agent-control-plane 0.1.8 → 0.1.12

package/tools/bin/agent-project-reconcile-pr-session

@@ -168,6 +168,9 @@ fi
 result_outcome=""
 result_action=""
 result_issue_id="${ISSUE_ID:-}"
+result_detail=""
+run_started_at="${STARTED_AT:-}"
+expected_run_started_at="${ACP_EXPECTED_RUN_STARTED_AT:-${F_LOSNING_EXPECTED_RUN_STARTED_AT:-}}"
 host_blocker_file="${run_dir}/host-blocker.md"
 prompt_file="${run_dir}/prompt.md"
 pr_comment_file="${run_dir}/pr-comment.md"
@@ -184,9 +187,18 @@ if [[ -f "$result_file_candidate" ]]; then
   set +a
   result_outcome="${OUTCOME:-}"
   result_action="${ACTION:-}"
+  result_detail="${DETAIL:-}"
   result_issue_id="${ISSUE_ID:-${result_issue_id}}"
 fi
 
+if [[ -n "${expected_run_started_at}" && "${expected_run_started_at}" != "${run_started_at}" ]]; then
+  printf 'STATUS=STALE-RUN-SKIPPED\n'
+  printf 'SESSION=%s\n' "$session"
+  printf 'EXPECTED_STARTED_AT=%s\n' "${expected_run_started_at}"
+  printf 'ACTUAL_STARTED_AT=%s\n' "${run_started_at}"
+  exit 0
+fi
+
 pr_schedule_retry() { :; }
 pr_clear_retry() { :; }
 pr_cleanup_linked_issue_session() { :; }
@@ -225,6 +237,8 @@ clear_provider_quota_cooldown() {
   "${provider_cooldown_script}" clear >/dev/null || true
 }
 
+blocked_runtime_reason=""
+
 owner="${repo_slug%%/*}"
 repo="${repo_slug#*/}"
 pr_view_json="$(flow_github_pr_view_json "$repo_slug" "$pr_number")"
@@ -339,6 +353,11 @@ normalize_pr_result_contract() {
         host-comment-pr-blocker)
           return 0
           ;;
+        host-comment-blocker)
+          result_action="host-comment-pr-blocker"
+          pr_result_contract_note="normalized-legacy-blocked-action"
+          return 0
+          ;;
         requested-changes-or-blocked)
           result_action="host-comment-pr-blocker"
           pr_result_contract_note="normalized-legacy-blocked-action"
@@ -358,8 +377,15 @@ normalize_pr_result_contract() {
 }
 
 mark_reconciled() {
+  local reconciled_at tmp_file
   if [[ -d "$run_dir" ]]; then
-    touch "${run_dir}/reconciled.ok"
+    reconciled_at="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+    tmp_file="${run_dir}/reconciled.ok.tmp.$$"
+    {
+      printf 'STARTED_AT=%s\n' "${run_started_at}"
+      printf 'RECONCILED_AT=%s\n' "${reconciled_at}"
+    } >"${tmp_file}"
+    mv "${tmp_file}" "${run_dir}/reconciled.ok"
   fi
 }
 
@@ -393,6 +419,20 @@ blocked_result_indicates_local_bind_failure() {
   return 1
 }
 
+classify_pr_blocked_runtime_reason() {
+  if [[ "${result_detail:-}" == "worker-tool-exec-empty-command" ]]; then
+    printf 'worker-tool-exec-empty-command\n'
+    return 0
+  fi
+
+  if [[ -f "$session_log_file" ]] && grep -Fq '[tools] exec failed: Provide a command to start.' "$session_log_file"; then
+    printf 'worker-tool-exec-empty-command\n'
+    return 0
+  fi
+
+  return 1
+}
+
 extract_preapproved_host_recovery_commands() {
   [[ -f "$prompt_file" ]] || return 0
   sed -n 's/^.*loopback retry command: `\(.*\)`$/\1/p' "$prompt_file"
@@ -700,18 +740,53 @@ merge_state_prepared() {
   git -C "$pr_worktree" rev-parse -q --verify MERGE_HEAD >/dev/null 2>&1
 }
 
+current_github_login() {
+  flow_export_github_cli_auth_env "${repo_slug}"
+  gh api user --jq '.login // ""' 2>/dev/null || true
+}
+
+pr_author_login() {
+  flow_export_github_cli_auth_env "${repo_slug}"
+  gh pr view "${pr_number}" -R "${repo_slug}" --json author --jq '.author.login // ""' 2>/dev/null || true
+}
+
+pr_is_self_authored_for_current_actor() {
+  local actor_login=""
+  local author_login=""
+
+  actor_login="$(current_github_login)"
+  author_login="$(pr_author_login)"
+  [[ -n "${actor_login}" && -n "${author_login}" && "${actor_login}" == "${author_login}" ]]
+}
+
+pr_remote_head_oid() {
+  flow_export_github_cli_auth_env "${repo_slug}"
+  gh pr view "${pr_number}" -R "${repo_slug}" --json headRefOid --jq '.headRefOid // ""' 2>/dev/null || true
+}
+
+pr_remote_already_has_final_head() {
+  local final_head="${FINAL_HEAD:-}"
+  local remote_head=""
+
+  [[ -n "${final_head}" ]] || return 1
+  remote_head="$(pr_remote_head_oid)"
+  [[ -n "${remote_head}" && "${remote_head}" == "${final_head}" ]]
+}
+
 approve_and_merge() {
   local approve_output
-  if ! approve_output="$(
-    flow_github_api_repo "${repo_slug}" "pulls/${pr_number}/reviews" \
-      --method POST \
-      -f event=APPROVE \
-      -f body="Automated final review passed. Safe low-risk scope, green checks, and host-side merge approved." \
-      2>&1
-  )"; then
-    if ! grep -q "Can not approve your own pull request" <<<"$approve_output"; then
-      printf '%s\n' "$approve_output" >&2
-      return 1
+  if ! pr_is_self_authored_for_current_actor; then
+    if ! approve_output="$(
+      flow_github_api_repo "${repo_slug}" "pulls/${pr_number}/reviews" \
+        --method POST \
+        -f event=APPROVE \
+        -f body="Automated final review passed. Safe low-risk scope, green checks, and host-side merge approved." \
+        2>&1
+    )"; then
+      if ! grep -q "Can not approve your own pull request" <<<"$approve_output"; then
+        printf '%s\n' "$approve_output" >&2
+        return 1
+      fi
     fi
   fi
 
@@ -753,7 +828,14 @@ handle_linked_issue_merge_cleanup() {
 
 handle_updated_branch_result() {
   if [[ -z "$pr_worktree" || ! -d "$pr_worktree" ]]; then
-    if pr_comment_already_posted; then
+    if pr_remote_already_has_final_head; then
+      post_pr_comment_if_present
+      require_transition "pr_clear_retry" pr_clear_retry
+      require_transition "pr_after_updated_branch" pr_after_updated_branch "$pr_number"
+      cleanup_pr_session
+      result_action="${result_action:-host-push-pr-branch}"
+      notify_pr_reconciled
+    elif pr_comment_already_posted; then
       require_transition "pr_clear_retry" pr_clear_retry
       require_transition "pr_after_updated_branch" pr_after_updated_branch "$pr_number"
       cleanup_pr_session
@@ -968,7 +1050,16 @@ elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "no-change-needed" ]];
     fi
   fi
 elif [[ "$status" == "SUCCEEDED" && "$result_outcome" == "blocked" ]]; then
-  if attempt_blocked_pr_host_verification_recovery; then
+  blocked_runtime_reason="$(classify_pr_blocked_runtime_reason || true)"
+  if [[ -n "${blocked_runtime_reason:-}" ]]; then
+    status="FAILED"
+    failure_reason="${blocked_runtime_reason}"
+    require_transition "pr_schedule_retry" pr_schedule_retry "$failure_reason"
+    require_transition "pr_after_failed" pr_after_failed "$pr_number"
+    cleanup_pr_session
+    result_action="queued-pr-retry"
+    notify_pr_reconciled
+  elif attempt_blocked_pr_host_verification_recovery; then
     handle_updated_branch_result
   else
     post_pr_comment_if_present

package/tools/bin/agent-project-run-claude-session

@@ -61,6 +61,24 @@ resolve_claude_bin() {
     return 0
   fi
 
+  # Well-known install locations for Claude Code CLI.
+  # Detached supervisors and LaunchAgents run with a minimal PATH that
+  # does not include user-local directories, so command -v alone is not
+  # enough.  Try the common locations explicitly.
+  local -a fallback_paths=(
+    "${HOME}/.local/bin/claude"
+    "${HOME}/.claude/local/bin/claude"
+    "/usr/local/bin/claude"
+    "/opt/homebrew/bin/claude"
+  )
+  local p
+  for p in "${fallback_paths[@]}"; do
+    if [[ -x "${p}" ]]; then
+      printf '%s\n' "${p}"
+      return 0
+    fi
+  done
+
   return 1
 }
 
@@ -348,7 +366,7 @@ fi
 
 reconcile_snippet=""
 if [[ -n "$reconcile_command" ]]; then
-  printf -v delayed_reconcile_q '%q' "sleep 2; $reconcile_command"
+  printf -v delayed_reconcile_q '%q' "export ACP_EXPECTED_RUN_STARTED_AT=${started_at_q}; export F_LOSNING_EXPECTED_RUN_STARTED_AT=${started_at_q}; while tmux has-session -t ${session_q} 2>/dev/null; do sleep 1; done; sleep 2; $reconcile_command"
   reconcile_snippet="nohup bash -lc ${delayed_reconcile_q} >> ${output_q} 2>&1 </dev/null &"
 fi
 

package/tools/bin/agent-project-run-codex-resilient

@@ -18,6 +18,7 @@ Options:
   --max-resume-attempts <count>           Maximum resume attempts after interruption
   --auth-refresh-timeout-seconds <secs>   How long to wait for refreshed auth before failing
   --auth-refresh-poll-seconds <secs>      Poll interval while waiting for refreshed auth
+  --stall-seconds <secs>                  Fail if Codex stops producing output for too long
   --help                                  Show this help
 EOF
 }
@@ -35,6 +36,8 @@ max_resume_attempts="${ACP_CODEX_MAX_RESUME_ATTEMPTS:-${F_LOSNING_CODEX_MAX_RESU
 auth_refresh_timeout_seconds="${ACP_CODEX_AUTH_REFRESH_TIMEOUT_SECONDS:-${F_LOSNING_CODEX_AUTH_REFRESH_TIMEOUT_SECONDS:-900}}"
 auth_refresh_poll_seconds="${ACP_CODEX_AUTH_REFRESH_POLL_SECONDS:-${F_LOSNING_CODEX_AUTH_REFRESH_POLL_SECONDS:-10}}"
 max_quota_autoswitch_attempts="${ACP_CODEX_MAX_AUTOSWITCH_ATTEMPTS:-${F_LOSNING_CODEX_MAX_AUTOSWITCH_ATTEMPTS:-1}}"
+codex_progress_heartbeat_seconds="${ACP_CODEX_PROGRESS_HEARTBEAT_SECONDS:-${F_LOSNING_CODEX_PROGRESS_HEARTBEAT_SECONDS:-30}}"
+codex_stall_seconds="${ACP_CODEX_STALL_SECONDS:-${F_LOSNING_CODEX_STALL_SECONDS:-300}}"
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -50,6 +53,7 @@ while [[ $# -gt 0 ]]; do
     --max-resume-attempts) max_resume_attempts="${2:-}"; shift 2 ;;
     --auth-refresh-timeout-seconds) auth_refresh_timeout_seconds="${2:-}"; shift 2 ;;
     --auth-refresh-poll-seconds) auth_refresh_poll_seconds="${2:-}"; shift 2 ;;
+    --stall-seconds) codex_stall_seconds="${2:-}"; shift 2 ;;
     --help|-h) usage; exit 0 ;;
     *) echo "Unknown argument: $1" >&2; usage >&2; exit 1 ;;
   esac
@@ -80,6 +84,13 @@ esac
 case "$max_quota_autoswitch_attempts" in
   ''|*[!0-9]*) echo "ACP_CODEX_MAX_AUTOSWITCH_ATTEMPTS must be numeric" >&2; exit 1 ;;
 esac
+case "$codex_progress_heartbeat_seconds" in
+  ''|*[!0-9]*) echo "ACP_CODEX_PROGRESS_HEARTBEAT_SECONDS must be numeric" >&2; exit 1 ;;
+  0) echo "ACP_CODEX_PROGRESS_HEARTBEAT_SECONDS must be greater than zero" >&2; exit 1 ;;
+esac
+case "$codex_stall_seconds" in
+  ''|*[!0-9]*) echo "ACP_CODEX_STALL_SECONDS must be numeric" >&2; exit 1 ;;
+esac
 
 FLOW_SKILL_DIR="$(resolve_flow_skill_dir "${BASH_SOURCE[0]}")"
 state_file="${host_run_dir}/runner.env"
@@ -116,6 +127,7 @@ last_quota_switch_status=""
 last_quota_next_retry_at=""
 last_quota_selected_label=""
 quota_autoswitch_attempt_count=0
+last_attempt_started_epoch=0
 
 mkdir -p "$host_run_dir"
 touch "$output_file"
@@ -148,6 +160,19 @@ write_state() {
   mv "$tmp_file" "$state_file"
 }
 
+run_codex_command() {
+  # Nested workers must not inherit a parent thread id; the wrapper persists the child thread explicitly.
+  env -u CODEX_THREAD_ID "$codex_bin" "$@"
+}
+
+codex_recovery_target() {
+  if [[ -n "$thread_id" ]]; then
+    printf 'thread %s' "$thread_id"
+    return 0
+  fi
+  printf 'initial Codex exec'
+}
+
 run_with_timeout() {
   local timeout_seconds="${1:?timeout seconds required}"
   shift
@@ -398,13 +423,43 @@ persist_thread_id_from_line() {
   fi
 }
 
+terminate_codex_producer_tree() {
+  local pid="${1:?pid required}"
+  local deadline=""
+
+  if ! kill -0 "$pid" 2>/dev/null; then
+    return 0
+  fi
+
+  pkill -TERM -P "$pid" 2>/dev/null || true
+  kill "$pid" 2>/dev/null || true
+
+  deadline=$(( $(date +%s) + 2 ))
+  while kill -0 "$pid" 2>/dev/null; do
+    if (( $(date +%s) >= deadline )); then
+      break
+    fi
+    sleep 0.1
+  done
+
+  if kill -0 "$pid" 2>/dev/null; then
+    pkill -KILL -P "$pid" 2>/dev/null || true
+    kill -9 "$pid" 2>/dev/null || true
+  fi
+}
+
 stream_codex_exec() {
   local phase="${1:?phase required}"
   local stream_fifo=""
   local producer_pid=""
+  local heartbeat_pid=""
+  local progress_file=""
   local line=""
 
   last_attempt_start_size="$(stat -f %z "$output_file" 2>/dev/null || printf '0')"
+  last_attempt_started_epoch="$(date +%s)"
+  progress_file="${host_run_dir}/.codex-progress.$$"
+  rm -f "$progress_file"
   stream_fifo="$(mktemp -u "${TMPDIR:-/tmp}/codex-stream.XXXXXX")"
   mkfifo "$stream_fifo"
 
@@ -413,10 +468,10 @@ stream_codex_exec() {
       (
         case "$mode" in
           safe)
-            "$codex_bin" exec --json --profile "$safe_profile" --full-auto <"$prompt_file"
+            run_codex_command exec --json --profile "$safe_profile" --full-auto <"$prompt_file"
             ;;
           bypass)
-            "$codex_bin" exec --json --profile "$bypass_profile" --dangerously-bypass-approvals-and-sandbox <"$prompt_file"
+            run_codex_command exec --json --profile "$bypass_profile" --dangerously-bypass-approvals-and-sandbox <"$prompt_file"
             ;;
         esac
       ) >"$stream_fifo" 2>&1 &
@@ -425,10 +480,10 @@ stream_codex_exec() {
       (
         case "$mode" in
           safe)
-            resume_prompt | "$codex_bin" exec resume --json --full-auto "$thread_id" -
+            resume_prompt | run_codex_command exec resume --json --full-auto "$thread_id" -
             ;;
           bypass)
-            resume_prompt | "$codex_bin" exec resume --json --dangerously-bypass-approvals-and-sandbox "$thread_id" -
+            resume_prompt | run_codex_command exec resume --json --dangerously-bypass-approvals-and-sandbox "$thread_id" -
             ;;
         esac
       ) >"$stream_fifo" 2>&1 &
@@ -441,12 +496,55 @@ stream_codex_exec() {
   esac
 
   producer_pid="$!"
+  (
+    local now elapsed last_progress_epoch idle_for
+    while kill -0 "$producer_pid" 2>/dev/null; do
+      sleep "$codex_progress_heartbeat_seconds"
+      if ! kill -0 "$producer_pid" 2>/dev/null; then
+        break
+      fi
+      now="$(date +%s)"
+      elapsed=$((now - last_attempt_started_epoch))
+      if (( codex_stall_seconds > 0 )); then
+        if [[ ! -f "$progress_file" ]]; then
+          if (( elapsed >= codex_stall_seconds )); then
+            write_state "running" ""
+            log_runner "stale-run no-codex-output-before-stall-threshold elapsed=${elapsed}s"
+            terminate_codex_producer_tree "$producer_pid"
+            break
+          fi
+        else
+          last_progress_epoch="$(stat -f %m "$progress_file" 2>/dev/null || printf '0')"
+          if [[ -n "$last_progress_epoch" && "$last_progress_epoch" != "0" ]]; then
+            idle_for=$((now - last_progress_epoch))
+            if (( idle_for >= codex_stall_seconds )); then
+              write_state "running" ""
+              log_runner "stale-run no-codex-progress-before-stall-threshold elapsed=${elapsed}s idle=${idle_for}s"
+              terminate_codex_producer_tree "$producer_pid"
+              break
+            fi
+          fi
+        fi
+      fi
+      write_state "running" ""
+      log_runner "heartbeat waiting-for-codex-output elapsed=${elapsed}s"
+    done
+  ) &
+  heartbeat_pid="$!"
+
   while IFS= read -r line || [[ -n "$line" ]]; do
     printf '%s\n' "$line" | tee -a "$output_file"
+    touch "$progress_file" 2>/dev/null || true
     persist_thread_id_from_line "$line"
   done <"$stream_fifo"
 
+  if [[ -n "$heartbeat_pid" ]] && kill -0 "$heartbeat_pid" 2>/dev/null; then
+    kill "$heartbeat_pid" 2>/dev/null || true
+    wait "$heartbeat_pid" 2>/dev/null || true
+  fi
+
   rm -f "$stream_fifo"
+  rm -f "$progress_file"
 
   if wait "$producer_pid"; then
     last_exit_code="0"
@@ -485,6 +583,16 @@ classify_failure_reason() {
 
   recent_chunk="$(tail -n 120 <<<"$chunk")"
 
+  if grep -Eiq 'stale-run no-codex-output-before-stall-threshold|no-codex-output-before-stall-threshold' <<<"$recent_chunk"; then
+    printf 'no-codex-output-before-stall-threshold\n'
+    return 0
+  fi
+
+  if grep -Eiq 'stale-run no-codex-progress-before-stall-threshold|no-codex-progress-before-stall-threshold' <<<"$recent_chunk"; then
+    printf 'no-codex-progress-before-stall-threshold\n'
+    return 0
+  fi
+
   if grep -Eiq "You've hit your usage limit|You have reached your Codex usage limits|visit https://chatgpt.com/codex/settings/usage|Upgrade to Pro|rate limit exceeded|quota exceeded|usage cap (reached|exceeded)|usage quota (reached|exceeded)" <<<"$recent_chunk"; then
     printf 'usage-limit\n'
     return 0
@@ -523,7 +631,7 @@ EOF
 }
 
 codex_login_healthy() {
-  "$codex_bin" login status >/dev/null 2>&1
+  run_codex_command login status >/dev/null 2>&1
 }
 
 wait_for_auth_refresh() {
@@ -533,7 +641,9 @@ wait_for_auth_refresh() {
   local baseline_switch_signature="${4:-}"
   local deadline now current_fingerprint current_quota_label current_switch_signature
   local sleep_seconds
+  local recovery_target
 
+  recovery_target="$(codex_recovery_target)"
   auth_wait_started_at="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
   last_trigger_reason="$trigger_reason"
   write_state "waiting-auth-refresh" "$trigger_reason"
@@ -548,28 +658,28 @@ wait_for_auth_refresh() {
         current_switch_signature="$(quota_switch_signature)"
         if codex_login_healthy; then
           if [[ "$current_fingerprint" != "$baseline_fingerprint" ]]; then
-            log_runner "detected refreshed Codex auth after quota interruption; resuming thread ${thread_id}"
+            log_runner "detected refreshed Codex auth after quota interruption; resuming ${recovery_target}"
             auth_wait_started_at=""
             write_state "running" ""
             return 0
           fi
 
           if [[ -n "$baseline_quota_label" && -n "$current_quota_label" && "$current_quota_label" != "$baseline_quota_label" ]]; then
-            log_runner "detected rotated Codex quota account (${baseline_quota_label} -> ${current_quota_label}); resuming thread ${thread_id}"
+            log_runner "detected rotated Codex quota account (${baseline_quota_label} -> ${current_quota_label}); resuming ${recovery_target}"
             auth_wait_started_at=""
             write_state "running" ""
             return 0
           fi
 
           if [[ -n "$baseline_switch_signature" && -n "$current_switch_signature" && "$current_switch_signature" != "$baseline_switch_signature" ]]; then
-            log_runner "detected quota switch state refresh; resuming thread ${thread_id}"
+            log_runner "detected quota switch state refresh; resuming ${recovery_target}"
             auth_wait_started_at=""
             write_state "running" ""
             return 0
           fi
 
           if [[ "$last_quota_switch_status" == "switched" && -n "$current_quota_label" ]]; then
-            log_runner "quota manager reports healthy Codex account ${current_quota_label}; resuming thread ${thread_id}"
+            log_runner "quota manager reports healthy Codex account ${current_quota_label}; resuming ${recovery_target}"
             auth_wait_started_at=""
             write_state "running" ""
             return 0
@@ -580,9 +690,9 @@ wait_for_auth_refresh() {
       *)
         if codex_login_healthy; then
           if [[ "$current_fingerprint" != "$baseline_fingerprint" ]]; then
-            log_runner "detected refreshed Codex auth; resuming thread ${thread_id}"
+            log_runner "detected refreshed Codex auth; resuming ${recovery_target}"
           else
-            log_runner "Codex auth is healthy again; resuming thread ${thread_id}"
+            log_runner "Codex auth is healthy again; resuming ${recovery_target}"
           fi
           auth_wait_started_at=""
           write_state "running" ""
@@ -643,11 +753,6 @@ attempt_run() {
   reason="$(classify_failure_reason "$(new_output_since "$last_attempt_start_size")")"
   last_failure_reason="${reason:-worker-exit-failed}"
 
-  if [[ -z "$thread_id" ]]; then
-    write_state "failed" "$last_failure_reason"
-    return 1
-  fi
-
   case "$last_failure_reason" in
     usage-limit|auth-failure|auth-401|account-banned)
       if (( resume_count >= max_resume_attempts )); then

package/tools/bin/agent-project-run-codex-session

@@ -24,6 +24,7 @@ EOF
 mode=""
 session=""
 worktree=""
+worktree_realpath=""
 prompt_file=""
 runs_root=""
 adapter_id=""
@@ -105,6 +106,12 @@ if [[ -z "$mode" || -z "$session" || -z "$worktree" || -z "$prompt_file" || -z "
   exit 1
 fi
 
+worktree_realpath="$(cd "$worktree" 2>/dev/null && pwd -P || true)"
+if [[ -z "$worktree_realpath" || ! -d "$worktree_realpath" ]]; then
+  echo "unable to resolve worktree realpath: $worktree" >&2
+  exit 1
+fi
+
 case "$mode" in
   safe|bypass) ;;
   *)
@@ -119,7 +126,7 @@ inner_script="${artifact_dir}/${session}.sh"
 meta_file="${artifact_dir}/run.env"
 result_file="${artifact_dir}/result.env"
 runner_state_file="${artifact_dir}/runner.env"
-sandbox_run_dir="${worktree%/}/${sandbox_subdir}/${session}"
+sandbox_run_dir="${worktree_realpath%/}/${sandbox_subdir}/${session}"
 started_at="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
 codex_bin="$(resolve_codex_bin || true)"
 runner_bin="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/agent-project-run-codex-resilient"
@@ -137,13 +144,14 @@ if [[ -z "$codex_bin" || ! -x "$codex_bin" ]]; then
   exit 1
 fi
 
-branch_name="$(git -C "$worktree" branch --show-current 2>/dev/null || true)"
+branch_name="$(git -C "$worktree_realpath" branch --show-current 2>/dev/null || true)"
 
 printf -v session_q '%q' "$session"
 printf -v task_kind_q '%q' "$task_kind"
 printf -v task_id_q '%q' "$task_id"
 printf -v mode_q '%q' "$mode"
 printf -v worktree_q '%q' "$worktree"
+printf -v worktree_realpath_q '%q' "$worktree_realpath"
 printf -v prompt_q '%q' "$prompt_file"
 printf -v output_q '%q' "$output_file"
 printf -v artifact_dir_q '%q' "$artifact_dir"
@@ -166,6 +174,7 @@ printf -v bypass_profile_q '%q' "$bypass_profile"
   printf 'SESSION=%s\n' "$session_q"
   printf 'MODE=%s\n' "$mode_q"
   printf 'WORKTREE=%s\n' "$worktree_q"
+  printf 'WORKTREE_REALPATH=%s\n' "$worktree_realpath_q"
   printf 'PROMPT_FILE=%s\n' "$prompt_q"
   printf 'OUTPUT_FILE=%s\n' "$output_q"
   printf 'SCRIPT=%s\n' "$script_q"
@@ -256,7 +265,7 @@ fi
 
 reconcile_snippet=""
 if [[ -n "$reconcile_command" ]]; then
-  printf -v delayed_reconcile_q '%q' "sleep 2; $reconcile_command"
+  printf -v delayed_reconcile_q '%q' "export ACP_EXPECTED_RUN_STARTED_AT=${started_at_q}; export F_LOSNING_EXPECTED_RUN_STARTED_AT=${started_at_q}; while tmux has-session -t ${session_q} 2>/dev/null; do sleep 1; done; sleep 2; $reconcile_command"
   reconcile_snippet="nohup bash -lc ${delayed_reconcile_q} >> ${output_q} 2>&1 </dev/null &"
 fi
 
@@ -264,19 +273,59 @@ cat >"$inner_script" <<EOF
 #!/usr/bin/env bash
 set -euo pipefail
 ${runtime_exports}
-${context_exports}cd ${worktree_q}
+${context_exports}cd ${worktree_realpath_q}
 reset_sandbox_run_dir() {
   mkdir -p ${sandbox_run_dir_q}
   find ${sandbox_run_dir_q} -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true
 }
+find_logged_artifact_path() {
+  local artifact_name="\${1:?artifact name required}"
+  local candidate=""
+
+  while IFS= read -r candidate; do
+    [[ -n "\${candidate}" ]] || continue
+    while [[ "\${candidate}" == *')' || "\${candidate}" == *']' || "\${candidate}" == *',' || "\${candidate}" == *'"' || "\${candidate}" == *"'" ]]; do
+      candidate="\${candidate%?}"
+    done
+    if [[ "\$(basename "\${candidate}")" == "\${artifact_name}" && -f "\${candidate}" ]]; then
+      printf '%s\n' "\${candidate}"
+    fi
+  done < <(grep -oE '/(Users|Volumes|tmp)/[^[:space:])"]+' ${output_q} 2>/dev/null || true)
+}
+recover_logged_artifact() {
+  local artifact_name="\${1:?artifact name required}"
+  local destination="\${2:?destination required}"
+  local source_path=""
+
+  source_path="\$(find_logged_artifact_path "\${artifact_name}" | tail -n 1)"
+  [[ -n "\${source_path}" ]] || return 0
+  mkdir -p "\$(dirname "\${destination}")"
+  if [[ "\${source_path}" != "\${destination}" ]]; then
+    cp "\${source_path}" "\${destination}"
+  fi
+}
+recover_collected_artifact() {
+  local artifact_name="\${1:?artifact name required}"
+  local destination="\${2:?destination required}"
+
+  if [[ -f ${sandbox_run_dir_q}/"\${artifact_name}" ]]; then
+    if [[ ${sandbox_run_dir_q}/"\${artifact_name}" != "\${destination}" ]]; then
+      cp ${sandbox_run_dir_q}/"\${artifact_name}" "\${destination}"
+    fi
+    return 0
+  fi
+
+  recover_logged_artifact "\${artifact_name}" "\${destination}"
+}
 record_final_git_state() {
   local final_head final_branch tmp_file
 
-  final_head="\$(git -C ${worktree_q} rev-parse HEAD 2>/dev/null || true)"
-  final_branch="\$(git -C ${worktree_q} branch --show-current 2>/dev/null || true)"
+  final_head="\$(git -C ${worktree_realpath_q} rev-parse HEAD 2>/dev/null || true)"
+  final_branch="\$(git -C ${worktree_realpath_q} branch --show-current 2>/dev/null || true)"
   tmp_file=${meta_file_q}.tmp.final.$$
-  grep -vE '^(FINAL_HEAD|FINAL_BRANCH)=' ${meta_file_q} >"\${tmp_file}" 2>/dev/null || true
+  grep -vE '^(FINAL_HEAD|FINAL_BRANCH|WORKTREE_REALPATH)=' ${meta_file_q} >"\${tmp_file}" 2>/dev/null || true
   {
+    printf 'WORKTREE_REALPATH=%s\n' ${worktree_realpath_q}
     printf 'FINAL_HEAD=%q\n' "\${final_head}"
     printf 'FINAL_BRANCH=%q\n' "\${final_branch}"
   } >>"\${tmp_file}"
@@ -286,7 +335,7 @@ reset_sandbox_run_dir
 set +e
 bash ${runner_bin_q} \\
   --mode ${mode_q} \\
-  --worktree ${worktree_q} \\
+  --worktree ${worktree_realpath_q} \\
   --prompt-file ${prompt_q} \\
   --output-file ${output_q} \\
   --host-run-dir ${artifact_dir_q} \\
@@ -296,9 +345,10 @@ bash ${runner_bin_q} \\
   --codex-bin ${codex_bin_q}
 status=\$?
 record_final_git_state
-if [[ -f ${sandbox_run_dir_q}/result.env ]]; then
-  cp ${sandbox_run_dir_q}/result.env ${result_q}
-fi
+recover_collected_artifact result.env ${result_q}
+recover_collected_artifact issue-comment.md ${artifact_dir_q}/issue-comment.md
+recover_collected_artifact pr-comment.md ${artifact_dir_q}/pr-comment.md
+recover_collected_artifact verification.jsonl ${artifact_dir_q}/verification.jsonl
 ${collect_copy_snippet}${reconcile_snippet}
 printf '\n__CODEX_EXIT__:%s\n' "\$status" | tee -a ${output_q}
 exit "\$status"