@songsid/agend 2.3.4-beta.7 → 2.3.5-alpha.3

package/dist/backend/codex.js

@@ -8,6 +8,8 @@ import { codexPackageWarning } from "./codex-package.js";
 import { probeCliVersion, resolveBinary, shellQuote, validateModel, validateProvider, warnIfModelMismatch } from "./types.js";
 import { credentialHomeSpec, credentialProfileHome, prepareCredentialProfileHome, resolveCredentialProfile, } from "./credential-profile.js";
 import { getAgendHome } from "../paths.js";
+import { selectedGeneralHostSession } from "../general-binding.js";
+import { ResumeBlockedError } from "./types.js";
 import { CODEX_MODELS_CACHE_MAX_BYTES, codexShortHomeFor, readCodexEffortLevels, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./codex-metadata.js";
 import { EFFORT_CAPABILITIES } from "./effort-metadata.js";
 import { codexEffort } from "./launch-effort.js";
@@ -604,6 +606,20 @@ function codexWorkspaceLimitPromptVisible(pane) {
     }
     return false;
 }
+/**
+ * The composer's own `›` row above the footer, or -1. Walking up from the footer, only blank rows and indented rows (the
+ * composer's wrapped text, however many lines a long paste takes) may come before it. The first column-zero row decides:
+ * a `›` there is the composer; a numbered `›` row is a selection card; any other column-zero row (`•`/`■`/`⚠` output, a
+ * status line) means a `›` above it is transcript history, never the composer.
+ */
+function ownedComposerRow(rows) {
+    for (let i = rows.length - 1; i >= 0; i--) {
+        if (!rows[i].trim() || /^[ \t]/.test(rows[i]))
+            continue;
+        return /^[>›][ \t]+\S/.test(rows[i]) && !/^[>›][ \t]+\d+\./.test(rows[i]) ? i : -1;
+    }
+    return -1;
+}
 /** Unknown pickers own stdin too; never type or press Enter into one. */
 function codexUnknownSelectionVisible(pane) {
     const rows = pane.replace(/\r/g, "").split("\n");
@@ -983,8 +999,15 @@ export const CODEX_RESUME_ATTEMPT_FILE = "codex-resume-attempt.json";
 export const CODEX_RESUME_FAILED_FILE = "codex-resume-failed.json";
 /** Above this, a resumed rollout carries a note that codex may compact it first. */
 export const CODEX_RESUME_LARGE_BYTES = 20 * 1024 * 1024;
-export class CodexBackend {
-    instanceDir;
+/** Pane-only detectors: construction performs no provider, config or session discovery. */
+export class CodexPaneDetectors {
+    paneDetectorContext;
+    constructor(paneDetectorContext) {
+        this.paneDetectorContext = paneDetectorContext;
+    }
+    readConfiguredStatusLineItems() { return this.paneDetectorContext?.statusLineItems()?.slice() ?? null; }
+    trustPaneFields(pane) { const state = codexTrustPromptState(pane); return { promptFolder: state.folder, promptRoot: state.root, rootNote: state.rootNote }; }
+    trustHoldReason(pane) { return { ...this.trustPaneFields(pane), reason: "Folder permission needs confirmation on this execution machine" }; }
     /**
      * #1510: the reply-completion guard covers codex, its turn end read from the rollout (task_complete /
      * turn_aborted, recorded on 0.162.0 in tests/fixtures/reply-guard-1510): the pane alone stays busy through a tool
@@ -993,121 +1016,10 @@ export class CodexBackend {
     replyCompletionGuard = true;
     turnEndFromTranscript = true;
     binaryName = "codex";
-    binaryPath;
-    sharedCodexHome;
-    isolatedCodexHome;
-    /** Which subscription this instance runs on, or null for the shared login. */
-    credentialProfile = null;
-    /** Set only after preTrust wrote and read back this instance's private config. */
-    authorizedTrust = null;
     configuredStatusLineItems;
     configuredStatusLinePattern;
-    /** Set by buildCommand when the resume plan fell back; read once by the daemon. */
-    launchWarning = null;
     /** Whether the last buildCommand launched a resume (`resume <id>` or `--last`). */
     lastLaunchResumes = true;
-    /** Set by writeConfig when the status_line could not be made verifiable (#931). */
-    statusLineWarning = null;
-    /** #2357: set by buildCommand when the codex being launched lacks a package companion (codex-code-mode-host). */
-    packageWarning = null;
-    constructor(instanceDir) {
-        this.instanceDir = instanceDir;
-        this.binaryPath = resolveBinary("codex");
-        this.sharedCodexHome = resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
-        this.isolatedCodexHome = CodexBackend.resolveShortHome(instanceDir);
-    }
-    /**
-     * Compute and (on first call for an existing instance) migrate to a SHORT
-     * persistent CODEX_HOME under `~/.agend/cx/<8-char-hash>/`.
-     *
-     * Background (#953): codex 0.157.0 added `app-server-control.sock` under
-     * CODEX_HOME. For instances with long `-t<topic_id>` suffixes the full path
-     * exceeds the Unix socket SUN_LEN (~107 chars). codex canonicalises the path
-     * before binding the socket, so a symlink workaround does not help — the real
-     * path must be short.
-     *
-     * Migration steps (each is idempotent; half-completed states self-heal):
-     *  1. If shortHome does not exist AND legacyHome is a real directory (not a
-     *     symlink) → atomic renameSync. On EXDEV or any other error, fall back
-     *     safely: keep using the legacy long path (instance can still start, just
-     *     without the short-path fix).
-     *  2. If shortHome exists but legacyHome is missing → recreate the backward-
-     *     compat symlink (self-heal for rename-succeeded-but-symlink-failed crash).
-     *  3. If both shortHome and legacyHome (as symlink) exist → nothing to do.
-     *  4. New instance (no legacyHome) → create shortHome directly.
-     *
-     * Fail-safe guarantee: migration failure must never make the instance worse.
-     * The caller always receives a valid path it can use as CODEX_HOME.
-     */
-    /** Exposed for fleet-manager to delete the short home on instance removal. */
-    static shortHomeFor(instanceDir) {
-        return codexShortHomeFor(instanceDir);
-    }
-    static resolveShortHome(instanceDir) {
-        const shortHome = CodexBackend.shortHomeFor(instanceDir);
-        const shortBase = join(getAgendHome(), "cx");
-        const canonical = resolve(instanceDir);
-        const legacyHome = resolve(instanceDir, "codex-home");
-        // Only migrate/create when the instance directory itself exists.
-        // Constructing CodexBackend for a non-existent dir (cli-env probes, test
-        // backends that never ran) must not litter ~/.agend/cx/ with orphan dirs.
-        if (!existsSync(canonical))
-            return shortHome;
-        const legacyExists = existsSync(legacyHome);
-        const legacyIsRealDir = legacyExists && !lstatSync(legacyHome).isSymbolicLink();
-        const shortExists = existsSync(shortHome);
-        if (!shortExists) {
-            mkdirSync(shortBase, { recursive: true, mode: 0o700 });
-            if (legacyIsRealDir) {
-                // Attempt atomic rename. Requires same device; fails with EXDEV otherwise.
-                try {
-                    renameSync(legacyHome, shortHome);
-                    // Log the one-time migration for observability.
-                    try {
-                        const logPath = join(shortBase, `${shortHome.split("/").at(-1)}.migrated`);
-                        writeFileSync(logPath, `${new Date().toISOString()} migrated from ${legacyHome}\n`);
-                    }
-                    catch { /* log failure is non-fatal */ }
-                }
-                catch (err) {
-                    // EXDEV (cross-device) or any other rename failure → fail-safe:
-                    // fall back to the legacy long path so the instance still works.
-                    // The socket-length bug persists for this instance but no data is lost.
-                    const code = err.code ?? "unknown";
-                    try {
-                        const warnPath = join(shortBase, `${shortHome.split("/").at(-1)}.migration-failed`);
-                        writeFileSync(warnPath, `${new Date().toISOString()} rename failed (${code}): ${err.message}\n`
-                            + `legacy path remains in use: ${legacyHome}\n`);
-                    }
-                    catch { /* warn log failure is also non-fatal */ }
-                    // Return legacy long path so the instance starts (socket may still fail
-                    // on 0.157.0 for long names, but no data is lost or corrupted).
-                    return legacyHome;
-                }
-            }
-            else if (!legacyExists) {
-                // New instance — no data to migrate.
-                mkdirSync(shortHome, { recursive: true, mode: 0o700 });
-            }
-            // If legacyExists but is already a symlink: shortHome was deleted externally
-            // while the symlink still points to it. Re-create shortHome as a fresh dir.
-            if (!existsSync(shortHome)) {
-                mkdirSync(shortHome, { recursive: true, mode: 0o700 });
-            }
-        }
-        // Backward-compat symlink: instanceDir/codex-home → shortHome.
-        // Also serves as self-heal: if a previous run renamed successfully but
-        // crashed before creating the symlink, we recreate it here.
-        if (!legacyExists || legacyIsRealDir) {
-            // legacyIsRealDir means rename just happened (now shortHome exists, legacyHome gone).
-            // !legacyExists means new instance or symlink was deleted — create it.
-            try {
-                symlinkSync(shortHome, legacyHome);
-            }
-            catch { /* race or already exists */ }
-        }
-        return shortHome;
-    }
     supportsQueuedInput() {
         return true;
     }
@@ -1132,24 +1044,10 @@ export class CodexBackend {
     }
     /** Observed on real Codex 0.156.0: the live input row precedes its footer. */
     isDeliveryInputReadyPane(pane) {
-        // A composer with no app-server behind it accepts text and never submits it (#1099).
-        if (codexAppServerDisconnected(pane))
-            return false;
-        const rows = pane.replace(/\r/g, "").split("\n");
-        while (rows.length && !rows[rows.length - 1].trim())
-            rows.pop();
-        const footer = rows.pop() ?? "";
-        // Codex preserves other configured status-line items after the context
-        // meter (observed on 0.156.0: "Context 100% left · GPT-6-Astra"). They
-        // are footer chrome, not evidence that the input row is unavailable.
-        const contextFooter = this.isAnyContextFooter(footer);
-        // A deliberately configured status_line may omit Context entirely. In
-        // that case require a recognized value from the actual configured item
-        // list after Codex's exact empty live-composer row. An arbitrary non-empty
-        // footer or a recent transcript echo is not a readiness signal; that was
-        // the false-ready hole in the old Layer 2 deny-list attempt (#931/#947).
-        if (!contextFooter && !this.isConfiguredStatusLineFooter(footer))
+        const frame = this.composerFrame(pane);
+        if (!frame)
             return false;
+        const { rows, contextFooter } = frame;
         if (!contextFooter) {
             if (this.getBusyPattern().test(pane))
                 return false;
@@ -1170,6 +1068,45 @@ export class CodexBackend {
         }
         return false;
     }
+    /**
+     * Complete ownership of a long pasted envelope: the `›` composer row and every wrapped row down to a context footer are
+     * proven by ownedComposerRow, however many rows they take. The Enter gate accepts this as well as isDeliveryInputReadyPane,
+     * never instead of the dialog, busy and expected-seq checks.
+     */
+    ownsComposerRows(pane) {
+        const frame = this.composerFrame(pane);
+        return !!frame?.contextFooter && ownedComposerRow(frame.rows) >= 0;
+    }
+    /**
+     * The screen above Codex's footer, shared by both readers: null when the footer is not a Codex footer at all or the
+     * app server behind the composer is gone (#1099). `rows` excludes the footer.
+     */
+    composerFrame(pane) {
+        // A composer with no app-server behind it accepts text and never submits it (#1099).
+        if (codexAppServerDisconnected(pane))
+            return null;
+        const rows = pane.replace(/\r/g, "").split("\n");
+        while (rows.length && !rows[rows.length - 1].trim())
+            rows.pop();
+        if (this.paneDetectorContext?.windowsConpty && /^[ \t]*\? for shortcuts[ \t]*$/.test(rows.at(-1) ?? "")) {
+            rows.pop();
+            while (rows.length && !rows[rows.length - 1].trim())
+                rows.pop();
+        }
+        const footer = rows.pop() ?? "";
+        // Codex preserves other configured status-line items after the context
+        // meter (observed on 0.156.0: "Context 100% left · GPT-6-Astra"). They
+        // are footer chrome, not evidence that the input row is unavailable.
+        const contextFooter = this.isAnyContextFooter(footer);
+        // A deliberately configured status_line may omit Context entirely. In
+        // that case require a recognized value from the actual configured item
+        // list after Codex's exact empty live-composer row. An arbitrary non-empty
+        // footer or a recent transcript echo is not a readiness signal; that was
+        // the false-ready hole in the old Layer 2 deny-list attempt (#931/#947).
+        if (!contextFooter && !this.isConfiguredStatusLineFooter(footer))
+            return null;
+        return { rows, contextFooter };
+    }
     /**
      * Live status chrome that must veto the broad prompt/context ready match.
      *
@@ -1236,990 +1173,1264 @@ export class CodexBackend {
             return false;
         return true;
     }
+    getReadyPattern() {
+        // Header and context text persist in inline scrollback and even while the
+        // CLI is loading or a modal owns stdin. Require the live prompt followed
+        // by the Context footer at the *end* of the capture. A valid custom
+        // status_line without Context gets a separate configured-item pattern;
+        // unknown footer values still fail closed. getBusyPattern vetoes a working
+        // turn whose empty composer remains visible.
+        // U+22C6 is Codex's observed cosmetic starfield; it can be drawn in the
+        // prompt, between prompt/footer, and below the footer. A drafted composer
+        // is also idle once this same bottom footer proves it owns the screen.
+        const nativeTail = (pattern) => this.paneDetectorContext?.windowsConpty
+            ? new RegExp(pattern.source.slice(0, -1) + String.raw `(?:\r?\n[ \t]*\? for shortcuts[ \t]*)?(?:\r?\n[ \t⋆]*)*$`, pattern.flags) : pattern;
+        const contextReady = nativeTail(/(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}[ \t⋆]+(?:[0-9a-f-]{36}[ \t]+·[ \t]+)?Context[ \t]+(?:\d+%[ \t]+(?:left|used)|\d+…|…)[^\r\n]*(?:\r?\n[ \t⋆]*)*$/i);
+        const footerPattern = this.configuredStatusLineFooterPattern();
+        if (!footerPattern)
+            return contextReady;
+        // The no-Context alternative requires the exact empty composer followed by
+        // a recognized configured Codex status_line value. If run-state is
+        // configured, that value must specifically be Ready. This is positive
+        // structural proof, never a deny-list of known dialogs.
+        const footerSource = footerPattern.source.slice(1, -1);
+        const noContextReady = nativeTail(new RegExp(String.raw `(?:^|\n)[>›][ \t⋆]*Ask Codex to do anything[ \t⋆]*\r?\n(?:[ \t⋆]*\r?\n){0,3}${footerSource}(?:\r?\n[ \t⋆]*)*$`, "iu"));
+        // #978: a configured footer that carries a Context item in any position
+        // is the Context footer: same drafted-composer rule as Context-first. The
+        // whole row must match the configured item grammar, so an arbitrary
+        // indented line that merely contains `Context N% left` cannot pass.
+        const configuredContextReady = this.configuredHasContextItem()
+            ? nativeTail(new RegExp(String.raw `(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}(?=[^\r\n]*${CODEX_CONTEXT_ITEM})${footerSource}(?:\r?\n[ \t⋆]*)*$`, "iu"))
+            : null;
+        return new RegExp([contextReady.source, noContextReady.source, configuredContextReady?.source]
+            .filter((source) => !!source)
+            .map(source => `(?:${source})`)
+            .join("|"), "iu");
+    }
+    configuredStatusLineFooterPattern() {
+        if (this.configuredStatusLinePattern !== undefined)
+            return this.configuredStatusLinePattern;
+        const items = this.readConfiguredStatusLineItems();
+        if (!items?.length)
+            return this.configuredStatusLinePattern = null;
+        const configuredPatterns = items
+            .map(item => CODEX_STATUS_LINE_VALUE_PATTERNS[item])
+            .filter((pattern) => pattern !== undefined);
+        if (!configuredPatterns.length)
+            return this.configuredStatusLinePattern = null;
+        const segment = `(?:${configuredPatterns.join("|")})`;
+        const separator = String.raw `[ \t]+·[ \t]+`;
+        const hasRunState = items.some(item => CODEX_RUN_STATE_STATUS_ITEMS.has(item));
+        // Ready must occupy its own status-line segment. Other configured items
+        // may precede/follow it, as Codex joins visible values with ` · `.
+        const line = hasRunState
+            ? `(?:${segment}${separator})*Ready(?:${separator}${segment})*`
+            : `${segment}(?:${separator}${segment})*`;
+        // The configured items, then (optionally) the CLI's own native fields — the same rule as the Context-first footer, so a
+        // `model · Context 46% left    Goal achieved (1h 6m)` row is the footer too, and the readiness regex built from this
+        // source (footerSource) says the same.
+        this.configuredStatusLinePattern = new RegExp(`^[ \t⋆]*${line}(?:${CODEX_NATIVE_FOOTER_FIELDS})?[ \t⋆]*$`, "iu");
+        return this.configuredStatusLinePattern;
+    }
+    isConfiguredStatusLineFooter(row) {
+        const pattern = this.configuredStatusLineFooterPattern();
+        if (!pattern)
+            return false;
+        pattern.lastIndex = 0;
+        return pattern.test(row);
+    }
+    configuredHasContextItem() {
+        return (this.readConfiguredStatusLineItems() ?? []).some(item => CODEX_CONTEXT_STATUS_ITEMS.has(item));
+    }
     /**
-     * The row codex paints for input it has taken into its own queue instead of
-     * submitting: `↳ <message>` under "Messages to be submitted after next tool
-     * call (press esc to interrupt and send immediately)".
+     * #978: a Context item in ANY position, accepted only as part of a footer
+     * whose every segment matches the configured status_line items. Codex keeps
+     * the user's order (`gpt-5.6-sol medium · Context 46% left · ~/x`); an
+     * arbitrary indented transcript line that happens to contain the item does
+     * not match that grammar. A stale config fails closed, and the daemon's
+     * stable-composer escape hatch then keeps the instance from latching.
      */
-    getQueuedInputMarker() {
-        return /↳/;
+    // The configured grammar already makes Context a whole segment, so the item
+    // test only has to establish that one is present.
+    isConfiguredContextFooter(row) {
+        return this.configuredHasContextItem()
+            && new RegExp(CODEX_CONTEXT_ITEM, "iu").test(row)
+            && this.isConfiguredStatusLineFooter(row);
     }
-    /** #1811: what the last launch left out and why — the Log tab and daemon.log, never a channel. */
-    quietLaunchNotes = [];
-    consumeQuietLaunchNotes() { const notes = this.quietLaunchNotes; this.quietLaunchNotes = []; return notes; }
-    buildCommand(config) {
-        this.lastKnownModel = config.model?.trim() || null;
-        this.credentialProfile = this.readProfile(config);
-        // #2886: `--full-auto` is gone from codex (no supported version, 0.155 on, accepts it: the instance never started);
-        // spelled out, it was a workspace-write sandbox that asks for approval on request.
-        const approvalFlag = config.skipPermissions !== false
-            ? "--dangerously-bypass-approvals-and-sandbox"
-            : "--sandbox workspace-write --ask-for-approval on-request";
-        // #984: never trust `codex resume --last` to pick this instance's session.
-        // Codex 0.157 scopes it to the git REPOSITORY, so in a worktree it resumes
-        // the newest session of any sibling worktree (a lock screen while that
-        // instance lives, a silent hijack otherwise), and a new instance in a
-        // shared repo does not start fresh. Resume the exact-cwd thread from the
-        // shared state DB instead; `--last` is only the fallback for an unreadable
-        // DB when no other Codex instance shares the repository.
-        let cmd;
-        this.launchWarning = null;
-        this.lastLaunchResumes = false;
-        // #2357: read-only (codex is never run here); a launch is not held for it — the operator is told once per launch.
-        this.packageWarning = codexPackageWarning(this.binaryPath);
-        if (config.skipResume) {
-            cmd = `${this.binaryPath} ${approvalFlag}`;
-        }
-        else {
-            const resumeBy = (id, why, bytes) => {
-                this.lastLaunchResumes = true;
-                this.writeResumeAttempt(id);
-                const large = bytes !== null && bytes > CODEX_RESUME_LARGE_BYTES ? ` ${t("codex.resume_large", String(Math.round(bytes / (1024 * 1024))))}` : "";
-                this.launchWarning = why + large;
-                return `${this.binaryPath} resume ${shellQuote(id)} ${approvalFlag}`;
-            };
-            const sessionsDir = join(this.isolatedCodexHome, "sessions");
-            // M-2266: the previous launch was told to resume a conversation by id. Codex records a thread as it opens it,
-            // so a resume that did not take (codex exited with "No saved session found…") left no row: this launch starts
-            // fresh, once, and says so. A database that cannot be read proves nothing, and planning goes on as usual.
-            // A new one-shot ask comes first: it is the person's explicit choice for this launch.
-            const oneShot = this.takeResumeNext();
-            const attempt = this.takeResumeAttempt();
-            const failed = !oneShot && attempt !== null && codexThreadRowExists(this.stateDbPath(), attempt) === false;
-            if (failed) {
-                // Remembered, so the auto-resume never picks this conversation again on a later launch.
-                this.rememberFailedResume(attempt);
-                cmd = `${this.binaryPath} ${approvalFlag}`;
-                this.launchWarning = t("codex.resume_failed", config.workingDirectory, attempt);
-            }
-            else if (oneShot) {
-                // M-2266: validated when it was asked for (restart_instance); checked again now, as the rollout may have moved.
-                const check = checkResumeId(sessionsDir, config.workingDirectory, oneShot);
-                if (check.ok)
-                    cmd = resumeBy(check.rollout.id, t("codex.resume_oneshot", config.workingDirectory, check.rollout.id), check.rollout.bytes);
-                else {
-                    cmd = this.plannedCommand(config, approvalFlag, sessionsDir, resumeBy);
-                    this.launchWarning = [t("codex.resume_oneshot_invalid", config.workingDirectory, oneShot, check.reason), this.launchWarning].filter(Boolean).join("\n");
-                }
-            }
-            else {
-                cmd = this.plannedCommand(config, approvalFlag, sessionsDir, resumeBy);
-            }
-        }
-        if (config.model) {
-            const model = validateModel(config.model);
-            warnIfModelMismatch("codex", model);
-            cmd += ` -c ${shellQuote(`model="${model}"`)}`;
-        }
-        if (config.backendOptions?.provider) {
-            const provider = validateProvider(String(config.backendOptions.provider));
-            cmd += ` -c ${shellQuote(`model_provider="${provider}"`)}`;
-        }
-        // #1811: the configured effort, when the catalog entry of the model that will run lists it (launch-effort.ts); else
-        // a quiet note. That model is proven from the command line or the config files codex reads (#1813 review).
-        const runs = resolveCodexLaunchModel({
-            isolatedHome: this.isolatedCodexHome, sharedHome: this.sharedCodexHome,
-            model: config.model, workingDirectory: config.workingDirectory,
-        });
-        const effort = codexEffort(config.effort, runs.proven
-            ? readCodexModelEffortLevels({ isolatedHome: this.isolatedCodexHome, sharedHome: this.sharedCodexHome, model: runs.model })
-            : { model: runs.model, levels: null, unproven: true });
-        if (effort.arg)
-            cmd += effort.arg;
-        this.quietLaunchNotes = effort.note ? [effort.note] : [];
-        // AgEnD instances are unattended processes: an interactive self-update
-        // picker blocks delivery and must never be enabled by a copied global or
-        // managed config layer. Keep this last so the CLI override is authoritative.
-        // Both observed Codex 0.155.0 and 0.156.1 support this launch flag. Pin
-        // the initial layout so a user/global fullscreen preference cannot make a
-        // header-only pane look ready. A later unknown layout still fails closed.
-        cmd += " -c check_for_update_on_startup=false --no-alt-screen";
-        // codex 0.159's opt-in `instant_interrupt` makes new input steer the
-        // running response instead of queueing behind it, which AgEnD's delivery
-        // and queued-input (↳) handling assume. Keep it off whatever a user or
-        // global config says. Codex before 0.159 ignores the key with a startup
-        // warning ("`features.instant_interrupt` is ignored"); nothing else.
-        cmd += " -c features.instant_interrupt=false";
-        // CODEX_HOME is the only Codex-supported way to isolate the complete base
-        // config. A profile only layers over the shared config and would therefore
-        // still load every globally registered AgEnD MCP server.
-        return `CODEX_HOME=${shellQuote(this.isolatedCodexHome)} ${cmd}`;
-    }
-    writeConfig(config) {
-        this.authorizedTrust = null;
-        // Set before the home is prepared: which login this instance gets is a
-        // property of the home, and the home is built here.
-        this.credentialProfile = this.readProfile(config);
-        this.prepareIsolatedHome();
-        this.cleanSharedConfig();
-        // Copy all user settings but no AgEnD MCP entries into a private base
-        // config, then append only this instance's server(s). Each instance writes
-        // a distinct file, eliminating the old concurrent global-config race.
-        let content = "";
-        try {
-            content = stripAgendMcpTables(readFileSync(join(this.sharedCodexHome, "config.toml"), "utf-8"));
-        }
-        catch { /* a first-time Codex user may have no global config */ }
-        if (content && !content.endsWith("\n"))
-            content += "\n";
-        for (const [name, entry] of Object.entries(config.mcpServers)) {
-            content += `\n${renderMcpServer(name, entry, config.instanceName)}`;
-        }
-        atomicWritePrivate(join(this.isolatedCodexHome, "config.toml"), content);
-        this.enableContextStatusLine();
-        this.disableStartupUpdateCheck();
-        this.hideRateLimitModelNudge();
-        // Write fleet instructions into AGENTS.md (additive via marker block)
-        if (config.instructions) {
-            try {
-                const agentsMd = join(config.workingDirectory, "AGENTS.md");
-                appendWithMarker(agentsMd, config.instanceName, config.instructions);
-                // Warn if file exceeds Codex's project_doc_max_bytes limit
-                try {
-                    const size = statSync(agentsMd).size;
-                    if (size > CODEX_PROJECT_DOC_MAX_BYTES) {
-                        console.warn(`[agend] AGENTS.md is ${size} bytes, exceeds Codex limit of ${CODEX_PROJECT_DOC_MAX_BYTES} — instructions may be truncated`);
-                    }
-                }
-                catch { /* stat failed — skip size check */ }
-            }
-            catch { /* best effort */ }
-        }
+    /** Any footer that proves the Context meter owns the bottom row. */
+    isAnyContextFooter(row) {
+        return isCodexContextFooter(row) || this.isConfiguredContextFooter(row);
     }
     /**
-     * Stop Codex opening its "Update available!" picker when an instance starts.
-     *
-     * That dialog owns the input loop until someone answers it, so after a fleet
-     * restart every Codex instance sat waiting on a keypress nobody was going to
-     * send. AgEnD then reported it as a stuck pane, which is true but unhelpful.
-     *
-     * `check_for_update_on_startup = false` is Codex's own config key (verified in
-     * the binary), so this prevents the prompt rather than racing to dismiss it.
-     * There is no CLI flag for it — `codex update` is a subcommand, not a switch.
-     *
-     * Placement matters: this is a TOP-LEVEL key, so it has to go above the first
-     * `[section]` header or TOML would read it as belonging to that section. And a
-     * AgEnD's isolated home is unattended, so an inherited `true` is replaced
-     * rather than preserved. TOML rejects duplicate keys, so replace in place.
+     * #978 escape hatch: the live, EMPTY Codex composer within the last few
+     * non-blank rows, no busy marker, and none of the known selection screens.
+     * Deliberately says nothing about the footer, which is what is unknown.
      */
-    disableStartupUpdateCheck() {
-        const configPath = join(this.isolatedCodexHome, "config.toml");
-        let content = "";
-        try {
-            content = readFileSync(configPath, "utf-8");
-        }
-        catch {
-            return;
-        }
-        const existing = /^\s*check_for_update_on_startup\s*=\s*(?:true|false)\s*(?:#.*)?$/m;
-        if (existing.test(content)) {
-            const updated = content.replace(existing, "check_for_update_on_startup = false");
-            if (updated !== content) {
-                try {
-                    atomicWritePrivate(configPath, updated);
-                }
-                catch { /* best effort */ }
-            }
-            return;
-        }
-        const LINE = "check_for_update_on_startup = false\n";
-        const firstSection = content.search(/^\s*\[/m);
-        const updated = firstSection === -1
-            ? (content.length && !content.endsWith("\n") ? `${content}\n${LINE}` : `${content}${LINE}`)
-            : `${content.slice(0, firstSection)}${LINE}${content.slice(firstSection)}`;
-        try {
-            atomicWritePrivate(configPath, updated);
-        }
-        catch { /* best effort */ }
+    isStableUnknownLayoutIdlePane(pane) {
+        if (this.getBusyPattern().test(pane))
+            return false;
+        // The composer is live-looking and the footer is unknown — exactly this
+        // proof's blind spot — but there is no server behind it (#1099).
+        if (codexAppServerDisconnected(pane))
+            return false;
+        // (No second, wider "esc to interrupt" match here: getBusyPattern() above already reads a live status row of ANY
+        // title — #964 — and anchors it to the whole row at column zero, so a reply that quotes the phrase, indented or
+        // in prose, cannot pin the escape hatch shut (#991).)
+        // A retained queued message (`↳ …` under "Messages to be submitted after
+        // next tool call") means work is pending, whatever the composer shows.
+        if (/↳|Messages to be submitted/i.test(pane))
+            return false;
+        if (codexUsageLimitMenuVisible(pane) || codexRateSwitchVisible(pane)
+            || codexUnknownSelectionVisible(pane) || codexUpdatePickerVisible(pane))
+            return false;
+        const rows = pane.replace(/\r/g, "").split("\n").filter(row => row.trim() !== "");
+        return rows.slice(-6).some(row => /^[>›][ \t⋆]*Ask Codex to do anything[ \t⋆]*$/.test(row));
     }
-    /**
-     * Suppress Codex's rate-limit model-switch reminder for unattended instances.
-     * Codex documents this as `notice.hide_rate_limit_model_nudge` (a boolean in
-     * the `[notice]` table). This changes only the per-instance config; the
-     * runtime holdOnly dialog remains as defense-in-depth for older or changed
-     * CLI behavior. No model option is selected automatically.
-     */
-    hideRateLimitModelNudge() {
-        const configPath = join(this.isolatedCodexHome, "config.toml");
-        let content = "";
-        try {
-            content = readFileSync(configPath, "utf-8");
-        }
-        catch {
-            return;
-        }
-        const updated = setTomlTableBoolean(content, "notice", "hide_rate_limit_model_nudge");
-        if (updated !== content) {
-            try {
-                atomicWritePrivate(configPath, updated);
-            }
-            catch { /* best effort */ }
-        }
+    isCodexIdleFooter(row) {
+        return isCodexContextFooter(row) || this.isConfiguredStatusLineFooter(row);
     }
-    /**
-     * Ensure Codex's TUI status line shows context usage: the Context item is
-     * both what /ctx scrapes and the footer AgEnD's readiness proofs rely on.
-     * Rules (never drops or reorders the user's items):
-     *   1. the effective `tui.status_line` already has a context item
-     *      (context-remaining / -usage / -used) → leave the config untouched.
-     *   2. no context item:
-     *        - no status_line at all → write status_line = ["context-remaining"]
-     *        - status_line exists     → prepend "context-remaining" to it
-     * Best-effort string edit (no TOML writer), but every candidate edit is
-     * parsed back and kept only if the effective `tui.status_line` becomes
-     * `["context-remaining", ...the user's items]`. A `status_line` key in some
-     * other table is not the TUI's and must not be the one edited (#931). If no
-     * edit can be verified, the launch warns the operator instead of leaving the
-     * pane silently unready.
-     */
-    enableContextStatusLine() {
-        this.configuredStatusLineItems = undefined;
-        this.configuredStatusLinePattern = undefined;
-        this.statusLineWarning = null;
-        const configPath = join(this.isolatedCodexHome, "config.toml");
-        // The private copy is rebuilt from the shared one at every launch, so the
-        // operator must be pointed at the file their status_line actually lives in.
-        const sharedConfigPath = join(this.sharedCodexHome, "config.toml");
-        let content = "";
-        try {
-            content = readFileSync(configPath, "utf-8");
-        }
-        catch { /* no file yet */ }
-        const ITEM = "context-remaining";
-        const current = effectiveTuiStatusLine(content);
-        if (current === "invalid") {
-            this.statusLineWarning = t("codex.status_line_unverifiable", "tui.status_line is not a list of item names, or config.toml does not parse", sharedConfigPath);
-            return;
-        }
-        // Rule 1: the TUI already shows a context item → don't touch anything.
-        if (current?.some(item => CODEX_CONTEXT_STATUS_ITEM_RE.test(item)))
-            return;
-        // TOML allows quoted keys: `"status_line" = [...]`, `"tui"."status_line"`,
-        // `['tui']`. Every textual candidate is tried; parsing decides.
-        const candidates = [];
-        if (current) {
-            // Rule 2b: prepend our item to the user's existing array (don't overwrite).
-            // First position keeps "Context N% left" at the far left of the footer so a
-            // long cwd/other items can't push it past 80 cols and truncate it.
-            for (const m of content.matchAll(/["']?status_line["']?\s*=\s*\[([^\]]*)\]/g)) {
-                const inner = m[1].trim().replace(/^,\s*/, "").replace(/,\s*$/, "");
-                const newInner = inner.length ? `"${ITEM}", ${inner}` : `"${ITEM}"`;
-                candidates.push(`${content.slice(0, m.index)}status_line = [${newInner}]${content.slice(m.index + m[0].length)}`);
-            }
-        }
-        else {
-            // Rule 2a: no status_line at all → add a minimal one.
-            const base = content.length && !content.endsWith("\n") ? `${content}\n` : content;
-            // Also recognise quoted section headers: `["tui"]` and `['tui']`.
-            if (/^\[["']?tui["']?\][^\n]*\n/m.test(base)) {
-                candidates.push(base.replace(/^\[["']?tui["']?\][^\n]*\n/m, h => `${h}status_line = ["${ITEM}"]\n`));
-            }
-            candidates.push(`${base}\n[tui]\nstatus_line = ["${ITEM}"]\n`);
-            // A config that defines tui with dotted keys cannot take a [tui] table.
-            candidates.push(`tui.status_line = ["${ITEM}"]\n${base}`);
-            // Nor can an inline `tui = { … }` table: the item goes inside it.
-            candidates.push(base.replace(/^([ \t]*["']?tui["']?[ \t]*=[ \t]*\{)[ \t]*\}/m, `$1 status_line = ["${ITEM}"] }`));
-            candidates.push(base.replace(/^([ \t]*["']?tui["']?[ \t]*=[ \t]*\{)/m, `$1 status_line = ["${ITEM}"],`));
-        }
-        const wanted = [ITEM, ...(current ?? [])];
-        const fixed = candidates.find(candidate => {
-            const items = effectiveTuiStatusLine(candidate);
-            return Array.isArray(items) && items.length === wanted.length && items.every((item, i) => item === wanted[i]);
-        });
-        if (!fixed) {
-            this.statusLineWarning = t("codex.status_line_unverifiable", "no edit of tui.status_line could be verified", sharedConfigPath);
-            return;
-        }
-        try {
-            atomicWritePrivate(configPath, fixed);
-        }
-        catch (err) {
-            // Never block launch on statusline config — but a verified edit that
-            // could not be written leaves the pane as unready as an unfixable one.
-            const reason = `the verified edit could not be written: ${err.code ?? "write failed"}`;
-            this.statusLineWarning = t("codex.status_line_unverifiable", reason, sharedConfigPath);
-        }
+    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
+    isProxyReplyChromeLine(line) {
+        return /^\s*[›>]\s+Ask Codex to do anything\s*$/.test(line)
+            || this.isAnyContextFooter(line);
     }
-    /** Null when the instance did not ask for a profile — today's behaviour. */
-    readProfile(config) {
-        try {
-            return resolveCredentialProfile(config.backendOptions);
-        }
-        catch {
-            // A malformed name is refused where it is written; launching is not the
-            // place to discover it, and falling back to the shared login is the
-            // behaviour every instance had before profiles existed.
-            return null;
-        }
+    getErrorPatterns() {
+        return [
+            // Specific quota codes must precede the generic HTTP 429 classifier:
+            // OpenAI returns insufficient_quota with status 429, but switching models
+            // cannot repair an exhausted account and would only start a failover loop.
+            {
+                pattern: new RegExp(String.raw `^\s*(?:${CODEX_STATUS_GLYPH}|Error:|API Error:)\s*[\s\S]{0,240}?\b(?:insufficient_quota|billing_hard_limit_reached|exceeded\s+your\s+current\s+quota)\b|^(?:${CODEX_STATUS_GLYPH}) Quota exceeded\. Check your plan and billing details\.\r?$`, "im"),
+                type: "quota",
+                action: "pause",
+                message: "OpenAI quota exceeded",
+                notice: () => quotaPausedLine("OpenAI", "api_quota"),
+            },
+            {
+                // Codex already exhausted HTTP retries and returned to its composer.
+                // The existing conditional continuation preserves context without
+                // replaying earlier tool effects. Quota remains a preceding pause.
+                pattern: new RegExp(`^${CODEX_EXHAUSTED_429_ROW}$`, "im"),
+                type: "rate_limit",
+                action: "nudge_continue",
+                message: t("inst.codex_rate_retry_stopped"),
+                skipCooldown: true,
+                skipRecoveryWait: true,
+            },
+            {
+                // Pane history contains the agent's own prose, source code and search
+                // results. Bare `rate limit` used to fail over an otherwise healthy
+                // Codex merely for discussing this regex. Match machine-readable API
+                // forms or an error-decorated terminal line instead.
+                pattern: new RegExp(String.raw `^\s*unexpected\s+status\s+429\b|^(?![\s\S]{0,240}?${CODEX_EXHAUSTED_429_ROW})[ \t]*(?:${CODEX_STATUS_GLYPH}|Error:|API Error:)\s*[\s\S]{0,240}?(?:["'](?:status|code)["']\s*:\s*429\b|\b(?:rate_limit_exceeded|too_many_requests)\b|\brate limit(?:ed| exceeded| reached)?\b|\btoo many requests\b)`, "im"),
+                type: "rate_limit",
+                action: "failover",
+                message: "OpenAI rate limit reached",
+            },
+            {
+                // Same false-positive boundary as rate limits: `authentication` is a
+                // normal English/code word. Require a structured 401/code or a
+                // decorated CLI error line before pausing every instance on the shared
+                // credential.
+                pattern: new RegExp(String.raw `^\s*unexpected\s+status\s+401\b|^\s*(?:${CODEX_STATUS_GLYPH}|Error:|API Error:)\s*[\s\S]{0,240}?(?:["'](?:status|code)["']\s*:\s*401\b|\b(?:invalid_api_key|authentication_error)\b|\b401\s+Unauthorized\b|\bauthentication (?:failed|error)\b|\binvalid api key\b)`, "im"),
+                type: "auth_error",
+                action: "pause",
+                message: "OpenAI authentication error",
+            },
+            // Codex writes the apostrophe as U+2019 ("You’ve hit your usage limit.") since
+            // 0.156 and as ASCII before (0.153.4): both must match, or no usage limit
+            // ever pauses the instance (#1098).
+            { pattern: /you['’]ve hit your usage limit/i, type: "quota", action: "pause", message: "Codex usage limit reached — upgrade plan required",
+                notice: () => quotaPausedLine("Codex", "usage") },
+            {
+                // The terminal stage of a lost app-server (#1099): Codex has given up
+                // reconnecting and says so, with a counter that never stops. Nothing
+                // recovers from here without a relaunch, and every message sent in the
+                // meantime waits for an idle that cannot come. Only the LIVE row counts:
+                // directly above the LAST composer with no later transcript item or composer
+                // (the same test as codexAppServerDisconnected, as a lookahead), so text that
+                // merely quotes it does not raise this.
+                pattern: new RegExp(String.raw `^[ \t]*•[ \t]+Reconnect failed[ \t]+—[ \t]+check the endpoint, then relaunch[ \t]+\(\d+[hms](?:[ \t]+\d+[hms])*\)[ \t]*$`
+                    + String.raw `(?=\n(?:[ \t]*\n)*[›>][^\n]*(?:\n(?![•■⚠›>])[^\n]*)*(?![\s\S]))`, "mu"),
+                type: "network",
+                action: "notify",
+                message: "Codex lost its app-server connection and could not reconnect — restart the instance (messages cannot be delivered until then)",
+            },
+            {
+                // Codex reports an unknown model either as a TUI metadata fallback or
+                // as a ChatGPT-account API rejection. Use whitespace-aware phrases so
+                // capture-pane hard wraps do not hide either form.
+                // Codex quotes the slug with BACKTICKS ("Model metadata for `x` not found.",
+                // verified live on 0.160.0 and in the 0.153.4–0.160.0 binaries). The old
+                // pattern only took ASCII quotes, so it could never match a real line.
+                pattern: /model\s+metadata\s+for\s+['"`‘’“”][^'"`‘’“”]+['"`‘’“”]\s+not\s+found\.\s+defaulting\s+to\s+fallback\s+metadata|model\s+is\s+not\s+supported\s+when\s+using\s+codex\s+with\s+a\s+chatgpt\s+account/i,
+                type: "model_error",
+                action: "notify",
+                message: "Codex model unavailable — use /model to switch",
+            },
+            {
+                // A capacity rejection is a completed failed turn: Codex returns to its
+                // prompt without an answer, with its context intact. Keep this anchored to
+                // the exact decorated TUI line so ordinary prose about model capacity
+                // cannot trigger anything on an otherwise healthy instance. The status
+                // glyph is decoration that changes between Codex versions and error classes
+                // (`■` U+25A0 on 0.159.2 and 0.160.0, `⚠` U+26A0 before), so any one
+                // "Other Symbol" glyph (optionally with its emoji selector) opens the line —
+                // never a bullet, dash, quote marker or number, which prose and the model's
+                // own transcript items use (`•`, `-`, `>`). The sentence must fill the line,
+                // from column 0. Box drawing and block elements (U+2500–U+259F) are
+                // excluded up front: they are `So` too, but a left-border popup or
+                // table row (`│ …`) is chrome, not a status line. The CLI is
+                // already back at the prompt, so skipRecoveryWait avoids an extra wait.
+                // action "nudge_continue": tell the user, then about a minute later tell
+                // the agent to keep going (the lifecycle bounds this to 3 per 30 minutes,
+                // then pauses; see #905). No restart — nothing would re-send the turn — and
+                // no model switch. skipCooldown: each NEW capacity line is a new episode,
+                // including a second one right after the nudge.
+                pattern: /^(?![─-▟])\p{So}\uFE0F? Selected model is at capacity\. Please try a different model\.\r?$/mu,
+                type: "model_error",
+                action: "nudge_continue",
+                message: t("inst.codex_model_capacity"),
+                skipCooldown: true,
+                skipRecoveryWait: true,
+            },
+            // Workspace (business) accounts report exhaustion differently from personal
+            // ones, with codex's own rows (codex-rs/protocol error.rs and tui
+            // turn_runtime.rs, unchanged 0.160.0–0.165.0):
+            //   member: "■ Your workspace is out of credits. Ask your workspace owner to refill in order to continue."
+            //           "■ You hit your spend cap set by the owner of your workspace. Ask an owner to increase your spend cap to continue."
+            //   owner:  "■ You're out of credits. Your workspace is out of credits. Add credits to continue using Codex."
+            //           "■ Your workspace is out of credits. Add credits to continue."
+            //           "■ You hit your spend cap set in your workspace. Increase your spend cap to continue."
+            //           "■ Usage limit reached. You've reached your usage limit. Increase your limits to continue using codex."
+            // Neither `insufficient_quota|billing` nor `you've hit your usage limit`
+            // matches them.
+            //
+            // pause, not notify: nothing works until someone refills or raises the cap.
+            // Anchored to the status glyph in COLUMN 0, because these skip the
+            // usage-window check (a workspace limit is not one of those windows, so the
+            // check would call it "available"): codex draws its own error cells there,
+            // while an agent's message, quote or code block is indented under its `•`
+            // (captured live, tests/fixtures/codex-0165-workspace-quoted.pane.txt).
+            // `\s+` at each word gap: capture-pane runs without -J, so tmux's hard wrap
+            // can land a newline anywhere in the sentence. A resumed transcript reprints
+            // these rows, and the first live composer of a spawn takes them as history.
+            {
+                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+(?:You['’]re\s+out\s+of\s+credits\.\s+)?Your\s+workspace\s+is\s+out\s+of\s+credits\.`, "m"),
+                type: "quota",
+                action: "pause",
+                message: "Codex workspace credits exhausted — workspace owner must refill",
+                notice: () => quotaPausedLine("Codex", "workspace_credits"),
+                skipUsageVerify: true,
+                historyUntilLiveComposer: true,
+            },
+            {
+                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+You\s+hit\s+your\s+spend\s+cap\s+set\s+(?:by\s+the\s+owner\s+of|in)\s+your\s+workspace\.`, "m"),
+                type: "quota",
+                action: "pause",
+                message: "Codex workspace spend cap reached — workspace owner must raise it",
+                notice: () => t("inst.quota_spend_cap"),
+                skipUsageVerify: true,
+                historyUntilLiveComposer: true,
+            },
+            {
+                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+Usage\s+limit\s+reached\.\s+You['’]ve\s+reached\s+your\s+usage\s+limit\.\s+Increase\s+your\s+limits`, "m"),
+                type: "quota",
+                action: "pause",
+                message: "Codex workspace usage limit reached — increase the workspace limits to continue",
+                notice: () => quotaPausedLine("Codex", "workspace_usage"),
+                skipUsageVerify: true,
+                historyUntilLiveComposer: true,
+            },
+            // Codex warns at 10% and 5% remaining, and scopes the limit by period —
+            // "weekly" alone missed every `monthly limit` warning.
+            //
+            // `\s+` at EVERY word gap (not literal spaces) because capture-pane runs without -J,
+            // so tmux's hard wrap can land a newline (plus continuation-line padding)
+            // at any of these word gaps. The trailing "Run /status for a breakdown."
+            // is deliberately NOT part of the pattern — that tail is what actually
+            // wrapped in the reported case.
+            //
+            // `of your <period> limit` is load-bearing: it's what keeps the pattern
+            // off the agent's own prose about percentages.
+            {
+                pattern: /less\s+than\s+(\d+)\s*%\s+of\s+your\s+(hourly|daily|weekly|monthly)\s+limit/i,
+                type: "quota",
+                action: "notify",
+                message: "Codex usage limit running low",
+                formatMessage: (m) => `Codex ${m[2].toLowerCase()} limit: less than ${m[1]}% left`,
+                notice: (m) => (m ? quotaLowLine(m[2], m[1]) : quotaLine("Codex", "usage")),
+            },
+        ];
+    }
+    getStartupDialogs() {
+        const trustHold = this.trustHoldDialog();
+        return [
+            this.autoTrustDialog(),
+            trustHold,
+            this.updatePickerDialog(),
+            this.rateSwitchPickerDialog(),
+            ...this.sessionHoldDialogs(),
+            this.unknownSelectionHoldDialog(),
+        ];
     }
     /**
-     * Where this instance's `auth.json` comes from.
-     *
-     * The shared home unless a profile says otherwise. A profile owns the file
-     * itself — not a copy, not a link — so codex refreshing the token writes
-     * into that subscription and no other.
+     * #984: session-selection screens only a human may answer. Held (never
+     * keyed) so the delivery gate keeps messages queued and dialog_parked tells
+     * the operator; listed before the generic selection hold for a clear notice.
      */
-    authSourceDir() {
-        if (!this.credentialProfile)
-            return this.sharedCodexHome;
-        const spec = credentialHomeSpec(this.binaryName);
-        if (!spec)
-            return this.sharedCodexHome;
-        const home = credentialProfileHome(getAgendHome(), this.binaryName, this.credentialProfile);
-        prepareCredentialProfileHome(spec, home);
-        return home;
-    }
-    preTrust(workDir) {
-        this.authorizedTrust = null;
-        const paths = codexTrustPaths(workDir);
-        const configPath = join(this.isolatedCodexHome, "config.toml");
-        let content = "";
-        try {
-            content = readFileSync(configPath, "utf-8");
-        }
-        catch { }
-        const updated = setProjectTrusted(content, paths.root);
-        if (updated !== content)
-            atomicWritePrivate(configPath, updated);
-        // Do not authorize an automatic Enter merely because the write returned:
-        // a stale/untrusted section in the effective isolated config must fail shut.
-        const onDisk = readFileSync(configPath, "utf-8");
-        if (effectiveProjectTrust(onDisk, paths.root) !== "trusted")
-            throw new Error("Codex project trust did not persist");
-        this.authorizedTrust = paths;
+    sessionHoldDialogs() {
+        return [
+            {
+                pattern: /This conversation is open in another app/,
+                keys: [],
+                description: "Codex session is open in another process (thread lock) — close the other one and press r, or fork manually",
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                remoteCard: codexSelectionCard,
+                isActive: codexSessionLockVisible,
+            },
+            {
+                pattern: /Working directory · resume/,
+                keys: [],
+                description: "Codex resume selected a session from another directory (sibling git worktree) — needs a human choice",
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                remoteCard: codexSelectionCard,
+                isActive: codexResumeCwdPickerVisible,
+            },
+        ];
     }
     /**
-     * Preserve Codex login/session/cache sharing while isolating config.toml
-     * and the CODEX_HOME-scoped app-server daemon/control runtime directories.
+     * The user's decision (hmsg-53600a2c): codex's folder-trust prompt in an AgEnD session is always answered Trust — the
+     * workspace is the agent's own, whatever preTrust covered (preTrust stays, so the prompt rarely shows at all). Enter,
+     * only with the cursor on "Trust and continue" among the known options (trustCursor); any other layout or row is
+     * held (trustHoldDialog). It trusts the folder only: per-action approvals are separate dialogs and are not touched.
      */
-    /** Session dirs every instance must share with the terminal CLI (#506). */
-    static SHARED_SESSION_DIRS = ["sessions", "archived_sessions"];
-    static PRIVATE_RUNTIME_DIRS = new Set(["app-server-daemon", "app-server-control"]);
-    prepareIsolatedHome() {
-        mkdirSync(this.isolatedCodexHome, { recursive: true, mode: 0o700 });
-        chmodSync(this.isolatedCodexHome, 0o700);
-        if (this.sharedCodexHome === this.isolatedCodexHome)
-            return;
-        // #1034: Codex's private socket directory check rejects directory symlinks.
-        // Detach only the exact shared-home links the old mirror pass created,
-        // including dangling links. Leave private directories and other links
-        // alone; Codex will create its own real runtime directories on launch.
-        for (const name of CodexBackend.PRIVATE_RUNTIME_DIRS) {
-            const target = join(this.isolatedCodexHome, name);
-            try {
-                if (lstatSync(target).isSymbolicLink()
-                    && readlinkSync(target) === join(this.sharedCodexHome, name)) {
-                    unlinkSync(target);
-                }
-            }
-            catch { /* absent, or another startup already detached the link */ }
-        }
-        // The session dirs must exist in the SHARED home before the symlink pass:
-        // on a fresh install they don't yet, so no link was created, and the first
-        // archive made Codex create a REAL dir in the instance-private home — a
-        // permanent fork the terminal CLI could never see (#506). mkdir -p is
-        // EEXIST-safe under concurrent instance startup.
-        for (const dir of CodexBackend.SHARED_SESSION_DIRS) {
-            try {
-                mkdirSync(join(this.sharedCodexHome, dir), { recursive: true, mode: 0o700 });
-            }
-            catch { /* best effort */ }
-        }
-        // Heal homes that already forked: merge the private real dir back into the
-        // shared one (never overwriting), then replace it with the symlink.
-        for (const dir of CodexBackend.SHARED_SESSION_DIRS) {
-            this.migrateDivergedSessionDir(dir);
-        }
-        // Older versions linked SQLite's WAL/SHM files independently of their
-        // base database. If the base file had already been created privately,
-        // that split one SQLite database across two homes and caused CANTOPEN (or
-        // worse, cross-database journal recovery). Remove only links AgEnD made to
-        // the matching shared-home path; real private sidecars remain untouched.
-        const healedSidecars = [];
-        for (const name of readdirSync(this.isolatedCodexHome)) {
-            if (!SQLITE_SIDECAR_RE.test(name))
-                continue;
-            const target = join(this.isolatedCodexHome, name);
-            try {
-                if (!lstatSync(target).isSymbolicLink())
-                    continue;
-                const linkTarget = resolve(dirname(target), readlinkSync(target));
-                if (linkTarget !== join(this.sharedCodexHome, name))
-                    continue;
-                unlinkSync(target);
-                healedSidecars.push(name);
-            }
-            catch {
-                // A concurrent process may remove an ephemeral sidecar/link first.
-            }
-        }
-        if (healedSidecars.length > 0) {
-            console.warn(`[agend] removed unsafe Codex SQLite sidecar links: ${healedSidecars.join(", ")}`);
-        }
-        // One file, possibly from somewhere else. Everything below is unchanged:
-        // sessions, the thread/state/memory databases and every cache still come
-        // from the shared home, which is why switching subscription does not throw
-        // the conversation away.
-        this.linkAuthFile();
-        for (const name of readdirSync(this.sharedCodexHome)) {
-            if (CodexBackend.PRIVATE_RUNTIME_DIRS.has(name))
-                continue;
-            if (name === "config.toml" || name === AGEND_MCP_CLEANUP_LOCK || name.startsWith(".config.toml."))
-                continue;
-            if (name === CODEX_AUTH_FILE)
-                continue; // handled above, possibly from a profile
-            // SQLite resolves a symlinked base DB to the shared path and creates its
-            // own adjacent sidecars there. Linking sidecars separately is redundant
-            // for shared bases and corrupts the file set for private bases.
-            if (SQLITE_SIDECAR_RE.test(name))
-                continue;
-            const source = join(this.sharedCodexHome, name);
-            const target = join(this.isolatedCodexHome, name);
-            if (existsSync(target))
-                continue;
-            try {
-                const type = lstatSync(source).isDirectory() ? "dir" : "file";
-                symlinkSync(source, target, type);
-            }
-            catch {
-                // State/cache links are compatibility aids; config isolation must not
-                // fail merely because a concurrently-created cache entry disappeared.
-            }
-        }
+    autoTrustDialog() {
+        return {
+            pattern: /^\s*Trust this folder\?/m,
+            keys: ["Enter"],
+            description: "Codex folder trust — trusting the agent's own folder",
+            blocksDelivery: true,
+            inputBlocked: true,
+            autoResolutionKey: "codex-folder-auto-trust",
+            // One Enter per prompt (claimed, then checked): a prompt still up after it is held, never pressed again (#2896 review).
+            verifyAfterKeys: true,
+            isActive: pane => codexTrustPromptState(pane).trustCursor,
+            answerDetail: pane => ({ autoTrusted: true, ...this.trustPaneFields(pane) }),
+        };
+    }
+    trustHoldDialog() {
+        return {
+            pattern: /^\s*(?:Folder access|Trust this folder\?|Do you trust the files in this folder\?)/im,
+            keys: [],
+            description: "Codex folder trust needs human confirmation",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexTrustVariantActive,
+            remoteCard: codexSelectionCard,
+            heldReason: pane => this.trustHoldReason(pane),
+        };
     }
     /**
-     * Point this home's `auth.json` at whichever login it should use.
+     * #1008: the rate-limit model-switch picker parked unattended instances (it
+     * waits forever and its default option changes the model). Prevention is
+     * `notice.hide_rate_limit_model_nudge` (hideRateLimitModelNudge — real and
+     * effective on 0.157.1 and 0.159.2, verified live); this is the answer for a
+     * picker that appears anyway (config not applied, a CLI that moved the key).
      *
-     * Codex refreshes the token by writing through the link rather than replacing
-     * it — observed across every instance home on a machine that has been running
-     * this arrangement for months, with the shared file's mtime moving. That is
-     * behaviour, though, not a contract: a release that starts renaming over the
-     * file would leave a real file here and quietly fork the login, with refreshes
-     * landing somewhere the profile never sees. So a real file where a link
-     * belongs is treated as exactly that — reported, and put back.
+     * Escape, not a navigated Enter: it selects nothing, so it can never take
+     * option 1 (switch model) or option 3 (writes "never show again" into the
+     * config). Deliberately not one-shot: if the picker swallowed the key it is
+     * simply sent again on the next poll, and a repeated Escape is harmless.
      */
-    linkAuthFile() {
-        const source = join(this.authSourceDir(), CODEX_AUTH_FILE);
-        const target = join(this.isolatedCodexHome, CODEX_AUTH_FILE);
-        let existing = null;
-        try {
-            existing = lstatSync(target);
-        }
-        catch { /* absent */ }
-        if (existing?.isSymbolicLink()) {
-            let current = "";
-            try {
-                current = resolve(dirname(target), readlinkSync(target));
-            }
-            catch { /* unreadable */ }
-            if (current === source)
-                return;
-            try {
-                unlinkSync(target);
-            }
-            catch { /* raced */ }
-        }
-        else if (existing) {
-            // Not a link: codex replaced it, or an older AgEnD copied it. Either way
-            // the refreshes it has been collecting are stranded in this instance's
-            // home, so say so rather than deleting them silently.
-            const stranded = `${target}.replaced-${Date.now()}`;
-            try {
-                renameSync(target, stranded);
-                console.warn(`[agend] codex replaced ${CODEX_AUTH_FILE} in ${this.isolatedCodexHome} with a real file — `
-                    + `its login was no longer shared. Kept a copy at ${stranded} and re-linked to ${source}.`);
-            }
-            catch {
-                return; // cannot move it; leave the instance working on what it has
-            }
-        }
-        if (!existsSync(source))
-            return; // not logged in yet; codex will create it
-        try {
-            symlinkSync(source, target, "file");
-        }
-        catch {
-            // EEXIST from a concurrent start is the ordinary case and means the link
-            // is already there.
-        }
+    rateSwitchPickerDialog() {
+        return {
+            // Documentation only: Daemon.dialogMatches uses isActive INSTEAD of this
+            // pattern, so it filters nothing here — the structural check below is the
+            // whole decision, and ordinary prose about the picker fails it. The words
+            // are the picker's own, kept so a reader can find the screen from the log.
+            pattern: /Keep current model \(never show again\)/,
+            keys: ["Escape"],
+            description: "Codex rate-limit model-switch picker — Escape keeps the current model",
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexRateSwitchPickerVisible,
+        };
     }
-    /**
-     * One-time heal for an instance whose isolated home grew a REAL session dir
-     * (#506): merge it into the shared home without overwriting anything, and
-     * only after both the copy and the removal succeed put the symlink in its
-     * place. Any failure keeps the private dir — sessions are never the thing
-     * sacrificed for tidiness — and logs what happened.
-     */
-    migrateDivergedSessionDir(name) {
-        const target = join(this.isolatedCodexHome, name);
-        let st;
-        try {
-            st = lstatSync(target);
-        }
-        catch {
-            return; // absent — the symlink pass below will create the link
-        }
-        if (st.isSymbolicLink())
-            return; // already correct
-        if (!st.isDirectory()) {
-            console.warn(`[agend] codex-home/${name} is neither a symlink nor a directory — leaving it untouched`);
-            return;
-        }
-        const shared = join(this.sharedCodexHome, name);
-        try {
-            mkdirSync(shared, { recursive: true, mode: 0o700 });
-            // cp -rn semantics: collisions keep the shared copy. Session rollout
-            // filenames are timestamp+uuid, so a genuine collision means the same
-            // file — skipping is lossless either way.
-            cpSync(target, shared, { recursive: true, force: false, errorOnExist: false });
-            rmSync(target, { recursive: true });
-            symlinkSync(shared, target, "dir");
-            console.warn(`[agend] migrated diverged codex ${name} into shared home: ${shared}`);
-        }
-        catch (err) {
-            // Keep whatever is left of the private dir. The copy never overwrites, so
-            // a retry on next start is safe; worst case is duplicated files in the
-            // shared home, never lost ones.
-            console.warn(`[agend] codex ${name} migration failed — keeping the instance-private dir (${err.message})`);
-        }
+    updatePickerDialog() {
+        return {
+            // Defense in depth for config written by older AgEnD versions or a Codex
+            // regression. Match the release URL as well as the banner so ordinary
+            // agent prose cannot trigger a keypress.
+            pattern: /Update available![\s\S]{0,200}Release notes: https:\/\/github\.com\/openai\/codex\/releases/m,
+            keys: ["Escape"],
+            description: "Codex startup update-available picker",
+            // A delivery must never land on this screen. Its selected option is
+            // `› 1. Update now (runs … curl … | sh)` — the same `›` the input row
+            // uses — so an Enter here runs an installer instead of sending a message.
+            // The runtime dismisser presses Escape, but it only polls every few
+            // seconds and a delivery can arrive first (hit live on codex-cli 0.153.4,
+            // which parks on this picker for as long as nobody answers it).
+            blocksDelivery: true,
+            // Daemon.dialogMatches uses isActive INSTEAD OF pattern when present.
+            // Check the complete current picker here; a different Enter-only menu
+            // must never receive this automatic Escape key.
+            isActive: codexUpdatePickerVisible,
+        };
     }
-    /**
-     * One-time migration for installations polluted by the old global `codex
-     * mcp add` path. The lock protects separate fleet processes/upgrades, and
-     * atomic rename prevents readers from observing a truncated config.
-     */
-    cleanSharedConfig() {
-        if (this.sharedCodexHome === this.isolatedCodexHome)
-            return;
-        mkdirSync(this.sharedCodexHome, { recursive: true, mode: 0o700 });
-        const lockPath = join(this.sharedCodexHome, AGEND_MCP_CLEANUP_LOCK);
-        let lockFd;
-        const acquire = () => {
-            try {
-                lockFd = openSync(lockPath, "wx", 0o600);
-                return true;
-            }
-            catch {
-                return false;
-            }
+    usageLimitLunaReserveDialog() {
+        // The real codex usage-limit dialog states codex has ALREADY switched to
+        // Luna Reserve and labels Escape as "continue working". Pressing Escape via
+        // sendSpecialKey is the ONLY safe key:
+        //
+        //   • Escape is sent via sendSpecialKey — never via pasteText (which adds
+        //     an implicit bracketed-paste Enter that could confirm the highlighted
+        //     server action: Upgrade, Reset usage, Add Credits, …).
+        //   • A digit selects its row at once, and pasted its implicit Enter would
+        //     confirm whatever it landed on. This path is explicitly NOT used.
+        //
+        // verifyAfterKeys: true — confirm the menu is gone after Escape.
+        // No confirmBeforeEnter / keysAfterConfirm: Escape needs no confirm gate.
+        return {
+            pattern: /Press enter to confirm or esc to continue working/i,
+            keys: ["Escape"],
+            description: "Codex usage limit — pressing Escape to continue with Luna Reserve",
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexUsageLimitMenuVisible,
+            verifyAfterKeys: true,
+            autoResolutionKey: "codex-usage-limit-luna-reserve",
+            postDismissNotice: {
+                text: t("inst.codex_usage_limit_luna_reserve", ""), // instance name injected by daemon
+                label: "codex-usage-limit-selected",
+            },
         };
-        if (!acquire()) {
-            try {
-                if (Date.now() - statSync(lockPath).mtimeMs > AGEND_MCP_CLEANUP_LOCK_STALE_MS) {
-                    unlinkSync(lockPath);
-                    if (!acquire())
-                        return;
-                }
-                else {
-                    return;
-                }
-            }
-            catch {
-                return;
-            }
-        }
-        try {
-            const configPath = join(this.sharedCodexHome, "config.toml");
-            let content;
-            try {
-                content = readFileSync(configPath, "utf-8");
-            }
-            catch {
-                return;
-            }
-            const cleaned = stripAgendMcpTables(content);
-            if (cleaned !== content)
-                atomicWritePrivate(configPath, cleaned);
-        }
-        finally {
-            if (lockFd !== undefined) {
-                try {
-                    closeSync(lockFd);
-                }
-                catch { }
-            }
-            try {
-                unlinkSync(lockPath);
-            }
-            catch { }
-        }
     }
-    getReadyPattern() {
-        // Header and context text persist in inline scrollback and even while the
-        // CLI is loading or a modal owns stdin. Require the live prompt followed
-        // by the Context footer at the *end* of the capture. A valid custom
-        // status_line without Context gets a separate configured-item pattern;
-        // unknown footer values still fail closed. getBusyPattern vetoes a working
-        // turn whose empty composer remains visible.
-        // U+22C6 is Codex's observed cosmetic starfield; it can be drawn in the
-        // prompt, between prompt/footer, and below the footer. A drafted composer
-        // is also idle once this same bottom footer proves it owns the screen.
-        const contextReady = /(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}[ \t⋆]+(?:[0-9a-f-]{36}[ \t]+·[ \t]+)?Context[ \t]+(?:\d+%[ \t]+(?:left|used)|\d+…|…)[^\r\n]*(?:\r?\n[ \t⋆]*)*$/i;
-        const footerPattern = this.configuredStatusLineFooterPattern();
-        if (!footerPattern)
-            return contextReady;
-        // The no-Context alternative requires the exact empty composer followed by
-        // a recognized configured Codex status_line value. If run-state is
-        // configured, that value must specifically be Ready. This is positive
-        // structural proof, never a deny-list of known dialogs.
-        const footerSource = footerPattern.source.slice(1, -1);
-        const noContextReady = new RegExp(String.raw `(?:^|\n)[>›][ \t⋆]*Ask Codex to do anything[ \t⋆]*\r?\n(?:[ \t⋆]*\r?\n){0,3}${footerSource}(?:\r?\n[ \t⋆]*)*$`, "iu");
-        // #978: a configured footer that carries a Context item in any position
-        // is the Context footer: same drafted-composer rule as Context-first. The
-        // whole row must match the configured item grammar, so an arbitrary
-        // indented line that merely contains `Context N% left` cannot pass.
-        const configuredContextReady = this.configuredHasContextItem()
-            ? new RegExp(String.raw `(?:^|\n)[>›][ \t⋆]+(?!\d+\.)\S[^\r\n]*\r?\n(?:[ \t⋆]*\r?\n){0,3}(?=[^\r\n]*${CODEX_CONTEXT_ITEM})${footerSource}(?:\r?\n[ \t⋆]*)*$`, "iu")
-            : null;
-        return new RegExp([contextReady.source, noContextReady.source, configuredContextReady?.source]
-            .filter((source) => !!source)
-            .map(source => `(?:${source})`)
-            .join("|"), "iu");
+    workspaceLimitPromptDialog() {
+        // Escape via sendSpecialKey, the same as the Luna Reserve menu: never a paste
+        // (its implicit Enter would confirm the cursor's row) and never "y". The error
+        // row codex printed above the prompt stays, and the quota pause takes it from
+        // there: one notice, no parked dialog.
+        return {
+            pattern: /^\s*enter select\s*[·•]\s*esc back\s*$/im,
+            keys: ["Escape"],
+            description: "Codex workspace limit prompt — pressing Escape (never asking the owner)",
+            blocksDelivery: true,
+            inputBlocked: true,
+            isActive: codexWorkspaceLimitPromptVisible,
+            verifyAfterKeys: true,
+            autoResolutionKey: "codex-workspace-limit-prompt",
+            answeredByAgend: true,
+            marksLiveIncident: true,
+        };
     }
-    readConfiguredStatusLineItems() {
-        if (this.configuredStatusLineItems !== undefined)
-            return this.configuredStatusLineItems;
-        try {
-            const config = tomlTable(parseToml(readFileSync(join(this.isolatedCodexHome, "config.toml"), "utf-8")));
-            const tui = tomlTable(config?.tui);
-            const items = tui?.status_line;
-            this.configuredStatusLineItems = Array.isArray(items) && items.every(item => typeof item === "string")
-                ? items
-                : null;
-        }
-        catch {
-            this.configuredStatusLineItems = null;
-        }
-        return this.configuredStatusLineItems;
+    unknownSelectionHoldDialog() {
+        return {
+            pattern: /^\s*[›❯>]\s+\S/m,
+            keys: [],
+            description: "Codex interactive selection needs human input",
+            holdOnly: true,
+            blocksDelivery: true,
+            inputBlocked: true,
+            remoteCard: codexSelectionCard,
+            isActive: codexUnknownSelectionVisible,
+        };
     }
-    configuredStatusLineFooterPattern() {
-        if (this.configuredStatusLinePattern !== undefined)
-            return this.configuredStatusLinePattern;
-        const items = this.readConfiguredStatusLineItems();
-        if (!items?.length)
-            return this.configuredStatusLinePattern = null;
-        const configuredPatterns = items
-            .map(item => CODEX_STATUS_LINE_VALUE_PATTERNS[item])
-            .filter((pattern) => pattern !== undefined);
-        if (!configuredPatterns.length)
-            return this.configuredStatusLinePattern = null;
-        const segment = `(?:${configuredPatterns.join("|")})`;
-        const separator = String.raw `[ \t]+·[ \t]+`;
-        const hasRunState = items.some(item => CODEX_RUN_STATE_STATUS_ITEMS.has(item));
-        // Ready must occupy its own status-line segment. Other configured items
-        // may precede/follow it, as Codex joins visible values with ` · `.
-        const line = hasRunState
-            ? `(?:${segment}${separator})*Ready(?:${separator}${segment})*`
-            : `${segment}(?:${separator}${segment})*`;
-        // The configured items, then (optionally) the CLI's own native fields — the same rule as the Context-first footer, so a
-        // `model · Context 46% left    Goal achieved (1h 6m)` row is the footer too, and the readiness regex built from this
-        // source (footerSource) says the same.
-        this.configuredStatusLinePattern = new RegExp(`^[ \t⋆]*${line}(?:${CODEX_NATIVE_FOOTER_FIELDS})?[ \t⋆]*$`, "iu");
-        return this.configuredStatusLinePattern;
+    getRuntimeDialogs() {
+        return [
+            this.autoTrustDialog(),
+            this.trustHoldDialog(),
+            this.rateSwitchPickerDialog(),
+            {
+                // Codex 0.156 may change the wording/order of this credit-cost choice.
+                // Never navigate it by position: a moved option could switch to a
+                // more expensive model. A live picker holds delivery and notifies a
+                // human; old transcript mentions are excluded by the tail matcher.
+                pattern: /(?:Approaching rate limits|Switch to [^\r\n]{1,120} for lower credit usage\?)/i,
+                keys: [],
+                description: "Codex rate limit model switch dialog needs human choice",
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                remoteCard: codexSelectionCard,
+                isActive: codexRateSwitchVisible,
+            },
+            this.updatePickerDialog(),
+            this.usageLimitLunaReserveDialog(),
+            this.workspaceLimitPromptDialog(),
+            ...this.sessionHoldDialogs(),
+            this.unknownSelectionHoldDialog(),
+        ];
     }
-    isConfiguredStatusLineFooter(row) {
-        const pattern = this.configuredStatusLineFooterPattern();
-        if (!pattern)
-            return false;
-        pattern.lastIndex = 0;
-        return pattern.test(row);
+    getInputUnavailableTransients() {
+        return [{
+                pattern: /(?:^|\n)\s*Resuming session…\s*(?:\n|$)/,
+                description: "Codex session resume in progress",
+                isActive: (pane) => {
+                    const rows = pane.split(/\r?\n/);
+                    return codexBoxedResumeLoading(rows) || codexUnboxedResumeLoading(rows);
+                },
+            }];
     }
-    configuredHasContextItem() {
-        return (this.readConfiguredStatusLineItems() ?? []).some(item => CODEX_CONTEXT_STATUS_ITEMS.has(item));
+    /** Only a resume paints "Resuming session…"; a fresh launch never does. */
+    launchMayShowInputTransient() {
+        return this.paneDetectorContext?.launchMayResume() ?? this.lastLaunchResumes;
+    }
+    getQuitCommand() { return "/quit"; }
+    getCompactCommand() { return "/compact"; }
+    getClearCommand() { return "/clear"; }
+    getCancelKey() { return "Escape"; }
+}
+export class CodexBackend extends CodexPaneDetectors {
+    instanceDir;
+    binaryPath;
+    sharedCodexHome;
+    isolatedCodexHome;
+    /** Which subscription this instance runs on, or null for the shared login. */
+    credentialProfile = null;
+    /** Set only after preTrust wrote and read back this instance's private config. */
+    authorizedTrust = null;
+    /** Set by buildCommand when the resume plan fell back; read once by the daemon. */
+    launchWarning = null;
+    /** Set by writeConfig when the status_line could not be made verifiable (#931). */
+    statusLineWarning = null;
+    /** #2357: set by buildCommand when the codex being launched lacks a package companion (codex-code-mode-host). */
+    packageWarning = null;
+    constructor(instanceDir) {
+        super();
+        this.instanceDir = instanceDir;
+        this.binaryPath = resolveBinary("codex");
+        this.sharedCodexHome = resolve(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
+        this.isolatedCodexHome = CodexBackend.resolveShortHome(instanceDir);
     }
     /**
-     * #978: a Context item in ANY position, accepted only as part of a footer
-     * whose every segment matches the configured status_line items. Codex keeps
-     * the user's order (`gpt-5.6-sol medium · Context 46% left · ~/x`); an
-     * arbitrary indented transcript line that happens to contain the item does
-     * not match that grammar. A stale config fails closed, and the daemon's
-     * stable-composer escape hatch then keeps the instance from latching.
+     * Compute and (on first call for an existing instance) migrate to a SHORT
+     * persistent CODEX_HOME under `~/.agend/cx/<8-char-hash>/`.
+     *
+     * Background (#953): codex 0.157.0 added `app-server-control.sock` under
+     * CODEX_HOME. For instances with long `-t<topic_id>` suffixes the full path
+     * exceeds the Unix socket SUN_LEN (~107 chars). codex canonicalises the path
+     * before binding the socket, so a symlink workaround does not help — the real
+     * path must be short.
+     *
+     * Migration steps (each is idempotent; half-completed states self-heal):
+     *  1. If shortHome does not exist AND legacyHome is a real directory (not a
+     *     symlink) → atomic renameSync. On EXDEV or any other error, fall back
+     *     safely: keep using the legacy long path (instance can still start, just
+     *     without the short-path fix).
+     *  2. If shortHome exists but legacyHome is missing → recreate the backward-
+     *     compat symlink (self-heal for rename-succeeded-but-symlink-failed crash).
+     *  3. If both shortHome and legacyHome (as symlink) exist → nothing to do.
+     *  4. New instance (no legacyHome) → create shortHome directly.
+     *
+     * Fail-safe guarantee: migration failure must never make the instance worse.
+     * The caller always receives a valid path it can use as CODEX_HOME.
      */
-    // The configured grammar already makes Context a whole segment, so the item
-    // test only has to establish that one is present.
-    isConfiguredContextFooter(row) {
-        return this.configuredHasContextItem()
-            && new RegExp(CODEX_CONTEXT_ITEM, "iu").test(row)
-            && this.isConfiguredStatusLineFooter(row);
+    /** Exposed for fleet-manager to delete the short home on instance removal. */
+    static shortHomeFor(instanceDir) {
+        return codexShortHomeFor(instanceDir);
     }
-    /** Any footer that proves the Context meter owns the bottom row. */
-    isAnyContextFooter(row) {
-        return isCodexContextFooter(row) || this.isConfiguredContextFooter(row);
+    static resolveShortHome(instanceDir) {
+        const shortHome = CodexBackend.shortHomeFor(instanceDir);
+        const shortBase = join(getAgendHome(), "cx");
+        const canonical = resolve(instanceDir);
+        const legacyHome = resolve(instanceDir, "codex-home");
+        // Only migrate/create when the instance directory itself exists.
+        // Constructing CodexBackend for a non-existent dir (cli-env probes, test
+        // backends that never ran) must not litter ~/.agend/cx/ with orphan dirs.
+        if (!existsSync(canonical))
+            return shortHome;
+        const legacyExists = existsSync(legacyHome);
+        const legacyIsRealDir = legacyExists && !lstatSync(legacyHome).isSymbolicLink();
+        const shortExists = existsSync(shortHome);
+        if (!shortExists) {
+            mkdirSync(shortBase, { recursive: true, mode: 0o700 });
+            if (legacyIsRealDir) {
+                // Attempt atomic rename. Requires same device; fails with EXDEV otherwise.
+                try {
+                    renameSync(legacyHome, shortHome);
+                    // Log the one-time migration for observability.
+                    try {
+                        const logPath = join(shortBase, `${shortHome.split("/").at(-1)}.migrated`);
+                        writeFileSync(logPath, `${new Date().toISOString()} migrated from ${legacyHome}\n`);
+                    }
+                    catch { /* log failure is non-fatal */ }
+                }
+                catch (err) {
+                    // EXDEV (cross-device) or any other rename failure → fail-safe:
+                    // fall back to the legacy long path so the instance still works.
+                    // The socket-length bug persists for this instance but no data is lost.
+                    const code = err.code ?? "unknown";
+                    try {
+                        const warnPath = join(shortBase, `${shortHome.split("/").at(-1)}.migration-failed`);
+                        writeFileSync(warnPath, `${new Date().toISOString()} rename failed (${code}): ${err.message}\n`
+                            + `legacy path remains in use: ${legacyHome}\n`);
+                    }
+                    catch { /* warn log failure is also non-fatal */ }
+                    // Return legacy long path so the instance starts (socket may still fail
+                    // on 0.157.0 for long names, but no data is lost or corrupted).
+                    return legacyHome;
+                }
+            }
+            else if (!legacyExists) {
+                // New instance — no data to migrate.
+                mkdirSync(shortHome, { recursive: true, mode: 0o700 });
+            }
+            // If legacyExists but is already a symlink: shortHome was deleted externally
+            // while the symlink still points to it. Re-create shortHome as a fresh dir.
+            if (!existsSync(shortHome)) {
+                mkdirSync(shortHome, { recursive: true, mode: 0o700 });
+            }
+        }
+        // Backward-compat symlink: instanceDir/codex-home → shortHome.
+        // Also serves as self-heal: if a previous run renamed successfully but
+        // crashed before creating the symlink, we recreate it here.
+        if (!legacyExists || legacyIsRealDir) {
+            // legacyIsRealDir means rename just happened (now shortHome exists, legacyHome gone).
+            // !legacyExists means new instance or symlink was deleted — create it.
+            try {
+                symlinkSync(shortHome, legacyHome);
+            }
+            catch { /* race or already exists */ }
+        }
+        return shortHome;
     }
     /**
-     * #978 escape hatch: the live, EMPTY Codex composer within the last few
-     * non-blank rows, no busy marker, and none of the known selection screens.
-     * Deliberately says nothing about the footer, which is what is unknown.
+     * The row codex paints for input it has taken into its own queue instead of
+     * submitting: `↳ <message>` under "Messages to be submitted after next tool
+     * call (press esc to interrupt and send immediately)".
      */
-    isStableUnknownLayoutIdlePane(pane) {
-        if (this.getBusyPattern().test(pane))
-            return false;
-        // The composer is live-looking and the footer is unknown — exactly this
-        // proof's blind spot — but there is no server behind it (#1099).
-        if (codexAppServerDisconnected(pane))
-            return false;
-        // (No second, wider "esc to interrupt" match here: getBusyPattern() above already reads a live status row of ANY
-        // title — #964 — and anchors it to the whole row at column zero, so a reply that quotes the phrase, indented or
-        // in prose, cannot pin the escape hatch shut (#991).)
-        // A retained queued message (`↳ …` under "Messages to be submitted after
-        // next tool call") means work is pending, whatever the composer shows.
-        if (/↳|Messages to be submitted/i.test(pane))
-            return false;
-        if (codexUsageLimitMenuVisible(pane) || codexRateSwitchVisible(pane)
-            || codexUnknownSelectionVisible(pane) || codexUpdatePickerVisible(pane))
-            return false;
-        const rows = pane.replace(/\r/g, "").split("\n").filter(row => row.trim() !== "");
-        return rows.slice(-6).some(row => /^[>›][ \t⋆]*Ask Codex to do anything[ \t⋆]*$/.test(row));
-    }
-    isCodexIdleFooter(row) {
-        return isCodexContextFooter(row) || this.isConfiguredStatusLineFooter(row);
-    }
-    /** A proxy reply filters chrome per line; whole-pane readiness is separate. */
-    isProxyReplyChromeLine(line) {
-        return /^\s*[›>]\s+Ask Codex to do anything\s*$/.test(line)
-            || this.isAnyContextFooter(line);
+    getQueuedInputMarker() {
+        return /↳/;
     }
-    getErrorPatterns() {
-        return [
-            // Specific quota codes must precede the generic HTTP 429 classifier:
-            // OpenAI returns insufficient_quota with status 429, but switching models
-            // cannot repair an exhausted account and would only start a failover loop.
-            {
-                pattern: new RegExp(String.raw `^\s*(?:${CODEX_STATUS_GLYPH}|Error:|API Error:)\s*[\s\S]{0,240}?\b(?:insufficient_quota|billing_hard_limit_reached|exceeded\s+your\s+current\s+quota)\b|^(?:${CODEX_STATUS_GLYPH}) Quota exceeded\. Check your plan and billing details\.\r?$`, "im"),
-                type: "quota",
-                action: "pause",
-                message: "OpenAI quota exceeded",
-                notice: () => quotaPausedLine("OpenAI", "api_quota"),
-            },
-            {
-                // Codex already exhausted HTTP retries and returned to its composer.
-                // The existing conditional continuation preserves context without
-                // replaying earlier tool effects. Quota remains a preceding pause.
-                pattern: new RegExp(`^${CODEX_EXHAUSTED_429_ROW}$`, "im"),
-                type: "rate_limit",
-                action: "nudge_continue",
-                message: t("inst.codex_rate_retry_stopped"),
-                skipCooldown: true,
-                skipRecoveryWait: true,
-            },
-            {
-                // Pane history contains the agent's own prose, source code and search
-                // results. Bare `rate limit` used to fail over an otherwise healthy
-                // Codex merely for discussing this regex. Match machine-readable API
-                // forms or an error-decorated terminal line instead.
-                pattern: new RegExp(String.raw `^\s*unexpected\s+status\s+429\b|^(?![\s\S]{0,240}?${CODEX_EXHAUSTED_429_ROW})[ \t]*(?:${CODEX_STATUS_GLYPH}|Error:|API Error:)\s*[\s\S]{0,240}?(?:["'](?:status|code)["']\s*:\s*429\b|\b(?:rate_limit_exceeded|too_many_requests)\b|\brate limit(?:ed| exceeded| reached)?\b|\btoo many requests\b)`, "im"),
-                type: "rate_limit",
-                action: "failover",
-                message: "OpenAI rate limit reached",
-            },
-            {
-                // Same false-positive boundary as rate limits: `authentication` is a
-                // normal English/code word. Require a structured 401/code or a
-                // decorated CLI error line before pausing every instance on the shared
-                // credential.
-                pattern: new RegExp(String.raw `^\s*unexpected\s+status\s+401\b|^\s*(?:${CODEX_STATUS_GLYPH}|Error:|API Error:)\s*[\s\S]{0,240}?(?:["'](?:status|code)["']\s*:\s*401\b|\b(?:invalid_api_key|authentication_error)\b|\b401\s+Unauthorized\b|\bauthentication (?:failed|error)\b|\binvalid api key\b)`, "im"),
-                type: "auth_error",
-                action: "pause",
-                message: "OpenAI authentication error",
-            },
-            // Codex writes the apostrophe as U+2019 ("You’ve hit your usage limit.") since
-            // 0.156 and as ASCII before (0.153.4): both must match, or no usage limit
-            // ever pauses the instance (#1098).
-            { pattern: /you['’]ve hit your usage limit/i, type: "quota", action: "pause", message: "Codex usage limit reached — upgrade plan required",
-                notice: () => quotaPausedLine("Codex", "usage") },
-            {
-                // The terminal stage of a lost app-server (#1099): Codex has given up
-                // reconnecting and says so, with a counter that never stops. Nothing
-                // recovers from here without a relaunch, and every message sent in the
-                // meantime waits for an idle that cannot come. Only the LIVE row counts:
-                // directly above the LAST composer with no later transcript item or composer
-                // (the same test as codexAppServerDisconnected, as a lookahead), so text that
-                // merely quotes it does not raise this.
-                pattern: new RegExp(String.raw `^[ \t]*•[ \t]+Reconnect failed[ \t]+—[ \t]+check the endpoint, then relaunch[ \t]+\(\d+[hms](?:[ \t]+\d+[hms])*\)[ \t]*$`
-                    + String.raw `(?=\n(?:[ \t]*\n)*[›>][^\n]*(?:\n(?![•■⚠›>])[^\n]*)*(?![\s\S]))`, "mu"),
-                type: "network",
-                action: "notify",
-                message: "Codex lost its app-server connection and could not reconnect — restart the instance (messages cannot be delivered until then)",
-            },
-            {
-                // Codex reports an unknown model either as a TUI metadata fallback or
-                // as a ChatGPT-account API rejection. Use whitespace-aware phrases so
-                // capture-pane hard wraps do not hide either form.
-                // Codex quotes the slug with BACKTICKS ("Model metadata for `x` not found.",
-                // verified live on 0.160.0 and in the 0.153.4–0.160.0 binaries). The old
-                // pattern only took ASCII quotes, so it could never match a real line.
-                pattern: /model\s+metadata\s+for\s+['"`‘’“”][^'"`‘’“”]+['"`‘’“”]\s+not\s+found\.\s+defaulting\s+to\s+fallback\s+metadata|model\s+is\s+not\s+supported\s+when\s+using\s+codex\s+with\s+a\s+chatgpt\s+account/i,
-                type: "model_error",
-                action: "notify",
-                message: "Codex model unavailable — use /model to switch",
-            },
-            {
-                // A capacity rejection is a completed failed turn: Codex returns to its
-                // prompt without an answer, with its context intact. Keep this anchored to
-                // the exact decorated TUI line so ordinary prose about model capacity
-                // cannot trigger anything on an otherwise healthy instance. The status
-                // glyph is decoration that changes between Codex versions and error classes
-                // (`■` U+25A0 on 0.159.2 and 0.160.0, `⚠` U+26A0 before), so any one
-                // "Other Symbol" glyph (optionally with its emoji selector) opens the line —
-                // never a bullet, dash, quote marker or number, which prose and the model's
-                // own transcript items use (`•`, `-`, `>`). The sentence must fill the line,
-                // from column 0. Box drawing and block elements (U+2500–U+259F) are
-                // excluded up front: they are `So` too, but a left-border popup or
-                // table row (`│ …`) is chrome, not a status line. The CLI is
-                // already back at the prompt, so skipRecoveryWait avoids an extra wait.
-                // action "nudge_continue": tell the user, then about a minute later tell
-                // the agent to keep going (the lifecycle bounds this to 3 per 30 minutes,
-                // then pauses; see #905). No restart — nothing would re-send the turn — and
-                // no model switch. skipCooldown: each NEW capacity line is a new episode,
-                // including a second one right after the nudge.
-                pattern: /^(?![─-▟])\p{So}\uFE0F? Selected model is at capacity\. Please try a different model\.\r?$/mu,
-                type: "model_error",
-                action: "nudge_continue",
-                message: t("inst.codex_model_capacity"),
-                skipCooldown: true,
-                skipRecoveryWait: true,
-            },
-            // Workspace (business) accounts report exhaustion differently from personal
-            // ones, with codex's own rows (codex-rs/protocol error.rs and tui
-            // turn_runtime.rs, unchanged 0.160.0–0.165.0):
-            //   member: "■ Your workspace is out of credits. Ask your workspace owner to refill in order to continue."
-            //           "■ You hit your spend cap set by the owner of your workspace. Ask an owner to increase your spend cap to continue."
-            //   owner:  "■ You're out of credits. Your workspace is out of credits. Add credits to continue using Codex."
-            //           "■ Your workspace is out of credits. Add credits to continue."
-            //           "■ You hit your spend cap set in your workspace. Increase your spend cap to continue."
-            //           "■ Usage limit reached. You've reached your usage limit. Increase your limits to continue using codex."
-            // Neither `insufficient_quota|billing` nor `you've hit your usage limit`
-            // matches them.
-            //
-            // pause, not notify: nothing works until someone refills or raises the cap.
-            // Anchored to the status glyph in COLUMN 0, because these skip the
-            // usage-window check (a workspace limit is not one of those windows, so the
-            // check would call it "available"): codex draws its own error cells there,
-            // while an agent's message, quote or code block is indented under its `•`
-            // (captured live, tests/fixtures/codex-0165-workspace-quoted.pane.txt).
-            // `\s+` at each word gap: capture-pane runs without -J, so tmux's hard wrap
-            // can land a newline anywhere in the sentence. A resumed transcript reprints
-            // these rows, and the first live composer of a spawn takes them as history.
-            {
-                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+(?:You['’]re\s+out\s+of\s+credits\.\s+)?Your\s+workspace\s+is\s+out\s+of\s+credits\.`, "m"),
-                type: "quota",
-                action: "pause",
-                message: "Codex workspace credits exhausted — workspace owner must refill",
-                notice: () => quotaPausedLine("Codex", "workspace_credits"),
-                skipUsageVerify: true,
-                historyUntilLiveComposer: true,
-            },
-            {
-                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+You\s+hit\s+your\s+spend\s+cap\s+set\s+(?:by\s+the\s+owner\s+of|in)\s+your\s+workspace\.`, "m"),
-                type: "quota",
-                action: "pause",
-                message: "Codex workspace spend cap reached — workspace owner must raise it",
-                notice: () => t("inst.quota_spend_cap"),
-                skipUsageVerify: true,
-                historyUntilLiveComposer: true,
-            },
-            {
-                pattern: new RegExp(String.raw `^(?:${CODEX_STATUS_GLYPH})[ \t]+Usage\s+limit\s+reached\.\s+You['’]ve\s+reached\s+your\s+usage\s+limit\.\s+Increase\s+your\s+limits`, "m"),
-                type: "quota",
-                action: "pause",
-                message: "Codex workspace usage limit reached — increase the workspace limits to continue",
-                notice: () => quotaPausedLine("Codex", "workspace_usage"),
-                skipUsageVerify: true,
-                historyUntilLiveComposer: true,
-            },
-            // Codex warns at 10% and 5% remaining, and scopes the limit by period —
-            // "weekly" alone missed every `monthly limit` warning.
-            //
-            // `\s+` at EVERY word gap (not literal spaces) because capture-pane runs without -J,
-            // so tmux's hard wrap can land a newline (plus continuation-line padding)
-            // at any of these word gaps. The trailing "Run /status for a breakdown."
-            // is deliberately NOT part of the pattern — that tail is what actually
-            // wrapped in the reported case.
-            //
-            // `of your <period> limit` is load-bearing: it's what keeps the pattern
-            // off the agent's own prose about percentages.
-            {
-                pattern: /less\s+than\s+(\d+)\s*%\s+of\s+your\s+(hourly|daily|weekly|monthly)\s+limit/i,
-                type: "quota",
-                action: "notify",
-                message: "Codex usage limit running low",
-                formatMessage: (m) => `Codex ${m[2].toLowerCase()} limit: less than ${m[1]}% left`,
-                notice: (m) => (m ? quotaLowLine(m[2], m[1]) : quotaLine("Codex", "usage")),
-            },
-        ];
+    /** #1811: what the last launch left out and why — the Log tab and daemon.log, never a channel. */
+    quietLaunchNotes = [];
+    consumeQuietLaunchNotes() { const notes = this.quietLaunchNotes; this.quietLaunchNotes = []; return notes; }
+    buildCommand(config) {
+        this.lastKnownModel = config.model?.trim() || null;
+        this.credentialProfile = this.readProfile(config);
+        // #2886: `--full-auto` is gone from codex (no supported version, 0.155 on, accepts it: the instance never started);
+        // spelled out, it was a workspace-write sandbox that asks for approval on request.
+        const approvalFlag = config.skipPermissions !== false
+            ? "--dangerously-bypass-approvals-and-sandbox"
+            : "--sandbox workspace-write --ask-for-approval on-request";
+        // #984: never trust `codex resume --last` to pick this instance's session.
+        // Codex 0.157 scopes it to the git REPOSITORY, so in a worktree it resumes
+        // the newest session of any sibling worktree (a lock screen while that
+        // instance lives, a silent hijack otherwise), and a new instance in a
+        // shared repo does not start fresh. Resume the exact-cwd thread from the
+        // shared state DB instead; `--last` is only the fallback for an unreadable
+        // DB when no other Codex instance shares the repository.
+        let cmd;
+        this.launchWarning = null;
+        this.lastLaunchResumes = false;
+        // #2357: read-only (codex is never run here); a launch is not held for it — the operator is told once per launch.
+        this.packageWarning = codexPackageWarning(this.binaryPath);
+        const retainedGeneral = selectedGeneralHostSession(this.instanceDir, config.instanceName, "codex", config.workingDirectory);
+        if (retainedGeneral) {
+            const check = checkResumeId(join(this.isolatedCodexHome, "sessions"), config.workingDirectory, retainedGeneral);
+            if (!check.ok)
+                throw new ResumeBlockedError(t("general_location.start_failed"), t("general_location.start_failed"));
+            this.lastLaunchResumes = true;
+            cmd = `${this.binaryPath} resume ${shellQuote(retainedGeneral)} ${approvalFlag}`;
+        }
+        else if (config.skipResume) {
+            cmd = `${this.binaryPath} ${approvalFlag}`;
+        }
+        else {
+            const resumeBy = (id, why, bytes) => {
+                this.lastLaunchResumes = true;
+                this.writeResumeAttempt(id);
+                const large = bytes !== null && bytes > CODEX_RESUME_LARGE_BYTES ? ` ${t("codex.resume_large", String(Math.round(bytes / (1024 * 1024))))}` : "";
+                this.launchWarning = why + large;
+                return `${this.binaryPath} resume ${shellQuote(id)} ${approvalFlag}`;
+            };
+            const sessionsDir = join(this.isolatedCodexHome, "sessions");
+            // M-2266: the previous launch was told to resume a conversation by id. Codex records a thread as it opens it,
+            // so a resume that did not take (codex exited with "No saved session found…") left no row: this launch starts
+            // fresh, once, and says so. A database that cannot be read proves nothing, and planning goes on as usual.
+            // A new one-shot ask comes first: it is the person's explicit choice for this launch.
+            const oneShot = this.takeResumeNext();
+            const attempt = this.takeResumeAttempt();
+            const failed = !oneShot && attempt !== null && codexThreadRowExists(this.stateDbPath(), attempt) === false;
+            if (failed) {
+                // Remembered, so the auto-resume never picks this conversation again on a later launch.
+                this.rememberFailedResume(attempt);
+                cmd = `${this.binaryPath} ${approvalFlag}`;
+                this.launchWarning = t("codex.resume_failed", config.workingDirectory, attempt);
+            }
+            else if (oneShot) {
+                // M-2266: validated when it was asked for (restart_instance); checked again now, as the rollout may have moved.
+                const check = checkResumeId(sessionsDir, config.workingDirectory, oneShot);
+                if (check.ok)
+                    cmd = resumeBy(check.rollout.id, t("codex.resume_oneshot", config.workingDirectory, check.rollout.id), check.rollout.bytes);
+                else {
+                    cmd = this.plannedCommand(config, approvalFlag, sessionsDir, resumeBy);
+                    this.launchWarning = [t("codex.resume_oneshot_invalid", config.workingDirectory, oneShot, check.reason), this.launchWarning].filter(Boolean).join("\n");
+                }
+            }
+            else {
+                cmd = this.plannedCommand(config, approvalFlag, sessionsDir, resumeBy);
+            }
+        }
+        if (config.model) {
+            const model = validateModel(config.model);
+            warnIfModelMismatch("codex", model);
+            cmd += ` -c ${shellQuote(`model="${model}"`)}`;
+        }
+        if (config.backendOptions?.provider) {
+            const provider = validateProvider(String(config.backendOptions.provider));
+            cmd += ` -c ${shellQuote(`model_provider="${provider}"`)}`;
+        }
+        // #1811: the configured effort, when the catalog entry of the model that will run lists it (launch-effort.ts); else
+        // a quiet note. That model is proven from the command line or the config files codex reads (#1813 review).
+        const runs = resolveCodexLaunchModel({
+            isolatedHome: this.isolatedCodexHome, sharedHome: this.sharedCodexHome,
+            model: config.model, workingDirectory: config.workingDirectory,
+        });
+        const effort = codexEffort(config.effort, runs.proven
+            ? readCodexModelEffortLevels({ isolatedHome: this.isolatedCodexHome, sharedHome: this.sharedCodexHome, model: runs.model })
+            : { model: runs.model, levels: null, unproven: true });
+        if (effort.arg)
+            cmd += effort.arg;
+        this.quietLaunchNotes = effort.note ? [effort.note] : [];
+        // AgEnD instances are unattended processes: an interactive self-update
+        // picker blocks delivery and must never be enabled by a copied global or
+        // managed config layer. Keep this last so the CLI override is authoritative.
+        // Both observed Codex 0.155.0 and 0.156.1 support this launch flag. Pin
+        // the initial layout so a user/global fullscreen preference cannot make a
+        // header-only pane look ready. A later unknown layout still fails closed.
+        cmd += " -c check_for_update_on_startup=false --no-alt-screen";
+        // codex 0.159's opt-in `instant_interrupt` makes new input steer the
+        // running response instead of queueing behind it, which AgEnD's delivery
+        // and queued-input (↳) handling assume. Keep it off whatever a user or
+        // global config says. Codex before 0.159 ignores the key with a startup
+        // warning ("`features.instant_interrupt` is ignored"); nothing else.
+        cmd += " -c features.instant_interrupt=false";
+        // CODEX_HOME is the only Codex-supported way to isolate the complete base
+        // config. A profile only layers over the shared config and would therefore
+        // still load every globally registered AgEnD MCP server.
+        return `CODEX_HOME=${shellQuote(this.isolatedCodexHome)} ${cmd}`;
+    }
+    writeConfig(config) {
+        this.authorizedTrust = null;
+        // Set before the home is prepared: which login this instance gets is a
+        // property of the home, and the home is built here.
+        this.credentialProfile = this.readProfile(config);
+        this.prepareIsolatedHome();
+        this.cleanSharedConfig();
+        // Copy all user settings but no AgEnD MCP entries into a private base
+        // config, then append only this instance's server(s). Each instance writes
+        // a distinct file, eliminating the old concurrent global-config race.
+        let content = "";
+        try {
+            content = stripAgendMcpTables(readFileSync(join(this.sharedCodexHome, "config.toml"), "utf-8"));
+        }
+        catch { /* a first-time Codex user may have no global config */ }
+        if (content && !content.endsWith("\n"))
+            content += "\n";
+        for (const [name, entry] of Object.entries(config.mcpServers)) {
+            content += `\n${renderMcpServer(name, entry, config.instanceName)}`;
+        }
+        atomicWritePrivate(join(this.isolatedCodexHome, "config.toml"), content);
+        this.enableContextStatusLine();
+        this.disableStartupUpdateCheck();
+        this.hideRateLimitModelNudge();
+        // Write fleet instructions into AGENTS.md (additive via marker block)
+        if (config.instructions) {
+            try {
+                const agentsMd = join(config.workingDirectory, "AGENTS.md");
+                appendWithMarker(agentsMd, config.instanceName, config.instructions);
+                // Warn if file exceeds Codex's project_doc_max_bytes limit
+                try {
+                    const size = statSync(agentsMd).size;
+                    if (size > CODEX_PROJECT_DOC_MAX_BYTES) {
+                        console.warn(`[agend] AGENTS.md is ${size} bytes, exceeds Codex limit of ${CODEX_PROJECT_DOC_MAX_BYTES} — instructions may be truncated`);
+                    }
+                }
+                catch { /* stat failed — skip size check */ }
+            }
+            catch { /* best effort */ }
+        }
+    }
+    /**
+     * Stop Codex opening its "Update available!" picker when an instance starts.
+     *
+     * That dialog owns the input loop until someone answers it, so after a fleet
+     * restart every Codex instance sat waiting on a keypress nobody was going to
+     * send. AgEnD then reported it as a stuck pane, which is true but unhelpful.
+     *
+     * `check_for_update_on_startup = false` is Codex's own config key (verified in
+     * the binary), so this prevents the prompt rather than racing to dismiss it.
+     * There is no CLI flag for it — `codex update` is a subcommand, not a switch.
+     *
+     * Placement matters: this is a TOP-LEVEL key, so it has to go above the first
+     * `[section]` header or TOML would read it as belonging to that section. And a
+     * AgEnD's isolated home is unattended, so an inherited `true` is replaced
+     * rather than preserved. TOML rejects duplicate keys, so replace in place.
+     */
+    disableStartupUpdateCheck() {
+        const configPath = join(this.isolatedCodexHome, "config.toml");
+        let content = "";
+        try {
+            content = readFileSync(configPath, "utf-8");
+        }
+        catch {
+            return;
+        }
+        const existing = /^\s*check_for_update_on_startup\s*=\s*(?:true|false)\s*(?:#.*)?$/m;
+        if (existing.test(content)) {
+            const updated = content.replace(existing, "check_for_update_on_startup = false");
+            if (updated !== content) {
+                try {
+                    atomicWritePrivate(configPath, updated);
+                }
+                catch { /* best effort */ }
+            }
+            return;
+        }
+        const LINE = "check_for_update_on_startup = false\n";
+        const firstSection = content.search(/^\s*\[/m);
+        const updated = firstSection === -1
+            ? (content.length && !content.endsWith("\n") ? `${content}\n${LINE}` : `${content}${LINE}`)
+            : `${content.slice(0, firstSection)}${LINE}${content.slice(firstSection)}`;
+        try {
+            atomicWritePrivate(configPath, updated);
+        }
+        catch { /* best effort */ }
+    }
+    /**
+     * Suppress Codex's rate-limit model-switch reminder for unattended instances.
+     * Codex documents this as `notice.hide_rate_limit_model_nudge` (a boolean in
+     * the `[notice]` table). This changes only the per-instance config; the
+     * runtime holdOnly dialog remains as defense-in-depth for older or changed
+     * CLI behavior. No model option is selected automatically.
+     */
+    hideRateLimitModelNudge() {
+        const configPath = join(this.isolatedCodexHome, "config.toml");
+        let content = "";
+        try {
+            content = readFileSync(configPath, "utf-8");
+        }
+        catch {
+            return;
+        }
+        const updated = setTomlTableBoolean(content, "notice", "hide_rate_limit_model_nudge");
+        if (updated !== content) {
+            try {
+                atomicWritePrivate(configPath, updated);
+            }
+            catch { /* best effort */ }
+        }
+    }
+    /**
+     * Ensure Codex's TUI status line shows context usage: the Context item is
+     * both what /ctx scrapes and the footer AgEnD's readiness proofs rely on.
+     * Rules (never drops or reorders the user's items):
+     *   1. the effective `tui.status_line` already has a context item
+     *      (context-remaining / -usage / -used) → leave the config untouched.
+     *   2. no context item:
+     *        - no status_line at all → write status_line = ["context-remaining"]
+     *        - status_line exists     → prepend "context-remaining" to it
+     * Best-effort string edit (no TOML writer), but every candidate edit is
+     * parsed back and kept only if the effective `tui.status_line` becomes
+     * `["context-remaining", ...the user's items]`. A `status_line` key in some
+     * other table is not the TUI's and must not be the one edited (#931). If no
+     * edit can be verified, the launch warns the operator instead of leaving the
+     * pane silently unready.
+     */
+    enableContextStatusLine() {
+        this.configuredStatusLineItems = undefined;
+        this.configuredStatusLinePattern = undefined;
+        this.statusLineWarning = null;
+        const configPath = join(this.isolatedCodexHome, "config.toml");
+        // The private copy is rebuilt from the shared one at every launch, so the
+        // operator must be pointed at the file their status_line actually lives in.
+        const sharedConfigPath = join(this.sharedCodexHome, "config.toml");
+        let content = "";
+        try {
+            content = readFileSync(configPath, "utf-8");
+        }
+        catch { /* no file yet */ }
+        const ITEM = "context-remaining";
+        const current = effectiveTuiStatusLine(content);
+        if (current === "invalid") {
+            this.statusLineWarning = t("codex.status_line_unverifiable", "tui.status_line is not a list of item names, or config.toml does not parse", sharedConfigPath);
+            return;
+        }
+        // Rule 1: the TUI already shows a context item → don't touch anything.
+        if (current?.some(item => CODEX_CONTEXT_STATUS_ITEM_RE.test(item)))
+            return;
+        // TOML allows quoted keys: `"status_line" = [...]`, `"tui"."status_line"`,
+        // `['tui']`. Every textual candidate is tried; parsing decides.
+        const candidates = [];
+        if (current) {
+            // Rule 2b: prepend our item to the user's existing array (don't overwrite).
+            // First position keeps "Context N% left" at the far left of the footer so a
+            // long cwd/other items can't push it past 80 cols and truncate it.
+            for (const m of content.matchAll(/["']?status_line["']?\s*=\s*\[([^\]]*)\]/g)) {
+                const inner = m[1].trim().replace(/^,\s*/, "").replace(/,\s*$/, "");
+                const newInner = inner.length ? `"${ITEM}", ${inner}` : `"${ITEM}"`;
+                candidates.push(`${content.slice(0, m.index)}status_line = [${newInner}]${content.slice(m.index + m[0].length)}`);
+            }
+        }
+        else {
+            // Rule 2a: no status_line at all → add a minimal one.
+            const base = content.length && !content.endsWith("\n") ? `${content}\n` : content;
+            // Also recognise quoted section headers: `["tui"]` and `['tui']`.
+            if (/^\[["']?tui["']?\][^\n]*\n/m.test(base)) {
+                candidates.push(base.replace(/^\[["']?tui["']?\][^\n]*\n/m, h => `${h}status_line = ["${ITEM}"]\n`));
+            }
+            candidates.push(`${base}\n[tui]\nstatus_line = ["${ITEM}"]\n`);
+            // A config that defines tui with dotted keys cannot take a [tui] table.
+            candidates.push(`tui.status_line = ["${ITEM}"]\n${base}`);
+            // Nor can an inline `tui = { … }` table: the item goes inside it.
+            candidates.push(base.replace(/^([ \t]*["']?tui["']?[ \t]*=[ \t]*\{)[ \t]*\}/m, `$1 status_line = ["${ITEM}"] }`));
+            candidates.push(base.replace(/^([ \t]*["']?tui["']?[ \t]*=[ \t]*\{)/m, `$1 status_line = ["${ITEM}"],`));
+        }
+        const wanted = [ITEM, ...(current ?? [])];
+        const fixed = candidates.find(candidate => {
+            const items = effectiveTuiStatusLine(candidate);
+            return Array.isArray(items) && items.length === wanted.length && items.every((item, i) => item === wanted[i]);
+        });
+        if (!fixed) {
+            this.statusLineWarning = t("codex.status_line_unverifiable", "no edit of tui.status_line could be verified", sharedConfigPath);
+            return;
+        }
+        try {
+            atomicWritePrivate(configPath, fixed);
+        }
+        catch (err) {
+            // Never block launch on statusline config — but a verified edit that
+            // could not be written leaves the pane as unready as an unfixable one.
+            const reason = `the verified edit could not be written: ${err.code ?? "write failed"}`;
+            this.statusLineWarning = t("codex.status_line_unverifiable", reason, sharedConfigPath);
+        }
+    }
+    /** Null when the instance did not ask for a profile — today's behaviour. */
+    readProfile(config) {
+        try {
+            return resolveCredentialProfile(config.backendOptions);
+        }
+        catch {
+            // A malformed name is refused where it is written; launching is not the
+            // place to discover it, and falling back to the shared login is the
+            // behaviour every instance had before profiles existed.
+            return null;
+        }
     }
-    getStartupDialogs() {
-        const trustHold = this.trustHoldDialog();
-        return [
-            this.autoTrustDialog(),
-            trustHold,
-            this.updatePickerDialog(),
-            this.rateSwitchPickerDialog(),
-            ...this.sessionHoldDialogs(),
-            this.unknownSelectionHoldDialog(),
-        ];
+    /**
+     * Where this instance's `auth.json` comes from.
+     *
+     * The shared home unless a profile says otherwise. A profile owns the file
+     * itself — not a copy, not a link — so codex refreshing the token writes
+     * into that subscription and no other.
+     */
+    authSourceDir() {
+        if (!this.credentialProfile)
+            return this.sharedCodexHome;
+        const spec = credentialHomeSpec(this.binaryName);
+        if (!spec)
+            return this.sharedCodexHome;
+        const home = credentialProfileHome(getAgendHome(), this.binaryName, this.credentialProfile);
+        prepareCredentialProfileHome(spec, home);
+        return home;
+    }
+    preTrust(workDir) {
+        this.authorizedTrust = null;
+        const paths = codexTrustPaths(workDir);
+        const configPath = join(this.isolatedCodexHome, "config.toml");
+        let content = "";
+        try {
+            content = readFileSync(configPath, "utf-8");
+        }
+        catch { }
+        const updated = setProjectTrusted(content, paths.root);
+        if (updated !== content)
+            atomicWritePrivate(configPath, updated);
+        // Do not authorize an automatic Enter merely because the write returned:
+        // a stale/untrusted section in the effective isolated config must fail shut.
+        const onDisk = readFileSync(configPath, "utf-8");
+        if (effectiveProjectTrust(onDisk, paths.root) !== "trusted")
+            throw new Error("Codex project trust did not persist");
+        this.authorizedTrust = paths;
     }
     /**
-     * #984: session-selection screens only a human may answer. Held (never
-     * keyed) so the delivery gate keeps messages queued and dialog_parked tells
-     * the operator; listed before the generic selection hold for a clear notice.
+     * Preserve Codex login/session/cache sharing while isolating config.toml
+     * and the CODEX_HOME-scoped app-server daemon/control runtime directories.
      */
-    sessionHoldDialogs() {
-        return [
-            {
-                pattern: /This conversation is open in another app/,
-                keys: [],
-                description: "Codex session is open in another process (thread lock) — close the other one and press r, or fork manually",
-                holdOnly: true,
-                blocksDelivery: true,
-                inputBlocked: true,
-                remoteCard: codexSelectionCard,
-                isActive: codexSessionLockVisible,
-            },
-            {
-                pattern: /Working directory · resume/,
-                keys: [],
-                description: "Codex resume selected a session from another directory (sibling git worktree) — needs a human choice",
-                holdOnly: true,
-                blocksDelivery: true,
-                inputBlocked: true,
-                remoteCard: codexSelectionCard,
-                isActive: codexResumeCwdPickerVisible,
-            },
-        ];
+    /** Session dirs every instance must share with the terminal CLI (#506). */
+    static SHARED_SESSION_DIRS = ["sessions", "archived_sessions"];
+    static PRIVATE_RUNTIME_DIRS = new Set(["app-server-daemon", "app-server-control"]);
+    prepareIsolatedHome() {
+        mkdirSync(this.isolatedCodexHome, { recursive: true, mode: 0o700 });
+        chmodSync(this.isolatedCodexHome, 0o700);
+        if (this.sharedCodexHome === this.isolatedCodexHome)
+            return;
+        // #1034: Codex's private socket directory check rejects directory symlinks.
+        // Detach only the exact shared-home links the old mirror pass created,
+        // including dangling links. Leave private directories and other links
+        // alone; Codex will create its own real runtime directories on launch.
+        for (const name of CodexBackend.PRIVATE_RUNTIME_DIRS) {
+            const target = join(this.isolatedCodexHome, name);
+            try {
+                if (lstatSync(target).isSymbolicLink()
+                    && readlinkSync(target) === join(this.sharedCodexHome, name)) {
+                    unlinkSync(target);
+                }
+            }
+            catch { /* absent, or another startup already detached the link */ }
+        }
+        // The session dirs must exist in the SHARED home before the symlink pass:
+        // on a fresh install they don't yet, so no link was created, and the first
+        // archive made Codex create a REAL dir in the instance-private home — a
+        // permanent fork the terminal CLI could never see (#506). mkdir -p is
+        // EEXIST-safe under concurrent instance startup.
+        for (const dir of CodexBackend.SHARED_SESSION_DIRS) {
+            try {
+                mkdirSync(join(this.sharedCodexHome, dir), { recursive: true, mode: 0o700 });
+            }
+            catch { /* best effort */ }
+        }
+        // Heal homes that already forked: merge the private real dir back into the
+        // shared one (never overwriting), then replace it with the symlink.
+        for (const dir of CodexBackend.SHARED_SESSION_DIRS) {
+            this.migrateDivergedSessionDir(dir);
+        }
+        // Older versions linked SQLite's WAL/SHM files independently of their
+        // base database. If the base file had already been created privately,
+        // that split one SQLite database across two homes and caused CANTOPEN (or
+        // worse, cross-database journal recovery). Remove only links AgEnD made to
+        // the matching shared-home path; real private sidecars remain untouched.
+        const healedSidecars = [];
+        for (const name of readdirSync(this.isolatedCodexHome)) {
+            if (!SQLITE_SIDECAR_RE.test(name))
+                continue;
+            const target = join(this.isolatedCodexHome, name);
+            try {
+                if (!lstatSync(target).isSymbolicLink())
+                    continue;
+                const linkTarget = resolve(dirname(target), readlinkSync(target));
+                if (linkTarget !== join(this.sharedCodexHome, name))
+                    continue;
+                unlinkSync(target);
+                healedSidecars.push(name);
+            }
+            catch {
+                // A concurrent process may remove an ephemeral sidecar/link first.
+            }
+        }
+        if (healedSidecars.length > 0) {
+            console.warn(`[agend] removed unsafe Codex SQLite sidecar links: ${healedSidecars.join(", ")}`);
+        }
+        // One file, possibly from somewhere else. Everything below is unchanged:
+        // sessions, the thread/state/memory databases and every cache still come
+        // from the shared home, which is why switching subscription does not throw
+        // the conversation away.
+        this.linkAuthFile();
+        for (const name of readdirSync(this.sharedCodexHome)) {
+            if (CodexBackend.PRIVATE_RUNTIME_DIRS.has(name))
+                continue;
+            if (name === "config.toml" || name === AGEND_MCP_CLEANUP_LOCK || name.startsWith(".config.toml."))
+                continue;
+            if (name === CODEX_AUTH_FILE)
+                continue; // handled above, possibly from a profile
+            // SQLite resolves a symlinked base DB to the shared path and creates its
+            // own adjacent sidecars there. Linking sidecars separately is redundant
+            // for shared bases and corrupts the file set for private bases.
+            if (SQLITE_SIDECAR_RE.test(name))
+                continue;
+            const source = join(this.sharedCodexHome, name);
+            const target = join(this.isolatedCodexHome, name);
+            if (existsSync(target))
+                continue;
+            try {
+                const type = lstatSync(source).isDirectory() ? "dir" : "file";
+                symlinkSync(source, target, type);
+            }
+            catch {
+                // State/cache links are compatibility aids; config isolation must not
+                // fail merely because a concurrently-created cache entry disappeared.
+            }
+        }
+    }
+    /**
+     * Point this home's `auth.json` at whichever login it should use.
+     *
+     * Codex refreshes the token by writing through the link rather than replacing
+     * it — observed across every instance home on a machine that has been running
+     * this arrangement for months, with the shared file's mtime moving. That is
+     * behaviour, though, not a contract: a release that starts renaming over the
+     * file would leave a real file here and quietly fork the login, with refreshes
+     * landing somewhere the profile never sees. So a real file where a link
+     * belongs is treated as exactly that — reported, and put back.
+     */
+    linkAuthFile() {
+        const source = join(this.authSourceDir(), CODEX_AUTH_FILE);
+        const target = join(this.isolatedCodexHome, CODEX_AUTH_FILE);
+        let existing = null;
+        try {
+            existing = lstatSync(target);
+        }
+        catch { /* absent */ }
+        if (existing?.isSymbolicLink()) {
+            let current = "";
+            try {
+                current = resolve(dirname(target), readlinkSync(target));
+            }
+            catch { /* unreadable */ }
+            if (current === source)
+                return;
+            try {
+                unlinkSync(target);
+            }
+            catch { /* raced */ }
+        }
+        else if (existing) {
+            // Not a link: codex replaced it, or an older AgEnD copied it. Either way
+            // the refreshes it has been collecting are stranded in this instance's
+            // home, so say so rather than deleting them silently.
+            const stranded = `${target}.replaced-${Date.now()}`;
+            try {
+                renameSync(target, stranded);
+                console.warn(`[agend] codex replaced ${CODEX_AUTH_FILE} in ${this.isolatedCodexHome} with a real file — `
+                    + `its login was no longer shared. Kept a copy at ${stranded} and re-linked to ${source}.`);
+            }
+            catch {
+                return; // cannot move it; leave the instance working on what it has
+            }
+        }
+        if (!existsSync(source))
+            return; // not logged in yet; codex will create it
+        try {
+            symlinkSync(source, target, "file");
+        }
+        catch {
+            // EEXIST from a concurrent start is the ordinary case and means the link
+            // is already there.
+        }
+    }
+    /**
+     * One-time heal for an instance whose isolated home grew a REAL session dir
+     * (#506): merge it into the shared home without overwriting anything, and
+     * only after both the copy and the removal succeed put the symlink in its
+     * place. Any failure keeps the private dir — sessions are never the thing
+     * sacrificed for tidiness — and logs what happened.
+     */
+    migrateDivergedSessionDir(name) {
+        const target = join(this.isolatedCodexHome, name);
+        let st;
+        try {
+            st = lstatSync(target);
+        }
+        catch {
+            return; // absent — the symlink pass below will create the link
+        }
+        if (st.isSymbolicLink())
+            return; // already correct
+        if (!st.isDirectory()) {
+            console.warn(`[agend] codex-home/${name} is neither a symlink nor a directory — leaving it untouched`);
+            return;
+        }
+        const shared = join(this.sharedCodexHome, name);
+        try {
+            mkdirSync(shared, { recursive: true, mode: 0o700 });
+            // cp -rn semantics: collisions keep the shared copy. Session rollout
+            // filenames are timestamp+uuid, so a genuine collision means the same
+            // file — skipping is lossless either way.
+            cpSync(target, shared, { recursive: true, force: false, errorOnExist: false });
+            rmSync(target, { recursive: true });
+            symlinkSync(shared, target, "dir");
+            console.warn(`[agend] migrated diverged codex ${name} into shared home: ${shared}`);
+        }
+        catch (err) {
+            // Keep whatever is left of the private dir. The copy never overwrites, so
+            // a retry on next start is safe; worst case is duplicated files in the
+            // shared home, never lost ones.
+            console.warn(`[agend] codex ${name} migration failed — keeping the instance-private dir (${err.message})`);
+        }
     }
     /**
-     * The user's decision (hmsg-53600a2c): codex's folder-trust prompt in an AgEnD session is always answered Trust — the
-     * workspace is the agent's own, whatever preTrust covered (preTrust stays, so the prompt rarely shows at all). Enter,
-     * only with the cursor on "Trust and continue" among the known options (trustCursor); any other layout or row is
-     * held (trustHoldDialog). It trusts the folder only: per-action approvals are separate dialogs and are not touched.
+     * One-time migration for installations polluted by the old global `codex
+     * mcp add` path. The lock protects separate fleet processes/upgrades, and
+     * atomic rename prevents readers from observing a truncated config.
      */
-    autoTrustDialog() {
-        return {
-            pattern: /^\s*Trust this folder\?/m,
-            keys: ["Enter"],
-            description: "Codex folder trust — trusting the agent's own folder",
-            blocksDelivery: true,
-            inputBlocked: true,
-            autoResolutionKey: "codex-folder-auto-trust",
-            // One Enter per prompt (claimed, then checked): a prompt still up after it is held, never pressed again (#2896 review).
-            verifyAfterKeys: true,
-            isActive: pane => codexTrustPromptState(pane).trustCursor,
-            answerDetail: pane => ({ autoTrusted: true, ...this.trustPaneFields(pane) }),
+    cleanSharedConfig() {
+        if (this.sharedCodexHome === this.isolatedCodexHome)
+            return;
+        mkdirSync(this.sharedCodexHome, { recursive: true, mode: 0o700 });
+        const lockPath = join(this.sharedCodexHome, AGEND_MCP_CLEANUP_LOCK);
+        let lockFd;
+        const acquire = () => {
+            try {
+                lockFd = openSync(lockPath, "wx", 0o600);
+                return true;
+            }
+            catch {
+                return false;
+            }
         };
+        if (!acquire()) {
+            try {
+                if (Date.now() - statSync(lockPath).mtimeMs > AGEND_MCP_CLEANUP_LOCK_STALE_MS) {
+                    unlinkSync(lockPath);
+                    if (!acquire())
+                        return;
+                }
+                else {
+                    return;
+                }
+            }
+            catch {
+                return;
+            }
+        }
+        try {
+            const configPath = join(this.sharedCodexHome, "config.toml");
+            let content;
+            try {
+                content = readFileSync(configPath, "utf-8");
+            }
+            catch {
+                return;
+            }
+            const cleaned = stripAgendMcpTables(content);
+            if (cleaned !== content)
+                atomicWritePrivate(configPath, cleaned);
+        }
+        finally {
+            if (lockFd !== undefined) {
+                try {
+                    closeSync(lockFd);
+                }
+                catch { }
+            }
+            try {
+                unlinkSync(lockPath);
+            }
+            catch { }
+        }
     }
-    trustHoldDialog() {
-        return {
-            pattern: /^\s*(?:Folder access|Trust this folder\?|Do you trust the files in this folder\?)/im,
-            keys: [],
-            description: "Codex folder trust needs human confirmation",
-            holdOnly: true,
-            blocksDelivery: true,
-            inputBlocked: true,
-            isActive: codexTrustVariantActive,
-            remoteCard: codexSelectionCard,
-            heldReason: pane => this.trustHoldReason(pane),
-        };
+    readConfiguredStatusLineItems() {
+        if (this.configuredStatusLineItems !== undefined)
+            return this.configuredStatusLineItems;
+        try {
+            const config = tomlTable(parseToml(readFileSync(join(this.isolatedCodexHome, "config.toml"), "utf-8")));
+            const tui = tomlTable(config?.tui);
+            const items = tui?.status_line;
+            this.configuredStatusLineItems = Array.isArray(items) && items.every(item => typeof item === "string")
+                ? items
+                : null;
+        }
+        catch {
+            this.configuredStatusLineItems = null;
+        }
+        return this.configuredStatusLineItems;
     }
     /**
      * #2893: why the authorized folder-trust answer did not take this prompt (log only): what the pane shows against what
@@ -2254,147 +2465,6 @@ export class CodexBackend {
             authorizedCwd: authorized?.cwd ?? null, authorizedRoot: authorized?.root ?? null,
             configPath: join(this.isolatedCodexHome, "config.toml") };
     }
-    /**
-     * #1008: the rate-limit model-switch picker parked unattended instances (it
-     * waits forever and its default option changes the model). Prevention is
-     * `notice.hide_rate_limit_model_nudge` (hideRateLimitModelNudge — real and
-     * effective on 0.157.1 and 0.159.2, verified live); this is the answer for a
-     * picker that appears anyway (config not applied, a CLI that moved the key).
-     *
-     * Escape, not a navigated Enter: it selects nothing, so it can never take
-     * option 1 (switch model) or option 3 (writes "never show again" into the
-     * config). Deliberately not one-shot: if the picker swallowed the key it is
-     * simply sent again on the next poll, and a repeated Escape is harmless.
-     */
-    rateSwitchPickerDialog() {
-        return {
-            // Documentation only: Daemon.dialogMatches uses isActive INSTEAD of this
-            // pattern, so it filters nothing here — the structural check below is the
-            // whole decision, and ordinary prose about the picker fails it. The words
-            // are the picker's own, kept so a reader can find the screen from the log.
-            pattern: /Keep current model \(never show again\)/,
-            keys: ["Escape"],
-            description: "Codex rate-limit model-switch picker — Escape keeps the current model",
-            blocksDelivery: true,
-            inputBlocked: true,
-            isActive: codexRateSwitchPickerVisible,
-        };
-    }
-    updatePickerDialog() {
-        return {
-            // Defense in depth for config written by older AgEnD versions or a Codex
-            // regression. Match the release URL as well as the banner so ordinary
-            // agent prose cannot trigger a keypress.
-            pattern: /Update available![\s\S]{0,200}Release notes: https:\/\/github\.com\/openai\/codex\/releases/m,
-            keys: ["Escape"],
-            description: "Codex startup update-available picker",
-            // A delivery must never land on this screen. Its selected option is
-            // `› 1. Update now (runs … curl … | sh)` — the same `›` the input row
-            // uses — so an Enter here runs an installer instead of sending a message.
-            // The runtime dismisser presses Escape, but it only polls every few
-            // seconds and a delivery can arrive first (hit live on codex-cli 0.153.4,
-            // which parks on this picker for as long as nobody answers it).
-            blocksDelivery: true,
-            // Daemon.dialogMatches uses isActive INSTEAD OF pattern when present.
-            // Check the complete current picker here; a different Enter-only menu
-            // must never receive this automatic Escape key.
-            isActive: codexUpdatePickerVisible,
-        };
-    }
-    usageLimitLunaReserveDialog() {
-        // The real codex usage-limit dialog states codex has ALREADY switched to
-        // Luna Reserve and labels Escape as "continue working". Pressing Escape via
-        // sendSpecialKey is the ONLY safe key:
-        //
-        //   • Escape is sent via sendSpecialKey — never via pasteText (which adds
-        //     an implicit bracketed-paste Enter that could confirm the highlighted
-        //     server action: Upgrade, Reset usage, Add Credits, …).
-        //   • A digit selects its row at once, and pasted its implicit Enter would
-        //     confirm whatever it landed on. This path is explicitly NOT used.
-        //
-        // verifyAfterKeys: true — confirm the menu is gone after Escape.
-        // No confirmBeforeEnter / keysAfterConfirm: Escape needs no confirm gate.
-        return {
-            pattern: /Press enter to confirm or esc to continue working/i,
-            keys: ["Escape"],
-            description: "Codex usage limit — pressing Escape to continue with Luna Reserve",
-            blocksDelivery: true,
-            inputBlocked: true,
-            isActive: codexUsageLimitMenuVisible,
-            verifyAfterKeys: true,
-            autoResolutionKey: "codex-usage-limit-luna-reserve",
-            postDismissNotice: {
-                text: t("inst.codex_usage_limit_luna_reserve", ""), // instance name injected by daemon
-                label: "codex-usage-limit-selected",
-            },
-        };
-    }
-    workspaceLimitPromptDialog() {
-        // Escape via sendSpecialKey, the same as the Luna Reserve menu: never a paste
-        // (its implicit Enter would confirm the cursor's row) and never "y". The error
-        // row codex printed above the prompt stays, and the quota pause takes it from
-        // there: one notice, no parked dialog.
-        return {
-            pattern: /^\s*enter select\s*[·•]\s*esc back\s*$/im,
-            keys: ["Escape"],
-            description: "Codex workspace limit prompt — pressing Escape (never asking the owner)",
-            blocksDelivery: true,
-            inputBlocked: true,
-            isActive: codexWorkspaceLimitPromptVisible,
-            verifyAfterKeys: true,
-            autoResolutionKey: "codex-workspace-limit-prompt",
-            answeredByAgend: true,
-            marksLiveIncident: true,
-        };
-    }
-    unknownSelectionHoldDialog() {
-        return {
-            pattern: /^\s*[›❯>]\s+\S/m,
-            keys: [],
-            description: "Codex interactive selection needs human input",
-            holdOnly: true,
-            blocksDelivery: true,
-            inputBlocked: true,
-            remoteCard: codexSelectionCard,
-            isActive: codexUnknownSelectionVisible,
-        };
-    }
-    getRuntimeDialogs() {
-        return [
-            this.autoTrustDialog(),
-            this.trustHoldDialog(),
-            this.rateSwitchPickerDialog(),
-            {
-                // Codex 0.156 may change the wording/order of this credit-cost choice.
-                // Never navigate it by position: a moved option could switch to a
-                // more expensive model. A live picker holds delivery and notifies a
-                // human; old transcript mentions are excluded by the tail matcher.
-                pattern: /(?:Approaching rate limits|Switch to [^\r\n]{1,120} for lower credit usage\?)/i,
-                keys: [],
-                description: "Codex rate limit model switch dialog needs human choice",
-                holdOnly: true,
-                blocksDelivery: true,
-                inputBlocked: true,
-                remoteCard: codexSelectionCard,
-                isActive: codexRateSwitchVisible,
-            },
-            this.updatePickerDialog(),
-            this.usageLimitLunaReserveDialog(),
-            this.workspaceLimitPromptDialog(),
-            ...this.sessionHoldDialogs(),
-            this.unknownSelectionHoldDialog(),
-        ];
-    }
-    getInputUnavailableTransients() {
-        return [{
-                pattern: /(?:^|\n)\s*Resuming session…\s*(?:\n|$)/,
-                description: "Codex session resume in progress",
-                isActive: (pane) => {
-                    const rows = pane.split(/\r?\n/);
-                    return codexBoxedResumeLoading(rows) || codexUnboxedResumeLoading(rows);
-                },
-            }];
-    }
     getContextUsage() {
         return null;
     }
@@ -2507,10 +2577,6 @@ export class CodexBackend {
             return peers ? codexSiblingState(config.workingDirectory, peers) : "siblings";
         });
     }
-    /** Only a resume paints "Resuming session…"; a fresh launch never does. */
-    launchMayShowInputTransient() {
-        return this.lastLaunchResumes;
-    }
     consumeLaunchWarning() {
         const warnings = [this.packageWarning, this.statusLineWarning, this.launchWarning].filter((w) => !!w);
         this.packageWarning = null;
@@ -2518,10 +2584,6 @@ export class CodexBackend {
         this.launchWarning = null;
         return warnings.length ? warnings.join("\n") : null;
     }
-    getQuitCommand() { return "/quit"; }
-    getCompactCommand() { return "/compact"; }
-    getClearCommand() { return "/clear"; }
-    getCancelKey() { return "Escape"; }
     // Codex has no `/effort`; reasoning effort is the `model_reasoning_effort`
     // config key (settable per launch with `-c`). The TUI reads it at startup, so
     // a change needs a respawn — restart, not runtime.