@songsid/agend 2.1.6-beta.12 → 2.1.6-beta.13

package/dist/backend/codex.js

@@ -1,20 +1,31 @@
-import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
-import { lastNonBlankRow } from "../pane-input-residue.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { probeCliVersion, resolveBinary, shellQuote, validateModel, validateProvider, warnIfModelMismatch } from "./types.js";
 import { credentialHomeSpec, credentialProfileHome, prepareCredentialProfileHome, resolveCredentialProfile, } from "./credential-profile.js";
 import { getAgendHome } from "../paths.js";
 import { appendWithMarker, removeMarker } from "./marker-utils.js";
 import { t } from "../locale.js";
+import { parse as parseToml } from "smol-toml";
+import { CODEX_SESSION_ID, CodexResumeIdentityError, codexCurrentSessionFromPane, codexRolloutForId, codexSessionsForPane, codexSessionOwners, readCodexRolloutMeta } from "./codex-session.js";
 const CODEX_PROJECT_DOC_MAX_BYTES = 32_768;
 const CODEX_MODELS_CACHE_MAX_BYTES = 5 * 1024 * 1024;
 const SAFE_MODEL_ID_RE = /^[A-Za-z0-9._:/-]+$/;
 const AGEND_MCP_CLEANUP_LOCK = ".agend-mcp-cleanup.lock";
 const AGEND_MCP_CLEANUP_LOCK_STALE_MS = 30_000;
 const SQLITE_SIDECAR_RE = /-(?:wal|shm|journal)$/;
+function isCodexContextFooter(row) {
+    const context = String.raw `Context\s+\d+%\s+(?:left|used)`;
+    const legacy = new RegExp(String.raw `^\s*${context}(?:\s+⚠\s+\d+\s+warnings?\b[^\r\n]*)?(?:\s+·\s+\S[^\r\n]*)?\s*$`, "i");
+    if (legacy.test(row))
+        return true;
+    // A narrow Codex 0.156 pane may truncate the context item after the
+    // authoritative first `session-id` item. Keep structural readiness while
+    // /ctx honestly reports context unavailable from a truncated percentage.
+    return /^\s*[0-9a-f-]{36}\s+·\s+Context\b[^\r\n]*$/i.test(row);
+}
 /**
  * Remove AgEnD-owned MCP tables from a Codex TOML config without touching
  * unrelated user settings or third-party MCP servers. Track TOML multiline
@@ -62,6 +73,336 @@ function tomlString(value) {
     // JSON strings are valid TOML basic strings for the values AgEnD emits.
     return JSON.stringify(value);
 }
+/** Codex 0.156 trusts a linked worktree's common repository root, not its CWD. */
+function codexTrustPaths(workingDirectory) {
+    const cwd = realpathSync(resolve(workingDirectory));
+    try {
+        const commonDir = execFileSync("git", ["-C", cwd, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
+            encoding: "utf-8", timeout: 2_000, stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        const canonicalCommonDir = realpathSync(commonDir);
+        if (basename(canonicalCommonDir) === ".git")
+            return { cwd, root: dirname(canonicalCommonDir) };
+        // Submodules keep their common dir in another repository's .git/modules.
+        const topLevel = execFileSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+            encoding: "utf-8", timeout: 2_000, stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return { cwd, root: realpathSync(topLevel) };
+    }
+    catch {
+        // A non-Git folder is its own Codex trust root.
+        return { cwd, root: cwd };
+    }
+}
+function tomlTable(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)
+        ? value : null;
+}
+function projectTrustTable(config, root) {
+    const projects = tomlTable(tomlTable(config)?.projects);
+    return projects ? tomlTable(projects[root]) : null;
+}
+function effectiveProjectTrust(content, root) {
+    return projectTrustTable(parseToml(content), root)?.trust_level;
+}
+/** Change only the private project's trust value; parse before and after editing. */
+function setProjectTrusted(content, root) {
+    const section = `[projects.${tomlString(root)}]`;
+    const parsed = parseToml(content);
+    if (projectTrustTable(parsed, root)?.trust_level === "trusted")
+        return content;
+    const lines = content.split("\n");
+    const tableRows = [];
+    let multiline = null;
+    for (let row = 0; row < lines.length; row++) {
+        const line = lines[row];
+        if (!multiline && /^\s*\[.*\]\s*(?:#.*)?$/.test(line))
+            tableRows.push(row);
+        // A multiline config value can quote an entire pane/config. Treat a
+        // project-looking row inside it as data, never as effective TOML.
+        for (const delimiter of ['"""', "'''"]) {
+            if (multiline && multiline !== delimiter)
+                continue;
+            let count = 0;
+            let pos = 0;
+            while ((pos = line.indexOf(delimiter, pos)) !== -1) {
+                if (delimiter === "'''" || pos === 0 || line[pos - 1] !== "\\")
+                    count++;
+                pos += delimiter.length;
+            }
+            if (count % 2 === 1)
+                multiline = multiline === delimiter ? null : delimiter;
+        }
+    }
+    const headers = tableRows.filter(row => {
+        // TOML permits whitespace around dots and quoted/literal table keys.
+        // Parse each real header instead of comparing its raw spelling.
+        try {
+            return projectTrustTable(parseToml(`${lines[row]}\n__agend_trust_probe__ = true\n`), root)?.__agend_trust_probe__ === true;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (headers.length > 1)
+        throw new Error("Duplicate Codex trust project table");
+    if (headers.length === 0 && projectTrustTable(parsed, root)) {
+        throw new Error("Cannot safely edit Codex trust project table");
+    }
+    let updated;
+    if (headers.length === 0) {
+        updated = `${content.trimEnd()}\n\n${section}\ntrust_level = "trusted"\n`;
+    }
+    else {
+        const header = headers[0];
+        const end = tableRows.find(row => row > header) ?? lines.length;
+        const trustRows = [];
+        for (let row = header + 1; row < end; row++) {
+            if (/^\s*(?:trust_level|"trust_level"|'trust_level')\s*=/.test(lines[row]))
+                trustRows.push(row);
+        }
+        if (trustRows.length > 1)
+            throw new Error("Duplicate Codex trust_level key");
+        if (trustRows.length === 1)
+            lines[trustRows[0]] = 'trust_level = "trusted"';
+        else
+            lines.splice(header + 1, 0, 'trust_level = "trusted"');
+        updated = lines.join("\n");
+    }
+    // Candidate validation is before atomic write. A spelling the narrow text
+    // editor cannot handle must fail closed, never leave Codex with invalid TOML.
+    if (effectiveProjectTrust(updated, root) !== "trusted")
+        throw new Error("Codex project trust is not effective");
+    return updated;
+}
+/** Captured from Codex 0.156; only the live, bottom-of-pane four-choice menu. */
+export function codexResumeDirectoryPromptState(pane) {
+    const empty = { active: false, sessionCwd: null, currentCwd: null, safeChoice: false };
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    let title = -1;
+    for (let i = last; i >= Math.max(0, last - 20); i--) {
+        if (/^\s{2}Working directory · resume\s*$/.test(rows[i])) {
+            title = i;
+            break;
+        }
+    }
+    if (title < 0 || !/^\s{2}enter continue · esc use session · ctrl\+c quit\s*$/.test(rows[last]))
+        return empty;
+    const menu = rows.slice(title + 1, last);
+    const one = menu.findIndex(row => /^› 1\. Use session directory \(/.test(row));
+    if (one < 0)
+        return empty;
+    const options = menu.slice(one, one + 4);
+    const first = options[0]?.match(/^› 1\. Use session directory \((\/[^)]+)\)$/);
+    const second = options[1]?.match(/^  2\. Use current directory \((\/[^)]+)\)$/);
+    const safeChoice = !!first && !!second
+        && options[2] === "  3. Always use session directory"
+        && options[3] === "  4. Always use current directory"
+        && menu.slice(one + 4).every(row => row.trim() === "")
+        && menu.slice(0, one).every(row => row.trim() === ""
+            || /^\s{2}(?:Session = latest cwd recorded in the resumed session|Current = your current working directory)$/.test(row));
+    return { active: true, sessionCwd: first?.[1] ?? null, currentCwd: second?.[1] ?? null, safeChoice };
+}
+/** Unknown variants still own stdin; only the exact canonical menu may be answered. */
+export function codexResumeDirectoryVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    let title = -1;
+    for (let i = last; i >= Math.max(0, last - 20); i--) {
+        if (/^\s{2}Working directory · resume\s*$/.test(rows[i])) {
+            title = i;
+            break;
+        }
+    }
+    if (title < 0)
+        return false;
+    const tail = rows.slice(title + 1, last + 1);
+    return tail.some(row => /^\s*[›❯]?\s*1\. Use session directory\b/.test(row))
+        && tail.some(row => /^\s*[›❯]?\s*2\. Use current directory\b/.test(row))
+        && !tail.some(row => /[›❯]\s*(?:Ask Codex|Message Codex|Type a message)/i.test(row));
+}
+/** Codex's concurrent-owner screen is a hold, never an invitation to press R. */
+export function codexResumeLockActive(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !/^\s*r retry\s+esc\/ctrl\+c\/q exit(?:\s+ctrl\+t transcript)?\s*$/.test(rows[last]))
+        return false;
+    const recent = rows.slice(Math.max(0, last - 5), last);
+    return recent.some(row => /^\s*🔒\s+This conversation is open in another app\b/.test(row))
+        && recent.some(row => /^\s*Close it there and press R to continue here\.\s*$/.test(row));
+}
+/** A changed lock-screen footer is still a hold, never a ready prompt. */
+export function codexResumeLockVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    const title = rows.findIndex((row, i) => i >= Math.max(0, last - 8)
+        && /^\s*🔒\s+This conversation is open in another app\b/.test(row));
+    if (title < 0)
+        return false;
+    const tail = rows.slice(title + 1, last + 1);
+    return tail.some(row => /Close it there and press R to continue here\./.test(row))
+        && !tail.some(row => /^\s*[›❯]\s*(?:Ask Codex|Message Codex|Type a message)/i.test(row));
+}
+/** Only the bottom, live Codex 0.156 folder-access screen can own stdin. */
+function codexTrustPromptState(pane) {
+    const noPrompt = { active: false, folder: null, root: null, rootNote: "absent", safeChoice: false };
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return noPrompt;
+    let access = -1;
+    for (let index = rows.length - 1; index >= 0; index--) {
+        if (/^\s{0,2}Folder access\s*$/.test(rows[index])) {
+            access = index;
+            break;
+        }
+    }
+    if (access < 0 || last - access > 60)
+        return noPrompt;
+    const question = rows.findIndex((row, index) => index > access && /^\s{0,2}Trust this folder\?/.test(row));
+    if (question < 0 || question >= last)
+        return noPrompt;
+    // A ready input row or transcript continuation below the question means the
+    // trust dialog is history, not the current interactive region.
+    if (rows.slice(question + 1, last + 1).some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row)))
+        return noPrompt;
+    const noteRows = rows.slice(access + 1, question);
+    // The folder must be the first content row after the title. Do not let a
+    // later repository-root path stand in for a missing folder path.
+    const folderRow = noteRows.find(row => row.trim() !== "");
+    const folder = folderRow && /^\s{0,2}\//.test(folderRow) ? folderRow.trim() : null;
+    const hasRootNote = noteRows.some(row => /\bNote:|\brepository root\b|Trusting will apply/i.test(row));
+    const rootLabel = noteRows.findIndex(row => /\brepository root:/i.test(row));
+    const inlineRoot = rootLabel < 0 ? "" : noteRows[rootLabel].split(/\brepository root:/i)[1]?.trim() ?? "";
+    const followingRoot = rootLabel < 0 ? "" : noteRows.slice(rootLabel + 1).find(row => row.trim() !== "")?.trim() ?? "";
+    const candidateRoot = inlineRoot || followingRoot;
+    const root = candidateRoot.startsWith("/") ? candidateRoot : null;
+    const rootNote = !hasRootNote ? "absent" : root ? "parsed" : "invalid";
+    const choices = rows.slice(question + 1, last + 1).flatMap((row, offset) => {
+        const match = row.match(/^\s*([›❯>]?)\s*(\d+)\.\s+(.+?)\s*$/);
+        return match ? [{ row: question + 1 + offset, cursor: match[1], number: match[2], text: match[3] }] : [];
+    });
+    // Unknown option orders, a moved cursor, a third option, or any different
+    // footer are held for a human. Never guess where Enter would land.
+    const safeChoice = choices.length === 2
+        && choices[0].row + 1 === choices[1].row
+        && rows.slice(choices[1].row + 1, last).every(row => row.trim() === "")
+        && choices[0].cursor === "›" && choices[0].number === "1" && choices[0].text === "Trust and continue"
+        && choices[1].cursor === "" && choices[1].number === "2" && choices[1].text === "Quit"
+        && /^\s*enter continue\s*·\s*esc quit\s*$/i.test(rows[last]);
+    return { active: true, folder, root, rootNote, safeChoice };
+}
+/** Unknown/older trust layouts are still input-blocking, never auto-answered. */
+function codexTrustVariantActive(pane) {
+    if (codexTrustPromptState(pane).active)
+        return true;
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return false;
+    const start = Math.max(0, last - 22);
+    const folderAccess = rows.findIndex((row, index) => index >= start && /^\s{0,2}Folder access\s*$/.test(row));
+    if (folderAccess >= 0) {
+        const tail = rows.slice(folderAccess + 1, last + 1);
+        if (!tail.some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row))
+            && tail.some(row => /^\s*[›❯>]?\s*\d+\.\s+(?:Open restricted|Trust and continue|Quit)\s*$/i.test(row))
+            && /(?:enter|esc|quit|cancel)/i.test(rows[last]))
+            return true;
+    }
+    const question = rows.findIndex((row, index) => index >= start
+        && /^\s*(?:Trust this folder\?|Do you trust the files in this folder\?)/i.test(row));
+    if (question < 0 || question >= last)
+        return false;
+    const tail = rows.slice(question + 1, last + 1);
+    // A normal input row after a quoted menu makes it history, not live UI.
+    if (tail.some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row)))
+        return false;
+    return tail.some(row => /^\s*[›❯>]?\s*\d+\.\s+\S/.test(row))
+        && (/(?:enter|esc|quit|cancel)/i.test(rows[last])
+            || /^\s*[›❯>]?\s*\d+\.\s+\S/.test(rows[last]));
+}
+/** Rate-switch prompts are economic choices, not a fixed keyboard position. */
+function codexRateSwitchVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    let title = -1;
+    for (let i = last; i >= Math.max(0, last - 18); i--) {
+        if (/^\s*(?:Approaching rate limits|Switch to .{1,120} for lower credit usage\?)\s*$/i.test(rows[i])) {
+            title = i;
+            break;
+        }
+    }
+    if (title < 0)
+        return false;
+    const tail = rows.slice(title + 1, last + 1);
+    // A copied picker in transcript history is not the currently active menu.
+    if (tail.some(row => /^[›>]\s+Ask Codex to do anything\b/.test(row) || isCodexContextFooter(row)))
+        return false;
+    return tail.some(row => /^\s*[›❯>]?\s*\d+\.\s*(?:Switch to|Keep current model)\b/i.test(row));
+}
+/** Unknown pickers own stdin too; never type or press Enter into one. */
+function codexUnknownSelectionVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !(/\benter\b.*\besc\b/i.test(rows[last])
+        || /^\s*Press enter to continue\s*$/i.test(rows[last])))
+        return false;
+    let selected = -1;
+    for (let i = last - 1; i >= Math.max(0, last - 24); i--) {
+        if (/^\s*[›❯>]\s+\S/.test(rows[i])) {
+            selected = i;
+            break;
+        }
+    }
+    if (selected < 0)
+        return false;
+    if (/^\s*[›❯>]\s+Ask Codex to do anything\b/.test(rows[selected]))
+        return false;
+    return !rows.slice(selected + 1, last + 1).some(row => /^[›>]\s+Ask Codex to do anything\b/.test(row) || isCodexContextFooter(row));
+}
+/** Only the complete, current Codex installer picker may receive Escape. */
+function codexUpdatePickerVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !/^\s*Press enter to continue\s*$/.test(rows[last]))
+        return false;
+    for (let first = last - 3; first >= Math.max(0, last - 9); first--) {
+        if (!/^\s*[›❯>]\s+1\.\s+Update now\b/.test(rows[first]))
+            continue;
+        // At 80 columns Codex 0.153 wraps the installer command to the next row.
+        // Permit a bounded continuation, but never another option or cursor.
+        const second = rows.findIndex((row, index) => index > first && index <= first + 3
+            && /^\s*2\.\s+Skip\s*$/.test(row));
+        if (second < 0 || !rows.slice(first + 1, second).every(row => /^\s+\S/.test(row) && !/^\s*[›❯>]?\s*\d+\./.test(row))
+            || !/^\s*3\.\s+Skip until next version\s*$/.test(rows[second + 1] ?? "")
+            || !rows.slice(second + 2, last).every(row => row.trim() === ""))
+            continue;
+        const intro = rows.slice(Math.max(0, first - 14), first);
+        if (intro.some(row => /Update available!/.test(row))
+            && intro.some(row => /^\s*Release notes: https:\/\/github\.com\/openai\/codex\/releases\/latest\s*$/.test(row)))
+            return true;
+    }
+    return false;
+}
 function renderMcpServer(name, entry, instanceName) {
     const mcpName = `${name}-${instanceName}`.replace(/[^A-Za-z0-9_-]/g, "_");
     const env = { ...entry.env, AGEND_INSTANCE_NAME: instanceName };
@@ -97,6 +438,49 @@ function atomicWritePrivate(path, content) {
         catch { }
     }
 }
+/** macOS lockf and Linux flock both fail immediately with status 75 on contention. */
+export function codexResumeClaimCommand(platform, lockPath, launch) {
+    // A child Codex exit 75 is remapped; only lock contention gets the marker.
+    const child = `sh -c ${shellQuote(`${launch}; agend_child_status=$?; if [ "$agend_child_status" -eq 75 ]; then exit 74; fi; exit "$agend_child_status"`)}`;
+    const guarded = platform === "darwin"
+        ? `lockf -s -t 0 -k -w ${shellQuote(lockPath)} ${child}`
+        : `flock -n -E 75 ${shellQuote(lockPath)} ${child}`;
+    // Daemon prefixes this command with TERM/AGEND_* assignments. A shell
+    // subshell is not a simple command (`VAR=x ( ... )` is a syntax error), but
+    // `sh -c` is, so the same claim works in the real daemon launch line.
+    return `sh -c ${shellQuote(`${guarded}; agend_resume_status=$?; if [ "$agend_resume_status" -eq 75 ]; then printf '%s\\n' '[agend:codex-session-held]'; fi; exit "$agend_resume_status"`)}`;
+}
+/** Explicit, stopped-instance recovery for an old conversation without an AgEnD owner record. */
+export function attachCodexSession(instanceDir, sharedHome, currentCwd, id) {
+    if (!CODEX_SESSION_ID.test(id))
+        throw new Error("Codex session ID must be a UUID");
+    if (existsSync(join(instanceDir, "window-id")))
+        throw new Error("Stop this instance before attaching a Codex session");
+    // Startup writes daemon.pid before window-id. Require a clean stop rather
+    // than race an instance still launching. An orphaned stale pid marker must
+    // be inspected and removed manually, never inferred to be harmless here.
+    if (existsSync(join(instanceDir, "daemon.pid")))
+        throw new Error("Stop this instance and clear its daemon PID marker before attaching a Codex session");
+    const found = codexRolloutForId(sharedHome, id);
+    if (!found)
+        throw new Error("Codex session ID was not found in the shared session store");
+    if (codexTrustPaths(found.cwd).root !== codexTrustPaths(currentCwd).root) {
+        throw new Error("Codex session belongs to a different repository; refusing to attach");
+    }
+    if (codexSessionOwners(id).length > 0)
+        throw new Error("Codex session has a live owner; close it before attaching");
+    const record = { ...found, owner: basename(instanceDir) };
+    atomicWritePrivate(join(instanceDir, "codex-session.json"), JSON.stringify(record));
+    atomicWritePrivate(join(instanceDir, "session-id"), id);
+    // Human-selected exact identity retires a prior ambiguous-live-pane hold.
+    try {
+        unlinkSync(join(instanceDir, "codex-session-unconfirmed"));
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+}
 // Account-aware models_cache.json is preferred. These documented Codex models
 // are only a last-resort menu when the TUI has not populated its cache yet.
 /** The whole of a codex identity, and the only file a profile owns. */
@@ -111,14 +495,21 @@ const CODEX_FALLBACK_MODELS = [
 ];
 export class CodexBackend {
     instanceDir;
+    procRoot;
     binaryName = "codex";
     binaryPath;
     sharedCodexHome;
     isolatedCodexHome;
     /** Which subscription this instance runs on, or null for the shared login. */
     credentialProfile = null;
-    constructor(instanceDir) {
+    /** Set only after preTrust wrote and read back this instance's private config. */
+    authorizedTrust = null;
+    activePanePid = null;
+    resumeRecord = null;
+    get unconfirmedSessionPath() { return join(this.instanceDir, "codex-session-unconfirmed"); }
+    constructor(instanceDir, procRoot = "/proc") {
         this.instanceDir = instanceDir;
+        this.procRoot = procRoot;
         this.binaryPath = resolveBinary("codex");
         this.sharedCodexHome = resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
         this.isolatedCodexHome = resolve(instanceDir, "codex-home");
@@ -145,6 +536,29 @@ export class CodexBackend {
     getBottomReadyPattern() {
         return /^\s*›\s?/;
     }
+    /** Observed on real Codex 0.156.0: the live input row precedes its footer. */
+    isDeliveryInputReadyPane(pane) {
+        const rows = pane.replace(/\r/g, "").split("\n");
+        while (rows.length && !rows[rows.length - 1].trim())
+            rows.pop();
+        const footer = rows.pop() ?? "";
+        // Codex preserves other configured status-line items after our session ID
+        // and context meter (observed on 0.156.0: "Context 100% left · GPT-6-Astra").
+        // They are footer chrome, not evidence that the input row is unavailable.
+        if (!isCodexContextFooter(footer))
+            return false;
+        // Pasted text may wrap over several continuation rows before the footer.
+        // Search only its immediate tail, not a historical transcript prompt.
+        for (let i = rows.length - 1; i >= Math.max(0, rows.length - 8); i--) {
+            if (/^[>›]\s+\d+\./.test(rows[i]))
+                return false;
+            if (/^[>›]\s+\S/.test(rows[i]))
+                return true;
+            if (/^[•■⚠]/.test(rows[i]))
+                return false;
+        }
+        return false;
+    }
     /** Live status chrome that must veto the broad prompt/context ready match. */
     getBusyPattern() {
         return /(?:^|\n)•\s+Working\b[^\n]*\besc to interrupt\b/i;
@@ -178,7 +592,7 @@ export class CodexBackend {
             return false;
         let footer = -1;
         for (let i = prompt + 1; i < Math.min(rows.length, prompt + 7); i++) {
-            if (/^\s*Context\s+\d+%\s+(?:left|used)\s*$/i.test(rows[i])) {
+            if (isCodexContextFooter(rows[i])) {
                 footer = i;
                 break;
             }
@@ -209,16 +623,21 @@ export class CodexBackend {
         const approvalFlag = config.skipPermissions !== false
             ? "--dangerously-bypass-approvals-and-sandbox"
             : "--full-auto";
-        // `codex resume --last` resumes the most recent session for the current
-        // working directory. Each AgEnD instance has a unique working_directory,
-        // so sessions are per-instance scoped and won't collide.
-        // If no prior session exists (first launch), Codex falls back to a fresh session.
+        // Never select by CWD: two instances can share a worktree and --last may
+        // select a session still owned by another app. A sidecar written from the
+        // actual pane's open rollout + writer lock is the only automatic identity.
+        // A present but unreadable/unknown-version record is NOT legacy absence.
+        // Do not overwrite it with a fresh session even if a caller requested a
+        // skip-resume recovery; a human must resolve this identity first.
+        if (this.hasInvalidSessionIdentity(config.workingDirectory))
+            throw new CodexResumeIdentityError();
+        this.resumeRecord = config.skipResume ? null : this.validResumeRecord(config.workingDirectory);
         let cmd;
-        if (config.skipResume) {
+        if (!this.resumeRecord) {
             cmd = `${this.binaryPath} ${approvalFlag}`;
         }
         else {
-            cmd = `${this.binaryPath} resume --last ${approvalFlag}`;
+            cmd = `${this.binaryPath} resume ${shellQuote(this.resumeRecord.id)} ${approvalFlag}`;
         }
         if (config.model) {
             const model = validateModel(config.model);
@@ -232,13 +651,68 @@ export class CodexBackend {
         // AgEnD instances are unattended processes: an interactive self-update
         // picker blocks delivery and must never be enabled by a copied global or
         // managed config layer. Keep this last so the CLI override is authoritative.
-        cmd += " -c check_for_update_on_startup=false";
+        // Both observed Codex 0.155.0 and 0.156.1 support this launch flag. Pin
+        // the initial layout so a user/global fullscreen preference cannot make a
+        // header-only pane look ready. A later unknown layout still fails closed.
+        cmd += " -c check_for_update_on_startup=false --no-alt-screen";
         // CODEX_HOME is the only Codex-supported way to isolate the complete base
         // config. A profile only layers over the shared config and would therefore
         // still load every globally registered AgEnD MCP server.
-        return `CODEX_HOME=${shellQuote(this.isolatedCodexHome)} ${cmd}`;
+        const launch = `CODEX_HOME=${shellQuote(this.isolatedCodexHome)} ${cmd}`;
+        if (!this.resumeRecord)
+            return launch;
+        // The shared claim is held for the entire Codex process lifetime;
+        // an atomic, cross-daemon fence closes the race between the owner probe and
+        // spawn. Exit 75 is recognized as a held session, never a broken session.
+        const claims = join(this.sharedCodexHome, ".agend-session-claims");
+        mkdirSync(claims, { recursive: true, mode: 0o700 });
+        return codexResumeClaimCommand(process.platform, join(claims, `${this.resumeRecord.id}.lock`), launch);
+    }
+    setActivePanePid(pid) { this.activePanePid = pid; }
+    /** A fresh launch has no resume identity; it must not be counted as --resume. */
+    canResume(workingDirectory) { return this.validResumeRecord(workingDirectory) !== null; }
+    hasSessionIdentity() {
+        return existsSync(join(this.instanceDir, "codex-session.json")) || existsSync(join(this.instanceDir, "session-id"))
+            || existsSync(this.unconfirmedSessionPath);
+    }
+    hasInvalidSessionIdentity(workingDirectory) {
+        return existsSync(this.unconfirmedSessionPath) || (this.hasSessionIdentity() && !this.validResumeRecord(workingDirectory));
+    }
+    hasUnconfirmedSessionIdentity() { return existsSync(this.unconfirmedSessionPath); }
+    /** Positive owner evidence, not merely a stale lock-file name on disk. */
+    resumeOwner(workingDirectory) {
+        const record = this.validResumeRecord(workingDirectory);
+        return record ? codexSessionOwners(record.id, this.procRoot).find(pid => pid !== process.pid) ?? null : null;
+    }
+    validResumeRecord(workingDirectory) {
+        if (existsSync(this.unconfirmedSessionPath))
+            return null;
+        try {
+            const record = JSON.parse(readFileSync(join(this.instanceDir, "codex-session.json"), "utf8"));
+            if (!record || !CODEX_SESSION_ID.test(record.id) || record.owner !== basename(this.instanceDir))
+                return null;
+            if (readFileSync(join(this.instanceDir, "session-id"), "utf8").trim() !== record.id)
+                return null;
+            const rollout = realpathSync(record.rolloutPath);
+            const sessions = realpathSync(join(this.sharedCodexHome, "sessions"));
+            if (!rollout.startsWith(`${sessions}/`))
+                return null;
+            const meta = readCodexRolloutMeta(rollout);
+            if (!meta || meta.id !== record.id || meta.cwd !== record.cwd)
+                return null;
+            // A moved worktree may legitimately have a different CWD in the saved
+            // session. It must still be the same Git repository as the current CWD.
+            const current = codexTrustPaths(workingDirectory);
+            if (record.cwd !== current.cwd && codexTrustPaths(record.cwd).root !== current.root)
+                return null;
+            return record;
+        }
+        catch {
+            return null;
+        }
     }
     writeConfig(config) {
+        this.authorizedTrust = null;
         // Set before the home is prepared: which login this instance gets is a
         // property of the home, and the home is built here.
         this.credentialProfile = this.readProfile(config);
@@ -324,16 +798,10 @@ export class CodexBackend {
         catch { /* best effort */ }
     }
     /**
-     * Ensure Codex's TUI status line shows context usage so /ctx can scrape it.
-     * Rules (never overwrites the user's status_line):
-     *   1. status_line already has a context item (context-remaining / -usage /
-     *      -used) → leave the whole config untouched (they already show context).
-     *   2. no context item:
-     *        - no status_line at all → write status_line = ["context-remaining"]
-     *        - status_line exists     → append "context-remaining" to it
-     * If a user's own status_line is long and truncates at 80 cols, that's their
-     * config — /ctx just reports context unavailable. Best-effort string edit of
-     * ~/.codex/config.toml (no toml dependency); other settings untouched.
+     * The first status-line item is Codex's own current session ID. Unlike fd
+     * order, this changes when /new switches chats while old writer locks stay
+     * open. Keep context too, then preserve all user-selected remaining items.
+     * If the footer is hidden/truncated, checkpointing fails closed instead.
      */
     enableContextStatusLine() {
         const configPath = join(this.isolatedCodexHome, "config.toml");
@@ -342,31 +810,48 @@ export class CodexBackend {
             content = readFileSync(configPath, "utf-8");
         }
         catch { /* no file yet */ }
-        // Rule 1: any existing context item → don't touch anything.
-        if (/status_line\s*=\s*\[[^\]]*context-(remaining|usage|used)[^\]]*\]/.test(content))
+        let existing;
+        try {
+            const parsed = parseToml(content);
+            if (parsed.tui?.status_line !== undefined) {
+                if (!Array.isArray(parsed.tui.status_line)
+                    || !parsed.tui.status_line.every((item) => typeof item === "string"))
+                    return;
+                existing = parsed.tui.status_line;
+            }
+        }
+        catch {
             return;
-        const ITEM = "context-remaining";
-        const arr = content.match(/status_line\s*=\s*\[([^\]]*)\]/);
+        }
+        const tuiHeader = /^[ \t]*\[[ \t]*tui[ \t]*\][ \t]*(?:#.*)?$/m.exec(content);
+        const tuiStart = tuiHeader ? tuiHeader.index + tuiHeader[0].length : -1;
+        const nextHeader = tuiStart >= 0 ? /^[ \t]*\[/m.exec(content.slice(tuiStart)) : null;
+        const tuiEnd = nextHeader ? tuiStart + nextHeader.index : content.length;
+        const tuiBody = tuiStart >= 0 ? content.slice(tuiStart, tuiEnd) : "";
+        const arr = /^[ \t]*status_line[ \t]*=[ \t]*\[([^\]]*)\]/m.exec(tuiBody);
+        if (existing && !arr)
+            return; // an unfamiliar but valid TOML form: preserve it
         if (arr) {
-            // Rule 2b: prepend our item to the user's existing array (don't overwrite).
-            // First position keeps "Context N% left" at the far left of the footer so a
-            // long cwd/other items can't push it past 80 cols and truncate it.
-            const inner = arr[1].trim().replace(/^,\s*/, "").replace(/,\s*$/, "");
-            const newInner = inner.length ? `"${ITEM}", ${inner}` : `"${ITEM}"`;
-            content = content.replace(arr[0], `status_line = [${newInner}]`);
+            const items = existing;
+            const context = items.find(item => /^(?:context-remaining|context-usage|context-used)$/.test(item)) ?? "context-remaining";
+            const ordered = ["session-id", context, ...items.filter(item => item !== "session-id" && item !== context)];
+            const updatedBody = tuiBody.replace(arr[0], `\nstatus_line = ${JSON.stringify(ordered)}`);
+            content = content.slice(0, tuiStart) + updatedBody + content.slice(tuiEnd);
         }
         else {
-            // Rule 2a: no status_line at all → add a minimal one.
             if (content.length && !content.endsWith("\n"))
                 content += "\n";
-            if (/^\[tui\]/m.test(content)) {
-                content = content.replace(/^\[tui\][^\n]*\n/m, h => `${h}status_line = ["${ITEM}"]\n`);
+            if (tuiHeader) {
+                content = content.slice(0, tuiStart) + '\nstatus_line = ["session-id", "context-remaining"]' + content.slice(tuiStart);
             }
             else {
-                content += `\n[tui]\nstatus_line = ["${ITEM}"]\n`;
+                content += '\n[tui]\nstatus_line = ["session-id", "context-remaining"]\n';
             }
         }
         try {
+            // A bad rewrite must not turn a working Codex configuration into a
+            // startup failure. It merely loses the optional current-ID proof.
+            parseToml(content);
             atomicWritePrivate(configPath, content);
         }
         catch { /* best effort — never block launch on statusline config */ }
@@ -401,16 +886,23 @@ export class CodexBackend {
         return home;
     }
     preTrust(workDir) {
+        this.authorizedTrust = null;
+        const paths = codexTrustPaths(workDir);
         const configPath = join(this.isolatedCodexHome, "config.toml");
         let content = "";
         try {
             content = readFileSync(configPath, "utf-8");
         }
         catch { }
-        const section = `[projects."${workDir}"]`;
-        if (content.includes(section))
-            return;
-        atomicWritePrivate(configPath, `${content.trimEnd()}\n\n${section}\ntrust_level = "trusted"\n`);
+        const updated = setProjectTrusted(content, paths.root);
+        if (updated !== content)
+            atomicWritePrivate(configPath, updated);
+        // Do not authorize an automatic Enter merely because the write returned:
+        // a stale/untrusted section in the effective isolated config must fail shut.
+        const onDisk = readFileSync(configPath, "utf-8");
+        if (effectiveProjectTrust(onDisk, paths.root) !== "trusted")
+            throw new Error("Codex project trust did not persist");
+        this.authorizedTrust = paths;
     }
     /**
      * Preserve Codex login/session/cache behavior while isolating config.toml.
@@ -654,11 +1146,20 @@ export class CodexBackend {
         }
     }
     getReadyPattern() {
-        // Startup/header: "OpenAI Codex". Prompt glyph is ">" on older Codex and
-        // "›" (U+203A) on newer releases. Exclude numbered menu selections so a
-        // trust/confirmation dialog is not mistaken for an idle input prompt.
-        // Statusline variants report either "% left" or "% used" while idle.
-        return /% left|% used|OpenAI Codex|^[>›](?!\s*\d+\.)/m;
+        // Header and context text persist in inline scrollback and even while the
+        // CLI is loading or a modal owns stdin. Require the live prompt followed
+        // by the Context footer at the *end* of the capture. getBusyPattern still
+        // vetoes a working turn whose empty composer remains visible. Unknown TUI
+        // layouts cannot claim readiness by merely rendering the old header.
+        // U+22C6 is Codex's observed cosmetic starfield; it can be drawn in the
+        // prompt, between prompt/footer, and below the footer. A drafted composer
+        // is also idle once this same bottom footer proves it owns the screen.
+        return /(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}[ \t⋆]+(?:[0-9a-f-]{36}[ \t]+·[ \t]+)?Context[ \t]+(?:\d+%[ \t]+(?:left|used)|\d+…|…)[^\r\n]*(?:\r?\n[ \t⋆]*)*$/i;
+    }
+    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
+    isProxyReplyChromeLine(line) {
+        return /^\s*[›>]\s+Ask Codex to do anything\s*$/.test(line)
+            || isCodexContextFooter(line);
     }
     getErrorPatterns() {
         return [
@@ -756,12 +1257,79 @@ export class CodexBackend {
         ];
     }
     getStartupDialogs() {
+        const trustHold = this.trustHoldDialog();
         return [
-            { pattern: /Do you trust the files in this folder/i, keys: ["Enter"], description: "Codex trust dialog" },
-            { pattern: /Yes, continue/i, keys: ["Enter"], description: "Codex 'Yes, continue' confirmation" },
+            {
+                pattern: /^\s{2}Working directory · resume\s*$/m,
+                keys: ["Down", "Enter"],
+                description: "Codex verified resume directory — use this instance's current worktree",
+                blocksDelivery: true,
+                inputBlocked: true,
+                autoResolutionKey: "codex-verified-resume-directory",
+                isActive: pane => {
+                    const state = codexResumeDirectoryPromptState(pane);
+                    const record = this.resumeRecord;
+                    const authorized = this.authorizedTrust;
+                    return state.active && state.safeChoice && !!record && !!authorized
+                        && state.sessionCwd === record.cwd && state.currentCwd === authorized.cwd;
+                },
+            },
+            this.resumeDirectoryHoldDialog(),
+            this.resumeLockHoldDialog(),
+            {
+                pattern: /^\s*Trust this folder\?/m,
+                keys: ["Enter"],
+                description: "Codex authorized folder trust dialog",
+                blocksDelivery: true,
+                inputBlocked: true,
+                autoResolutionKey: "codex-authorized-folder-trust",
+                isActive: pane => {
+                    const state = codexTrustPromptState(pane);
+                    const authorized = this.authorizedTrust;
+                    return state.active && state.safeChoice && authorized !== null
+                        && state.folder === authorized.cwd
+                        && (state.rootNote === "absent" ? authorized.root === authorized.cwd
+                            : state.rootNote === "parsed" && state.root === authorized.root);
+                },
+            },
+            trustHold,
             this.updatePickerDialog(),
+            this.unknownSelectionHoldDialog(),
         ];
     }
+    trustHoldDialog() {
+        return {
+            pattern: /^\s*(?:Folder access|Trust this folder\?|Do you trust the files in this folder\?)/im,
+            keys: [],
+            description: "Codex folder trust needs human confirmation",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexTrustVariantActive,
+        };
+    }
+    resumeDirectoryHoldDialog() {
+        return {
+            pattern: /^\s{2}Working directory · resume\s*$/m,
+            keys: [],
+            description: "Codex resume directory needs verified session/worktree ownership",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexResumeDirectoryVisible,
+        };
+    }
+    resumeLockHoldDialog() {
+        return {
+            pattern: /This conversation is open in another app/,
+            keys: [],
+            description: "Codex conversation is open in another app — close that owner before a manual restart",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexResumeLockVisible,
+        };
+    }
     updatePickerDialog() {
         return {
             // Defense in depth for config written by older AgEnD versions or a Codex
@@ -777,26 +1345,43 @@ export class CodexBackend {
             // seconds and a delivery can arrive first (hit live on codex-cli 0.153.4,
             // which parks on this picker for as long as nobody answers it).
             blocksDelivery: true,
-            // Bottom-anchored, so a transcript that quotes the picker (an agent
-            // pasting a pane capture, this very change being reviewed) is not
-            // mistaken for a live one: the real picker owns the bottom of the pane
-            // and has no input row under it.
-            isActive: (pane) => {
-                const last = lastNonBlankRow(pane);
-                return last != null && /^\s*Press enter to continue\s*$/.test(last);
-            },
+            // Daemon.dialogMatches uses isActive INSTEAD OF pattern when present.
+            // Check the complete current picker here; a different Enter-only menu
+            // must never receive this automatic Escape key.
+            isActive: codexUpdatePickerVisible,
+        };
+    }
+    unknownSelectionHoldDialog() {
+        return {
+            pattern: /^\s*[›❯>]\s+\S/m,
+            keys: [],
+            description: "Codex interactive selection needs human input",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexUnknownSelectionVisible,
         };
     }
     getRuntimeDialogs() {
         return [
+            this.trustHoldDialog(),
+            this.resumeDirectoryHoldDialog(),
+            this.resumeLockHoldDialog(),
             {
-                // Codex shows a model switch dialog when approaching rate limits.
-                // Auto-select "Keep current model (never show again)" — option 3.
-                pattern: /Approaching rate limits[\s\S]*Switch to.*for lower credit/m,
-                keys: ["Down", "Down", "Enter"],
-                description: "Codex rate limit model switch dialog",
+                // Codex 0.156 may change the wording/order of this credit-cost choice.
+                // Never navigate it by position: a moved option could switch to a
+                // more expensive model. A live picker holds delivery and notifies a
+                // human; old transcript mentions are excluded by the tail matcher.
+                pattern: /(?:Approaching rate limits|Switch to [^\r\n]{1,120} for lower credit usage\?)/i,
+                keys: [],
+                description: "Codex rate limit model switch dialog needs human choice",
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                isActive: codexRateSwitchVisible,
             },
             this.updatePickerDialog(),
+            this.unknownSelectionHoldDialog(),
         ];
     }
     getInputUnavailableTransients() {
@@ -835,10 +1420,60 @@ export class CodexBackend {
     getContextUsage() {
         return null;
     }
-    getSessionId() {
-        // Codex manages sessions internally via SQLite (~/.codex/state_5.sqlite).
-        // `resume --last` handles session selection by CWD automatically.
-        return null;
+    getSessionId(pane) {
+        const panePid = this.activePanePid;
+        if (!panePid)
+            return null;
+        const candidates = codexSessionsForPane(panePid, this.sharedCodexHome, this.procRoot);
+        const displayedId = pane === undefined ? null : codexCurrentSessionFromPane(pane);
+        // Once ambiguity has revoked the old identity, only fresh visible proof
+        // can restore it. A later status callback without a pane cannot silently
+        // re-arm the old sidecar just because one fd happened to close.
+        if (existsSync(this.unconfirmedSessionPath) && !displayedId)
+            return null;
+        const active = candidates.length === 1
+            ? displayedId && displayedId !== candidates[0].id ? null : candidates[0]
+            : displayedId ? candidates.find(candidate => candidate.id === displayedId) ?? null : null;
+        if (!active) {
+            // `/new` keeps both native writer locks open even after a completed
+            // turn. A null checkpoint must revoke the old resumable sidecar, not
+            // leave it armed for a later wake into the wrong conversation.
+            const oldId = (() => {
+                try {
+                    return readFileSync(join(this.instanceDir, "session-id"), "utf8").trim();
+                }
+                catch {
+                    return null;
+                }
+            })();
+            const hasStoredIdentity = existsSync(join(this.instanceDir, "codex-session.json")) || oldId !== null;
+            if (candidates.length > 1 || (displayedId && displayedId !== oldId)
+                || (pane !== undefined && candidates.length === 0 && hasStoredIdentity)) {
+                try {
+                    writeFileSync(this.unconfirmedSessionPath, "current Codex session unconfirmed\n", { flag: "wx", mode: 0o600 });
+                }
+                catch (err) {
+                    if (err.code !== "EEXIST")
+                        throw err;
+                }
+            }
+            return null;
+        }
+        const record = { ...active, owner: basename(this.instanceDir) };
+        const path = join(this.instanceDir, "codex-session.json");
+        try {
+            const prior = readFileSync(path, "utf8");
+            if (prior === JSON.stringify(record)) {
+                if (existsSync(this.unconfirmedSessionPath))
+                    unlinkSync(this.unconfirmedSessionPath);
+                return active.id;
+            }
+        }
+        catch { /* first checkpoint */ }
+        atomicWritePrivate(path, JSON.stringify(record));
+        if (existsSync(this.unconfirmedSessionPath))
+            unlinkSync(this.unconfirmedSessionPath);
+        return active.id;
     }
     getQuitCommand() { return "/quit"; }
     getCompactCommand() { return "/compact"; }