agentbox-app 0.1.6 → 0.1.11

package/main/claude-bin.mjs

@@ -6,7 +6,8 @@
 // the app found nothing, said "missing" on a grey dot in Settings, and gave no
 // sentence and no next step. It read as broken rather than as unfinished.
 //
-// HER RULE, 2026-08-23, and it is the one this file exists to keep:
+// THE RULE this file exists to keep: never tell someone Claude Code is
+// missing unless we are certain it is.
 //
 // So there are two different questions here and they must never be answered by
 // the same value. `found` is whether a runnable file is really there, and it
@@ -45,10 +46,10 @@
 // the same way, and it is a real state: the installer points ~/.local/bin/claude
 // at a versioned file and swaps that file on every update.
 //
-// Nothing here overrides her file. An explicit `claudeBin` in zero.config.json
-// wins untouched and is never searched around, because that file's first line
-// is "all paths explicit, no discovery magic" and a search that second-guesses
-// a setting she wrote is exactly that.
+// Nothing here overrides the config file. An explicit `claudeBin` in
+// zero.config.json wins untouched and is never searched around, because that
+// file promises explicit paths with no discovery, and a search that
+// second-guesses a written setting would break that promise.
 
 import fs from 'node:fs';
 import os from 'node:os';
@@ -96,6 +97,27 @@ function defaultReaddir(dir) {
   try { return fs.readdirSync(dir); } catch { return []; }
 }
 
+// THE COPY THE CLAUDE APP KEEPS FOR ITSELF, one folder per version, newest
+// first. Somebody who has only ever used Claude Code inside the Claude app has
+// this and nothing else (w-9f6975906c, measured 2026-10-05: 2.1.209 there, and
+// it shared the CLI's sign-in). It is searched LAST, after the shell, because it
+// updates when the app does and a real install is fresher.
+export function appCopyPaths(home = os.homedir(), readdir = defaultReaddir) {
+  const dir = path.join(home, 'Library/Application Support/Claude/claude-code');
+  return readdir(dir)
+    .filter((v) => /^\d+(\.\d+)*$/.test(v))
+    .sort(newestFirst)
+    .map((v) => path.join(dir, v, 'claude.app/Contents/MacOS/claude'));
+}
+
+function newestFirst(a, b) {
+  const x = a.split('.').map(Number), y = b.split('.').map(Number);
+  for (let i = 0; i < Math.max(x.length, y.length); i++) {
+    if ((x[i] ?? 0) !== (y[i] ?? 0)) return (y[i] ?? 0) - (x[i] ?? 0);
+  }
+  return 0;
+}
+
 // WHAT CLAUDE CODE LEAVES BEHIND. Any one of these means it has run on this
 // Mac. None of them is a binary and none of them is ever spawned; they exist
 // only to stop the app announcing an absence it cannot support.
@@ -263,6 +285,10 @@ export function findClaudeBin({
   const fromShell = shellSaid(shellLookup());
   if (fromShell.path) return { path: fromShell.path, found: true, certain: true, from: 'shell', searched, evidence: null };
 
+  for (const candidate of appCopyPaths(home, readdir)) {
+    if (exists(candidate)) return { path: candidate, found: true, certain: true, from: 'app', searched, evidence: null };
+  }
+
   // NOT FOUND, AND WHETHER THAT IS KNOWN. Every cheap path missed and every
   // shell we could reach missed, so the last question is whether this Mac shows
   // any sign of Claude Code anyway. If it does, we looked in the wrong places

package/main/claude-input.mjs

@@ -12,6 +12,10 @@ function turnClosed(message) {
   return error;
 }
 
+// How long a finished background job may go without the agent waking for it
+// before the session is closed anyway. Measured wakes arrive in about a second.
+const WAKE_GRACE_MS = 2 * 60 * 1000;
+
 export function claudeStreamArgs(args) {
   const copy = [...args];
   const index = copy.indexOf('-p');
@@ -27,7 +31,21 @@ export function attachClaudeInput(child) {
   const controls = new Map();
   const seenUsers = new Set();
   const pending = new Map();
-  const closeInput = () => { closed = true; child.stdin.end(); };
+  // WHAT THE AGENT STARTED AND HAS NOT HEARD BACK FROM: a background command,
+  // a command Claude Code moved to the background past its time limit, a
+  // background helper. Claude Code lists them in `background_tasks_changed`
+  // and wakes the agent itself when one ends, but only while stdin is open. A
+  // result with any of these out is "I'll report once it finishes", not the
+  // end of the run, and closing there killed the suite it was waiting on
+  // (tests/an-agent-waiting-on-its-own-tests-does-not-come-back-to-you).
+  let waiting = [], wakeTimer = null;
+  // Input only ever closes at a result with nothing out, so a closed input is
+  // the one proof the run reached its end. A session that exits with input
+  // still open was stopped part-way, whatever its last turn said
+  // (tests/a-worker-whose-helpers-are-still-working-does-not-come-back-to-you).
+  let ended = false;
+  const closeInput = () => { closed = true; ended = true; clearTimeout(wakeTimer); child.stdin.end(); };
+  const mayClose = () => !held && atResult && !pending.size && !waiting.length;
   const fail = reason => {
     closed = true;
     for (const request of pending.values()) {
@@ -72,16 +90,29 @@ export function attachClaudeInput(child) {
         atResult = false;
         request.resolve({ accepted: true });
       }
+      if (event.type === 'system' && event.subtype === 'background_tasks_changed' && Array.isArray(event.tasks)) {
+        waiting = event.tasks;
+        // The last one ended between turns. Claude Code wakes the agent for
+        // it, and that turn's result closes as usual. The timer is only for a
+        // wake that never comes, so a session cannot sit open forever.
+        clearTimeout(wakeTimer);
+        if (!waiting.length && atResult && !closed) {
+          wakeTimer = setTimeout(() => { if (mayClose() && !closed) closeInput(); }, WAKE_GRACE_MS);
+          wakeTimer.unref?.();
+        }
+      }
       if (event.type === 'result') {
         atResult = true;
-        if (!held && !pending.size) closeInput();
+        if (mayClose()) closeInput();
       }
     }
   });
+  child.waitingOn = () => [...waiting];
+  child.ranToTheEnd = () => ended;
   child.holdInput = value => {
     if (closed && value) throw Error('This session has ended. Open remote control again to resume it.');
     held = !!value;
-    if (!held && atResult && !pending.size) closeInput();
+    if (mayClose()) closeInput();
   };
   child.control = (request, timeoutMs = 30000) => new Promise((resolve, reject) => {
     if (closed || !child.stdin.writable) return reject(Error('The agent connection is closed.'));
@@ -92,6 +123,17 @@ export function attachClaudeInput(child) {
     try { child.stdin.write(JSON.stringify({ type:'control_request', request_id, request }) + '\n'); }
     catch(error) { clearTimeout(timer); controls.delete(request_id); reject(error); }
   });
+  // SEND NOW: cut the step the agent is in so her waiting message is answered
+  // as a turn of its own, instead of after a command that may run for minutes
+  // (tests/send-now-cuts-the-current-step-so-the-agent-answers). Measured on a
+  // 45-second command: 43 s of waiting without it, 1.4 s to the answer with it.
+  // ONLY WHILE A MESSAGE OF HERS IS WAITING. The cut turn ends in a result,
+  // and with nothing pending that result closes the input and ends the run.
+  child.interrupt = () => {
+    if (closed || !pending.size) return Promise.resolve({ interrupted: false });
+    child.lastInterruptAt = Date.now();
+    return child.control({ subtype: 'interrupt' }).then(() => ({ interrupted: true }));
+  };
   // NO CLOCK ON THE ACKNOWLEDGEMENT. Claude replays a queued message at its next
   // break, and a break can be minutes away: a worker inside one long command
   // (a render poll, `sleep 12` fifty times) holds it until the command returns.

package/main/claude-plan.mjs

@@ -4,7 +4,7 @@
 //
 // THE PROBLEM. Agentbox runs several Claude Code sessions at once and the number
 // is a flat default (`maxConcurrentSessions: 3`, main/config.mjs) that was
-// chosen on a Max subscription and has never been anything else. Nothing
+// chosen with the biggest plan in mind and has never been anything else. Nothing
 // anywhere in the app mentions a plan: not the walk, not the Accounts page, not
 // a row that dies. So a person on a smaller plan gets three sessions started on
 // their behalf, all three burn the same allowance, and what they see is agents
@@ -12,16 +12,16 @@
 // founder was asking out loud while she watched a tester use it.
 //
 // THE ANSWER IS ALREADY ON THE DISK. Claude Code writes its own account profile
-// into its config file and refreshes it as it runs. MEASURED on her Mac
-// 2026-08-29 20:5x, both of her accounts:
+// into its config file and refreshes it as it runs. On a machine with two
+// accounts signed in, for example:
 //
 //   ~/.claude.json                  oauthAccount.organizationType        claude_max
 //                                   oauthAccount.organizationRateLimitTier  default_claude_max_20x
-//                                   profileFetchedAt                    2026-08-29 05:00Z
-//   ~/.claude-second/.claude.json   the same two values
-//                                   profileFetchedAt                    2026-08-29 20:47Z
+//                                   profileFetchedAt                    (within the day)
+//   ~/.claude-second/.claude.json   the same two fields
+//                                   profileFetchedAt                    (within the day)
 //
-// Both fetched within the day, so the field is live rather than a one-time
+// Each is refetched within the day, so the field is live rather than a one-time
 // stamp from a login months ago, and it is the honest source: it is Claude
 // Code's own answer about its own subscription, not a guess of ours.
 //
@@ -30,14 +30,14 @@
 // runs with nothing set, so its file is `~/.claude.json`; a second account runs
 // with CLAUDE_CONFIG_DIR pointing at a folder, so its file is inside that
 // folder (main/supervisor.mjs sets exactly that per spawn). Both are verified
-// above. Note that `~/.claude/.claude.json` also exists on her Mac and is NINE
-// DAYS STALE — it is what a run with CLAUDE_CONFIG_DIR=~/.claude left behind.
+// above. Note that a `~/.claude/.claude.json` can also exist and be days
+// STALE — it is what a run with CLAUDE_CONFIG_DIR=~/.claude left behind.
 // It is not read for the default account, and that is deliberate: the rule here
 // is Claude Code's own rule, not a search for the likeliest looking file.
 //
 // WHAT THIS DELIBERATELY DOES NOT DO. It does not guess the strings for plans
-// nobody here has seen. Only one plan has ever been measured on this machine,
-// and inventing `default_claude_pro` in a table would be a number nobody
+// nobody here has seen in a real file, and inventing `default_claude_pro` in
+// a table would be a number nobody
 // measured. So `max` is decided by looking for the word max, the label is
 // derived from the raw string mechanically, and anything unreadable comes back
 // `known: false` and changes nothing anywhere.

package/main/code-change.mjs

@@ -14,7 +14,7 @@
 // IT IS NOT ENOUGH ON ITS OWN, AND THAT WAS MEASURED, NOT ARGUED. An agent
 // that rewrites a file with sed or a heredoc puts nothing in its transcript,
 // and on her Mac 2026-08-24 that was 101 of the 105 runs that changed a file
-// over two days. Every one of those left David an empty card. So the disk is
+// over two days. Every one of those left a tester an empty card. So the disk is
 // read too, by main/git-change.mjs, and `mergeChange` below puts the two
 // together: git's lines, the conversation's words, git winning where they
 // disagree.
@@ -39,9 +39,9 @@ const NOT_CODE = /(^|\/)(node_modules|\.git)\//;
 // AND SCRATCH, WHICH IS NOT THE PRODUCT. A run writes throwaway scripts to
 // /tmp constantly and one of them landed in the tree as a folder called `tmp`
 // on the first real change we read (18 files, and one of them was
-// /tmp/shelf-shots.mjs). Dropped rather than shown: what David is being asked
+// /tmp/shelf-shots.mjs). Dropped rather than shown: what a tester is being asked
 // to review is the product, and a file nobody will ever open again reads as
-// work he has to account for.
+// work they have to account for.
 const SCRATCH = /^\/(private\/)?(tmp|var\/folders)\//;
 
 /**

package/main/codex-account.mjs

@@ -35,7 +35,7 @@ const AUTH_CLAIM = 'https://api.openai.com/auth';
 
 /**
  * The plan ids whose proper names are known. Everything else is printed exactly
- *  as Codex spells it, and that is deliberate: her own token reads "prolite",
+ *  as Codex spells it, and that is deliberate: a real token can read "prolite",
  *  which title-cases into "Prolite", a product name nobody at OpenAI has ever
  *  used. Inventing a label is how a screen tells a confident lie about what
  *  somebody is paying for, so an id we do not know is shown as the id. */

package/main/codex-bin.mjs

@@ -140,6 +140,19 @@ function defaultReaddir(dir) {
   try { return fs.readdirSync(dir); } catch { return []; }
 }
 
+// THE COPY THE CHATGPT APP CARRIES INSIDE ITSELF. Somebody who has only ever
+// used Codex in the ChatGPT app has this and nothing else (w-9f6975906c,
+// measured 2026-10-05: codex-cli 0.158.0-alpha.2, sharing the CLI's sign-in).
+// Searched LAST, after the shell, because it moves with the app's releases.
+//
+// AND THE ONE THE CODEX DESKTOP APP CARRIES (w-d5d632e503). Its reported place,
+// not measured on a Mac here: none of the Macs this was written on had the app.
+// A path that is not there costs one missed `exists`.
+export function appCopyPaths(home = os.homedir()) {
+  const inside = ['ChatGPT.app/Contents/Resources/codex-cli/bin/codex', 'Codex.app/Contents/Resources/codex'];
+  return inside.flatMap((p) => [path.join('/Applications', p), path.join(home, 'Applications', p)]);
+}
+
 // WHAT CODEX LEAVES BEHIND. None of these is a binary and none is ever spawned.
 // They exist only to stop the app claiming an absence it has not established.
 //
@@ -214,6 +227,10 @@ export function findCodexBin({
   const fromShell = shellSaid(shellLookup());
   if (fromShell.path) return { path: fromShell.path, found: true, certain: true, from: 'shell', searched, evidence: null };
 
+  for (const candidate of appCopyPaths(home)) {
+    if (exists(candidate)) return { path: candidate, found: true, certain: true, from: 'app', searched, evidence: null };
+  }
+
   // NOT FOUND, AND WHETHER THAT IS KNOWN. Every cheap path missed and every
   // shell we could reach missed, so the last question is whether this Mac shows
   // any sign of Codex anyway.

package/main/codex-memory-gate.mjs

@@ -0,0 +1,260 @@
+// HOW A CODEX WORKER'S COMMANDS COME TO ASK ABOUT MEMORY — w-e5225b62ba.
+//
+// w-3958c3753d built the whole of the decision (main/memory-gate.mjs), the
+// coordinator (main/memory-gate-server.mjs) and the hook a worker runs
+// (scripts/memory-gate-hook.sh) for Claude Code, and said plainly that Codex
+// workers were not covered. This file is the Codex half, and it is small on
+// purpose: everything measured below says Codex 0.160 presents a PreToolUse
+// hook the way Claude Code does, so the script, the deny and the coordinator
+// are carried over rather than rewritten.
+//
+// MEASURED ON THIS MAC, codex-cli 0.160.0, a real `codex app-server` and real
+// turns, 2026-10-04. Read none of this as documentation; it was all run.
+//
+//   THE PAYLOAD IS CLAUDE CODE'S, FIELD FOR FIELD:
+//     { session_id, turn_id, transcript_path, cwd, hook_event_name: "PreToolUse",
+//       model, permission_mode, tool_name: "Bash",
+//       tool_input: { command }, tool_use_id }
+//   and the deny it reads is the same `hookSpecificOutput.permissionDecision`
+//   object `denyOutput` already prints. A deny blocked the command and our
+//   sentence reached the model verbatim. A hook that slept eight seconds made
+//   the command wait and then run.
+//
+//   THE MATCHER IS "Bash". A group with matcher "shell" listed as trusted and
+//   enabled and never fired once; with no matcher it fired and said its
+//   tool_name was "Bash". That one word was the difference between this working
+//   and silently doing nothing.
+//
+//   THE FILE IS `hooks.json` IN THE CODEX HOME, `{ description?, hooks: {...} }`,
+//   whose event keys are PascalCase (`PreToolUse`) even though Codex's own
+//   errors name them in snake_case. An unknown event key is dropped in silence,
+//   which is why the key is pinned by a test rather than trusted to a comment.
+//
+//   A HOOK ONLY RUNS ONCE TRUSTED, AND TRUST IS PER HOOK. `hooks/list` reports
+//   every hook with a `key`, a `currentHash` and a `trustStatus` of managed /
+//   untrusted / trusted / modified. Writing
+//   `hooks.state."<key>".trusted_hash = <currentHash>` through the app-server's
+//   own `config/batchWrite` turned OURS trusted and left a second hook in the
+//   same file untrusted, with an unrelated `[projects."..."]` table in
+//   config.toml untouched. That is the whole of "do not switch off hook trust
+//   for anyone's other hooks": we never touch the requirement, we satisfy it for
+//   one key. Editing our own command afterwards turned ours "modified" rather
+//   than leaving it trusted, so a hook somebody swapped under us does not
+//   inherit what we wrote.
+//
+// WHY THE ITEM IS NOT IN THE ENVIRONMENT, which is the one real difference from
+// the Claude side. A Claude worker is a process per work item, so `memoryGateEnv`
+// puts the item on it. ONE app-server serves every Codex thread of a login, so
+// there is one environment for all of them and an item id on it would label
+// every thread as whichever row started first. The thread names itself instead:
+// `session_id` in the payload is the app-server's own `thread.id`, which
+// main/codex.mjs already keeps as `session.sessionId`. The lookup lives in
+// main/memory-gate-server.mjs (`ownerOf`).
+
+import fsNode from 'node:fs';
+import path from 'node:path';
+
+/** What Codex calls the tool that runs a shell command. Measured, not guessed. */
+export const CODEX_MATCHER = 'Bash';
+
+/** The file in a Codex home that holds its hooks. */
+export const HOOKS_FILE = 'hooks.json';
+
+/** The two events Codex has that we want. There is no PostToolUseFailure. */
+export const CODEX_EVENTS = ['PreToolUse', 'PostToolUse'];
+
+/** How we know a hook in somebody's file is one of ours. */
+const OUR_SCRIPT = 'memory-gate-hook.sh';
+
+/**
+ * Whether a hook's command is one we wrote. It has to be the script ITSELF and
+ * not a file whose name merely starts the same way, or turning the switch off
+ * would delete `memory-gate-hook.sh.backup` out of somebody's config.
+ */
+export function hookIsOurs(command) {
+  if (typeof command !== 'string') return false;
+  return new RegExp(`${OUR_SCRIPT}'?\\s+(pre|post)\\s*$`).test(command.trim());
+}
+
+/** A path inside a single-quoted shell word, app bundles and apostrophes included. */
+function quoted(scriptPath) {
+  return `'${String(scriptPath).replace(/'/g, `'\\''`)}'`;
+}
+
+/**
+ * Our matcher groups, one per event.
+ *
+ * The pre hook's limit sits above the longest wait the gate will ever impose,
+ * for the reason the Claude side gives: a hook that times out lets its command
+ * run, so the app's own refusal has to arrive first. Codex counts it in seconds.
+ */
+export function ourHookGroups(scriptPath, { maxWaitSec = 20 * 60 } = {}) {
+  const group = (mode, timeout) => ([{
+    matcher: CODEX_MATCHER,
+    hooks: [{ type: 'command', command: `${quoted(scriptPath)} ${mode}`, timeout }],
+  }]);
+  return {
+    PreToolUse: group('pre', maxWaitSec + 600),
+    PostToolUse: group('post', 10),
+  };
+}
+
+/** A hooks.json object, whatever shape the file on disk turned out to be. */
+function asFile(file) {
+  const base = file && typeof file === 'object' && !Array.isArray(file) ? { ...file } : {};
+  base.hooks = base.hooks && typeof base.hooks === 'object' && !Array.isArray(base.hooks) ? { ...base.hooks } : {};
+  return base;
+}
+
+/** Every group in `list` that is not one of ours, in the order it was written. */
+function withoutOurGroups(list) {
+  if (!Array.isArray(list)) return [];
+  return list.filter((g) => !(g?.hooks ?? []).some?.((h) => hookIsOurs(h?.command)));
+}
+
+/**
+ * The same hooks.json with our two hooks in it and everything else where it was.
+ *
+ * Ours go LAST so a hook somebody already had keeps running first, and any older
+ * entry of ours is replaced rather than kept beside the new one: the app moves
+ * between versions and a stale absolute path is a worker asking a script that is
+ * not there. Running this twice gives the same file, so turning the switch on
+ * again adds nothing.
+ */
+export function withOurHooks(file, scriptPath, options) {
+  const out = asFile(file);
+  const ours = ourHookGroups(scriptPath, options);
+  for (const event of CODEX_EVENTS) {
+    out.hooks[event] = [...withoutOurGroups(out.hooks[event]), ...ours[event]];
+  }
+  return out;
+}
+
+/**
+ * The same hooks.json with ours taken out, for when the switch goes off. An
+ * event left with nothing in it loses its key entirely, so a file that was only
+ * ever ours reads as a file with no hooks rather than as empty lists.
+ */
+export function withoutOurHooks(file) {
+  const out = asFile(file);
+  for (const event of Object.keys(out.hooks)) {
+    const kept = withoutOurGroups(out.hooks[event]);
+    if (kept.length) out.hooks[event] = kept;
+    else delete out.hooks[event];
+  }
+  return out;
+}
+
+/** A TOML key as `config/batchWrite` wants it: one quoted segment, escaped. */
+function tomlKey(key) {
+  return JSON.stringify(String(key));
+}
+
+/**
+ * The `config/batchWrite` edits that trust our hooks and nothing else.
+ *
+ * Takes either a flat list of hook entries or a whole `hooks/list` answer
+ * (one record per cwd), because the same hook is reported once per cwd and must
+ * be asked for once. A hook already trusted needs nothing; a `managed` one is an
+ * admin's decision and is left alone; a `modified` one is ours whose script
+ * changed with the app, and re-trusting it is the whole reason this runs at every
+ * start rather than once at install.
+ */
+export function ourTrustEdits(answer) {
+  const entries = [];
+  for (const row of Array.isArray(answer) ? answer : []) {
+    if (Array.isArray(row?.hooks)) entries.push(...row.hooks);
+    else if (row?.key) entries.push(row);
+  }
+  const edits = new Map();
+  for (const h of entries) {
+    if (!h?.key || !h?.currentHash) continue;
+    if (!hookIsOurs(h.command)) continue;
+    if (h.trustStatus === 'trusted' || h.trustStatus === 'managed') continue;
+    edits.set(h.key, { keyPath: `hooks.state.${tomlKey(h.key)}.trusted_hash`, mergeStrategy: 'upsert', value: h.currentHash });
+  }
+  return [...edits.values()];
+}
+
+/**
+ * PUT OUR HOOK IN A CODEX HOME, OR TAKE IT OUT, AND TRUST ONLY OUR OWN.
+ *
+ * Runs at every app start while the switch is on, not once at install, because
+ * three things change underneath it: the app's path (a new version moves the
+ * script, and Codex then calls our hook "modified" and stops running it), the
+ * user's own hooks.json (they may add or remove their own entries at any time),
+ * and the home itself (a second Codex login is a second home).
+ *
+ * NOTHING HERE WRITES config.toml. The trust goes through `config/batchWrite`,
+ * which is the call the Codex TUI itself uses, so Codex edits its own file and
+ * every other setting and every other hook's trust survives untouched. Measured
+ * on this Mac: an unrelated `[projects."..."]` table was still there afterwards,
+ * and a second hook in the same hooks.json was still `untrusted`.
+ *
+ * It is all best-effort. A Codex home we cannot write, an app-server that will
+ * not answer, a refused config write: each one means Codex workers run ungated,
+ * which is exactly where they were before this existed. It must never be a
+ * reason the app fails to start.
+ *
+ * @param {object} how
+ * @param {string} how.home The CODEX_HOME to write in.
+ * @param {string} how.scriptPath scripts/memory-gate-hook.sh, unpacked.
+ * @param {boolean} how.on Whether the memory check is on.
+ * @param {(method: string, params: object) => Promise<any>} [how.request] The
+ *   app-server call. Omitted means "write the file, do not try to trust it".
+ * @param {string[]} [how.cwds] Folders to ask `hooks/list` about. A hook in the
+ *   home is listed for any cwd, so one is enough; the app's own folder is used.
+ * @param {object} [how.fs] Injected for tests.
+ * @param {(line: string) => void} [how.log]
+ * @returns {Promise<{wrote: boolean, trusted: number, error: string|null}>}
+ */
+export async function syncCodexMemoryGate({ home, scriptPath, on, request = null, cwds = [], fs = fsNode, log = () => {} }) {
+  const out = { wrote: false, trusted: 0, error: null };
+  if (!home || (on && !scriptPath)) { out.error = 'no codex home'; return out; }
+  const file = path.join(home, HOOKS_FILE);
+
+  // THEIR FILE IS READ BEFORE IT IS WRITTEN, AND A FILE WE CANNOT UNDERSTAND IS
+  // LEFT ALONE. A hooks.json that exists and is not JSON is somebody's own,
+  // broken or newer than us; replacing it to install ours would throw their work
+  // away. Codex workers then run ungated, which is where they already were.
+  let raw = null;
+  try { raw = fs.readFileSync(file, 'utf8'); } catch { raw = null; }
+  let before = null;
+  if (raw !== null && raw.trim()) {
+    try { before = JSON.parse(raw); } catch {
+      out.error = `${file} is not readable JSON, so it was left alone`;
+      log(`memory gate: ${out.error}`);
+      return out;
+    }
+  }
+  // Off, and we were never in it: nothing to do, and no file to create.
+  if (!on && before === null) return out;
+
+  const wanted = `${JSON.stringify(on ? withOurHooks(before, scriptPath) : withoutOurHooks(before), null, 2)}\n`;
+  if (raw !== wanted) {
+    try {
+      fs.mkdirSync(home, { recursive: true });
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, wanted);
+      fs.renameSync(tmp, file);
+      out.wrote = true;
+    } catch (err) {
+      out.error = `could not write ${file}: ${err.message}`;
+      log(`memory gate: ${out.error}`);
+      return out;
+    }
+  }
+  if (!on || typeof request !== 'function') return out;
+
+  // Trust ours. `hooks/list` is what reports the key and the hash Codex computed,
+  // and neither can be worked out from here: the hash is not of the command text.
+  try {
+    const listed = await request('hooks/list', { cwds });
+    const edits = ourTrustEdits(listed?.data ?? listed);
+    if (!edits.length) return out;
+    await request('config/batchWrite', { edits, reloadUserConfig: true });
+    out.trusted = edits.length;
+    log(`memory gate: trusted ${edits.length} Codex hook${edits.length === 1 ? '' : 's'} in ${home}`);
+  } catch (err) { out.error = `could not trust the Codex hook: ${err.message}`; log(`memory gate: ${out.error}`); }
+  return out;
+}

package/main/codex-models.mjs

@@ -27,10 +27,9 @@
 // models (checked against 0.148.0), and even if it did, a picker must never be
 // the reason a login shell is spawned while she is typing.
 //
-// AND NOTHING HERE IS CACHED IN MEMORY, for the reason main/codex-bin.mjs
-// gives about its own stat calls: caching a cheap read is how a screen ends up
-// still saying the old answer after the thing changed underneath it. The CLI
-// rewrites this file whenever its etag moves, and a spawn is not a hot path.
+// A successful model/list refresh now keeps an account-scoped live catalog in
+// memory. Startup and hourly refreshes replace it; before the first success,
+// the CLI-maintained disk cache remains the fallback.
 //
 // ---------------------------------------------------------------------------
 // TWO QUESTIONS, NOT ONE, AND THE 2026-08-26 ORIGINAL ONLY ASKED THE FIRST.
@@ -60,6 +59,12 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+const liveCatalogs=new Map();
+export function rememberCodexModels(home,models){
+ const rows=models.filter(m=>typeof m.model==='string'&&m.model).map((m,i)=>({slug:m.model,display_name:m.displayName,visibility:m.hidden?'hide':'list',priority:i,default_reasoning_level:m.defaultReasoningEffort,supported_reasoning_levels:(m.supportedReasoningEfforts||[]).map(l=>({effort:l.reasoningEffort,description:l.description}))}));
+ if(rows.length)liveCatalogs.set(home,rows);
+}
+const catalogRows=(home,read)=>liveCatalogs.get(home)??modelRows(read(path.join(home,'models_cache.json')));
 
 /**
  * WHICH CODEX HOME. Her own setting first, then the environment, then the
@@ -93,7 +98,7 @@ export function codexHome({ configured = null, env = process.env, home = os.home
  * supervisor's refusal is built to need a list before it refuses anything.
  */
 export function codexModels({ home = codexHome(), read = readJson } = {}) {
-  return modelRows(read(path.join(home, 'models_cache.json')))
+  return catalogRows(home,read)
     .filter((m) => m.visibility === 'list')
     .sort((a, b) => priorityOf(a) - priorityOf(b))
     .map((m) => ({
@@ -112,7 +117,7 @@ export function codexModels({ home = codexHome(), read = readJson } = {}) {
  * were handed the word, which is a different question from what she may pick.
  */
 export function codexKnownSlugs({ home = codexHome(), read = readJson } = {}) {
-  return new Set(modelRows(read(path.join(home, 'models_cache.json'))).map((m) => String(m.slug)));
+  return new Set(catalogRows(home,read).map((m) => String(m.slug)));
 }
 
 /**
@@ -126,7 +131,7 @@ export function codexKnownSlugs({ home = codexHome(), read = readJson } = {}) {
  * `codexModels`, asked about the other field.
  */
 export function codexModelLevels(slug, { home = codexHome(), read = readJson } = {}) {
-  const cache = read(path.join(home, 'models_cache.json'));
+  const cache = liveCatalogs.has(home)?{models:liveCatalogs.get(home)}:read(path.join(home, 'models_cache.json'));
   if (!cache) return null;
   const row = modelRows(cache).find((m) => m.slug === slug);
   if (!row) return null;