@songsid/agend 2.1.6-beta.12 → 2.1.6-beta.14

package/dist/backend/codex.d.ts

@@ -7,6 +7,8 @@ export declare class CodexBackend implements CliBackend {
     private readonly isolatedCodexHome;
     /** Which subscription this instance runs on, or null for the shared login. */
     private credentialProfile;
+    /** Set only after preTrust wrote and read back this instance's private config. */
+    private authorizedTrust;
     constructor(instanceDir: string);
     supportsQueuedInput(): boolean;
     /**
@@ -26,6 +28,8 @@ export declare class CodexBackend implements CliBackend {
      * (updatePickerDialog) before any delivery path reads this pattern.
      */
     getBottomReadyPattern(): RegExp | null;
+    /** Observed on real Codex 0.156.0: the live input row precedes its footer. */
+    isDeliveryInputReadyPane(pane: string): boolean;
     /** Live status chrome that must veto the broad prompt/context ready match. */
     getBusyPattern(): RegExp;
     /**
@@ -127,9 +131,13 @@ export declare class CodexBackend implements CliBackend {
      */
     private cleanSharedConfig;
     getReadyPattern(): RegExp;
+    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
+    isProxyReplyChromeLine(line: string): boolean;
     getErrorPatterns(): ErrorPattern[];
     getStartupDialogs(): StartupDialog[];
+    private trustHoldDialog;
     private updatePickerDialog;
+    private unknownSelectionHoldDialog;
     getRuntimeDialogs(): RuntimeDialog[];
     getInputUnavailableTransients(): InputUnavailableTransient[];
     getContextUsage(): number | null;

package/dist/backend/codex.js

@@ -1,17 +1,32 @@
-import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
-import { lastNonBlankRow } from "../pane-input-residue.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { probeCliVersion, resolveBinary, shellQuote, validateModel, validateProvider, warnIfModelMismatch } from "./types.js";
 import { credentialHomeSpec, credentialProfileHome, prepareCredentialProfileHome, resolveCredentialProfile, } from "./credential-profile.js";
 import { getAgendHome } from "../paths.js";
 import { appendWithMarker, removeMarker } from "./marker-utils.js";
 import { t } from "../locale.js";
+import { parse as parseToml } from "smol-toml";
 const CODEX_PROJECT_DOC_MAX_BYTES = 32_768;
 const CODEX_MODELS_CACHE_MAX_BYTES = 5 * 1024 * 1024;
 const SAFE_MODEL_ID_RE = /^[A-Za-z0-9._:/-]+$/;
+/**
+ * Whether a pane row is Codex's context footer. Kept when #913 was reverted:
+ * #913 introduced it, but #914's pane/ready detection is built on it, and it
+ * is pane parsing, not session handling.
+ */
+function isCodexContextFooter(row) {
+    const context = String.raw `Context\s+\d+%\s+(?:left|used)`;
+    const legacy = new RegExp(String.raw `^\s*${context}(?:\s+⚠\s+\d+\s+warnings?\b[^\r\n]*)?(?:\s+·\s+\S[^\r\n]*)?\s*$`, "i");
+    if (legacy.test(row))
+        return true;
+    // A narrow Codex 0.156 pane may truncate the context item after the
+    // authoritative first `session-id` item. Keep structural readiness while
+    // /ctx honestly reports context unavailable from a truncated percentage.
+    return /^\s*[0-9a-f-]{36}\s+·\s+Context\b[^\r\n]*$/i.test(row);
+}
 const AGEND_MCP_CLEANUP_LOCK = ".agend-mcp-cleanup.lock";
 const AGEND_MCP_CLEANUP_LOCK_STALE_MS = 30_000;
 const SQLITE_SIDECAR_RE = /-(?:wal|shm|journal)$/;
@@ -62,6 +77,259 @@ function tomlString(value) {
     // JSON strings are valid TOML basic strings for the values AgEnD emits.
     return JSON.stringify(value);
 }
+/** Codex 0.156 trusts a linked worktree's common repository root, not its CWD. */
+function codexTrustPaths(workingDirectory) {
+    const cwd = realpathSync(resolve(workingDirectory));
+    try {
+        const commonDir = execFileSync("git", ["-C", cwd, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
+            encoding: "utf-8", timeout: 2_000, stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        const canonicalCommonDir = realpathSync(commonDir);
+        if (basename(canonicalCommonDir) === ".git")
+            return { cwd, root: dirname(canonicalCommonDir) };
+        // Submodules keep their common dir in another repository's .git/modules.
+        const topLevel = execFileSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+            encoding: "utf-8", timeout: 2_000, stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return { cwd, root: realpathSync(topLevel) };
+    }
+    catch {
+        // A non-Git folder is its own Codex trust root.
+        return { cwd, root: cwd };
+    }
+}
+function tomlTable(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)
+        ? value : null;
+}
+function projectTrustTable(config, root) {
+    const projects = tomlTable(tomlTable(config)?.projects);
+    return projects ? tomlTable(projects[root]) : null;
+}
+function effectiveProjectTrust(content, root) {
+    return projectTrustTable(parseToml(content), root)?.trust_level;
+}
+/** Change only the private project's trust value; parse before and after editing. */
+function setProjectTrusted(content, root) {
+    const section = `[projects.${tomlString(root)}]`;
+    const parsed = parseToml(content);
+    if (projectTrustTable(parsed, root)?.trust_level === "trusted")
+        return content;
+    const lines = content.split("\n");
+    const tableRows = [];
+    let multiline = null;
+    for (let row = 0; row < lines.length; row++) {
+        const line = lines[row];
+        if (!multiline && /^\s*\[.*\]\s*(?:#.*)?$/.test(line))
+            tableRows.push(row);
+        // A multiline config value can quote an entire pane/config. Treat a
+        // project-looking row inside it as data, never as effective TOML.
+        for (const delimiter of ['"""', "'''"]) {
+            if (multiline && multiline !== delimiter)
+                continue;
+            let count = 0;
+            let pos = 0;
+            while ((pos = line.indexOf(delimiter, pos)) !== -1) {
+                if (delimiter === "'''" || pos === 0 || line[pos - 1] !== "\\")
+                    count++;
+                pos += delimiter.length;
+            }
+            if (count % 2 === 1)
+                multiline = multiline === delimiter ? null : delimiter;
+        }
+    }
+    const headers = tableRows.filter(row => {
+        // TOML permits whitespace around dots and quoted/literal table keys.
+        // Parse each real header instead of comparing its raw spelling.
+        try {
+            return projectTrustTable(parseToml(`${lines[row]}\n__agend_trust_probe__ = true\n`), root)?.__agend_trust_probe__ === true;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (headers.length > 1)
+        throw new Error("Duplicate Codex trust project table");
+    if (headers.length === 0 && projectTrustTable(parsed, root)) {
+        throw new Error("Cannot safely edit Codex trust project table");
+    }
+    let updated;
+    if (headers.length === 0) {
+        updated = `${content.trimEnd()}\n\n${section}\ntrust_level = "trusted"\n`;
+    }
+    else {
+        const header = headers[0];
+        const end = tableRows.find(row => row > header) ?? lines.length;
+        const trustRows = [];
+        for (let row = header + 1; row < end; row++) {
+            if (/^\s*(?:trust_level|"trust_level"|'trust_level')\s*=/.test(lines[row]))
+                trustRows.push(row);
+        }
+        if (trustRows.length > 1)
+            throw new Error("Duplicate Codex trust_level key");
+        if (trustRows.length === 1)
+            lines[trustRows[0]] = 'trust_level = "trusted"';
+        else
+            lines.splice(header + 1, 0, 'trust_level = "trusted"');
+        updated = lines.join("\n");
+    }
+    // Candidate validation is before atomic write. A spelling the narrow text
+    // editor cannot handle must fail closed, never leave Codex with invalid TOML.
+    if (effectiveProjectTrust(updated, root) !== "trusted")
+        throw new Error("Codex project trust is not effective");
+    return updated;
+}
+/** Only the bottom, live Codex 0.156 folder-access screen can own stdin. */
+function codexTrustPromptState(pane) {
+    const noPrompt = { active: false, folder: null, root: null, rootNote: "absent", safeChoice: false };
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return noPrompt;
+    let access = -1;
+    for (let index = rows.length - 1; index >= 0; index--) {
+        if (/^\s{0,2}Folder access\s*$/.test(rows[index])) {
+            access = index;
+            break;
+        }
+    }
+    if (access < 0 || last - access > 60)
+        return noPrompt;
+    const question = rows.findIndex((row, index) => index > access && /^\s{0,2}Trust this folder\?/.test(row));
+    if (question < 0 || question >= last)
+        return noPrompt;
+    // A ready input row or transcript continuation below the question means the
+    // trust dialog is history, not the current interactive region.
+    if (rows.slice(question + 1, last + 1).some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row)))
+        return noPrompt;
+    const noteRows = rows.slice(access + 1, question);
+    // The folder must be the first content row after the title. Do not let a
+    // later repository-root path stand in for a missing folder path.
+    const folderRow = noteRows.find(row => row.trim() !== "");
+    const folder = folderRow && /^\s{0,2}\//.test(folderRow) ? folderRow.trim() : null;
+    const hasRootNote = noteRows.some(row => /\bNote:|\brepository root\b|Trusting will apply/i.test(row));
+    const rootLabel = noteRows.findIndex(row => /\brepository root:/i.test(row));
+    const inlineRoot = rootLabel < 0 ? "" : noteRows[rootLabel].split(/\brepository root:/i)[1]?.trim() ?? "";
+    const followingRoot = rootLabel < 0 ? "" : noteRows.slice(rootLabel + 1).find(row => row.trim() !== "")?.trim() ?? "";
+    const candidateRoot = inlineRoot || followingRoot;
+    const root = candidateRoot.startsWith("/") ? candidateRoot : null;
+    const rootNote = !hasRootNote ? "absent" : root ? "parsed" : "invalid";
+    const choices = rows.slice(question + 1, last + 1).flatMap((row, offset) => {
+        const match = row.match(/^\s*([›❯>]?)\s*(\d+)\.\s+(.+?)\s*$/);
+        return match ? [{ row: question + 1 + offset, cursor: match[1], number: match[2], text: match[3] }] : [];
+    });
+    // Unknown option orders, a moved cursor, a third option, or any different
+    // footer are held for a human. Never guess where Enter would land.
+    const safeChoice = choices.length === 2
+        && choices[0].row + 1 === choices[1].row
+        && rows.slice(choices[1].row + 1, last).every(row => row.trim() === "")
+        && choices[0].cursor === "›" && choices[0].number === "1" && choices[0].text === "Trust and continue"
+        && choices[1].cursor === "" && choices[1].number === "2" && choices[1].text === "Quit"
+        && /^\s*enter continue\s*·\s*esc quit\s*$/i.test(rows[last]);
+    return { active: true, folder, root, rootNote, safeChoice };
+}
+/** Unknown/older trust layouts are still input-blocking, never auto-answered. */
+function codexTrustVariantActive(pane) {
+    if (codexTrustPromptState(pane).active)
+        return true;
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return false;
+    const start = Math.max(0, last - 22);
+    const folderAccess = rows.findIndex((row, index) => index >= start && /^\s{0,2}Folder access\s*$/.test(row));
+    if (folderAccess >= 0) {
+        const tail = rows.slice(folderAccess + 1, last + 1);
+        if (!tail.some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row))
+            && tail.some(row => /^\s*[›❯>]?\s*\d+\.\s+(?:Open restricted|Trust and continue|Quit)\s*$/i.test(row))
+            && /(?:enter|esc|quit|cancel)/i.test(rows[last]))
+            return true;
+    }
+    const question = rows.findIndex((row, index) => index >= start
+        && /^\s*(?:Trust this folder\?|Do you trust the files in this folder\?)/i.test(row));
+    if (question < 0 || question >= last)
+        return false;
+    const tail = rows.slice(question + 1, last + 1);
+    // A normal input row after a quoted menu makes it history, not live UI.
+    if (tail.some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row)))
+        return false;
+    return tail.some(row => /^\s*[›❯>]?\s*\d+\.\s+\S/.test(row))
+        && (/(?:enter|esc|quit|cancel)/i.test(rows[last])
+            || /^\s*[›❯>]?\s*\d+\.\s+\S/.test(rows[last]));
+}
+/** Rate-switch prompts are economic choices, not a fixed keyboard position. */
+function codexRateSwitchVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    let title = -1;
+    for (let i = last; i >= Math.max(0, last - 18); i--) {
+        if (/^\s*(?:Approaching rate limits|Switch to .{1,120} for lower credit usage\?)\s*$/i.test(rows[i])) {
+            title = i;
+            break;
+        }
+    }
+    if (title < 0)
+        return false;
+    const tail = rows.slice(title + 1, last + 1);
+    // A copied picker in transcript history is not the currently active menu.
+    if (tail.some(row => /^[›>]\s+Ask Codex to do anything\b/.test(row) || isCodexContextFooter(row)))
+        return false;
+    return tail.some(row => /^\s*[›❯>]?\s*\d+\.\s*(?:Switch to|Keep current model)\b/i.test(row));
+}
+/** Unknown pickers own stdin too; never type or press Enter into one. */
+function codexUnknownSelectionVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !(/\benter\b.*\besc\b/i.test(rows[last])
+        || /^\s*Press enter to continue\s*$/i.test(rows[last])))
+        return false;
+    let selected = -1;
+    for (let i = last - 1; i >= Math.max(0, last - 24); i--) {
+        if (/^\s*[›❯>]\s+\S/.test(rows[i])) {
+            selected = i;
+            break;
+        }
+    }
+    if (selected < 0)
+        return false;
+    if (/^\s*[›❯>]\s+Ask Codex to do anything\b/.test(rows[selected]))
+        return false;
+    return !rows.slice(selected + 1, last + 1).some(row => /^[›>]\s+Ask Codex to do anything\b/.test(row) || isCodexContextFooter(row));
+}
+/** Only the complete, current Codex installer picker may receive Escape. */
+function codexUpdatePickerVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !/^\s*Press enter to continue\s*$/.test(rows[last]))
+        return false;
+    for (let first = last - 3; first >= Math.max(0, last - 9); first--) {
+        if (!/^\s*[›❯>]\s+1\.\s+Update now\b/.test(rows[first]))
+            continue;
+        // At 80 columns Codex 0.153 wraps the installer command to the next row.
+        // Permit a bounded continuation, but never another option or cursor.
+        const second = rows.findIndex((row, index) => index > first && index <= first + 3
+            && /^\s*2\.\s+Skip\s*$/.test(row));
+        if (second < 0 || !rows.slice(first + 1, second).every(row => /^\s+\S/.test(row) && !/^\s*[›❯>]?\s*\d+\./.test(row))
+            || !/^\s*3\.\s+Skip until next version\s*$/.test(rows[second + 1] ?? "")
+            || !rows.slice(second + 2, last).every(row => row.trim() === ""))
+            continue;
+        const intro = rows.slice(Math.max(0, first - 14), first);
+        if (intro.some(row => /Update available!/.test(row))
+            && intro.some(row => /^\s*Release notes: https:\/\/github\.com\/openai\/codex\/releases\/latest\s*$/.test(row)))
+            return true;
+    }
+    return false;
+}
 function renderMcpServer(name, entry, instanceName) {
     const mcpName = `${name}-${instanceName}`.replace(/[^A-Za-z0-9_-]/g, "_");
     const env = { ...entry.env, AGEND_INSTANCE_NAME: instanceName };
@@ -117,6 +385,8 @@ export class CodexBackend {
     isolatedCodexHome;
     /** Which subscription this instance runs on, or null for the shared login. */
     credentialProfile = null;
+    /** Set only after preTrust wrote and read back this instance's private config. */
+    authorizedTrust = null;
     constructor(instanceDir) {
         this.instanceDir = instanceDir;
         this.binaryPath = resolveBinary("codex");
@@ -145,6 +415,29 @@ export class CodexBackend {
     getBottomReadyPattern() {
         return /^\s*›\s?/;
     }
+    /** Observed on real Codex 0.156.0: the live input row precedes its footer. */
+    isDeliveryInputReadyPane(pane) {
+        const rows = pane.replace(/\r/g, "").split("\n");
+        while (rows.length && !rows[rows.length - 1].trim())
+            rows.pop();
+        const footer = rows.pop() ?? "";
+        // Codex preserves other configured status-line items after the context
+        // meter (observed on 0.156.0: "Context 100% left · GPT-6-Astra"). They
+        // are footer chrome, not evidence that the input row is unavailable.
+        if (!isCodexContextFooter(footer))
+            return false;
+        // Pasted text may wrap over several continuation rows before the footer.
+        // Search only its immediate tail, not a historical transcript prompt.
+        for (let i = rows.length - 1; i >= Math.max(0, rows.length - 8); i--) {
+            if (/^[>›]\s+\d+\./.test(rows[i]))
+                return false;
+            if (/^[>›]\s+\S/.test(rows[i]))
+                return true;
+            if (/^[•■⚠]/.test(rows[i]))
+                return false;
+        }
+        return false;
+    }
     /** Live status chrome that must veto the broad prompt/context ready match. */
     getBusyPattern() {
         return /(?:^|\n)•\s+Working\b[^\n]*\besc to interrupt\b/i;
@@ -178,7 +471,7 @@ export class CodexBackend {
             return false;
         let footer = -1;
         for (let i = prompt + 1; i < Math.min(rows.length, prompt + 7); i++) {
-            if (/^\s*Context\s+\d+%\s+(?:left|used)\s*$/i.test(rows[i])) {
+            if (isCodexContextFooter(rows[i])) {
                 footer = i;
                 break;
             }
@@ -232,13 +525,17 @@ export class CodexBackend {
         // AgEnD instances are unattended processes: an interactive self-update
         // picker blocks delivery and must never be enabled by a copied global or
         // managed config layer. Keep this last so the CLI override is authoritative.
-        cmd += " -c check_for_update_on_startup=false";
+        // Both observed Codex 0.155.0 and 0.156.1 support this launch flag. Pin
+        // the initial layout so a user/global fullscreen preference cannot make a
+        // header-only pane look ready. A later unknown layout still fails closed.
+        cmd += " -c check_for_update_on_startup=false --no-alt-screen";
         // CODEX_HOME is the only Codex-supported way to isolate the complete base
         // config. A profile only layers over the shared config and would therefore
         // still load every globally registered AgEnD MCP server.
         return `CODEX_HOME=${shellQuote(this.isolatedCodexHome)} ${cmd}`;
     }
     writeConfig(config) {
+        this.authorizedTrust = null;
         // Set before the home is prepared: which login this instance gets is a
         // property of the home, and the home is built here.
         this.credentialProfile = this.readProfile(config);
@@ -401,16 +698,23 @@ export class CodexBackend {
         return home;
     }
     preTrust(workDir) {
+        this.authorizedTrust = null;
+        const paths = codexTrustPaths(workDir);
         const configPath = join(this.isolatedCodexHome, "config.toml");
         let content = "";
         try {
             content = readFileSync(configPath, "utf-8");
         }
         catch { }
-        const section = `[projects."${workDir}"]`;
-        if (content.includes(section))
-            return;
-        atomicWritePrivate(configPath, `${content.trimEnd()}\n\n${section}\ntrust_level = "trusted"\n`);
+        const updated = setProjectTrusted(content, paths.root);
+        if (updated !== content)
+            atomicWritePrivate(configPath, updated);
+        // Do not authorize an automatic Enter merely because the write returned:
+        // a stale/untrusted section in the effective isolated config must fail shut.
+        const onDisk = readFileSync(configPath, "utf-8");
+        if (effectiveProjectTrust(onDisk, paths.root) !== "trusted")
+            throw new Error("Codex project trust did not persist");
+        this.authorizedTrust = paths;
     }
     /**
      * Preserve Codex login/session/cache behavior while isolating config.toml.
@@ -654,11 +958,20 @@ export class CodexBackend {
         }
     }
     getReadyPattern() {
-        // Startup/header: "OpenAI Codex". Prompt glyph is ">" on older Codex and
-        // "›" (U+203A) on newer releases. Exclude numbered menu selections so a
-        // trust/confirmation dialog is not mistaken for an idle input prompt.
-        // Statusline variants report either "% left" or "% used" while idle.
-        return /% left|% used|OpenAI Codex|^[>›](?!\s*\d+\.)/m;
+        // Header and context text persist in inline scrollback and even while the
+        // CLI is loading or a modal owns stdin. Require the live prompt followed
+        // by the Context footer at the *end* of the capture. getBusyPattern still
+        // vetoes a working turn whose empty composer remains visible. Unknown TUI
+        // layouts cannot claim readiness by merely rendering the old header.
+        // U+22C6 is Codex's observed cosmetic starfield; it can be drawn in the
+        // prompt, between prompt/footer, and below the footer. A drafted composer
+        // is also idle once this same bottom footer proves it owns the screen.
+        return /(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}[ \t⋆]+(?:[0-9a-f-]{36}[ \t]+·[ \t]+)?Context[ \t]+(?:\d+%[ \t]+(?:left|used)|\d+…|…)[^\r\n]*(?:\r?\n[ \t⋆]*)*$/i;
+    }
+    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
+    isProxyReplyChromeLine(line) {
+        return /^\s*[›>]\s+Ask Codex to do anything\s*$/.test(line)
+            || isCodexContextFooter(line);
     }
     getErrorPatterns() {
         return [
@@ -756,12 +1069,40 @@ export class CodexBackend {
         ];
     }
     getStartupDialogs() {
+        const trustHold = this.trustHoldDialog();
         return [
-            { pattern: /Do you trust the files in this folder/i, keys: ["Enter"], description: "Codex trust dialog" },
-            { pattern: /Yes, continue/i, keys: ["Enter"], description: "Codex 'Yes, continue' confirmation" },
+            {
+                pattern: /^\s*Trust this folder\?/m,
+                keys: ["Enter"],
+                description: "Codex authorized folder trust dialog",
+                blocksDelivery: true,
+                inputBlocked: true,
+                autoResolutionKey: "codex-authorized-folder-trust",
+                isActive: pane => {
+                    const state = codexTrustPromptState(pane);
+                    const authorized = this.authorizedTrust;
+                    return state.active && state.safeChoice && authorized !== null
+                        && state.folder === authorized.cwd
+                        && (state.rootNote === "absent" ? authorized.root === authorized.cwd
+                            : state.rootNote === "parsed" && state.root === authorized.root);
+                },
+            },
+            trustHold,
             this.updatePickerDialog(),
+            this.unknownSelectionHoldDialog(),
         ];
     }
+    trustHoldDialog() {
+        return {
+            pattern: /^\s*(?:Folder access|Trust this folder\?|Do you trust the files in this folder\?)/im,
+            keys: [],
+            description: "Codex folder trust needs human confirmation",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexTrustVariantActive,
+        };
+    }
     updatePickerDialog() {
         return {
             // Defense in depth for config written by older AgEnD versions or a Codex
@@ -777,26 +1118,41 @@ export class CodexBackend {
             // seconds and a delivery can arrive first (hit live on codex-cli 0.153.4,
             // which parks on this picker for as long as nobody answers it).
             blocksDelivery: true,
-            // Bottom-anchored, so a transcript that quotes the picker (an agent
-            // pasting a pane capture, this very change being reviewed) is not
-            // mistaken for a live one: the real picker owns the bottom of the pane
-            // and has no input row under it.
-            isActive: (pane) => {
-                const last = lastNonBlankRow(pane);
-                return last != null && /^\s*Press enter to continue\s*$/.test(last);
-            },
+            // Daemon.dialogMatches uses isActive INSTEAD OF pattern when present.
+            // Check the complete current picker here; a different Enter-only menu
+            // must never receive this automatic Escape key.
+            isActive: codexUpdatePickerVisible,
+        };
+    }
+    unknownSelectionHoldDialog() {
+        return {
+            pattern: /^\s*[›❯>]\s+\S/m,
+            keys: [],
+            description: "Codex interactive selection needs human input",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexUnknownSelectionVisible,
         };
     }
     getRuntimeDialogs() {
         return [
+            this.trustHoldDialog(),
             {
-                // Codex shows a model switch dialog when approaching rate limits.
-                // Auto-select "Keep current model (never show again)" — option 3.
-                pattern: /Approaching rate limits[\s\S]*Switch to.*for lower credit/m,
-                keys: ["Down", "Down", "Enter"],
-                description: "Codex rate limit model switch dialog",
+                // Codex 0.156 may change the wording/order of this credit-cost choice.
+                // Never navigate it by position: a moved option could switch to a
+                // more expensive model. A live picker holds delivery and notifies a
+                // human; old transcript mentions are excluded by the tail matcher.
+                pattern: /(?:Approaching rate limits|Switch to [^\r\n]{1,120} for lower credit usage\?)/i,
+                keys: [],
+                description: "Codex rate limit model switch dialog needs human choice",
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                isActive: codexRateSwitchVisible,
             },
             this.updatePickerDialog(),
+            this.unknownSelectionHoldDialog(),
         ];
     }
     getInputUnavailableTransients() {