.1.259/2.1.263/2.1.266/2.1.267/2.1.285. Other complete `x.y.z` versions remain callable through the generic runtime protocol and display a compatibility warning; a real UI/schema incompatibility fails at runtime and is never retried automatically. Claude's modal Status panel is parsed and dismissed before the action proves the original idle composer. The action creates no Session, Turn, receipt, monitor, or callback. Direct `/model`, `/usage`, `/cost`, `/stats`, `/usage-credits`, `/compact`, and arbitrary slash-command injection remain unavailable; use only the typed `/akk models` and `/akk set-model` model-control flow above. Bare Codex `/usage` is not read-only automation: it opens a menu whose later Enter can select an account-side usage-limit reset.
 
-An idle Codex row with ambiguous foreground rollout identity may instead advertise `agent_knock_knock_identify_foreground({terminal_id})` and `agent_knock_knock_identify_and_send({terminal_id,request})`. The first action mutates no AKK Store state, but it does type `/status` and Enter exactly once into that visible exact-empty pane. Its 30-second proof is diagnostic only and cannot authorize a later call. The second is the safe actionable form: it retains one terminal lock across that probe and one task, while durable Session/Turn identity still requires unique exact request acceptance. If the probe becomes changed or uncertain, no task is sent and neither input is retried automatically. List and Status never invoke this probe. Codex 0.158.0/0.159.0 exact Send and active-task Watch use a separate closed `/status` transaction to bind the foreground paginated thread.
+An idle Codex row with ambiguous foreground rollout identity may instead advertise `agent_knock_knock_identify_foreground({terminal_id})` and `agent_knock_knock_identify_and_send({terminal_id,request})`. The first action mutates no AKK Store state, but it does type `/status` and Enter exactly once into that visible exact-empty pane. Its 30-second proof is diagnostic only and cannot authorize a later call. The second is the safe actionable form: it retains one terminal lock across that probe and one task, while durable Session/Turn identity still requires unique exact request acceptance. If the probe becomes changed or uncertain, no task is sent and neither input is retried automatically. List and Status never invoke this probe. Codex 0.158.0/0.159.0/0.159.2 exact Send and active-task Watch use a separate closed `/status` transaction to bind the foreground paginated thread.
 
 ## 5. Watch an existing terminal task
 
@@ -136,7 +136,7 @@ Copy the row's complete `terminal_id`. An advertised `available_actions.watch` i
 /akk watch <exact-terminal-id>
 ```
 
-Watch follows the exact terminal selected by the user. Codex 0.158.0/0.159.0 exact Watch creation types a closed `/status` command into an available main Composer to bind its foreground task; later observation is read-only. See the [compatibility boundaries](codex-0.159.0-compatibility.md). Agent-version or artifact uncertainty, missing binding metadata, existing AKK-managed ownership, and missing action advertisement produce warnings rather than blocking creation. AKK fails only when the exact terminal is absent, its endpoint/process cannot be identified, neither an exact durable task anchor nor a read-only screen-status path exists, or its durable Store record cannot be created. Prefer an existing managed monitor when its exact Turn attribution is what you need, but Watch can coexist without adopting or mutating it. New exact-task Watches and accepted exact-request fallback Watches default to `respond_when_exact`; a supported native interaction emits `interaction_required`, and the owning controller must call Status before it receives a single-use response offer. Terminal-activity/best-effort Watches and manual-only shapes emit `interaction_manual_required` with `capabilities.interaction_respond=false`.
+Watch follows the exact terminal selected by the user. Codex 0.158.0/0.159.0/0.159.2 exact Watch creation types a closed `/status` command into an available main Composer to bind its foreground task; later observation is read-only. See the [compatibility boundaries](codex-0.159.2-compatibility.md). Agent-version or artifact uncertainty, missing binding metadata, existing AKK-managed ownership, and missing action advertisement produce warnings rather than blocking creation. AKK fails only when the exact terminal is absent, its endpoint/process cannot be identified, neither an exact durable task anchor nor a read-only screen-status path exists, or its durable Store record cannot be created. Prefer an existing managed monitor when its exact Turn attribution is what you need, but Watch can coexist without adopting or mutating it. New exact-task Watches and accepted exact-request fallback Watches default to `respond_when_exact`; a supported native interaction emits `interaction_required`, and the owning controller must call Status before it receives a single-use response offer. Terminal-activity/best-effort Watches and manual-only shapes emit `interaction_manual_required` with `capabilities.interaction_respond=false`.
 
 The result contains a durable `watch_id`. Use that ID—not a `session_id`, `turn_id`, terminal selector, or short reference—to inspect or stop observation:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scotthuang/agent-knock-knock",
-  "version": "0.13.13",
+  "version": "0.13.15",
   "description": "Control local Codex and Claude Code from OpenClaw or compatible controller Hosts through shared terminals.",
   "license": "MIT",
   "type": "module",
@@ -88,7 +88,10 @@
     "LICENSE",
     "CHANGELOG.md",
     "docs/codex-0.158.0-compatibility.md",
-    "docs/codex-0.159.0-compatibility.md"
+    "docs/codex-0.159.0-compatibility.md",
+    "docs/codex-0.159.2-compatibility.md",
+    "docs/claude-2.1.285-compatibility.md",
+    "docs/callback-compatibility.md"
   ],
   "publishConfig": {
     "access": "public"

package/templates/openclaw-skills/agent-knock-knock/SKILL.md

@@ -26,7 +26,7 @@ Core slash-command forms:
 - `/akk <task>`: send a new task only when exactly one send-ready coding-agent pane exists across all workspaces.
 - `/akk <selector>: <message>`: resolve one exact eligible AKK session and create a new Turn for the message.
 - `/akk list`: list live coding-agent terminals, their current or recent managed-turn context, and durable Terminal Watches.
-- `/akk watch <exact-terminal-id>`: observe one exact user-selected terminal without sending input or creating a Session or Turn; prefer an exact task anchor and otherwise use a clearly labeled best-effort terminal-activity Watch.
+- `/akk watch <exact-terminal-id>`: observe one exact user-selected terminal without submitting a task or creating a Session or Turn; prefer an exact task anchor and otherwise use a clearly labeled best-effort terminal-activity Watch.
 - `/akk unwatch <watch-id>`: cancel only that observation; do not interrupt or otherwise change the TUI task.
 - `/akk threads <exact-terminal-id>`: list verified native threads that may be resumed in one exact terminal.
 - `/akk models <exact-terminal-id>`: inspect the exact native model and reasoning-effort catalog for one verified idle terminal.
@@ -38,23 +38,23 @@ Core slash-command forms:
 - `/akk respond <turn-selector>: <answer>`: answer a coding-agent question inside a `waiting_for_openclaw` Turn.
 - `/akk cancel <turn-selector>`: interrupt the exact Turn without closing its terminal pane.
 
-For human-facing ordinary-send slash forms, a selector may be `codex`, `claude`, `only`, `latest`, or an `@short-ref` returned by `AKK list`. These selectors are only a resolution layer and fail closed when the target is missing or ambiguous. The v30 structured-tool contract never exposes a selector or opaque authority value: the model supplies semantic IDs only. The agent-neutral `terminal_user_explicit_composer_policy` advertises `replace_current_composer_and_submit`; the old Codex-named field is a v28 compatibility alias only. `send({session_id,request})` is strict `session_exact`; `send({terminal_id,request})` is either managed `terminal_follow_current` or user-priority `terminal_user_explicit`, exactly as advertised; the two target fields are mutually exclusive, and both may be omitted only when AKK must prove one unique send-ready pane. Codex and Claude Code `terminal_user_explicit` depend on the exact live terminal/process, a scanned non-blocked approval state, and no proven input-owning questionnaire, editor, menu, history search, or read-only viewer—not ordinary main-Composer visibility, stability, exactness, parsed working activity, existing draft contents, or AKK Store, Turn, Session, transfer, transition, ledger, or ownership. Profiled Codex 0.154.0/0.155.1 exact collapsed async-question summaries leaves the main Composer sendable; an expanded, clipped, or ambiguous async editor and an active-writer resume viewer remain zero-input boundaries. Both advertise `replace_current_composer_and_submit`: Codex physical fallback sends `C-u` once; Claude Code physical fallback uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each injects the request, waits through the paste window, and dispatches Enter exactly once. After text injection, Composer observation must never veto Enter. AKK tries managed delivery where its strict empty-Composer pre-input authority exists; after either agent's user-explicit text injection, that path follows the same no-Composer-veto Enter rule. A source-less Codex terminal with zero, one, or many pre-existing rollout roots freezes that full candidate set before input and binds only the unique rollout that later persists the exact request hash; a unique stale root is never assumed to be foreground. If managed preparation still fails before input, AKK sends once without a managed callback Turn, then best-effort attaches an exact request-bound Terminal Watch callback and releases stale management. Watch failure is a warning and never revokes or retries a successful Send. Native inspection and native lifecycle input remain exact-empty-only. With runtime durability, an omitted target binds its `message_id` to the first selected physical terminal and existing or uncertain same-ID evidence rejects replay. If fresh durability is unavailable, user priority wins: AKK proceeds with a warning, and the degraded result must not be automatically retried. Once clear or request input may have occurred, an uncertain result must not be automatically retried. Read Send results as orthogonal facts: `terminal_input_dispatched`, `agent_acceptance`, `management_mode`, `observation_mode`, and `capabilities` distinguish physical dispatch from durable native acceptance and callback/interaction authority; do not infer one from another. If the result returns `observation_mode="terminal_watch"`, wait for that callback and retain `watch-status` as the recovery path. The only non-ordinary Send form is an exact `send({turn_id})` copied unchanged from a current `available_actions.retry_submission`; it accepts no request text or other target and requires explicit user confirmation. Native-thread actions use the full `terminal_id`, never an `@short-ref`. Other managed controls use `turn_id`; terminal-scoped approval uses `terminal_id` after explicit user confirmation. The trusted plugin/CLI derives terminal, binding, candidate, prompt, composer, handoff, and compare-and-swap fences privately. Never ask the user or model to copy draft text, a composer digest, a token, fingerprint, revision, binding ID/generation, or handoff-only live native UUID from an action; `native_thread_id` is the intentional semantic UUID for resume. For every side effect, AKK must revalidate the selected agent PID and provider-owned terminal identity and revalidate the relevant approval prompt; Composer revalidation remains action-specific and is not user-explicit Send authority.
+For human-facing ordinary-send slash forms, a selector may be `codex`, `claude`, `only`, `latest`, or an `@short-ref` returned by `AKK list`. These selectors are only a resolution layer and fail closed when the target is missing or ambiguous. The v30 structured-tool contract never exposes a selector or opaque authority value: the model supplies semantic IDs only. The agent-neutral `terminal_user_explicit_composer_policy` advertises `replace_current_composer_and_submit`; the old Codex-named field is a v28 compatibility alias only. `send({session_id,request})` is strict `session_exact`; `send({terminal_id,request})` is either managed `terminal_follow_current` or user-priority `terminal_user_explicit`, exactly as advertised; the two target fields are mutually exclusive, and both may be omitted only when AKK must prove one unique send-ready pane. Codex and Claude Code `terminal_user_explicit` depend on the exact live terminal/process, a scanned non-blocked approval state, and no proven input-owning questionnaire, editor, menu, history search, or read-only viewer—not ordinary main-Composer visibility, stability, exactness, parsed working activity, existing draft contents, or AKK Store, Turn, Session, transfer, transition, ledger, or ownership. An unreviewed Codex frontend is the narrower exception: physical Send requires a recognized styled Composer before clearing and a fresh empty styled Composer before task text. Profiled Codex 0.154.0/0.155.1 exact collapsed async-question summaries leaves the main Composer sendable; an expanded, clipped, or ambiguous async editor and an active-writer resume viewer remain zero-input boundaries. Both advertise `replace_current_composer_and_submit`: Codex physical fallback sends `C-u` once; Claude Code physical fallback uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each injects the request, waits through the paste window, and dispatches Enter exactly once. After text injection, Composer observation must never veto Enter. AKK tries managed delivery where its strict empty-Composer pre-input authority exists; after either agent's user-explicit text injection, that path follows the same no-Composer-veto Enter rule. A source-less Codex terminal with zero, one, or many pre-existing rollout roots freezes that full candidate set before input and binds only the unique rollout that later persists the exact request hash; a unique stale root is never assumed to be foreground. If managed preparation still fails before input, AKK sends once without a managed callback Turn, then best-effort attaches the prepared exact request-bound or clearly labeled terminal-activity Watch and releases stale management. Watch persistence failure is a warning and never revokes or retries a successful Send; an unsafe or uncertain native probe still stops before task text. Native inspection and native lifecycle input remain exact-empty-only. With runtime durability, an omitted target binds its `message_id` to the first selected physical terminal and existing or uncertain same-ID evidence rejects replay. If fresh durability is unavailable, user priority wins: AKK proceeds with a warning, and the degraded result must not be automatically retried. Once clear or request input may have occurred, an uncertain result must not be automatically retried. Read Send results as orthogonal facts: `terminal_input_dispatched`, `agent_acceptance`, `management_mode`, `observation_mode`, and `capabilities` distinguish physical dispatch from durable native acceptance and callback/interaction authority; do not infer one from another. If the result returns `observation_mode="terminal_watch"`, wait for that callback and retain `watch-status` as the recovery path. The only non-ordinary Send form is an exact `send({turn_id})` copied unchanged from a current `available_actions.retry_submission`; it accepts no request text or other target and requires explicit user confirmation. Native-thread actions use the full `terminal_id`, never an `@short-ref`. Other managed controls use `turn_id`; terminal-scoped approval uses `terminal_id` after explicit user confirmation. The trusted plugin/CLI derives terminal, binding, candidate, prompt, composer, handoff, and compare-and-swap fences privately. Never ask the user or model to copy draft text, a composer digest, a token, fingerprint, revision, binding ID/generation, or handoff-only live native UUID from an action; `native_thread_id` is the intentional semantic UUID for resume. For every side effect, AKK must revalidate the selected agent PID and provider-owned terminal identity and revalidate the relevant approval prompt; Composer revalidation remains action-specific; unreviewed Codex frontends require the styled-Composer checks above.
 
 The human-priority Codex path may proceed when the pane/process and complete open-rollout candidate inventory are exact even though no single foreground UUID can be selected, including a supported manual `/clear` whose new logical thread appears before its rollout materializes. The complete exact inventory domain binds the provider terminal, PID and process birth, workspace and canonical endpoint, and every open rollout's UUID, descriptor, device, inode, canonical path, and pre-submit byte offset. A `/clear` resume hint is advisory only, never routing or acceptance authority. Under the terminal lock, AKK isolates the predecessor, creates a separate zero-UUID provisional Session and Turn, sends the real task once, and binds only the single candidate rollout that durably accepts that exact request. A rollout-backed Codex row therefore advertises `terminal_follow_current` with `terminal_id`, not `session_exact`; a cached strict Session attempt rejects before task text and never downgrades itself. Only released predecessor Turn history from a strictly earlier binding epoch is excluded from current-send authority; unresolved current-epoch state still blocks. Use only the freshly listed semantic-ID action. Until promotion commits, strict `session_id` send, `respond`, managed `approve`, `cancel`, native lifecycle, callback delivery, and `native_inspect` remain unavailable. If delivery or acceptance is uncertain, do not retry automatically. Terminal-scoped manual Codex approval likewise exposes only `terminal_id`, requires explicit confirmation, leaves managed identity unchanged, never participates in auto-approval, and must not be retried blindly after an uncertain result.
 
-For an exact-empty idle Codex pane whose native identity is ambiguous, List may advertise `identify_foreground` and `identify_and_send`. `agent_knock_knock_identify_foreground({terminal_id})` is explicit and Codex-only: it mutates no Store record but does send `/status` and Enter exactly once to the visible pane. Its 30-second proof is diagnostic, never reusable authority; do not feed its UUID or expiry into another tool. `agent_knock_knock_identify_and_send({terminal_id,request})` keeps one terminal lock across the probe and task and is the only actionable consumer of that observation. It still binds a durable Session/Turn only from unique exact request acceptance. A changed or uncertain probe sends no task and must not be retried automatically. Never invoke either action unless the current terminal row advertises it. List and Status do not run `/status`. Ordinary Send must not be redirected through these explicit identification tools implicitly; Codex 0.158.0/0.159.0 uses its separate closed `/status` transaction for exact paginated Watch binding.
+For an exact-empty idle Codex pane whose native identity is ambiguous, List may advertise `identify_foreground` and `identify_and_send`. `agent_knock_knock_identify_foreground({terminal_id})` is explicit and Codex-only: it mutates no Store record but does send `/status` and Enter exactly once to the visible pane. Its 30-second proof is diagnostic, never reusable authority; do not feed its UUID or expiry into another tool. `agent_knock_knock_identify_and_send({terminal_id,request})` keeps one terminal lock across the probe and task and is the only actionable consumer of that observation. It still binds a durable Session/Turn only from unique exact request acceptance. A changed or uncertain probe sends no task and must not be retried automatically. Never invoke either action unless the current terminal row advertises it. List and Status do not run `/status`. Ordinary Send must not be redirected through these explicit identification tools implicitly; Codex 0.158.0 and later stable semantic versions may attempt their separate closed `/status` transaction for exact paginated Watch binding when the actual UI and read contract can be proven.
 
 The private approval fence remains prompt-scoped. It binds the adapter-isolated exact unredacted approval region plus terminal/process identity, decision keys and label, prompt kind, working directory, reason/detail, and request or policy evidence. The whole-screen digest and redacted excerpt are diagnostic only: output outside the approval region may continue scrolling without invalidating the same reviewed prompt. After explicit user confirmation, the plugin/CLI retains a private confirmation offer and recaptures the region under lock. Any change inside the exact region—including a command or otherwise identically redacted secret—rejects and sends zero approval keys. Never expose, persist as public action data, log, infer, or reconstruct the raw prompt evidence or its opaque fingerprint.
 
 Coding-agent versions distinguish missing verification from known protocol incompatibility. A merely unverified complete Codex or Claude Code `x.y.z` version keeps otherwise eligible actions advertised; preserve and surface its compatibility warning, then let runtime structure and postcondition checks decide success. Never suppress an action solely because its exact version lacks a regression-tested AKK profile. Known incompatible protocols disable their affected actions before input. Codex 0.157.0/0.157.1 create new durable TUI sessions with paginated history and may use a shared background server; AKK cannot yet bind that history to an exact managed task. Managed completion callbacks, native thread lifecycle actions, and automated native status dispatch remain unavailable; visible status cards can still be parsed. Explicit terminal Send and warning-bearing `terminal_activity` Watch remain available subject to native UI safety checks; that Watch reports best-effort activity notifications without proving exact task completion or granting question-response authority. `--no-daemon` does not restore legacy JSONL history for new sessions. Use only currently advertised mutation actions, and if input may already have occurred and the result is unproven, report the uncertainty and never retry automatically.
 
-Codex 0.158.0/0.159.0 physical Send uses an exact paginated task Watch instead of a legacy managed Session/Turn. Before Send, AKK attempts a closed `/status` transaction in the available main Composer to bind the foreground thread. When an exact Watch attaches, retain its `watch_id` for Status, question responses, and completion callbacks; do not invent a `turn_id`. If binding or Watch attachment fails, report the receipt's callback limitation. This adapter does not establish managed session-only dispatch or native new/resume for paginated threads. Async responses offer only `steer_current_turn`, never `queue_next_turn`. A first Watch requested while a blocking modal already owns input cannot establish this binding and falls back to activity observation with manual question handling.
+Codex 0.158.0 and later stable semantic versions may attempt an exact paginated task Watch instead of a legacy managed Session/Turn, including versions outside AKK's regression matrix. Before Send, AKK attempts a closed `/status` transaction in the available main Composer and validates the actual app-server read contract, Codex home, native thread, and task boundaries. A new version alone does not reject read-only observation. An existing exact Watch may continue across a compatible backend upgrade while retaining its original thread, turn, and request identity. When a Watch attaches, retain its `watch_id` for Status and callbacks; do not invent a `turn_id`. Read compatibility grants no native response authority: unreviewed frontend/backend pairs are notify-only, and backend drift withdraws existing executable question offers. Use fresh Status and its advertised capabilities before any response. This adapter does not establish managed session-only dispatch or native new/resume for paginated threads. Supported async responses offer only `steer_current_turn`, never `queue_next_turn`. A first Watch requested while a blocking modal already owns input cannot establish this binding and falls back to activity observation with manual question handling.
 
 AKK discovers eligible panes across workspaces. When more than one target matches, choose one exact listed `terminal_id` for a structured tool or a listed selector for a human slash command; never guess based on a workspace name or path.
 
 Natural-language forms:
 
-- `AKK: <task>`: call `agent_knock_knock_send` with `request=<task>` and neither target ID. This succeeds only when exactly one send-ready pane exists. A scanned blocked approval or proven input-owning questionnaire, editor, menu, or read-only viewer vetoes physical Send; parsed working activity, an existing draft, and ordinary main-Composer observation do not. Codex replaces the current Composer with `C-u`; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each injects the request and submits exactly once. Broken or stale AKK management activity records do not veto that independently verified live terminal/process.
+- `AKK: <task>`: call `agent_knock_knock_send` with `request=<task>` and neither target ID. This succeeds only when exactly one send-ready pane exists. A scanned blocked approval or proven input-owning questionnaire, editor, menu, or read-only viewer vetoes physical Send; parsed working activity and an existing draft do not. Unreviewed Codex frontends require the styled-Composer checks above; reviewed physical Send paths do not require ordinary main-Composer visibility. Codex replaces the current Composer with `C-u`; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each injects the request and submits exactly once. Broken or stale AKK management activity records do not veto that independently verified live terminal/process.
 - `AKK Codex: <task>`: list first, require one exact eligible Codex row, then call `agent_knock_knock_send` with that row's `terminal_id` and `request=<task>`.
 - `AKK Claude: <task>`: list first, require one exact eligible Claude row, then call `agent_knock_knock_send` with that row's `terminal_id` and `request=<task>`.
 - Requests to list AKK or local coding-agent work: call `agent_knock_knock_list`.
@@ -78,9 +78,9 @@ Natural-language forms:
 
 ## Sessions and Turns
 
-AKK's identity hierarchy is terminal → native Codex or Claude Code session → AKK session → Turns. `session_id` is the strict ordinary-send target for one exact native context. `terminal_id` is the deliberately different follow-current target that lets the user hand the pane's currently verified context back to AKK after a safe human-driven switch. Each accepted managed Send creates a distinct `turn_id` without clearing the native agent context; Codex 0.158.0/0.159.0 physical Send instead returns an independent task Watch when observation can be attached. A `turn_id` is used for history, callbacks, respond, status, approval, cancellation, renewal, callback retry, close, and the explicitly advertised submission-retry form of Send.
+AKK's identity hierarchy is terminal → native Codex or Claude Code session → AKK session → Turns. `session_id` is the strict ordinary-send target for one exact native context. `terminal_id` is the deliberately different follow-current target that lets the user hand the pane's currently verified context back to AKK after a safe human-driven switch. Each accepted managed Send creates a distinct `turn_id` without clearing the native agent context; Codex paginated physical Send instead returns an independent exact-task or terminal-activity Watch when observation can be attached. A `turn_id` is used for history, callbacks, respond, status, approval, cancellation, renewal, callback retry, close, and the explicitly advertised submission-retry form of Send.
 
-Use `agent_knock_knock_send` with `request` and neither `session_id` nor `terminal_id` only when the target is unspecified. AKK must resolve exactly one eligible Codex or Claude Code pane across all workspaces and use its currently advertised Send path. Managed delivery attaches or discovers its AKK session and verifies idle before input; Codex 0.158.0/0.159.0 physical Send does not require a managed Session and follows its terminal input-safety checks. If no eligible pane exists, report AKK's setup guidance; do not substitute another execution path.
+Use `agent_knock_knock_send` with `request` and neither `session_id` nor `terminal_id` only when the target is unspecified. AKK must resolve exactly one eligible Codex or Claude Code pane across all workspaces and use its currently advertised Send path. Managed delivery attaches or discovers its AKK session and verifies idle before input; Codex paginated physical Send does not require a managed Session and follows its terminal input-safety checks. If no eligible pane exists, report AKK's setup guidance; do not substitute another execution path.
 
 On first attach, the target terminal must be explicitly named by the user; never guess which already-running pane should receive the task.
 
@@ -90,7 +90,7 @@ For ordinary send or an in-flight answer:
 2. If no ID is supplied and more than one eligible pane may exist, call `agent_knock_knock_list`.
 3. Treat `terminals[]` as the primary resource list. Its managed context exposes `session_id`; `managed.current_turn` is the only current AKK owner, while `managed.recent_turn` and `managed.history` are retained Turn history. Records in `unavailable_managed_turns[]` have no live pane in this snapshot.
 4. Read the selected resource's `available_actions`. In the compact Host projection its keys are the exact current action names and each value is `true`; `action_inputs`, when present, carries only dynamic semantic arguments, `missing_required`, and scope. For every mutation, use only an advertised action, start with those semantic inputs, supply every `missing_required` field, and follow this skill's action rules. User-selected Watch is the exception: explicit user intent plus one complete exact `terminal_id` is sufficient even when `available_actions.watch` is absent. The only additional mutation sources are a terminal row's `handoff_decision.choices.take_over_current.action` and an exact `blocking_turns[].recovery_action`: use either only after explicit user confirmation and refresh the list immediately afterward.
-5. If an existing managed Session advertises send with `session_id`, call `agent_knock_knock_send({session_id,request})`; it creates a new Turn strictly in that Session's native context and may require exact empty before input. If the selected row advertises terminal-scoped send, call `agent_knock_knock_send({terminal_id,request})`. `terminal_follow_current` may adopt a safe human-driven handoff or send once within an exact, complete Codex rollout-candidate inventory before binding the uniquely accepting native thread. `terminal_user_explicit` instead preserves the user's Send when internal AKK state is broken: Codex replaces the current Composer with `C-u`; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each injects the new request and submits exactly once without a post-text Composer veto. For source-less Codex sends, zero exact acceptors remains pending for monitor recovery, one promotes the provisional Session/Turn, and multiple acceptors or identity drift becomes uncertain without replay. Managed delivery is attempted where eligible, but a proven zero-input failure falls back to one unmanaged delivery with no managed callback Turn. After Enter, AKK best-effort attaches a Terminal Watch callback; Watch failure never changes the successful Send. Once clear or request input may have occurred, an uncertain result must not be retried automatically. Wait for an attached Watch callback or use its status as recovery. The status-card-only first-task path remains the zero-rollout special case. `send({turn_id})` is never an ordinary target: use it only for a fresh `retry_submission` action after explicit confirmation, with no other field. Never construct or pass an opaque fence or composer authority. Use `respond` with its `turn_id` only when that Turn is explicitly `waiting_for_openclaw`; the answer stays in the same Turn. Do not add timeout fields for ordinary use; `timeoutSeconds` is unsupported.
+5. If an existing managed Session advertises send with `session_id`, call `agent_knock_knock_send({session_id,request})`; it creates a new Turn strictly in that Session's native context and may require exact empty before input. If the selected row advertises terminal-scoped send, call `agent_knock_knock_send({terminal_id,request})`. `terminal_follow_current` may adopt a safe human-driven handoff or send once within an exact, complete Codex rollout-candidate inventory before binding the uniquely accepting native thread. `terminal_user_explicit` instead preserves the user's Send when internal AKK state is broken: Codex replaces the current Composer with `C-u`; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each injects the new request and submits exactly once without a post-text Composer veto. For source-less Codex sends, zero exact acceptors remains pending for monitor recovery, one promotes the provisional Session/Turn, and multiple acceptors or identity drift becomes uncertain without replay. Managed delivery is attempted where eligible, but a proven zero-input failure falls back to one unmanaged delivery with no managed callback Turn. AKK prepares the strongest safe Watch before dispatch and best-effort attaches it after Enter; Watch persistence failure never changes the successful Send. Once clear or request input may have occurred, an uncertain result must not be retried automatically. Wait for an attached Watch callback or use its status as recovery. The status-card-only first-task path remains the zero-rollout special case. `send({turn_id})` is never an ordinary target: use it only for a fresh `retry_submission` action after explicit confirmation, with no other field. Never construct or pass an opaque fence or composer authority. Use `respond` with its `turn_id` only when that Turn is explicitly `waiting_for_openclaw`; the answer stays in the same Turn. Do not add timeout fields for ordinary use; `timeoutSeconds` is unsupported.
 6. If multiple terminals match, show their `short_ref`, agent, provider, and terminal target, then ask the user to choose. If a human switch has an unresolved Turn, ambiguous ownership, or unverifiable identity and no follow-current send is advertised, report that blocker and ask the user which context to resolve; never guess, supersede active work, or bypass the fence.
 
 An idle pane is at a verified ready prompt, with no current work or unresolved permission request. A previously completed managed turn alone is not proof that the pane is still idle.
@@ -99,17 +99,17 @@ Do not treat ordinary Send's whole-draft Composer replacement as a native conver
 
 ## Terminal Watch
 
-Terminal Watch follows the exact terminal selected by the user. Codex 0.158.0/0.159.0 exact Watch creation uses a closed `/status` transaction in an available main Composer to bind its foreground paginated task; subsequent observation is read-only. Answering a supported native interaction later is a separate explicit, owner-bound mutation. The normal sequence is user selects a Codex or Claude Code terminal → fresh `agent_knock_knock_list` or `/akk list` → copy its complete `terminal_id` and, when present, its advertised `watch` action → retain the returned `watch_id` for status or unwatch. Advertisement is discovery help, not Watch authorization. If the user explicitly supplies one complete exact terminal ID, call `agent_knock_knock_watch({terminal_id})` even when that row does not advertise Watch. Never infer a terminal or use a selector/short ID.
+Terminal Watch follows the exact terminal selected by the user. Codex paginated exact Watch creation uses a closed `/status` transaction in an available main Composer to bind its foreground paginated task; subsequent observation is read-only. Answering a supported native interaction later is a separate explicit, owner-bound mutation. The normal sequence is user selects a Codex or Claude Code terminal → fresh `agent_knock_knock_list` or `/akk list` → copy its complete `terminal_id` and, when present, its advertised `watch` action → retain the returned `watch_id` for status or unwatch. Advertisement is discovery help, not Watch authorization. If the user explicitly supplies one complete exact terminal ID, call `agent_knock_knock_watch({terminal_id})` even when that row does not advertise Watch. Never infer a terminal or use a selector/short ID.
 
-Managed ownership is not a veto. Prefer an existing managed Turn monitor when exact Turn attribution is wanted, but an explicit Watch may coexist because subsequent observation sends no input and does not adopt, replace, close, reserve, block, interrupt, approve, or otherwise mutate that Turn, Session, terminal, or task. Codex 0.158.0/0.159.0 exact Watch creation separately types the closed `/status` transaction described above. A successful `terminal_user_explicit` unmanaged fallback may separately return an automatic exact request-bound Watch after AKK sends; retain that `watch_id` and use Status for recovery. Once exact request acceptance, terminal identity, owner, and one current supported native interaction are established, that Watch may emit an idempotent `interaction_required` callback. The callback itself is notification only; call `agent_knock_knock_status({watch_id})` in the owning controller conversation to obtain the single-use private response offer, and respond only when its projection says `capabilities.respond=true`. When exact response authority cannot be proven, AKK emits `interaction_manual_required` instead; that state and every terminal-activity Watch remain notify-only with `capabilities.interaction_respond=false`, so the human must answer in the live TUI.
+Managed ownership is not a veto. Prefer an existing managed Turn monitor when exact Turn attribution is wanted, but an explicit Watch may coexist because subsequent observation sends no input and does not adopt, replace, close, reserve, block, interrupt, approve, or otherwise mutate that Turn, Session, terminal, or task. Codex paginated exact Watch creation separately types the closed `/status` transaction described above. A successful `terminal_user_explicit` unmanaged fallback may separately return an automatic exact request-bound or terminal-activity Watch after AKK sends; retain that `watch_id` and use Status for recovery. Once exact request acceptance, terminal identity, owner, and one current supported native interaction are established, that Watch may emit an idempotent `interaction_required` callback. The callback itself is notification only; call `agent_knock_knock_status({watch_id})` in the owning controller conversation to obtain the single-use private response offer, and respond only when its projection says `capabilities.respond=true`. When exact response authority cannot be proven, AKK emits `interaction_manual_required` instead; that state and every terminal-activity Watch remain notify-only with `capabilities.interaction_respond=false`, so the human must answer in the live TUI.
 
-At creation, AKK first tries to build a privacy-safe exact provider task anchor. Codex 0.158.0/0.159.0 binds the exact foreground paginated thread and native task; older supported Codex versions bind rollout identity and request/turn byte boundaries. Claude binds transcript identity, root prompt, and current-turn byte boundaries. Success returns `watch_mode="exact_task"`, `confidence="exact"`. Legacy anchors invalidate on process, endpoint, native-thread, file identity, truncation/replacement, boundary, successor-task, or fingerprint drift. Codex 0.158.0/0.159.0 retains the original accepted native turn even when an unrelated later task starts; it never follows that later task or loses the original completion merely because a successor exists.
+At creation, AKK first tries to build a privacy-safe exact provider task anchor. A Codex paginated read-contract Watch binds the exact foreground thread and native task; older supported Codex versions bind rollout identity and request/turn byte boundaries. Claude binds transcript identity, root prompt, and current-turn byte boundaries. Success returns `watch_mode="exact_task"`, `confidence="exact"`. Legacy anchors invalidate on process, endpoint, native-thread, file identity, truncation/replacement, boundary, successor-task, or fingerprint drift. A Codex paginated Watch retains the original accepted native turn even when an unrelated later task starts; it never follows that later task or loses the original completion merely because a successor exists.
 
-Missing or mismatched agent-version evidence is always a warning and does not weaken an otherwise usable exact task anchor. If no unique usable anchor can be established because artifact, native-task, or boundary evidence is unavailable or incompatible, do not reject. AKK records those diagnostics in `warnings` and creates `watch_mode="terminal_activity"`, `confidence="best_effort"`. Binding metadata, managed ownership, and missing action advertisement likewise remain non-veto warnings. This fallback follows only the selected terminal/process activity epoch. It must first observe `working` or `awaiting_approval`, then stable `idle` across consecutive supervision sweeps. Starting at `idle` or `unknown` never settles immediately; later activity must be observed first.
+Missing or mismatched agent-version evidence is always a warning and does not weaken an otherwise usable exact task anchor. If no unique usable anchor can be established because artifact, native-task, or boundary evidence is unavailable or incompatible, do not reject. AKK records those diagnostics in `warnings` and creates `watch_mode="terminal_activity"`, `confidence="best_effort"`. Binding metadata, managed ownership, and missing action advertisement likewise remain non-veto warnings. This fallback follows only the selected terminal/process activity epoch. It must first observe `working` or `awaiting_approval`, then stable `idle` across consecutive supervision sweeps. Starting at `idle` or `unknown` never settles immediately; later activity must be observed first. For automatic fallback after Send, the Watch is request-correlated and starts with no observed activity: it must see activity after that Send, then two idle observations. Pre-Send activity cannot complete it. Replaying the same `message_id` cannot resend the task or create duplicate notifications.
 
 Treat a terminal-activity completion-shaped callback exactly as labeled: it means the observed terminal activity became idle. It is not proof that one exact task completed or succeeded, and it carries no exact-task completion text. State that limitation plainly to the user. Do not silently upgrade it to managed or exact-task attribution.
 
-Hard creation failure is limited to an absent exact terminal, inability to identify its endpoint/process, absence of both a durable exact-task anchor and a read-only screen-status activity path, or inability to create/write the durable Watch Store. Existing identical active observation may return its current `watch_id` instead of failing as a duplicate.
+Hard creation failure includes an absent exact terminal, inability to identify its endpoint/process, absence of both a durable exact-task anchor and a read-only screen-status activity path, inability to create/write the durable Watch Store, or uncertain native probe input. Safe read-contract failures may fall back to activity observation only after revalidating the physical endpoint, PID, process incarnation, working directory, and screen-status path; never bypass an unsafe input surface or retry uncertain probe input. Existing identical active observation may return its current `watch_id` instead of failing as a duplicate.
 
 Approval attention is notification-only for every Watch: never call an approval tool for a `watch_id`, send approval keys, or apply `autoApprove`. Native-interaction attention is different. An automatic exact request-bound Watch created by `terminal_user_explicit` unmanaged fallback can, after exact request acceptance and attribution, emit `interaction_required`; call Status with its exact `watch_id`, show the projected question to the user, and use `respond_interaction({watch_id,...})` only when that fresh owner-bound projection advertises `capabilities.respond=true`. A terminal-activity Watch or `interaction_manual_required` callback remains notify-only: tell the user to inspect and answer in the live TUI, and send no interaction input. Each new exact attention fingerprint is notified once while the Watch remains active. Terminal outcomes settle once. The durable outbox uses deterministic notification IDs/idempotency and leased retry, so startup and periodic supervision can safely recover callback delivery after AKK, OpenClaw, or Gateway restart.
 
@@ -130,9 +130,9 @@ success; never retry an uncertain repair automatically.
 For native status inspection:
 
 1. Use only a current `available_actions.native_inspect({terminal_id,inspection:"status"})` entry. Those semantic arguments are complete; never add a command or authority field.
-2. Regression-tested profiles are Codex 0.146.0/0.146.1/0.147.0/0.148.0/0.149.1/0.150.1/0.151.0/0.153.0/0.153.4/0.154.0/0.155.1/0.158.0/0.159.0 and Claude Code 2.1.218/2.1.226/2.1.237/2.1.251/2.1.259/2.1.263/2.1.266/2.1.267 `inspection="status"`. Other complete `x.y.z` versions remain callable through the generic runtime profile and add a compatibility warning; actual incompatible UI or schema evidence fails at runtime and is not automatically retried. Claude success includes parsing and safely dismissing the newly opened Status panel. The inspection tool does not accept `/status` text or any arbitrary command string. `/usage`, `/cost`, `/stats`, `/usage-credits`, raw `/model`, `/compact`, and arbitrary slash commands remain unavailable; model changes use only the typed model-control tools above. Never automate bare Codex `/usage`: it opens an interactive menu whose later Enter can select an account-side usage-limit reset.
+2. Regression-tested profiles are Codex 0.146.0/0.146.1/0.147.0/0.148.0/0.149.1/0.150.1/0.151.0/0.153.0/0.153.4/0.154.0/0.155.1/0.158.0/0.159.0/0.159.2 and Claude Code 2.1.218/2.1.226/2.1.237/2.1.251/2.1.259/2.1.263/2.1.266/2.1.267/2.1.285 `inspection="status"`. Other complete `x.y.z` versions remain callable through the generic runtime profile and add a compatibility warning; actual incompatible UI or schema evidence fails at runtime and is not automatically retried. Claude success includes parsing and safely dismissing the newly opened Status panel. The inspection tool does not accept `/status` text or any arbitrary command string. `/usage`, `/cost`, `/stats`, `/usage-credits`, raw `/model`, `/compact`, and arbitrary slash commands remain unavailable; model changes use only the typed model-control tools above. Never automate bare Codex `/usage`: it opens an interactive menu whose later Enter can select an account-side usage-limit reset.
 3. Treat this as terminal input even though the native command is read-only. AKK privately derives a fresh binding fence and requires an idle empty composer, exact PID/process/pane/cwd/version identity, and no conflicting Turn, transition, dispatch, approval, or owner.
-4. Codex `/status` requires an exact viewport of at least 80 columns so the full Session UUID can be proven. That pre-UUID gate applies to native inspection, lifecycle, and strict Session operations that must know the UUID before terminal input. Legacy terminal-scoped ordinary tasks may send once and bind from exact native acceptance afterward without running `/status` or failing merely because the pane is narrow. Codex 0.158.0/0.159.0 attempts its separate closed `/status` binding before physical Send; if an exact callback Watch cannot be prepared, the Send receipt must state that limitation.
+4. Codex `/status` requires an exact viewport of at least 80 columns so the full Session UUID can be proven. That pre-UUID gate applies to native inspection, lifecycle, and strict Session operations that must know the UUID before terminal input. Legacy terminal-scoped ordinary tasks may send once and bind from exact native acceptance afterward without running `/status` or failing merely because the pane is narrow. Codex paginated read-contract candidates attempt their separate closed `/status` binding before physical Send. If an exact callback Watch cannot be prepared safely, AKK may prepare terminal-activity observation; report the receipt's actual callback mode and limitation.
 5. The result is valid only when AKK proves one fresh bounded native status result and the pane returns to idle. On an uncertain or unproven submission, do not retry, send Enter, clear the composer, or bypass AKK with raw terminal input.
 6. Native inspection creates no AKK Session, Turn, receipt, monitor, callback, or response round.
 
@@ -232,7 +232,7 @@ Action-name glossary:
 
 - `status`: inspect one terminal, Turn, or Watch; it sends no native slash command.
 - `send`: deliver a new request, or perform the separately advertised immutable `retry_submission` form.
-- `watch` / `unwatch`: create or stop durable terminal observation; Codex 0.158.0/0.159.0 exact creation performs the closed `/status` transaction, while subsequent observation is read-only.
+- `watch` / `unwatch`: create or stop durable terminal observation; Codex 0.158.0/0.159.0/0.159.2 exact creation performs the closed `/status` transaction, while subsequent observation is read-only.
 - `list_resumable_threads`, `new_thread`, and `resume_thread`: inspect or change native thread context through their closed lifecycle protocols.
 - `native_inspect`: run only an advertised closed native inspection such as `status`.
 - `model_options`, `repair_model_control`, and `set_model`: discover the current native catalog, clear only a proven model-control residue, or consume one catalog offer.
@@ -248,9 +248,9 @@ Action-name glossary:
 
 The tool name is normally `agent_knock_knock_<action-name>`. The sole List alias is `retry_submission`, which invokes `agent_knock_knock_send` with its listed `turn_id` only after explicit confirmation. Nested `handoff_decision.choices.take_over_current.action` and `blocking_turns[].recovery_action` carry their explicit tool/action name and semantic arguments; the explanatory choice and recovery text is defined here rather than repeated in every List row.
 
-`available_actions` is the authoritative current-action source for mutations after listing except for the explicitly modeled nested handoff decision and `blocking_turns[].recovery_action`; user-selected `watch({terminal_id})` deliberately honors an exact user-selected terminal even without advertisement. A native interaction response instead requires the current `interaction_state` returned by Status in the same controller conversation. Approval, native interaction response, handoff takeover, and `reconcile_binding` require explicit user intent and fresh source state. Model-facing shapes include `model_options({terminal_id})`, the separately advertised Codex-only `repair_model_control({terminal_id})`, and `set_model({terminal_id,model,reasoning_effort})`; `watch({terminal_id})`; `send({session_id|terminal_id,request})`, with the targets mutually exclusive; `identify_foreground({terminal_id})`; `identify_and_send({terminal_id,request})`; `respond_interaction({turn_id|watch_id,interaction_id,answers,delivery_mode?})`, with exactly one subject id, only projected question/option ids, and `delivery_mode` present only for `async_question`; managed `approve({turn_id,decision})` or approve-once-only terminal-scoped `approve({terminal_id})`; `native_inspect({terminal_id,inspection})`; `new_thread({terminal_id})`; `resume_thread({terminal_id,native_thread_id})`; and `reconcile_binding({terminal_id,conflicting_session_id})`. A top-level `previous` block, when present, is the only authority for a “previous/刚才那个” request; human-facing numbers and short IDs remain slash-navigation aids and are never structured tool arguments. The model never carries terminal, binding, catalog, candidate, composer, handoff, approval, interaction-fingerprint, revision, binding ID/generation, or handoff-only live-native-UUID fences; it never receives draft text or composer digests. `native_thread_id` remains the semantic resume identity. AKK derives those private fences and revalidates them before side effects. Orphan-close `expected_message_id` and `expected_transition_id` remain because they are entity IDs. Store format remains 1 and writer protocol is 8; Terminal Watch schema remains 3.
+`available_actions` is the authoritative current-action source for mutations after listing except for the explicitly modeled nested handoff decision and `blocking_turns[].recovery_action`; user-selected `watch({terminal_id})` deliberately honors an exact user-selected terminal even without advertisement. A native interaction response instead requires the current `interaction_state` returned by Status in the same controller conversation. Approval, native interaction response, handoff takeover, and `reconcile_binding` require explicit user intent and fresh source state. Model-facing shapes include `model_options({terminal_id})`, the separately advertised Codex-only `repair_model_control({terminal_id})`, and `set_model({terminal_id,model,reasoning_effort})`; `watch({terminal_id})`; `send({session_id|terminal_id,request})`, with the targets mutually exclusive; `identify_foreground({terminal_id})`; `identify_and_send({terminal_id,request})`; `respond_interaction({turn_id|watch_id,interaction_id,answers,delivery_mode?})`, with exactly one subject id, only projected question/option ids, and `delivery_mode` present only for `async_question`; managed `approve({turn_id,decision})` or approve-once-only terminal-scoped `approve({terminal_id})`; `native_inspect({terminal_id,inspection})`; `new_thread({terminal_id})`; `resume_thread({terminal_id,native_thread_id})`; and `reconcile_binding({terminal_id,conflicting_session_id})`. A top-level `previous` block, when present, is the only authority for a “previous/刚才那个” request; human-facing numbers and short IDs remain slash-navigation aids and are never structured tool arguments. The model never carries terminal, binding, catalog, candidate, composer, handoff, approval, interaction-fingerprint, revision, binding ID/generation, or handoff-only live-native-UUID fences; it never receives draft text or composer digests. `native_thread_id` remains the semantic resume identity. AKK derives those private fences and revalidates them before side effects. Orphan-close `expected_message_id` and `expected_transition_id` remain because they are entity IDs. Store format remains 1 and writer protocol is 9; Terminal Watch schema remains 3.
 
-Before every terminal operation, AKK revalidates the expected agent PID and provider-owned terminal identity. Native inspection and lifecycle input require an exactly empty Composer; managed Send may require exact empty before input. Codex and Claude Code `terminal_user_explicit` instead require a scanned non-blocked approval state and no proven input-owning questionnaire, editor, menu, or read-only viewer. Ordinary main-Composer visibility, stability, exactness, existing draft contents, and parsed working activity do not veto this user-priority path, and after text injection no Composer observation may veto Enter. Once clear or request input may have occurred, an uncertain result must not be retried automatically. Humans can attach to the same tmux or Herdr session and continue directly at any time.
+Before every terminal operation, AKK revalidates the expected agent PID and provider-owned terminal identity. Native inspection and lifecycle input require an exactly empty Composer; managed Send may require exact empty before input. Codex and Claude Code `terminal_user_explicit` instead require a scanned non-blocked approval state and no proven input-owning questionnaire, editor, menu, or read-only viewer. Reviewed physical Send paths do not require ordinary main-Composer visibility, stability, or exactness. Unreviewed Codex frontends require a recognized styled Composer before clearing and a fresh empty styled Composer before task text. Existing drafts and parsed working activity do not themselves veto the user-priority path, and after text injection no Composer observation may veto Enter. Once clear or request input may have occurred, an uncertain result must not be retried automatically. Humans can attach to the same tmux or Herdr session and continue directly at any time.
 
 Exact-task Claude Code completion depends on a strictly correlated local transcript turn and fails closed for unknown schemas, background work, or ambiguous identity. A `terminal_activity` Watch may separately notify that the selected terminal became stably idle only after observed activity; always label that callback best-effort and never report it as exact task completion or success.