@songsid/agend 2.1.6-beta.9 → 2.1.6

package/dist/backend/codex.js

@@ -1,17 +1,33 @@
-import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
-import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
-import { lastNonBlankRow } from "../pane-input-residue.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { probeCliVersion, resolveBinary, shellQuote, validateModel, validateProvider, warnIfModelMismatch } from "./types.js";
 import { credentialHomeSpec, credentialProfileHome, prepareCredentialProfileHome, resolveCredentialProfile, } from "./credential-profile.js";
 import { getAgendHome } from "../paths.js";
 import { appendWithMarker, removeMarker } from "./marker-utils.js";
 import { t } from "../locale.js";
+import { parse as parseToml } from "smol-toml";
 const CODEX_PROJECT_DOC_MAX_BYTES = 32_768;
 const CODEX_MODELS_CACHE_MAX_BYTES = 5 * 1024 * 1024;
 const SAFE_MODEL_ID_RE = /^[A-Za-z0-9._:/-]+$/;
+/**
+ * Whether a pane row is Codex's context footer. Kept when #913 was reverted:
+ * #913 introduced it, but #914's pane/ready detection is built on it, and it
+ * is pane parsing, not session handling.
+ */
+function isCodexContextFooter(row) {
+    const context = String.raw `Context\s+\d+%\s+(?:left|used)`;
+    const legacy = new RegExp(String.raw `^\s*${context}(?:\s+⚠\s+\d+\s+warnings?\b[^\r\n]*)?(?:\s+·\s+\S[^\r\n]*)?\s*$`, "i");
+    if (legacy.test(row))
+        return true;
+    // A narrow Codex 0.156 pane may truncate the context item after the
+    // authoritative first `session-id` item. Keep structural readiness while
+    // /ctx honestly reports context unavailable from a truncated percentage.
+    return /^\s*[0-9a-f-]{36}\s+·\s+Context\b[^\r\n]*$/i.test(row);
+}
 const AGEND_MCP_CLEANUP_LOCK = ".agend-mcp-cleanup.lock";
 const AGEND_MCP_CLEANUP_LOCK_STALE_MS = 30_000;
 const SQLITE_SIDECAR_RE = /-(?:wal|shm|journal)$/;
@@ -62,6 +78,322 @@ function tomlString(value) {
     // JSON strings are valid TOML basic strings for the values AgEnD emits.
     return JSON.stringify(value);
 }
+/** Codex 0.156 trusts a linked worktree's common repository root, not its CWD. */
+function codexTrustPaths(workingDirectory) {
+    const cwd = realpathSync(resolve(workingDirectory));
+    try {
+        const commonDir = execFileSync("git", ["-C", cwd, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
+            encoding: "utf-8", timeout: 2_000, stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        const canonicalCommonDir = realpathSync(commonDir);
+        if (basename(canonicalCommonDir) === ".git")
+            return { cwd, root: dirname(canonicalCommonDir) };
+        // Submodules keep their common dir in another repository's .git/modules.
+        const topLevel = execFileSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+            encoding: "utf-8", timeout: 2_000, stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return { cwd, root: realpathSync(topLevel) };
+    }
+    catch {
+        // A non-Git folder is its own Codex trust root.
+        return { cwd, root: cwd };
+    }
+}
+function tomlTable(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)
+        ? value : null;
+}
+function projectTrustTable(config, root) {
+    const projects = tomlTable(tomlTable(config)?.projects);
+    return projects ? tomlTable(projects[root]) : null;
+}
+function effectiveProjectTrust(content, root) {
+    return projectTrustTable(parseToml(content), root)?.trust_level;
+}
+/** Change only the private project's trust value; parse before and after editing. */
+function setProjectTrusted(content, root) {
+    const section = `[projects.${tomlString(root)}]`;
+    const parsed = parseToml(content);
+    if (projectTrustTable(parsed, root)?.trust_level === "trusted")
+        return content;
+    const lines = content.split("\n");
+    const tableRows = [];
+    let multiline = null;
+    for (let row = 0; row < lines.length; row++) {
+        const line = lines[row];
+        if (!multiline && /^\s*\[.*\]\s*(?:#.*)?$/.test(line))
+            tableRows.push(row);
+        // A multiline config value can quote an entire pane/config. Treat a
+        // project-looking row inside it as data, never as effective TOML.
+        for (const delimiter of ['"""', "'''"]) {
+            if (multiline && multiline !== delimiter)
+                continue;
+            let count = 0;
+            let pos = 0;
+            while ((pos = line.indexOf(delimiter, pos)) !== -1) {
+                if (delimiter === "'''" || pos === 0 || line[pos - 1] !== "\\")
+                    count++;
+                pos += delimiter.length;
+            }
+            if (count % 2 === 1)
+                multiline = multiline === delimiter ? null : delimiter;
+        }
+    }
+    const headers = tableRows.filter(row => {
+        // TOML permits whitespace around dots and quoted/literal table keys.
+        // Parse each real header instead of comparing its raw spelling.
+        try {
+            return projectTrustTable(parseToml(`${lines[row]}\n__agend_trust_probe__ = true\n`), root)?.__agend_trust_probe__ === true;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (headers.length > 1)
+        throw new Error("Duplicate Codex trust project table");
+    if (headers.length === 0 && projectTrustTable(parsed, root)) {
+        throw new Error("Cannot safely edit Codex trust project table");
+    }
+    let updated;
+    if (headers.length === 0) {
+        updated = `${content.trimEnd()}\n\n${section}\ntrust_level = "trusted"\n`;
+    }
+    else {
+        const header = headers[0];
+        const end = tableRows.find(row => row > header) ?? lines.length;
+        const trustRows = [];
+        for (let row = header + 1; row < end; row++) {
+            if (/^\s*(?:trust_level|"trust_level"|'trust_level')\s*=/.test(lines[row]))
+                trustRows.push(row);
+        }
+        if (trustRows.length > 1)
+            throw new Error("Duplicate Codex trust_level key");
+        if (trustRows.length === 1)
+            lines[trustRows[0]] = 'trust_level = "trusted"';
+        else
+            lines.splice(header + 1, 0, 'trust_level = "trusted"');
+        updated = lines.join("\n");
+    }
+    // Candidate validation is before atomic write. A spelling the narrow text
+    // editor cannot handle must fail closed, never leave Codex with invalid TOML.
+    if (effectiveProjectTrust(updated, root) !== "trusted")
+        throw new Error("Codex project trust is not effective");
+    return updated;
+}
+/** Only the bottom, live Codex 0.156 folder-access screen can own stdin. */
+function codexTrustPromptState(pane) {
+    const noPrompt = { active: false, folder: null, root: null, rootNote: "absent", safeChoice: false };
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return noPrompt;
+    let access = -1;
+    for (let index = rows.length - 1; index >= 0; index--) {
+        if (/^\s{0,2}Folder access\s*$/.test(rows[index])) {
+            access = index;
+            break;
+        }
+    }
+    if (access < 0 || last - access > 60)
+        return noPrompt;
+    const question = rows.findIndex((row, index) => index > access && /^\s{0,2}Trust this folder\?/.test(row));
+    if (question < 0 || question >= last)
+        return noPrompt;
+    // A ready input row or transcript continuation below the question means the
+    // trust dialog is history, not the current interactive region.
+    if (rows.slice(question + 1, last + 1).some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row)))
+        return noPrompt;
+    const noteRows = rows.slice(access + 1, question);
+    // The folder must be the first content row after the title. Do not let a
+    // later repository-root path stand in for a missing folder path.
+    const folderRow = noteRows.find(row => row.trim() !== "");
+    const folder = folderRow && /^\s{0,2}\//.test(folderRow) ? folderRow.trim() : null;
+    const hasRootNote = noteRows.some(row => /\bNote:|\brepository root\b|Trusting will apply/i.test(row));
+    const rootLabel = noteRows.findIndex(row => /\brepository root:/i.test(row));
+    const inlineRoot = rootLabel < 0 ? "" : noteRows[rootLabel].split(/\brepository root:/i)[1]?.trim() ?? "";
+    const followingRoot = rootLabel < 0 ? "" : noteRows.slice(rootLabel + 1).find(row => row.trim() !== "")?.trim() ?? "";
+    const candidateRoot = inlineRoot || followingRoot;
+    const root = candidateRoot.startsWith("/") ? candidateRoot : null;
+    const rootNote = !hasRootNote ? "absent" : root ? "parsed" : "invalid";
+    const choices = rows.slice(question + 1, last + 1).flatMap((row, offset) => {
+        const match = row.match(/^\s*([›❯>]?)\s*(\d+)\.\s+(.+?)\s*$/);
+        return match ? [{ row: question + 1 + offset, cursor: match[1], number: match[2], text: match[3] }] : [];
+    });
+    // Unknown option orders, a moved cursor, a third option, or any different
+    // footer are held for a human. Never guess where Enter would land.
+    const safeChoice = choices.length === 2
+        && choices[0].row + 1 === choices[1].row
+        && rows.slice(choices[1].row + 1, last).every(row => row.trim() === "")
+        && choices[0].cursor === "›" && choices[0].number === "1" && choices[0].text === "Trust and continue"
+        && choices[1].cursor === "" && choices[1].number === "2" && choices[1].text === "Quit"
+        && /^\s*enter continue\s*·\s*esc quit\s*$/i.test(rows[last]);
+    return { active: true, folder, root, rootNote, safeChoice };
+}
+/** Unknown/older trust layouts are still input-blocking, never auto-answered. */
+function codexTrustVariantActive(pane) {
+    if (codexTrustPromptState(pane).active)
+        return true;
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return false;
+    const start = Math.max(0, last - 22);
+    const folderAccess = rows.findIndex((row, index) => index >= start && /^\s{0,2}Folder access\s*$/.test(row));
+    if (folderAccess >= 0) {
+        const tail = rows.slice(folderAccess + 1, last + 1);
+        if (!tail.some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row))
+            && tail.some(row => /^\s*[›❯>]?\s*\d+\.\s+(?:Open restricted|Trust and continue|Quit)\s*$/i.test(row))
+            && /(?:enter|esc|quit|cancel)/i.test(rows[last]))
+            return true;
+    }
+    const question = rows.findIndex((row, index) => index >= start
+        && /^\s*(?:Trust this folder\?|Do you trust the files in this folder\?)/i.test(row));
+    if (question < 0 || question >= last)
+        return false;
+    const tail = rows.slice(question + 1, last + 1);
+    // A normal input row after a quoted menu makes it history, not live UI.
+    if (tail.some(row => /^\s*[›❯>]\s*(?!\d+\.)\S/.test(row)))
+        return false;
+    return tail.some(row => /^\s*[›❯>]?\s*\d+\.\s+\S/.test(row))
+        && (/(?:enter|esc|quit|cancel)/i.test(rows[last])
+            || /^\s*[›❯>]?\s*\d+\.\s+\S/.test(rows[last]));
+}
+/**
+ * Structural helpers for the codex usage-limit selection menu (#945).
+ *
+ * The real codex 0.156.1 dialog (captured live) states that codex has
+ * ALREADY switched to Luna Reserve and offers:
+ *
+ *   • Automatically switched to Luna Reserve xhigh due to usage limits.
+ *     You're now using Luna, a faster model for simpler tasks.
+ *     Use your reset to continue using the most advanced models, or
+ *     wait for usage to reset after 08:00 on 27 Sep.
+ *   › 1. Reset usage
+ *     2. Add Credits
+ *     3. Continue with Luna Reserve
+ *     Press enter to confirm or esc to continue working
+ *
+ * The SAFE key is **Escape** ("esc to continue working"), which dismisses
+ * the dialog and keeps the already-active Luna Reserve session. Escape is
+ * sent via sendSpecialKey, NEVER via pasteText (which would add an implicit
+ * Enter that could confirm option 1 = Reset usage).
+ *
+ * Design:  keys: ["Escape"]  + verifyAfterKeys: true (menu must vanish).
+ * No confirmBeforeEnter / keysAfterConfirm needed: Escape cannot select any
+ * numbered option — it is handled by sendSpecialKey, never by paste+Enter.
+ */
+/** MUST match the exact hint row text to prevent false positives. */
+const USAGE_LIMIT_ESC_HINT = /^\s*Press enter to confirm or esc to continue working\s*$/i;
+/** Option-set that appears in this specific menu (exact wording). */
+const USAGE_LIMIT_OPT1 = /^\s*[›❯>]?\s*1\.\s+Reset usage\b/i;
+const USAGE_LIMIT_OPT3 = /^\s*[›❯>]?\s*3\.\s+Continue with Luna Reserve\b/i;
+/**
+ * True when the usage-limit selection menu is the **current** interactive
+ * region of the pane (not a historical transcript copy).
+ *
+ * Structural requirements (all must hold):
+ *   - Hint row "Press enter to confirm or esc to continue working"
+ *   - Options 1 and 3 present in the bottom region (with exact text)
+ *   - NOT followed by the Codex idle compositor (Context footer / Ask Codex row)
+ */
+function codexUsageLimitMenuVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0)
+        return false;
+    // The hint row "Press enter to confirm or esc to continue working" must be last.
+    if (!USAGE_LIMIT_ESC_HINT.test(rows[last]))
+        return false;
+    // The three options must appear in the bottom region (within 10 rows of hint).
+    const region = rows.slice(Math.max(0, last - 10), last);
+    const hasOpt1 = region.some(r => USAGE_LIMIT_OPT1.test(r));
+    const hasOpt3 = region.some(r => USAGE_LIMIT_OPT3.test(r));
+    if (!hasOpt1 || !hasOpt3)
+        return false;
+    // Guard: if the Codex compositor (idle prompt + Context footer) is at the
+    // bottom, this is scrollback, not the live menu.
+    const tail = region.join("\n");
+    if (/[›>]\s*Ask Codex to do anything\b/i.test(tail))
+        return false;
+    if (isCodexContextFooter(rows[last]))
+        return false;
+    return true;
+}
+/** Rate-switch prompts are economic choices, not a fixed keyboard position. */
+function codexRateSwitchVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    let title = -1;
+    for (let i = last; i >= Math.max(0, last - 18); i--) {
+        if (/^\s*(?:Approaching rate limits|Switch to .{1,120} for lower credit usage\?)\s*$/i.test(rows[i])) {
+            title = i;
+            break;
+        }
+    }
+    if (title < 0)
+        return false;
+    const tail = rows.slice(title + 1, last + 1);
+    // A copied picker in transcript history is not the currently active menu.
+    if (tail.some(row => /^[›>]\s+Ask Codex to do anything\b/.test(row) || isCodexContextFooter(row)))
+        return false;
+    return tail.some(row => /^\s*[›❯>]?\s*\d+\.\s*(?:Switch to|Keep current model)\b/i.test(row));
+}
+/** Unknown pickers own stdin too; never type or press Enter into one. */
+function codexUnknownSelectionVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !(/\benter\b.*\besc\b/i.test(rows[last])
+        || /^\s*Press enter to continue\s*$/i.test(rows[last])))
+        return false;
+    let selected = -1;
+    for (let i = last - 1; i >= Math.max(0, last - 24); i--) {
+        if (/^\s*[›❯>]\s+\S/.test(rows[i])) {
+            selected = i;
+            break;
+        }
+    }
+    if (selected < 0)
+        return false;
+    if (/^\s*[›❯>]\s+Ask Codex to do anything\b/.test(rows[selected]))
+        return false;
+    return !rows.slice(selected + 1, last + 1).some(row => /^[›>]\s+Ask Codex to do anything\b/.test(row) || isCodexContextFooter(row));
+}
+/** Only the complete, current Codex installer picker may receive Escape. */
+function codexUpdatePickerVisible(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let last = rows.length - 1;
+    while (last >= 0 && rows[last].trim() === "")
+        last--;
+    if (last < 0 || !/^\s*Press enter to continue\s*$/.test(rows[last]))
+        return false;
+    for (let first = last - 3; first >= Math.max(0, last - 9); first--) {
+        if (!/^\s*[›❯>]\s+1\.\s+Update now\b/.test(rows[first]))
+            continue;
+        // At 80 columns Codex 0.153 wraps the installer command to the next row.
+        // Permit a bounded continuation, but never another option or cursor.
+        const second = rows.findIndex((row, index) => index > first && index <= first + 3
+            && /^\s*2\.\s+Skip\s*$/.test(row));
+        if (second < 0 || !rows.slice(first + 1, second).every(row => /^\s+\S/.test(row) && !/^\s*[›❯>]?\s*\d+\./.test(row))
+            || !/^\s*3\.\s+Skip until next version\s*$/.test(rows[second + 1] ?? "")
+            || !rows.slice(second + 2, last).every(row => row.trim() === ""))
+            continue;
+        const intro = rows.slice(Math.max(0, first - 14), first);
+        if (intro.some(row => /Update available!/.test(row))
+            && intro.some(row => /^\s*Release notes: https:\/\/github\.com\/openai\/codex\/releases\/latest\s*$/.test(row)))
+            return true;
+    }
+    return false;
+}
 function renderMcpServer(name, entry, instanceName) {
     const mcpName = `${name}-${instanceName}`.replace(/[^A-Za-z0-9_-]/g, "_");
     const env = { ...entry.env, AGEND_INSTANCE_NAME: instanceName };
@@ -117,11 +449,109 @@ export class CodexBackend {
     isolatedCodexHome;
     /** Which subscription this instance runs on, or null for the shared login. */
     credentialProfile = null;
+    /** Set only after preTrust wrote and read back this instance's private config. */
+    authorizedTrust = null;
     constructor(instanceDir) {
         this.instanceDir = instanceDir;
         this.binaryPath = resolveBinary("codex");
         this.sharedCodexHome = resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
-        this.isolatedCodexHome = resolve(instanceDir, "codex-home");
+        this.isolatedCodexHome = CodexBackend.resolveShortHome(instanceDir);
+    }
+    /**
+     * Compute and (on first call for an existing instance) migrate to a SHORT
+     * persistent CODEX_HOME under `~/.agend/cx/<8-char-hash>/`.
+     *
+     * Background (#953): codex 0.157.0 added `app-server-control.sock` under
+     * CODEX_HOME. For instances with long `-t<topic_id>` suffixes the full path
+     * exceeds the Unix socket SUN_LEN (~107 chars). codex canonicalises the path
+     * before binding the socket, so a symlink workaround does not help — the real
+     * path must be short.
+     *
+     * Migration steps (each is idempotent; half-completed states self-heal):
+     *  1. If shortHome does not exist AND legacyHome is a real directory (not a
+     *     symlink) → atomic renameSync. On EXDEV or any other error, fall back
+     *     safely: keep using the legacy long path (instance can still start, just
+     *     without the short-path fix).
+     *  2. If shortHome exists but legacyHome is missing → recreate the backward-
+     *     compat symlink (self-heal for rename-succeeded-but-symlink-failed crash).
+     *  3. If both shortHome and legacyHome (as symlink) exist → nothing to do.
+     *  4. New instance (no legacyHome) → create shortHome directly.
+     *
+     * Fail-safe guarantee: migration failure must never make the instance worse.
+     * The caller always receives a valid path it can use as CODEX_HOME.
+     */
+    /** Exposed for fleet-manager to delete the short home on instance removal. */
+    static shortHomeFor(instanceDir) {
+        // Resolve to canonical form before hashing so trailing slashes or
+        // non-canonical paths don't produce a different (orphaned) home.
+        const canonical = resolve(instanceDir);
+        const hash = createHash("sha256").update(canonical).digest("hex").slice(0, 8);
+        return join(getAgendHome(), "cx", hash);
+    }
+    static resolveShortHome(instanceDir) {
+        const shortHome = CodexBackend.shortHomeFor(instanceDir);
+        const shortBase = join(getAgendHome(), "cx");
+        const canonical = resolve(instanceDir);
+        const legacyHome = resolve(instanceDir, "codex-home");
+        // Only migrate/create when the instance directory itself exists.
+        // Constructing CodexBackend for a non-existent dir (cli-env probes, test
+        // backends that never ran) must not litter ~/.agend/cx/ with orphan dirs.
+        if (!existsSync(canonical))
+            return shortHome;
+        const legacyExists = existsSync(legacyHome);
+        const legacyIsRealDir = legacyExists && !lstatSync(legacyHome).isSymbolicLink();
+        const shortExists = existsSync(shortHome);
+        if (!shortExists) {
+            mkdirSync(shortBase, { recursive: true });
+            if (legacyIsRealDir) {
+                // Attempt atomic rename. Requires same device; fails with EXDEV otherwise.
+                try {
+                    renameSync(legacyHome, shortHome);
+                    // Log the one-time migration for observability.
+                    try {
+                        const logPath = join(shortBase, `${shortHome.split("/").at(-1)}.migrated`);
+                        writeFileSync(logPath, `${new Date().toISOString()} migrated from ${legacyHome}\n`);
+                    }
+                    catch { /* log failure is non-fatal */ }
+                }
+                catch (err) {
+                    // EXDEV (cross-device) or any other rename failure → fail-safe:
+                    // fall back to the legacy long path so the instance still works.
+                    // The socket-length bug persists for this instance but no data is lost.
+                    const code = err.code ?? "unknown";
+                    try {
+                        const warnPath = join(shortBase, `${shortHome.split("/").at(-1)}.migration-failed`);
+                        writeFileSync(warnPath, `${new Date().toISOString()} rename failed (${code}): ${err.message}\n`
+                            + `legacy path remains in use: ${legacyHome}\n`);
+                    }
+                    catch { /* warn log failure is also non-fatal */ }
+                    // Return legacy long path so the instance starts (socket may still fail
+                    // on 0.157.0 for long names, but no data is lost or corrupted).
+                    return legacyHome;
+                }
+            }
+            else if (!legacyExists) {
+                // New instance — no data to migrate.
+                mkdirSync(shortHome, { recursive: true, mode: 0o700 });
+            }
+            // If legacyExists but is already a symlink: shortHome was deleted externally
+            // while the symlink still points to it. Re-create shortHome as a fresh dir.
+            if (!existsSync(shortHome)) {
+                mkdirSync(shortHome, { recursive: true, mode: 0o700 });
+            }
+        }
+        // Backward-compat symlink: instanceDir/codex-home → shortHome.
+        // Also serves as self-heal: if a previous run renamed successfully but
+        // crashed before creating the symlink, we recreate it here.
+        if (!legacyExists || legacyIsRealDir) {
+            // legacyIsRealDir means rename just happened (now shortHome exists, legacyHome gone).
+            // !legacyExists means new instance or symlink was deleted — create it.
+            try {
+                symlinkSync(shortHome, legacyHome);
+            }
+            catch { /* race or already exists */ }
+        }
+        return shortHome;
     }
     supportsQueuedInput() {
         return true;
@@ -145,6 +575,29 @@ export class CodexBackend {
     getBottomReadyPattern() {
         return /^\s*›\s?/;
     }
+    /** Observed on real Codex 0.156.0: the live input row precedes its footer. */
+    isDeliveryInputReadyPane(pane) {
+        const rows = pane.replace(/\r/g, "").split("\n");
+        while (rows.length && !rows[rows.length - 1].trim())
+            rows.pop();
+        const footer = rows.pop() ?? "";
+        // Codex preserves other configured status-line items after the context
+        // meter (observed on 0.156.0: "Context 100% left · GPT-6-Astra"). They
+        // are footer chrome, not evidence that the input row is unavailable.
+        if (!isCodexContextFooter(footer))
+            return false;
+        // Pasted text may wrap over several continuation rows before the footer.
+        // Search only its immediate tail, not a historical transcript prompt.
+        for (let i = rows.length - 1; i >= Math.max(0, rows.length - 8); i--) {
+            if (/^[>›]\s+\d+\./.test(rows[i]))
+                return false;
+            if (/^[>›]\s+\S/.test(rows[i]))
+                return true;
+            if (/^[•■⚠]/.test(rows[i]))
+                return false;
+        }
+        return false;
+    }
     /** Live status chrome that must veto the broad prompt/context ready match. */
     getBusyPattern() {
         return /(?:^|\n)•\s+Working\b[^\n]*\besc to interrupt\b/i;
@@ -178,7 +631,7 @@ export class CodexBackend {
             return false;
         let footer = -1;
         for (let i = prompt + 1; i < Math.min(rows.length, prompt + 7); i++) {
-            if (/^\s*Context\s+\d+%\s+(?:left|used)\s*$/i.test(rows[i])) {
+            if (isCodexContextFooter(rows[i])) {
                 footer = i;
                 break;
             }
@@ -232,13 +685,17 @@ export class CodexBackend {
         // AgEnD instances are unattended processes: an interactive self-update
         // picker blocks delivery and must never be enabled by a copied global or
         // managed config layer. Keep this last so the CLI override is authoritative.
-        cmd += " -c check_for_update_on_startup=false";
+        // Both observed Codex 0.155.0 and 0.156.1 support this launch flag. Pin
+        // the initial layout so a user/global fullscreen preference cannot make a
+        // header-only pane look ready. A later unknown layout still fails closed.
+        cmd += " -c check_for_update_on_startup=false --no-alt-screen";
         // CODEX_HOME is the only Codex-supported way to isolate the complete base
         // config. A profile only layers over the shared config and would therefore
         // still load every globally registered AgEnD MCP server.
         return `CODEX_HOME=${shellQuote(this.isolatedCodexHome)} ${cmd}`;
     }
     writeConfig(config) {
+        this.authorizedTrust = null;
         // Set before the home is prepared: which login this instance gets is a
         // property of the home, and the home is built here.
         this.credentialProfile = this.readProfile(config);
@@ -342,11 +799,15 @@ export class CodexBackend {
             content = readFileSync(configPath, "utf-8");
         }
         catch { /* no file yet */ }
+        // TOML allows quoted keys: `"status_line" = [...]` and `['tui']` are both
+        // legal. The regexes below accept an optional surrounding quote pair so that
+        // users who write their config with quoted keys still get context-remaining
+        // injected correctly. Both single and double TOML quotes are accepted.
         // Rule 1: any existing context item → don't touch anything.
-        if (/status_line\s*=\s*\[[^\]]*context-(remaining|usage|used)[^\]]*\]/.test(content))
+        if (/["']?status_line["']?\s*=\s*\[[^\]]*context-(remaining|usage|used)[^\]]*\]/.test(content))
             return;
         const ITEM = "context-remaining";
-        const arr = content.match(/status_line\s*=\s*\[([^\]]*)\]/);
+        const arr = content.match(/["']?status_line["']?\s*=\s*\[([^\]]*)\]/);
         if (arr) {
             // Rule 2b: prepend our item to the user's existing array (don't overwrite).
             // First position keeps "Context N% left" at the far left of the footer so a
@@ -359,8 +820,9 @@ export class CodexBackend {
             // Rule 2a: no status_line at all → add a minimal one.
             if (content.length && !content.endsWith("\n"))
                 content += "\n";
-            if (/^\[tui\]/m.test(content)) {
-                content = content.replace(/^\[tui\][^\n]*\n/m, h => `${h}status_line = ["${ITEM}"]\n`);
+            // Also recognise quoted section headers: `["tui"]` and `['tui']`.
+            if (/^\[["']?tui["']?\]/m.test(content)) {
+                content = content.replace(/^\[["']?tui["']?\][^\n]*\n/m, h => `${h}status_line = ["${ITEM}"]\n`);
             }
             else {
                 content += `\n[tui]\nstatus_line = ["${ITEM}"]\n`;
@@ -401,16 +863,23 @@ export class CodexBackend {
         return home;
     }
     preTrust(workDir) {
+        this.authorizedTrust = null;
+        const paths = codexTrustPaths(workDir);
         const configPath = join(this.isolatedCodexHome, "config.toml");
         let content = "";
         try {
             content = readFileSync(configPath, "utf-8");
         }
         catch { }
-        const section = `[projects."${workDir}"]`;
-        if (content.includes(section))
-            return;
-        atomicWritePrivate(configPath, `${content.trimEnd()}\n\n${section}\ntrust_level = "trusted"\n`);
+        const updated = setProjectTrusted(content, paths.root);
+        if (updated !== content)
+            atomicWritePrivate(configPath, updated);
+        // Do not authorize an automatic Enter merely because the write returned:
+        // a stale/untrusted section in the effective isolated config must fail shut.
+        const onDisk = readFileSync(configPath, "utf-8");
+        if (effectiveProjectTrust(onDisk, paths.root) !== "trusted")
+            throw new Error("Codex project trust did not persist");
+        this.authorizedTrust = paths;
     }
     /**
      * Preserve Codex login/session/cache behavior while isolating config.toml.
@@ -654,11 +1123,20 @@ export class CodexBackend {
         }
     }
     getReadyPattern() {
-        // Startup/header: "OpenAI Codex". Prompt glyph is ">" on older Codex and
-        // "›" (U+203A) on newer releases. Exclude numbered menu selections so a
-        // trust/confirmation dialog is not mistaken for an idle input prompt.
-        // Statusline variants report either "% left" or "% used" while idle.
-        return /% left|% used|OpenAI Codex|^[>›](?!\s*\d+\.)/m;
+        // Header and context text persist in inline scrollback and even while the
+        // CLI is loading or a modal owns stdin. Require the live prompt followed
+        // by the Context footer at the *end* of the capture. getBusyPattern still
+        // vetoes a working turn whose empty composer remains visible. Unknown TUI
+        // layouts cannot claim readiness by merely rendering the old header.
+        // U+22C6 is Codex's observed cosmetic starfield; it can be drawn in the
+        // prompt, between prompt/footer, and below the footer. A drafted composer
+        // is also idle once this same bottom footer proves it owns the screen.
+        return /(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}[ \t⋆]+(?:[0-9a-f-]{36}[ \t]+·[ \t]+)?Context[ \t]+(?:\d+%[ \t]+(?:left|used)|\d+…|…)[^\r\n]*(?:\r?\n[ \t⋆]*)*$/i;
+    }
+    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
+    isProxyReplyChromeLine(line) {
+        return /^\s*[›>]\s+Ask Codex to do anything\s*$/.test(line)
+            || isCodexContextFooter(line);
     }
     getErrorPatterns() {
         return [
@@ -705,11 +1183,13 @@ export class CodexBackend {
                 // A capacity rejection is a completed failed turn: Codex returns to its
                 // prompt without an answer. Keep this anchored to the exact decorated
                 // TUI line so ordinary prose about model capacity cannot pause an
-                // otherwise healthy instance. The CLI is already ready again, so there
-                // is no recovery state to wait for after the pause notification.
+                // otherwise healthy instance. The CLI is already back at the prompt, so
+                // skipRecoveryWait avoids an extra wait before the backoff timer fires.
+                // action "backoff_restart": exponential backoff + resume, up to 3 times;
+                // the lifecycle falls back to "pause" after the limit (see #905).
                 pattern: /^⚠ Selected model is at capacity\. Please try a different model\.\r?$/m,
                 type: "model_error",
-                action: "pause",
+                action: "backoff_restart",
                 message: t("inst.codex_model_capacity"),
                 skipRecoveryWait: true,
             },
@@ -756,12 +1236,40 @@ export class CodexBackend {
         ];
     }
     getStartupDialogs() {
+        const trustHold = this.trustHoldDialog();
         return [
-            { pattern: /Do you trust the files in this folder/i, keys: ["Enter"], description: "Codex trust dialog" },
-            { pattern: /Yes, continue/i, keys: ["Enter"], description: "Codex 'Yes, continue' confirmation" },
+            {
+                pattern: /^\s*Trust this folder\?/m,
+                keys: ["Enter"],
+                description: "Codex authorized folder trust dialog",
+                blocksDelivery: true,
+                inputBlocked: true,
+                autoResolutionKey: "codex-authorized-folder-trust",
+                isActive: pane => {
+                    const state = codexTrustPromptState(pane);
+                    const authorized = this.authorizedTrust;
+                    return state.active && state.safeChoice && authorized !== null
+                        && state.folder === authorized.cwd
+                        && (state.rootNote === "absent" ? authorized.root === authorized.cwd
+                            : state.rootNote === "parsed" && state.root === authorized.root);
+                },
+            },
+            trustHold,
             this.updatePickerDialog(),
+            this.unknownSelectionHoldDialog(),
         ];
     }
+    trustHoldDialog() {
+        return {
+            pattern: /^\s*(?:Folder access|Trust this folder\?|Do you trust the files in this folder\?)/im,
+            keys: [],
+            description: "Codex folder trust needs human confirmation",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexTrustVariantActive,
+        };
+    }
     updatePickerDialog() {
         return {
             // Defense in depth for config written by older AgEnD versions or a Codex
@@ -777,26 +1285,70 @@ export class CodexBackend {
             // seconds and a delivery can arrive first (hit live on codex-cli 0.153.4,
             // which parks on this picker for as long as nobody answers it).
             blocksDelivery: true,
-            // Bottom-anchored, so a transcript that quotes the picker (an agent
-            // pasting a pane capture, this very change being reviewed) is not
-            // mistaken for a live one: the real picker owns the bottom of the pane
-            // and has no input row under it.
-            isActive: (pane) => {
-                const last = lastNonBlankRow(pane);
-                return last != null && /^\s*Press enter to continue\s*$/.test(last);
+            // Daemon.dialogMatches uses isActive INSTEAD OF pattern when present.
+            // Check the complete current picker here; a different Enter-only menu
+            // must never receive this automatic Escape key.
+            isActive: codexUpdatePickerVisible,
+        };
+    }
+    usageLimitLunaReserveDialog() {
+        // The real codex usage-limit dialog states codex has ALREADY switched to
+        // Luna Reserve and labels Escape as "continue working". Pressing Escape via
+        // sendSpecialKey is the ONLY safe key:
+        //
+        //   • Escape is sent via sendSpecialKey — never via pasteText (which adds
+        //     an implicit bracketed-paste Enter that could confirm Reset usage).
+        //   • A digit pasted via pasteText would leave the cursor on option 1 and
+        //     its own implicit Enter would fire Reset usage BEFORE any confirmation
+        //     gate. This path is explicitly NOT used.
+        //
+        // verifyAfterKeys: true — confirm the menu is gone after Escape.
+        // No confirmBeforeEnter / keysAfterConfirm: Escape needs no confirm gate.
+        return {
+            pattern: /Press enter to confirm or esc to continue working/i,
+            keys: ["Escape"],
+            description: "Codex usage limit — pressing Escape to continue with Luna Reserve",
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexUsageLimitMenuVisible,
+            verifyAfterKeys: true,
+            autoResolutionKey: "codex-usage-limit-luna-reserve",
+            postDismissNotice: {
+                text: t("inst.codex_usage_limit_luna_reserve", ""), // instance name injected by daemon
+                label: "codex-usage-limit-selected",
             },
         };
     }
+    unknownSelectionHoldDialog() {
+        return {
+            pattern: /^\s*[›❯>]\s+\S/m,
+            keys: [],
+            description: "Codex interactive selection needs human input",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexUnknownSelectionVisible,
+        };
+    }
     getRuntimeDialogs() {
         return [
+            this.trustHoldDialog(),
             {
-                // Codex shows a model switch dialog when approaching rate limits.
-                // Auto-select "Keep current model (never show again)" — option 3.
-                pattern: /Approaching rate limits[\s\S]*Switch to.*for lower credit/m,
-                keys: ["Down", "Down", "Enter"],
-                description: "Codex rate limit model switch dialog",
+                // Codex 0.156 may change the wording/order of this credit-cost choice.
+                // Never navigate it by position: a moved option could switch to a
+                // more expensive model. A live picker holds delivery and notifies a
+                // human; old transcript mentions are excluded by the tail matcher.
+                pattern: /(?:Approaching rate limits|Switch to [^\r\n]{1,120} for lower credit usage\?)/i,
+                keys: [],
+                description: "Codex rate limit model switch dialog needs human choice",
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                isActive: codexRateSwitchVisible,
             },
             this.updatePickerDialog(),
+            this.usageLimitLunaReserveDialog(),
+            this.unknownSelectionHoldDialog(),
         ];
     }
     getInputUnavailableTransients() {