acbridge 1.1.2 → 1.2.0

package/plugin/plugins/alexa/scripts/codex-signal.mjs

@@ -14,6 +14,9 @@
 //   SessionStart        compact                    SILENT — Pre/PostCompact own compaction
 //   UserPromptSubmit     —                         working
 //   Stop                 —                         finished
+//   SessionEnd           —                         ended (upstream shipped SessionEnd mid-2026; the
+//                                                   hub's 30-min idle close is now the BACKSTOP for
+//                                                   abnormal exits / pre-SessionEnd Codex builds)
 //   PermissionRequest    —                         needs_permission (observe-and-abstain: NEVER stdout —
 //                                                   Codex's permission-shaped hooks read stdout as an
 //                                                   approve/deny decision; this script never writes one)
@@ -24,6 +27,10 @@
 //   PostToolUse                —                        a state-less context TICK (POST .../context)
 //   anything else                 —                        exit 0, nothing to report
 //
+//   (synthesized)      first event ever seen for a       started, POSTed BEFORE the event's own signal —
+//                      session is not a start/end        the v0.146 TUI dispatches NO SessionStart hook
+//                                                        (codex exec does); see TUI-SYNTHESIZED START below
+//
 // Unlike Claude Code, Codex's own hook payload carries `model` and `permission_mode` on EVERY event, so
 // the mode/model FERRY (feeding the hub's modePlan/modeAuto/.../modelChanged synthesis, same as
 // signal.mjs) is a straight field read here — no transcript walk needed for that part. The transcript
@@ -52,7 +59,7 @@
 // only); stdout is NEVER written to (Codex hook stdout can influence approve/deny — this script is
 // observe-only, on every path, always).
 
-import { closeSync, fstatSync, openSync, readFileSync, readSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, openSync, readFileSync, readSync, writeFileSync } from "node:fs";
 import { request } from "node:http";
 import os from "node:os";
 import path from "node:path";
@@ -85,6 +92,23 @@ if (event === null || typeof event !== "object") done(); // non-object JSON (e.g
 // Part-B: an adapter owns this session's states already — bail before touching the handshake or the hub.
 if (process.env.ACB_CODEX_ADAPTER) done();
 
+// ── The memories thread guard (2026-08, live-verified). Codex opens a SECOND session at startup with
+// cwd inside its own home (`~/.codex/memories`, 2.3s after the real one). It is not a human session —
+// signalling it self-derives a `memories@<machine>~codex` identity, arms the hub's duration watch, and
+// pollutes the context tracker. Any event whose cwd sits under the codex home is dropped HERE, before
+// handshake resolution, so it can neither POST nor write a handshake file. CODEX_HOME (upstream's home
+// relocation) is honoured. Accepted cost: a user deliberately running codex with cwd inside ~/.codex
+// gets no profile signals for that session.
+{
+  const evCwd = typeof event.cwd === "string" ? event.cwd : "";
+  if (evCwd) {
+    const norm = (p) => String(p).replace(/\\/g, "/").replace(/\/+$/, "");
+    const codexHome = norm(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"));
+    const c = norm(evCwd);
+    if (c === codexHome || c.startsWith(codexHome + "/")) done();
+  }
+}
+
 // ── Dormancy gate: resolve THIS run's hub coordinates, mirroring signal.mjs's resolution order. ──────
 const isPlaceholder = (v) => Boolean(v) && /^\$\{.*\}$/.test(v); // sanitized-env literal `${BRIDGE_*}`
 const envVar = (v) => (v && !isPlaceholder(v) ? v : undefined);
@@ -183,8 +207,34 @@ function selfDeriveHandshake(ev, cfg) {
 }
 
 const cfg = readCliConfig();
-let handshake = resolveHandshake(typeof event.session_id === "string" ? event.session_id : undefined);
-if (!handshake && autoProfilesEnabled(cfg)) handshake = selfDeriveHandshake(event, cfg);
+const codexSid = typeof event.session_id === "string" ? event.session_id : undefined;
+let handshake = resolveHandshake(codexSid);
+
+// ── TUI-SYNTHESIZED START (2026-08-02, live-verified on Codex v0.146). The 0.146 interactive TUI
+// dispatches NO SessionStart hook at open — the same binary's `codex exec` does, same hooks.json, same
+// trust rows (a TUI session sat open with zero dispatches anywhere; every event after the first prompt
+// then fired normally). No hook ⇒ no code of ours runs, so the closest honest approximation is: when the
+// FIRST event we ever see for a session is not itself a start (SessionStart would double) or a close
+// (started→ended in one breath is a pointless flash-and-revert), SessionStart never dispatched —
+// synthesize `started` and POST it BEFORE the event's own signal. First-sighting detection is the
+// self-derive handshake write itself: a lane where SessionStart DOES fire (exec, or a fixed future TUI)
+// writes the file at start, so every later event finds it and never re-synthesizes. The explicit
+// BRIDGE_SESSION_ID env path never synthesizes (a launcher that exports coords owns its own lifecycle),
+// and a no-account run writes no file ⇒ no synthesis (the hub would refuse the unattributable POST anyway).
+let synthesizeStart = false;
+if (!handshake && autoProfilesEnabled(cfg)) {
+  const sessionsFile = codexSid ? path.join(SECRET_DIR, "sessions", `${codexSid}.json`) : null;
+  const hadFile = Boolean(sessionsFile) && existsSync(sessionsFile);
+  handshake = selfDeriveHandshake(event, cfg);
+  const name = String(event.hook_event_name ?? "");
+  synthesizeStart =
+    Boolean(handshake) &&
+    Boolean(sessionsFile) &&
+    !hadFile &&
+    existsSync(sessionsFile) && // the write really happened (needs a signed-in account)
+    name !== "SessionStart" &&
+    name !== "SessionEnd";
+}
 if (!handshake) done(); // no bridge session AND no hub configured (or auto-profiles off) — stay silent
 
 // ── Classify table: hook_event_name (+ source) → one wire state, {tick:true}, or null. ────────────────
@@ -193,7 +243,8 @@ function classify(ev) {
   switch (name) {
     case "SessionStart": {
       const source = String(ev.source ?? "");
-      // A compact "restart" is the SAME session continuing — PostCompact owns compaction.
+      // A compact "restart" is the SAME session continuing — PostCompact owns compaction. A "fork"
+      // deliberately falls through to `started` (a forked session IS a new session opening here).
       if (source === "compact") return null;
       return { state: source === "resume" ? "resumed" : "started" };
     }
@@ -201,6 +252,10 @@ function classify(ev) {
       return { state: "working" };
     case "Stop":
       return { state: "finished" };
+    case "SessionEnd":
+      // The real close (upstream hook, mid-2026): runs the hub's ONE ended path — arbiter stand-down +
+      // scene revert — immediately, instead of waiting out the 30-min SessionIdleWatch backstop.
+      return { state: "ended" };
     case "PermissionRequest":
       // Observe-and-abstain: classify it for the device signal, but NEVER emit stdout (below, always).
       return { state: "needs_permission" };
@@ -213,11 +268,11 @@ function classify(ev) {
     case "SubagentStop":
       return { state: "subagentFinished" };
     case "PostToolUse": {
-      // S2: legacy best-effort error detection — MIRRORS signal.mjs's exact tool_response check (the
-      // Claude sibling, same field names): fire only when the tool response explicitly signals a hard
-      // failure, biased to UNDER-fire (an unflagged failure stays silent) so a normal session never
-      // flashes the error scene.
-      const resp = ev.tool_response;
+      // S2: legacy best-effort error detection — MIRRORS signal.mjs's exact check (the Claude sibling,
+      // same field names: upstream's `tool_output` first, older `tool_response` as fallback): fire only
+      // when the tool response explicitly signals a hard failure, biased to UNDER-fire (an unflagged
+      // failure stays silent) so a normal session never flashes the error scene.
+      const resp = ev.tool_output ?? ev.tool_response;
       const isError =
         resp &&
         typeof resp === "object" &&
@@ -234,7 +289,10 @@ function classify(ev) {
 }
 
 const mapped = classify(event);
-if (!mapped) done(); // this event carries no state and no tick → no-op
+// A synthesized start still POSTs even when the triggering event itself classifies to nothing (a future
+// unregistered hook as the first sighting) — otherwise that sighting writes the handshake, exits, and the
+// session's start is lost forever.
+if (!mapped && !synthesizeStart) done(); // no state, no tick, nothing to synthesize → no-op
 
 // ── readRolloutTail: the context ferry. Positioned read of the last 64KB only — rollouts reach tens of
 // MB and this runs per tool call. Walk BACKWARD for the first (= latest) token_count row; cumulative
@@ -331,23 +389,37 @@ const ids = {
   ts: Date.now(),
   ...(typeof event.cwd === "string" ? { cwd: event.cwd } : {}),
 };
-// A tick (PostToolUse) targets the state-less context route; everything else is a state signal.
-const apiPath = mapped.tick ? "/local/session/context" : "/local/session/state";
 // Straight from the payload — unlike Claude, Codex ships model + permission_mode on every hook event.
 const mode = typeof event.permission_mode === "string" && event.permission_mode ? event.permission_mode : undefined;
 const model = typeof event.model === "string" && event.model ? event.model : undefined;
 const ferry = { agent: "codex", ...(mode ? { mode } : {}), ...(model ? { model } : {}) };
-const payload = JSON.stringify(
-  mapped.tick
-    ? { ...ids, ...(context ? { context } : {}), ...ferry }
-    : {
-        ...ids,
-        state: mapped.state,
-        event: `codex:${String(event.hook_event_name ?? "")}`,
-        ...(context ? { context } : {}),
-        ...ferry,
-      },
-);
+// This event's signal(s), POSTed strictly in order: a synthesized `started` must land BEFORE the event's
+// own signal so the hub tracker sees start → activity exactly as a real dispatch order would. A tick
+// (PostToolUse) targets the state-less context route; everything else is a state signal. The `event`
+// audit string on the synthesized row says so — the state digest shows what really happened.
+const posts = [];
+if (synthesizeStart) {
+  posts.push({
+    apiPath: "/local/session/state",
+    payload: JSON.stringify({ ...ids, state: "started", event: "codex:SessionStart~synthesized", ...(context ? { context } : {}), ...ferry }),
+  });
+}
+if (mapped) {
+  posts.push({
+    apiPath: mapped.tick ? "/local/session/context" : "/local/session/state",
+    payload: JSON.stringify(
+      mapped.tick
+        ? { ...ids, ...(context ? { context } : {}), ...ferry }
+        : {
+            ...ids,
+            state: mapped.state,
+            event: `codex:${String(event.hook_event_name ?? "")}`,
+            ...(context ? { context } : {}),
+            ...ferry,
+          },
+    ),
+  });
+}
 
 /** One bounded breadcrumb for a REJECTED signal — the twin of signal.mjs's, which this script lacked, so
  *  a dead cross-boundary Codex hook left no trace anywhere and `doctor` had nothing to report. Written to
@@ -377,30 +449,37 @@ function recordHookRejection(status) {
 }
 
 // node:http (not fetch) for zero deps + guaranteed NO Origin header (the guard 403s any Origin) + a hard
-// timeout. Observe-and-abstain: this response is drained and discarded — NOTHING from it (or anywhere
-// else in this script) is ever written to our own stdout.
-const req = request(
-  {
-    host: "127.0.0.1",
-    port: handshake.hubPort,
-    path: apiPath,
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      "content-length": Buffer.byteLength(payload),
-      "x-bridge-hub-token": token,
+// timeout per request. Sequential: each POST goes out only after the previous one's response completes
+// (order is the point of the chain); an unreachable/unresponsive hub aborts the remainder — bounded,
+// never blocking Codex. Observe-and-abstain: responses are drained and discarded — NOTHING from them (or
+// anywhere else in this script) is ever written to our own stdout.
+function send(i) {
+  if (i >= posts.length) done();
+  const { apiPath, payload } = posts[i];
+  const req = request(
+    {
+      host: "127.0.0.1",
+      port: handshake.hubPort,
+      path: apiPath,
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload),
+        "x-bridge-hub-token": token,
+      },
+      timeout: 2000,
     },
-    timeout: 2000,
-  },
-  (res) => {
-    if (res.statusCode && res.statusCode >= 400) recordHookRejection(res.statusCode);
-    res.on("data", () => {}); // drain
-    res.on("end", done);
-  },
-);
-req.on("timeout", () => {
-  req.destroy();
-  done();
-});
-req.on("error", done); // hub down / connection refused → silent no-op
-req.end(payload);
+    (res) => {
+      if (res.statusCode && res.statusCode >= 400) recordHookRejection(res.statusCode);
+      res.on("data", () => {}); // drain
+      res.on("end", () => send(i + 1));
+    },
+  );
+  req.on("timeout", () => {
+    req.destroy();
+    done(); // an unresponsive hub won't take the next one either
+  });
+  req.on("error", done); // hub down / connection refused → silent no-op
+  req.end(payload);
+}
+send(0);

package/plugin/plugins/alexa/scripts/signal.mjs

@@ -170,25 +170,26 @@ function selfDeriveHandshake(ev, cfg) {
   // SIGNED-IN account (sub === pinned scope). No account ⇒ nothing written ⇒ unattributable ⇒ still refused;
   // an acbridge run / channel file is never overwritten; the selfWritten marker keeps gate.mjs dev-freedom.
   //
-  // RACE-SAFETY — never write at SessionStart: SessionStart hooks are DOCUMENTED to fire BEFORE plugin MCP
-  // servers finish connecting (code.claude.com/docs/en/hooks). So on a bare `claude --channels` VOICE session
-  // the channel hasn't written its (non-selfWritten) handshake yet at SessionStart; writing a selfWritten file
-  // here would let the channel adopt it verbatim ("prefer it verbatim, never overwrite") and gate.mjs would
-  // then treat the VOICE session as plain and drop its credential-read guard. By any LATER hook a voice
-  // session's channel file already exists → resolveHandshake returns it → this self-derive path isn't reached.
-  // A plain session just picks up its handshake (and profiles) from its first post-start activity instead of
-  // the started scene — a small, deliberate cost to keep the voice guard sound.
-  if (String(ev.hook_event_name ?? "") !== "SessionStart") {
-    writePlainSessionHandshakeIfAbsent({
-      secretDir: SECRET_DIR,
-      id,
-      hubPort: cfg.hubPort,
-      hubTokenFile,
-      cwd,
-      claudeSessionId: typeof ev.session_id === "string" ? ev.session_id : undefined,
-      sub: readActiveUserSub(SECRET_DIR),
-    });
-  }
+  // The write runs on EVERY hook, SessionStart INCLUDED (2026-08). It used to be suppressed at
+  // SessionStart (which fires BEFORE plugin MCP servers connect, code.claude.com/docs/en/hooks) so a
+  // bare `claude --channels` channel could never mistake a selfWritten race file for its own — but that
+  // suppression made `started`/`resumed` DEAD in every plain/app-launched session: no handshake at
+  // start ⇒ the hub drops the whole start payload ⇒ start scenes never fire. The race it guarded is
+  // CLOSED by AS-T9f2 (channel/src/handshake.ts): the channel, on connect, ADOPTS a pre-existing file
+  // and MERGE-asserts `voice: true` onto it (every field preserved, selfWritten included), before any
+  // reply egress or the first PreToolUse gate — so gate.mjs sees the voice marker either way. The lone
+  // residual is handshake.ts's documented Finding A (that atomic merge-rewrite failing), judged
+  // practically unreachable there: a same-user atomic rewrite of a 0600 file milliseconds old, inside
+  // the sub-second window before mcp.connect.
+  writePlainSessionHandshakeIfAbsent({
+    secretDir: SECRET_DIR,
+    id,
+    hubPort: cfg.hubPort,
+    hubTokenFile,
+    cwd,
+    claudeSessionId: typeof ev.session_id === "string" ? ev.session_id : undefined,
+    sub: readActiveUserSub(SECRET_DIR),
+  });
   return { id, hubPort: cfg.hubPort, hubTokenFile };
 }
 
@@ -197,6 +198,71 @@ let handshake = resolveHandshake(typeof event.session_id === "string" ? event.se
 if (!handshake && autoProfilesEnabled(cfg)) handshake = selfDeriveHandshake(event, cfg);
 if (!handshake) done(); // no bridge session AND no hub configured (or auto-profiles off) — stay silent
 
+// ── Agent device-brief (2026-08-02, "Make agent aware of devices in chat"). At SessionStart, ask the
+// hub whether this cwd's bound profile enables the brief and print it as additionalContext — the ONE
+// stdout this script ever writes, and only on this event (every other path stays byte-silent). Emit
+// on startup/clear/fork AND on compact (compaction is precisely when previously-injected context is
+// lost); SKIP resume (the resumed transcript already contains the brief). Silent on any error,
+// non-200, enabled:false, or a dead hub (ECONNREFUSED returns instantly; the timeout only guards a
+// hung hub — a session must never start late because of us). The GET creates no files and completes
+// BEFORE the classify/POST flow below, so ordering and the exit-0 contract are unchanged.
+await new Promise((resolveBrief) => {
+  const name = String(event.hook_event_name ?? "");
+  const source = String(event.source ?? "");
+  if (name !== "SessionStart" || source === "resume") return resolveBrief();
+  let token = "";
+  try {
+    token = readFileSync(handshake.hubTokenFile, "utf8").trim();
+  } catch {
+    return resolveBrief();
+  }
+  if (!token) return resolveBrief();
+  const cwd = typeof event.cwd === "string" && event.cwd ? event.cwd : process.cwd();
+  let settled = false;
+  const settle = () => {
+    if (!settled) {
+      settled = true;
+      resolveBrief();
+    }
+  };
+  const req = request(
+    {
+      host: "127.0.0.1",
+      port: handshake.hubPort,
+      path: `/local/agent/brief?cwd=${encodeURIComponent(cwd)}&agent=claude`,
+      method: "GET",
+      headers: { "x-bridge-hub-token": token },
+      timeout: 600,
+    },
+    (res) => {
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (c) => (body += c));
+      res.on("end", () => {
+        try {
+          if (res.statusCode === 200) {
+            const parsed = JSON.parse(body || "{}");
+            if (parsed && parsed.enabled === true && typeof parsed.brief === "string" && parsed.brief) {
+              // Nested exactly as the hooks contract requires; sliced defensively under the upstream
+              // 10k additionalContext cap (the hub already composes ≤9,500 — this guards version skew).
+              process.stdout.write(
+                JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: parsed.brief.slice(0, 9800) } }) + "\n",
+              );
+            }
+          }
+        } catch {
+          /* silent — the brief is an optimization, never a fault */
+        }
+        settle();
+      });
+      res.on("error", settle);
+    },
+  );
+  req.on("timeout", () => req.destroy());
+  req.on("error", settle);
+  req.end();
+});
+
 // ── Map the firing hook (+ payload) → one wire state, {tick:true} for a context tick, or null. ───────
 const msgExtra = (ev) => (typeof ev.message === "string" && ev.message ? { message: ev.message.slice(0, 120) } : undefined);
 
@@ -207,6 +273,8 @@ function classify(ev) {
       const source = String(ev.source ?? "");
       // A compact "restart" is the SAME session continuing — PostCompact owns compaction (firing
       // `started` here re-ran the start scene after every auto-compact, the pre-expansion bug).
+      // `source:"fork"` (2026 upstream matcher) deliberately falls through to `started`: a forked
+      // session IS a new session opening in this repo. Pinned by channel/test/signal.test.ts.
       if (source === "compact") return null;
       return { state: source === "resume" ? "resumed" : "started" };
     }
@@ -265,7 +333,9 @@ function classify(ev) {
       // Legacy best-effort error detection (older Claude Code without PostToolUseFailure): fire only when
       // the tool response explicitly signals a hard failure — biased to UNDER-fire (a failed grep / non-
       // zero exit the runtime doesn't flag stays silent) so a normal session never flashes the error scene.
-      const resp = ev.tool_response;
+      // Upstream renamed the payload field to `tool_output` (2026); older builds still send
+      // `tool_response` — read both, upstream name first.
+      const resp = ev.tool_output ?? ev.tool_response;
       const isError =
         resp &&
         typeof resp === "object" &&

package/plugin/plugins/alexa/scripts/statusline-guard.mjs

@@ -23,8 +23,12 @@ export const CHAIN_DEPTH_ENV = "BRIDGE_STATUSLINE_DEPTH";
 const MARKERS = ["plugins/alexa/scripts/statusline.mjs", "plugins\\alexa\\scripts\\statusline.mjs"];
 
 /** Roots/launchers only the bridge installs under — used to attribute a RELOCATED or renamed copy of our
- *  script without also claiming a user's unrelated `statusline.mjs`. */
-const BRIDGE_OWNED = /\.claude-bridge|@bridgeapp|bridge-node|ac-bridge/;
+ *  script without also claiming a user's unrelated `statusline.mjs`.
+ *  `@bridgeapp` is the Windows install directory up to v1.3.1 (one-click ⇒ named after the package,
+ *  `@bridge/app`); `ac bridge` is the one from v1.3.2 (assisted ⇒ named after the product). Both are
+ *  live on real machines forever, because an in-place upgrade keeps the directory it was installed in.
+ *  Matched against `norm()`ed text, so lower-case with `/` separators. */
+const BRIDGE_OWNED = /\.claude-bridge|@bridgeapp|ac bridge|bridge-node|ac-bridge/;
 
 const norm = (s) => s.replace(/\\/g, "/").toLowerCase();