@ucsandman/legcli 0.7.0

package/src/taps/codex.mjs

@@ -0,0 +1,286 @@
+// codex tap — an interactive `codex` writes its whole thread to a rollout
+// file, flushed per event (observed live 2026-09-11: file mtime == last line
+// timestamp). Baton tails that file; no hook is injected, so codex never shows
+// its "review new hooks" prompt for a Baton session.
+// Shapes (observed live, codex-cli 0.153.4, originator codex-tui):
+//   session_meta.payload  {id, cwd, originator, cli_version, source}
+//   event_msg.token_count.rate_limits {primary:{used_percent,window_minutes,resets_at}, secondary:{…}}
+//     primary = 300 min (5h), secondary = 10080 min (7d)
+//   event_msg.task_complete.error {message:"You've hit your usage limit…", codex_error_info:"usage_limit_exceeded"}
+//   response_item.message {role:'user'|'assistant', content:[{type:'input_text'|'output_text', text}]}
+// Source of the error text: codex-rs/protocol/src/error.rs (UsageLimitReachedError).
+import { spawn, spawnSync } from 'node:child_process'
+import { existsSync, readdirSync, readFileSync, statSync, openSync, readSync, closeSync, fstatSync } from 'node:fs'
+import { join } from 'node:path'
+import { LAYOUT } from '../accounts.mjs'
+import { sanitizeEnv } from '../env.mjs'
+import codexAdapter from '../adapters/codex.mjs'
+
+const LEG_VERSION = (() => { try { return JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version } catch { return 'unknown' } })()
+
+export function sessionsRootFor(codexHome = LAYOUT.codex.home()) { return join(codexHome, 'sessions') }
+
+function sameDir(a, b) {
+  const n = (x) => String(x ?? '').replace(/\\/g, '/').replace(/\/$/, '').toLowerCase()
+  return n(a) === n(b)
+}
+
+const localDay = (d) => `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`
+
+// Newest rollout created at or after `sinceMs` whose session_meta cwd is `cwd`.
+export function findRollout({ codexHome, cwd, sinceMs, allowOlderMs = 5000 }) {
+  const root = sessionsRootFor(codexHome)
+  if (!existsSync(root)) return null
+  // codex names the day directory from LOCAL time while the rollout's own
+  // session_meta timestamp is UTC (observed live: a 20:33 EDT rollout under
+  // sessions/2026/09/10 stamped 2026-09-11T00:33:44Z). Compare local days, and
+  // keep the one before as slack around midnight.
+  const from = localDay(new Date(sinceMs - allowOlderMs - 86400000))
+  const days = []
+  for (const y of readdirSync(root)) for (const m of safeList(join(root, y))) for (const day of safeList(join(root, y, m))) {
+    if (`${y}-${m}-${day}` >= from) days.push(join(root, y, m, day))
+  }
+  const cands = []
+  for (const dir of days) for (const f of safeList(dir)) {
+    if (!f.startsWith('rollout-') || !f.endsWith('.jsonl')) continue
+    const p = join(dir, f)
+    let st
+    try { st = statSync(p) } catch { continue }
+    if (st.birthtimeMs && st.birthtimeMs < sinceMs - allowOlderMs && st.mtimeMs < sinceMs - allowOlderMs) continue
+    cands.push({ p, mtime: st.mtimeMs })
+  }
+  cands.sort((a, b) => b.mtime - a.mtime)
+  for (const c of cands) {
+    const meta = readMeta(c.p)
+    if (meta && sameDir(meta.cwd, cwd) && Date.parse(meta.timestamp ?? 0) >= sinceMs - allowOlderMs) return { path: c.p, meta }
+  }
+  return null
+}
+
+function safeList(dir) { try { return readdirSync(dir) } catch { return [] } }
+
+export function readMeta(path) {
+  try {
+    const fd = openSync(path, 'r')
+    // session_meta carries the git snapshot and can run past 15 KB (seen live)
+    const buf = Buffer.alloc(Math.min(1048576, fstatSync(fd).size))
+    readSync(fd, buf, 0, buf.length, 0)
+    closeSync(fd)
+    const first = buf.toString('utf8').split('\n')[0]
+    const j = JSON.parse(first)
+    return j.type === 'session_meta' ? j.payload : null
+  } catch { return null }
+}
+
+// Incremental reader: keeps a byte offset and a partial line. `from` skips
+// what is already in the file (agy's log is per session, not per leg).
+export function createTail(path, { from = 0 } = {}) {
+  let offset = from
+  let rest = ''
+  return {
+    path,
+    read() {
+      let st
+      try { st = statSync(path) } catch { return [] }
+      // truncated or replaced under us: read it again rather than go blind
+      if (st.size < offset) { offset = 0; rest = '' }
+      if (st.size <= offset) return []
+      const fd = openSync(path, 'r')
+      const buf = Buffer.alloc(st.size - offset)
+      readSync(fd, buf, 0, buf.length, offset)
+      closeSync(fd)
+      offset = st.size
+      const text = rest + buf.toString('utf8')
+      const lines = text.split('\n')
+      rest = lines.pop() ?? ''
+      return lines.filter(Boolean)
+    },
+  }
+}
+
+const USAGE_LIMIT_RE = /hit your usage limit/i
+const RETRY_AT_RE = /try again at ([^.]+?)(?:\.|$)/i
+const PATCH_BLOCK_RE = /\*\*\* Begin Patch\n([\s\S]*?)\n\*\*\* End Patch/g
+const PATCH_FILE_RE = /^\*\*\* (?:Add|Update|Delete) File: ([^\r\n]+)$/gm
+
+function applyPatchArgument(args) {
+  const text = String(args ?? '')
+  if (text.startsWith('*** Begin Patch')) return text
+  const start = /tools\.apply_patch\(\s*(['"])/.exec(text)
+  if (!start) return text
+  const quote = start[1]
+  let value = ''
+  for (let i = start.index + start[0].length; i < text.length; i += 1) {
+    const char = text[i]
+    if (char === quote) return value
+    if (char !== '\\' || i + 1 === text.length) { value += char; continue }
+    const escaped = text[++i]
+    if (escaped === 'n') value += '\n'
+    else if (escaped === 'r') value += '\r'
+    else if (escaped === '\\' || escaped === quote) value += escaped
+    else value += `\\${escaped}`
+  }
+  return text
+}
+
+function patchFiles(args) {
+  // A functions.exec payload can contain an apply_patch JavaScript string,
+  // where patch line breaks are serialized as literal "\\n". Decode only
+  // that string argument so direct patches retain literal Windows backslashes.
+  const patch = applyPatchArgument(args).replace(/\r\n/g, '\n')
+  const files = []
+  for (const block of patch.matchAll(PATCH_BLOCK_RE)) {
+    let match
+    while ((match = PATCH_FILE_RE.exec(block[1]))) files.push(match[1].trim())
+  }
+  return files
+}
+
+// Codex can expose either window as primary. The duration is the identity:
+// current Pro Lite rollouts expose only primary=10080 (the weekly window).
+export function normalizeRateLimits(rateLimits) {
+  const out = { five_hour: null, seven_day: null }
+  const entries = [rateLimits?.primary, rateLimits?.secondary]
+  for (const raw of entries) {
+    if (!raw) continue
+    const pct = Number(raw.used_percent ?? raw.usedPercent)
+    if (!Number.isFinite(pct)) continue
+    const minutes = Number(raw.window_minutes ?? raw.windowDurationMins)
+    const window = { pct, resets_at: raw.resets_at ?? raw.resetsAt ?? null, window_minutes: Number.isFinite(minutes) ? minutes : null }
+    if (minutes === 300) out.five_hour = window
+    else if (minutes === 10080) out.seven_day = window
+    // An absent or unfamiliar duration stays unknown. Primary is a transport
+    // position, not a promise that this is the 5-hour bucket.
+  }
+  return out
+}
+
+function parseRetryAt(msg) {
+  const m = RETRY_AT_RE.exec(msg ?? '')
+  if (!m) return null
+  // "Sep 14th, 2026 9:35 PM" → strip the ordinal suffix
+  const t = Date.parse(m[1].replace(/(\d+)(st|nd|rd|th)/, '$1'))
+  return Number.isFinite(t) ? Math.floor(t / 1000) : null
+}
+
+// lines → { limits, limit, messages, turnsDone, taskStarted, threadId }
+export function parseLines(lines) {
+  const out = { limits: null, limits_at: null, limit: null, messages: [], turnsDone: 0, taskStarted: 0, threadId: null, files: [] }
+  for (const line of lines) {
+    let j
+    try { j = JSON.parse(line) } catch { continue }
+    const p = j.payload ?? {}
+    if (j.type === 'session_meta') { out.threadId = p.id ?? null; continue }
+    if (j.type === 'event_msg') {
+      if (p.type === 'token_count' && p.rate_limits) {
+        out.limits = normalizeRateLimits(p.rate_limits)
+        out.limits_at = j.timestamp ?? null
+      } else if (p.type === 'task_started') out.taskStarted += 1
+      else if (p.type === 'task_complete') {
+        out.turnsDone += 1
+        if (p.last_agent_message) out.messages.push({ role: 'assistant', text: String(p.last_agent_message).slice(0, 1500), ts: j.timestamp ?? null })
+        const err = p.error
+        if (err && (err.codex_error_info === 'usage_limit_exceeded' || USAGE_LIMIT_RE.test(err.message ?? ''))) {
+          out.limit = { reason: 'usage_limit_exceeded', detail: String(err.message ?? '').slice(0, 300), resets_at: parseRetryAt(err.message), observed_at: j.timestamp ?? null, raw: j }
+        }
+      } else if (p.type === 'error' && USAGE_LIMIT_RE.test(p.message ?? '')) {
+        out.limit = { reason: 'usage_limit_exceeded', detail: String(p.message).slice(0, 300), resets_at: parseRetryAt(p.message), observed_at: j.timestamp ?? null, raw: j }
+      }
+      continue
+    }
+    if (j.type === 'response_item') {
+      if (p.type === 'message' && Array.isArray(p.content)) {
+        const text = p.content.filter((c) => (c.type === 'input_text' || c.type === 'output_text') && c.text).map((c) => c.text).join('\n').trim()
+        // skip the injected context (<environment_context>, and the "# AGENTS.md instructions" block codex
+        // prepends to a thread: observed live 2026-09-11 as the first user message of every rollout)
+        if (text && !/^<[a-z_-]+>/i.test(text) && !/^# AGENTS\.md instructions/i.test(text)) out.messages.push({ role: p.role === 'user' ? 'user' : 'assistant', text: text.slice(0, 1500), ts: j.timestamp ?? null })
+      } else if (p.type === 'function_call' || p.type === 'custom_tool_call') {
+        const args = String(p.arguments ?? p.input ?? '')
+        out.files.push(...patchFiles(args))
+      }
+    }
+  }
+  return out
+}
+
+// Read the account quota without starting a model turn. This protocol and the
+// `ordinaryUsageAllowed` tri-state come from `codex app-server
+// generate-json-schema --experimental`; null means unavailable and must not be
+// inferred from percentages.
+export function readCodexUsage({ codexHome = LAYOUT.codex.home(), timeoutMs = 8000, signal = null } = {}) {
+  return new Promise((resolvePromise) => {
+    let child
+    let settled = false
+    let stdout = ''
+    const killProbe = () => {
+      if (!child?.pid || child.exitCode !== null || child.signalCode !== null) return
+      if (process.platform === 'win32') spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' })
+      else { try { process.kill(-child.pid, 'SIGTERM') } catch { try { child.kill() } catch {} } }
+    }
+    const finish = (result, { kill = false } = {}) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      signal?.removeEventListener?.('abort', onAbort)
+      if (kill) killProbe()
+      else {
+        try { child?.stdin.end() } catch {}
+        const cleanup = setTimeout(killProbe, 1000)
+        cleanup.unref?.()
+        child?.once('exit', () => clearTimeout(cleanup))
+      }
+      resolvePromise(result)
+    }
+    const stop = (error) => {
+      finish({ ok: false, limits: null, available: null, observed_at: null, error }, { kill: true })
+    }
+    const onAbort = () => stop('codex usage read cancelled')
+    const timer = setTimeout(() => stop('codex usage read timed out'), timeoutMs)
+    timer.unref?.()
+    if (signal?.aborted) return onAbort()
+    signal?.addEventListener?.('abort', onAbort, { once: true })
+    try {
+      const { bin, viaNode, entry } = codexAdapter.resolve()
+      const args = [...(viaNode ? [entry ?? bin] : []), 'app-server', '--listen', 'stdio://']
+      const env = { ...sanitizeEnv(process.env, { interactive: true }), CODEX_HOME: codexHome }
+      child = spawn(viaNode ? process.execPath : bin, args, { env, windowsHide: true, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'] })
+      child.stderr.resume()
+    } catch { return stop('codex app-server failed to start') }
+    child.on('error', () => stop('codex app-server failed to start'))
+    child.stdin.on('error', () => stop('codex app-server input closed'))
+    child.on('exit', (code) => { if (!settled) finish({ ok: false, limits: null, available: null, observed_at: null, error: `codex app-server exited (${code ?? 'unknown'})` }) })
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk.toString('utf8')
+      const lines = stdout.split('\n')
+      stdout = lines.pop() ?? ''
+      for (const line of lines) {
+        let message
+        try { message = JSON.parse(line) } catch { continue }
+        if (message.id === 1 && message.result) {
+          try {
+            child.stdin.write(`${JSON.stringify({ method: 'initialized' })}\n`)
+            child.stdin.write(`${JSON.stringify({ id: 2, method: 'account/rateLimits/read', params: { excludeResetCreditDetails: true } })}\n`)
+          } catch { return stop('codex app-server input closed') }
+        } else if (message.id === 2) {
+          if (message.error || !message.result) return stop('codex rate-limit read failed')
+          const snapshot = message.result.rateLimitsByLimitId?.codex ?? message.result.rateLimits
+          const limits = normalizeRateLimits(snapshot)
+          const available = typeof message.result.ordinaryUsageAllowed === 'boolean' ? message.result.ordinaryUsageAllowed : null
+          return finish({ ok: available !== null || Boolean(limits.five_hour || limits.seven_day), limits, available, observed_at: new Date().toISOString(), error: null })
+        }
+      }
+    })
+    try { child.stdin.write(`${JSON.stringify({ id: 1, method: 'initialize', params: { clientInfo: { name: 'leg', version: LEG_VERSION }, capabilities: { experimentalApi: true } } })}\n`) } catch { stop('codex app-server input closed') }
+  })
+}
+
+export function firstPrompt(path) {
+  if (!path || !existsSync(path)) return null
+  const r = parseLines(readFileSync(path, 'utf8').split('\n').filter(Boolean))
+  return r.messages.find((m) => m.role === 'user')?.text.slice(0, 500) ?? null
+}
+
+export function transcriptTail(path, limit = 8) {
+  if (!path || !existsSync(path)) return []
+  return parseLines(readFileSync(path, 'utf8').split('\n').filter(Boolean)).messages.slice(-limit)
+}

package/src/trust.mjs

@@ -0,0 +1,323 @@
+// trust — records the folder-trust answer each agent CLI asks for on its first
+// run in a directory, before Baton spawns that agent.
+//
+// Why this exists: the handoff is the product. When claude hits its 5-hour
+// limit at 3am, Baton writes the bundle and starts codex in the same terminal
+// with nobody there. If the incoming agent has never run in that folder it
+// stops on a full-screen "Is this a project you trust?" prompt and waits for a
+// keypress that is not coming, and the handoff the user paid for silently
+// becomes a stalled terminal they find in the morning.
+//
+// Each CLI already stores that answer in a file, so the fix is to write the
+// same answer the user would have clicked, for the repository they already
+// chose by typing `baton claude` in it:
+//
+//   claude  ~/.claude.json            projects["<repo>"].hasTrustDialogAccepted
+//           (or $CLAUDE_CONFIG_DIR/.claude.json)
+//   codex   ~/.codex/config.toml      [projects."<repo>"] trust_level = "trusted"
+//   agy     ~/.gemini/trustedFolders.json   "<repo>": "TRUST_FOLDER"
+//
+// For claude this is the documented remedy: its own permissions docs say to
+// "set projects[<path>].hasTrustDialogAccepted to true in ~/.claude.json, where
+// <path> is the repository root", and its error text prints the same sentence.
+//
+// Three rules this module holds to, because it writes files Baton does not own:
+//   1. Never create a config file that is not already there. A missing file
+//      means that CLI has never run here, so its own first-run flow (login,
+//      onboarding) is about to happen with the user present anyway. Skip.
+//   2. Never rewrite a file to say what it already says. No write, no risk.
+//   3. Never lose what is already in the file. Read, add, write atomically,
+//      under the same cross-process lock the rest of Baton uses.
+//
+// BATON_TRUST=never turns all of it off; the prompts come back.
+import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve, dirname, parse, isAbsolute } from 'node:path'
+import { realPath, withFileLock, writeJsonAtomic } from './fsx.mjs'
+
+// The repository root is the unit of trust: claude walks up from the working
+// directory to the repo root looking for the flag, so one record covers every
+// worktree Baton creates under <repo>/.baton-worktrees/ as well.
+export function repoRootOf(dir) {
+  let at = realPath(dir)
+  const stop = parse(at).root
+  while (true) {
+    if (existsSync(join(at, '.git'))) return at
+    const up = dirname(at)
+    if (up === at || at === stop) return realPath(dir)
+    at = up
+  }
+}
+
+export function trustPolicy(env = process.env) {
+  const raw = String(env.LEG_TRUST ?? env.BATON_TRUST ?? 'auto').trim().toLowerCase()
+  return raw === 'never' || raw === 'off' || raw === '0' ? 'never' : 'auto'
+}
+
+// ---- claude ----
+
+// A path like `C:\cfg` is absolute on Windows and a plain relative filename
+// everywhere else, so `resolve()` on a POSIX host prepends the process's own
+// cwd and invents a directory that was never named. These functions describe a
+// Windows agent's config, and they have to say the same thing whatever host
+// they are asked on, so a drive-letter path is taken as already absolute.
+const DRIVE_ABS = /^[A-Za-z]:[\\/]/
+
+function absolutely(p) { return DRIVE_ABS.test(p) ? p : resolve(p) }
+
+export function claudeConfigFile(env = process.env) {
+  const dir = env.CLAUDE_CONFIG_DIR ? absolutely(env.CLAUDE_CONFIG_DIR) : homedir()
+  return join(dir, '.claude.json')
+}
+
+// Claude Code stores a project under a normalized spelling of its path, and on
+// Windows that spelling is forward slashes with an upper-case drive letter and
+// no trailing separator: 100 of the 104 entries in a real ~/.claude.json are in
+// that form, and the four that are not are older duplicates of projects that
+// also appear in the new form. Write the wrong spelling and the entry is simply
+// ignored: the flag is on file, the prompt still appears, and nothing says why.
+export function claudeProjectKey(repo) {
+  // realPath() resolves symlinks and 8.3 names against the host filesystem,
+  // which is the right thing for a path that lives on it and meaningless for a
+  // drive-letter path on a POSIX host: there it silently becomes cwd + the
+  // literal. A drive-letter path is already the canonical spelling, so it is
+  // normalized directly.
+  const raw = String(repo)
+  let p = (DRIVE_ABS.test(raw) ? raw : realPath(raw)).replace(/\\/g, '/')
+  if (/^[a-z]:/.test(p)) p = p[0].toUpperCase() + p.slice(1)
+  return p.length > 3 ? p.replace(/\/+$/, '') : p
+}
+
+// The canonical key, plus the spellings Claude Code used in older versions.
+// Older spellings are updated when they are already in the file and never
+// created, so Baton corrects a stale entry without littering the config.
+export function projectKeys(repo, existing = {}) {
+  const key = claudeProjectKey(repo)
+  const out = [key]
+  for (const v of [key.normalize('NFC'), realPath(repo), resolve(repo)]) {
+    if (!out.includes(v) && Object.prototype.hasOwnProperty.call(existing, v)) out.push(v)
+  }
+  // The older spelling is the same path written with Windows separators, so it
+  // is recognised by its spelling rather than by asking the host to resolve it:
+  // matching on the exact string only worked on a host where a backslash is a
+  // separator, and the entry Baton was meant to correct was left stale
+  // anywhere else. Nothing is created here — an entry is only ever brought up
+  // to date when it is already in the file.
+  for (const k of Object.keys(existing)) {
+    if (!out.includes(k) && k.includes('\\') && claudeProjectKey(k.replace(/\\/g, '/')) === key) out.push(k)
+  }
+  return out
+}
+
+// A project-level CLAUDE.md that imports a file outside the working directory
+// is what triggers the second prompt ("Allow external CLAUDE.md file imports?").
+// Claude Code reads a CLAUDE.md from every ancestor directory of the working
+// directory, so an import in C:\Projects\CLAUDE.md is external to a session in
+// C:\Projects\some-repo. Returns the resolved paths, so Baton can print exactly
+// what it approved instead of approving something invisible.
+export function externalImports(cwd) {
+  const start = realPath(cwd)
+  const stop = parse(start).root
+  const dirs = []
+  for (let at = start; ; at = dirname(at)) {
+    dirs.push(at)
+    if (at === stop || dirname(at) === at) break
+  }
+  const home = realPath(homedir())
+  const out = []
+  for (const dir of dirs) {
+    // ~/.claude/CLAUDE.md is user memory, not project memory: its imports never
+    // raise the dialog, so they are not ours to approve either.
+    if (dir === home) continue
+    const file = join(dir, 'CLAUDE.md')
+    if (!existsSync(file)) continue
+    let text
+    try { text = readFileSync(file, 'utf8') } catch { continue }
+    for (const line of text.split('\n')) {
+      const m = line.match(/^\s*@(\S+)\s*$/)
+      if (!m) continue
+      const target = isAbsolute(m[1]) ? resolve(m[1]) : resolve(dir, m[1])
+      if (inside(target, start) || out.includes(target)) continue
+      out.push(target)
+    }
+  }
+  return out
+}
+
+function inside(target, root) {
+  const a = process.platform === 'win32' ? target.toLowerCase() : target
+  const b = process.platform === 'win32' ? root.toLowerCase() : root
+  return a === b || a.startsWith(b.endsWith('\\') || b.endsWith('/') ? b : b + (b.includes('\\') ? '\\' : '/'))
+}
+
+function readJson(file) {
+  try { return JSON.parse(readFileSync(file, 'utf8')) } catch { return null }
+}
+
+export function ensureClaudeTrust(repo, { env = process.env, cwd = repo } = {}) {
+  const file = claudeConfigFile(env)
+  const root = repoRootOf(repo)
+  // Rule 1: a config that is not there means claude has never run as this
+  // user. Its own onboarding is next, with a person at the keyboard.
+  if (!existsSync(file)) return { agent: 'claude', file, wrote: [], imports: [], skipped: 'no claude config yet' }
+  const imports = externalImports(cwd)
+  let wrote = []
+  withFileLock(`${file}.baton-lock`, () => {
+    const cfg = readJson(file)
+    // Rule 3: an unreadable or non-object config is not ours to repair.
+    if (!cfg || typeof cfg !== 'object') { wrote = null; return }
+    const projects = cfg.projects && typeof cfg.projects === 'object' ? cfg.projects : {}
+    const keys = projectKeys(root, projects)
+    // Rule 4, and the one that matters most: an answer already on file is the
+    // user's, including "no". Only an ABSENT key is an unanswered question.
+    // Treating "not true" as "not asked yet" would flip a deliberate refusal
+    // to trust a folder into trust, silently, on every run in that repo.
+    const said = (o, k) => Object.prototype.hasOwnProperty.call(o, k)
+    if (keys.some((k) => projects[k] && said(projects[k], 'hasTrustDialogAccepted') && projects[k].hasTrustDialogAccepted !== true)) {
+      wrote = 'declined'
+      return
+    }
+    const changed = []
+    for (const key of keys) {
+      const was = projects[key] && typeof projects[key] === 'object' ? projects[key] : {}
+      const next = { ...was }
+      const here = []
+      if (!said(was, 'hasTrustDialogAccepted')) { next.hasTrustDialogAccepted = true; here.push('hasTrustDialogAccepted') }
+      // The imports question is answered separately, and declining it is also
+      // an answer: WarningShown true with Approved false is a recorded "no".
+      if (imports.length && !said(was, 'hasClaudeMdExternalIncludesWarningShown') && !said(was, 'hasClaudeMdExternalIncludesApproved')) {
+        next.hasClaudeMdExternalIncludesApproved = true
+        next.hasClaudeMdExternalIncludesWarningShown = true
+        here.push('hasClaudeMdExternalIncludesApproved', 'hasClaudeMdExternalIncludesWarningShown')
+      }
+      if (!here.length) continue
+      projects[key] = next
+      changed.push(...here)
+    }
+    // Rule 2: nothing to say that the file does not already say.
+    if (!changed.length) return
+    writeJsonAtomic(file, { ...cfg, projects })
+    wrote = [...new Set(changed)]
+  })
+  if (wrote === null) return { agent: 'claude', file, wrote: [], imports, skipped: 'claude config is not readable json' }
+  if (wrote === 'declined') return { agent: 'claude', file, root, wrote: [], imports, skipped: 'you answered no for this folder; Baton leaves that answer alone' }
+  return { agent: 'claude', file, root, wrote, imports, skipped: null }
+}
+
+// ---- codex ----
+
+export function codexConfigFile(env = process.env) {
+  const dir = env.CODEX_HOME ? resolve(env.CODEX_HOME) : join(homedir(), '.codex')
+  return join(dir, 'config.toml')
+}
+
+// TOML basic strings escape a backslash, which is every separator on Windows.
+const tomlPath = (p) => p.replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+
+export function ensureCodexTrust(repo, { env = process.env } = {}) {
+  const file = codexConfigFile(env)
+  const root = repoRootOf(repo)
+  if (!existsSync(file)) return { agent: 'codex', file, wrote: [], imports: [], skipped: 'no codex config yet' }
+  let wrote = []
+  withFileLock(`${file}.baton-lock`, () => {
+    let text
+    try { text = readFileSync(file, 'utf8') } catch { wrote = null; return }
+    if (codexTrustedPaths(text).some((p) => samePath(p, root))) return
+    const block = `\n[projects."${tomlPath(root)}"]\ntrust_level = "trusted"\n`
+    // Append only: a TOML table added at the end cannot change the meaning of
+    // a table above it, and Baton never reformats a file it did not write.
+    writeTextAtomic(file, text.endsWith('\n') ? text + block : text + '\n' + block)
+    wrote = ['trust_level']
+  })
+  if (wrote === null) return { agent: 'codex', file, wrote: [], imports: [], skipped: 'codex config is not readable' }
+  return { agent: 'codex', file, root, wrote, imports: [], skipped: null }
+}
+
+// Every folder config.toml already names. Codex writes the same folder two
+// ways, plain and in the \\?\ extended-length form, so both unescape to the
+// path we are about to compare against.
+export function codexTrustedPaths(text) {
+  const out = []
+  for (const m of text.matchAll(/^\s*\[projects\."((?:[^"\\]|\\.)*)"\]/gm)) {
+    const raw = m[1].replace(/\\(.)/g, '$1')
+    out.push(raw.replace(/^\\\\\?\\/, ''))
+  }
+  return out
+}
+
+function samePath(a, b) {
+  return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b
+}
+
+function writeTextAtomic(file, text) {
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`
+  writeFileSync(tmp, text)
+  for (let i = 0; i < 20; i++) {
+    try { renameSync(tmp, file); return } catch (err) {
+      // Windows holds a brief lock on a file another process has open; the
+      // same retry the rest of Baton uses rather than lose the config.
+      if (!['EPERM', 'EBUSY', 'EACCES', 'EEXIST'].includes(err.code)) { try { unlinkSync(tmp) } catch {} throw err }
+      const until = Date.now() + 25
+      while (Date.now() < until) { /* spin */ }
+    }
+  }
+  try { unlinkSync(tmp) } catch {}
+  writeFileSync(file, text)
+}
+
+// ---- agy ----
+
+export function agyTrustFile(env = process.env) {
+  const dir = env.GEMINI_CONFIG_DIR ? resolve(env.GEMINI_CONFIG_DIR) : join(homedir(), '.gemini')
+  return join(dir, 'trustedFolders.json')
+}
+
+export function ensureAgyTrust(repo, { env = process.env } = {}) {
+  const file = agyTrustFile(env)
+  const root = repoRootOf(repo)
+  // agy keeps trust in its own small file rather than a big config, so an
+  // absent file next to an existing ~/.gemini is just an empty answer sheet.
+  if (!existsSync(dirname(file))) return { agent: 'agy', file, wrote: [], imports: [], skipped: 'no agy config yet' }
+  let wrote = []
+  withFileLock(`${file}.baton-lock`, () => {
+    const map = existsSync(file) ? readJson(file) : {}
+    if (map === null || typeof map !== 'object') { wrote = null; return }
+    // Rule 4: a folder already in this file has been answered, whatever the
+    // answer was. Only an absent key is an unanswered question; anything else
+    // (DO_NOT_TRUST included) is the user's decision and stays.
+    if (Object.prototype.hasOwnProperty.call(map, root)) { if (map[root] !== 'TRUST_FOLDER') wrote = 'declined'; return }
+    writeJsonAtomic(file, { ...map, [root]: 'TRUST_FOLDER' })
+    wrote = ['TRUST_FOLDER']
+  })
+  if (wrote === null) return { agent: 'agy', file, wrote: [], imports: [], skipped: 'agy trust file is not readable json' }
+  if (wrote === 'declined') return { agent: 'agy', file, root, wrote: [], imports: [], skipped: 'you answered no for this folder; Baton leaves that answer alone' }
+  return { agent: 'agy', file, root, wrote, imports: [], skipped: null }
+}
+
+// ---- the one entry point ----
+
+const ENSURE = { claude: ensureClaudeTrust, codex: ensureCodexTrust, agy: ensureAgyTrust }
+
+// Returns a result even when nothing was written, so the caller can say why.
+export function ensureTrust(agent, repo, { env = process.env, cwd = repo } = {}) {
+  if (trustPolicy(env) === 'never') return { agent, wrote: [], imports: [], skipped: 'BATON_TRUST=never' }
+  const fn = ENSURE[agent]
+  if (!fn) return { agent, wrote: [], imports: [], skipped: `no trust record for ${agent}` }
+  try {
+    return fn(repo, { env, cwd })
+  } catch (err) {
+    // A trust record Baton could not write is a prompt the user will answer
+    // themselves. It is never a reason to fail the session.
+    return { agent, wrote: [], imports: [], skipped: `could not write the trust record: ${err.message}` }
+  }
+}
+
+// The line Baton prints. Null when there is nothing worth saying.
+export function trustLine(result) {
+  if (!result || !result.wrote?.length) return null
+  const what = result.agent === 'claude' && result.imports?.length
+    ? `trusted ${result.root} for claude, and allowed ${result.imports.length} external CLAUDE.md import${result.imports.length === 1 ? '' : 's'}: ${result.imports.join(', ')}`
+    : `trusted ${result.root} for ${result.agent}`
+  return `${what} (recorded in ${result.file}; BATON_TRUST=never turns this off)`
+}
+