borgmcp 5.2.0 → 5.3.0

package/src/codex-app-wake.ts

@@ -1,11 +1,11 @@
 import {
   getActiveCube,
-  getCodexWakeTarget,
-  setCodexWakeTarget,
   type ActiveCube,
 } from './cubes.js';
+import { existsSync } from 'node:fs';
 import { CodexAppServerClient } from './codex-app-server.js';
 import { checkCodexBridgeHealthy } from './codex-remote.js';
+import { debugLog } from './debug.js';
 import { hasPendingWakeActivity, hasPendingWakeEntry } from './remote-client.js';
 import {
   BORG_CODEX_REMOTE_WAKE_ENV,
@@ -14,7 +14,6 @@ import {
 import {
   codexAppServerSocketFromEnv,
   pickFreshThread,
-  wakeTargetChanged,
   wakeRetryBackoffMs,
   wakeRetryExpired,
   WAKE_RETRY_MAX_ATTEMPTS,
@@ -69,26 +68,25 @@ export function resolveCodexWakeTarget(env: NodeJS.ProcessEnv = process.env): Co
  * (which is false-by-design for codex and falsely flagged them, gh#633).
  *
  * Tri-state (boolean|null; caller maps null→armed for false-deaf-avoidance):
- *   - false ONLY on a positively-dead bridge: no wake target registered (the
- *     bridge cannot deliver wakes), OR the app-server pid is dead.
- *   - true when the wake target resolves AND the app-server pid is alive.
- *   - null when the bridge health is indeterminate (target read or pid check
- *     could not resolve) → armed (don't false-flag on uncertainty).
+ *   - false when this child has no live socket, the socket file is missing, or
+ *     the app-server pid is dead.
+ *   - true when the env socket exists and the app-server pid is alive.
+ *   - null when the pidfile cannot be read or parsed.
  */
 export async function probeCodexBridgeArmed(
-  active: { cubeId: string; droneId: string },
+  _active: { cubeId: string; droneId: string },
   deps: {
-    getCodexWakeTarget?: typeof getCodexWakeTarget;
+    env?: NodeJS.ProcessEnv;
+    socketExists?: (socketPath: string) => boolean;
     checkBridge?: typeof checkCodexBridgeHealthy;
   } = {}
 ): Promise<boolean | null> {
   try {
-    const resolve = deps.getCodexWakeTarget ?? getCodexWakeTarget;
-    const target = await resolve(active.cubeId, active.droneId);
-    // No registered wake target → the bridge cannot deliver a wake → not armed.
-    if (!target) return false;
+    const socketPath = codexAppServerSocketFromEnv(deps.env ?? process.env);
+    if (!socketPath) return false;
+    if (!(deps.socketExists ?? existsSync)(socketPath)) return false;
     const check = deps.checkBridge ?? checkCodexBridgeHealthy;
-    return check(target.socketPath);
+    return check(socketPath);
   } catch {
     return null;
   }
@@ -280,9 +278,6 @@ function defaultSleep(ms: number): Promise<void> {
 
 export interface CodexWakeDeps {
   getActiveCube?: typeof getActiveCube;
-  getCodexWakeTarget?: typeof getCodexWakeTarget;
-  // gh#855: self-heal write of the freshly-resolved target (write-only-on-change).
-  setCodexWakeTarget?: typeof setCodexWakeTarget;
   createClient?: (
     socketPath: string
   ) => Pick<CodexAppServerClient, 'connect' | 'readThread' | 'startTurn' | 'loadedThreadIds' | 'close'>;
@@ -320,12 +315,9 @@ export interface CodexWakeDeps {
 /**
  * gh#855: FRESH wake-target resolution. Prefer THIS drone's live app-server
  * socket (pinned into the child's env at spawn) and re-resolve the loaded thread
- * NOW (loadedThreadIds is re-runnable) — so a missed/stale launch probe or a
- * thread change can never cause permanent deafness. Self-heals the file cache
- * (write-only-on-change) so other readers (probeCodexBridgeArmed / health-beat)
- * stay current. Falls back to the launch-recorded file when the env socket is
- * absent (un-upgraded launch) — no regression. Returns the resolved target, or
- * null (caller skips this wake; the next one retries). Does NOT keep a
+ * NOW (loadedThreadIds is re-runnable), so a thread change cannot cause
+ * permanent deafness. The live env socket is the sole source. Returns the
+ * resolved target, or null when the socket/thread is unavailable. Does NOT keep a
  * connection open — the env path opens a short-lived probe client to re-resolve
  * the thread, then closes it, so the caller can dedup BEFORE opening the wake
  * connection (no reconnect on an already-delivered wake).
@@ -338,52 +330,31 @@ function makeCodexClient(
 }
 
 async function resolveFreshCodexWakeTarget(
-  active: { cubeId: string; droneId: string },
+  _active: { cubeId: string; droneId: string },
   deps: CodexWakeDeps
 ): Promise<{ socketPath: string; threadId: string } | null> {
   const envSocket = codexAppServerSocketFromEnv(deps.env ?? process.env);
-  if (envSocket) {
-    const probe = makeCodexClient(envSocket, deps);
-    await probe.connect();
-    try {
-      const ids = await probe.loadedThreadIds();
-      const summaries: CodexThreadInfo[] = [];
-      for (const id of ids) {
-        const t = await probe.readThread(id);
-        if (t) summaries.push({ id: t.id, cwd: t.cwd, updatedAt: t.updatedAt });
-      }
-      const threadId = pickFreshThread(summaries, { cwd: (deps.cwd ?? (() => process.cwd()))() });
-      if (!threadId) return null; // no loaded thread yet — next wake retries (no permanent fail)
-      await maybePersistWakeTarget(active, { socketPath: envSocket, threadId }, deps);
-      return { socketPath: envSocket, threadId };
-    } finally {
-      probe.close();
-    }
+  if (!envSocket) {
+    debugLog('codex wake target unavailable: BORG_CODEX_APP_SERVER_SOCKET is absent');
+    return null;
   }
-
-  // Fallback: the launch-recorded file (un-upgraded launch / env absent) — no
-  // connect needed to resolve, so the caller dedups before opening any socket.
-  const target = await (deps.getCodexWakeTarget ?? getCodexWakeTarget)(active.cubeId, active.droneId);
-  if (!target) return null;
-  return { socketPath: target.socketPath, threadId: target.threadId };
-}
-
-/** Self-healing cache write — only when the resolved target actually changed. */
-async function maybePersistWakeTarget(
-  active: { cubeId: string; droneId: string },
-  fresh: { socketPath: string; threadId: string },
-  deps: CodexWakeDeps
-): Promise<void> {
+  const probe = makeCodexClient(envSocket, deps);
+  await probe.connect();
   try {
-    const get = deps.getCodexWakeTarget ?? getCodexWakeTarget;
-    const set = deps.setCodexWakeTarget ?? setCodexWakeTarget;
-    const existing = await get(active.cubeId, active.droneId);
-    const prev = existing ? { socketPath: existing.socketPath, threadId: existing.threadId } : null;
-    if (wakeTargetChanged(prev, fresh)) {
-      await set(active.cubeId, active.droneId, fresh);
+    const ids = await probe.loadedThreadIds();
+    const summaries: CodexThreadInfo[] = [];
+    for (const id of ids) {
+      try {
+        const thread = await probe.readThread(id);
+        if (thread) summaries.push(thread);
+      } catch {
+        // A loaded thread may disappear before its read; keep other candidates.
+      }
     }
-  } catch {
-    // best-effort cache write; never break the wake path
+    const threadId = pickFreshThread(summaries, { cwd: (deps.cwd ?? (() => process.cwd()))() });
+    return threadId ? { socketPath: envSocket, threadId } : null;
+  } finally {
+    probe.close();
   }
 }
 
@@ -396,7 +367,12 @@ export function wakeCodexViaAppServer(
 ): void {
   const target = resolveCodexWakeTarget(env);
   if (!target.enabled) return;
-  pendingWakeRequests.push({ reason, deliveryIdentity, sourceEntryId, deps });
+  pendingWakeRequests.push({
+    reason,
+    deliveryIdentity,
+    sourceEntryId,
+    deps: deps.env ? deps : { ...deps, env },
+  });
   if (wakeInFlight) return;
 
   wakeInFlight = true;
@@ -432,17 +408,14 @@ async function wakeCodexTargeted(
     if (!active) return;
     const pendingEntry = deps.hasPendingEntry ?? hasPendingWakeEntry;
     if (sourceEntryId && !(await pendingEntry(active, sourceEntryId))) return;
-    // gh#855: resolve FRESH (live env socket + re-resolved thread), falling back
-    // to the launch-recorded file only when the env socket is absent.
+    // Resolve fresh from this child’s live env socket and loaded threads.
     const resolved = await resolveFreshCodexWakeTarget(active, deps);
     if (!resolved) {
-      // client#89: a scoped entry passed the pending check above but no target
-      // resolves — undeliverable, and this path does NOT schedule a retry-drain
-      // (the design leaves it to the next wake / the heartbeat backstop). Mark
-      // the deferral live so health reads degraded rather than armed. An
-      // unscoped wake carries no authoritative pending signal, so it does not
-      // set the marker. Retry behavior is unchanged.
+      // A scoped entry passed the pending check but its TUI thread is not loaded
+      // yet. Keep it in the coalesced retry-drain instead of waiting for another
+      // inbound event or the heartbeat.
       if (sourceEntryId) deliveryDeferred = true;
+      scheduleRetryDrain(deps, sourceEntryId);
       return;
     }
     const { socketPath, threadId } = resolved;

package/src/codex-launch.ts

@@ -2,6 +2,13 @@ import type { BorgCli } from './cubes.js';
 import type { AgentKind } from './agent-runtime.js';
 import { wakePathArming } from './regen-format.js';
 import { OPENCODE_WAKE_PATH_GUIDANCE } from './opencode-wake-copy.js';
+import { withCodexCwdArg, type CodexRemoteReadyLaunch } from './codex-remote.js';
+import { codexBorgSessionConfigArgs } from './launch-gate.js';
+import {
+  codexAgentKindConfigArgs,
+  codexRemoteWakeConfigArgs,
+  codexStateRootConfigArgs,
+} from './agent-runtime.js';
 
 /**
  * The claude kickoff prompt's wake-path section (gh#929) — the SAME shared
@@ -29,25 +36,9 @@ export function buildKickoffWakePathClause(
   return '';
 }
 
-export interface CodexWakeTargetDeps {
-  setCodexWakeTarget: (
-    cubeId: string,
-    droneId: string,
-    target: { threadId: string; socketPath: string }
-  ) => Promise<void>;
-  findLoadedCodexThread: (options: {
-    socketPath: string;
-    cwd: string;
-    previewIncludes: string;
-    updatedAfter: number;
-  }) => Promise<string | null>;
-}
-
 export function buildAgentKickoffPrompt(options: {
   cli: BorgCli;
-  codexWakeNonce: string | null;
   monitorClause: string;
-  codexWakePathClause?: string;
 }): string {
   // gh#929: compacted to the load-bearing launch essentials (lean/explicit/
   // imperative, #914 treatment). STRIPPED: the read-log-triage paragraph (the
@@ -55,13 +46,9 @@ export function buildAgentKickoffPrompt(options: {
   // clause (Coordinator/Queen-only; belongs in role-text, not injected for
   // ALL). KEPT: core call + MCP-disconnect recovery + the wake-path arming
   // (claude via the shared monitorClause = buildKickoffWakePathClause; codex
-  // via codexWakePathClause) + the claude/codex/opencode cli-branching.
-  const codexNonceClause = options.codexWakeNonce
-    ? `Wake target nonce: ${options.codexWakeNonce}. `
-    : '';
+  // via the Borg-owned remote socket clause) + the cli-specific branching.
   const codexWakePathClause =
-    options.codexWakePathClause ??
-    `Codex Borg wakeups use remote-control when available; if no wake arrives, run borg_regen manually when returning to the session.`;
+    'Codex Borg wakeups use the Borg-owned remote-control socket for this session.';
   const opencodeWakePathClause = OPENCODE_WAKE_PATH_GUIDANCE;
   const wakeClause = options.cli === 'claude'
     ? options.monitorClause
@@ -70,7 +57,6 @@ export function buildAgentKickoffPrompt(options: {
       : opencodeWakePathClause;
   return (
     `Call borg_regen and follow the playbook in its response. ` +
-    codexNonceClause +
     `Note: at session start the borg MCP server is still spinning up in ` +
     `parallel — if a system reminder claims "MCP server disconnected" or ` +
     `the borg tools are not yet registered, do NOT bail. Make one recovery attempt via ` +
@@ -82,61 +68,42 @@ export function buildAgentKickoffPrompt(options: {
   );
 }
 
-export function socketPathFromRemoteArgs(args: string[]): string | null {
-  const index = args.indexOf('--remote');
-  if (index < 0) return null;
-  const value = args[index + 1];
-  if (!value?.startsWith('unix://')) return null;
-  return value.slice('unix://'.length);
-}
+export type CodexLaunchArgsResult =
+  | { ready: true; args: string[] }
+  | { ready: false; reason: string };
 
-export function threadIdFromPassthroughArgs(args: string[]): string | null {
-  if (args[0] === 'resume' && args[1] && !args[1].startsWith('-')) return args[1];
-  const resumeIndex = args.indexOf('--resume');
-  if (resumeIndex >= 0 && args[resumeIndex + 1]) return args[resumeIndex + 1];
-  return null;
-}
-
-export async function recordCodexWakeTarget(options: {
-  deps: CodexWakeTargetDeps;
-  cubeId: string;
-  droneId: string;
-  socketPath: string;
+export function buildCodexLaunchArgs(options: {
+  remote: CodexRemoteReadyLaunch;
   cwd: string;
-  previewNeedle: string;
-  launchedAtSeconds: number;
+  kickoff: string;
+  approvalArgs?: string[];
+  accessArgs?: string[];
+  seatExpectationArgs?: string[];
   passthroughArgs?: string[];
-}): Promise<void> {
-  try {
-    const explicitThreadId = options.passthroughArgs
-      ? threadIdFromPassthroughArgs(options.passthroughArgs)
-      : null;
-    if (explicitThreadId) {
-      await options.deps.setCodexWakeTarget(options.cubeId, options.droneId, {
-        threadId: explicitThreadId,
-        socketPath: options.socketPath,
-      });
-      return;
-    }
-
-    const deadline = Date.now() + 15_000;
-    while (Date.now() < deadline) {
-      const threadId = await options.deps.findLoadedCodexThread({
-        socketPath: options.socketPath,
-        cwd: options.cwd,
-        previewIncludes: options.previewNeedle,
-        updatedAfter: options.launchedAtSeconds - 5,
-      });
-      if (threadId) {
-        await options.deps.setCodexWakeTarget(options.cubeId, options.droneId, {
-          threadId,
-          socketPath: options.socketPath,
-        });
-        return;
-      }
-      await new Promise((resolve) => setTimeout(resolve, 500));
-    }
-  } catch {
-    // Best-effort mapping: launch still succeeds and manual regen remains available.
+}): CodexLaunchArgsResult {
+  const passthroughArgs = options.passthroughArgs ?? [];
+  if (passthroughArgs.some((arg) => arg === '--remote' || arg.startsWith('--remote='))) {
+    return {
+      ready: false,
+      reason: 'Borg owns Codex remote control; remove the passthrough --remote option and retry.',
+    };
+  }
+  const remoteValue = `unix://${options.remote.server.socketPath}`;
+  if (options.remote.args.length !== 2 || options.remote.args[0] !== '--remote' || options.remote.args[1] !== remoteValue) {
+    return { ready: false, reason: 'The Borg-owned Codex remote socket is unavailable.' };
   }
+  return {
+    ready: true,
+    args: [
+      ...(options.accessArgs ?? []),
+      ...(options.approvalArgs ?? []),
+      ...codexBorgSessionConfigArgs(),
+      ...codexAgentKindConfigArgs(),
+      ...codexRemoteWakeConfigArgs(),
+      ...codexStateRootConfigArgs(),
+      ...(options.seatExpectationArgs ?? []),
+      ...options.remote.args,
+      ...withCodexCwdArg([...passthroughArgs, options.kickoff], options.cwd),
+    ],
+  };
 }

package/src/codex-remote.ts

@@ -35,14 +35,22 @@ export interface CodexAppServerHandle {
   cleanup: () => void;
 }
 
-export interface CodexRemoteLaunch {
+export interface CodexRemoteReadyLaunch {
+  ready: true;
   args: string[];
   env: Record<string, string>;
-  warning?: string;
-  /** Present when borg owns a per-launch app-server that must be cleaned up on TUI exit. */
-  server?: CodexAppServerHandle;
+  /** Borg owns this per-launch app-server and must clean it up on TUI exit. */
+  server: CodexAppServerHandle;
 }
 
+export interface CodexRemoteLaunchRefusal {
+  ready: false;
+  reason: string;
+  stderr: string;
+}
+
+export type CodexRemoteLaunch = CodexRemoteReadyLaunch | CodexRemoteLaunchRefusal;
+
 export interface CodexChild {
   pid: number | undefined;
   kill: () => void;
@@ -69,15 +77,17 @@ export interface PrepareCodexRemoteDeps {
   runtimeDir?: string;
   /** Unique socket id generator (default 32-hex). Injected for deterministic tests. */
   socketId?: () => string;
-  /** Readiness timeout (default 30000ms) + poll interval (default 250ms). */
+  /** Readiness timeout (default 60000ms) + poll interval (default 250ms). */
   readyTimeoutMs?: number;
   pollIntervalMs?: number;
+  /** Wall clock used to enforce the readiness budget. */
+  now?: () => number;
   /** Whether a pid is alive (default process.kill(pid, 0)). Injected for tests. */
   isAlive?: (pid: number) => boolean;
 }
 
 export const DEFAULT_CODEX_REMOTE_DIR = join(borgConfigRoot(), 'codex-remote');
-const DEFAULT_CODEX_REMOTE_READY_TIMEOUT_MS = 30_000;
+const DEFAULT_CODEX_REMOTE_READY_TIMEOUT_MS = 60_000;
 const MAX_CODEX_APP_SERVER_STDERR_CHARS = 16_384;
 
 /**
@@ -266,8 +276,8 @@ function pruneStaleSockets(runtimeDir: string, isAlive: (pid: number) => boolean
   }
 }
 
-function failLoud(reason: string): CodexRemoteLaunch {
-  return { args: [], env: {}, warning: reason };
+function refuse(reason: string, stderr = ''): CodexRemoteLaunchRefusal {
+  return { ready: false, reason, stderr: sanitizeCodexDiagnostic(stderr).trim() };
 }
 
 function formatExitReason(diagnostics: CodexChildDiagnostics): string {
@@ -277,16 +287,10 @@ function formatExitReason(diagnostics: CodexChildDiagnostics): string {
   return 'unknown exit status';
 }
 
-function formatStderr(stderr: string): string {
-  const trimmed = sanitizeCodexDiagnostic(stderr).trim();
-  return trimmed ? ` Stderr: ${trimmed}` : '';
-}
-
 /**
  * Start a borg-owned per-launch Codex app-server, probe it for readiness, and
- * return the `--remote` launch args + an owned handle (or a fail-loud warning).
- * Async + lifecycle-owning: the caller MUST call `result.server?.cleanup()` on
- * TUI exit.
+ * return the `--remote` launch args + an owned handle, or a typed refusal after
+ * one retry. The caller MUST call `result.server.cleanup()` on TUI exit.
  */
 export async function prepareCodexRemoteLaunch(
   deps: PrepareCodexRemoteDeps
@@ -295,6 +299,7 @@ export async function prepareCodexRemoteLaunch(
   const isAlive = deps.isAlive ?? defaultIsAlive;
   const readyTimeoutMs = deps.readyTimeoutMs ?? DEFAULT_CODEX_REMOTE_READY_TIMEOUT_MS;
   const pollIntervalMs = deps.pollIntervalMs ?? 250;
+  const now = deps.now ?? Date.now;
 
   // 1. 0700 owned dir + prune crashed prior sockets (concurrent-safe via pid liveness).
   try {
@@ -302,89 +307,92 @@ export async function prepareCodexRemoteLaunch(
     chmodSync(runtimeDir, 0o700); // enforce 0700 even if it pre-existed with looser perms
     pruneStaleSockets(runtimeDir, isAlive);
   } catch (err: any) {
-    return failLoud(
-      `Codex remote-wake disabled: could not prepare ${runtimeDir} (${err?.message ?? err}); run borg_regen manually.`
-    );
+    return refuse(`could not prepare the Codex app-server runtime directory (${sanitizeCodexDiagnostic(String(err?.message ?? err))})`);
   }
 
-  // 2. unique, non-predictable socket path inside the owned dir.
-  const id = (deps.socketId ?? (() => randomBytes(16).toString('hex')))();
-  const socketPath = join(runtimeDir, `${id}.sock`);
-  const pidPath = join(runtimeDir, `${id}.pid`);
-
-  // 3. spawn the long-lived app-server.
-  let child: CodexChild;
-  try {
-    child = deps.spawnAppServer(socketPath);
-  } catch (err: any) {
-    safeRm(socketPath);
-    return failLoud(
-      `Codex remote-wake disabled: could not start \`codex app-server\` (${sanitizeCodexDiagnostic(String(err?.message ?? err))}) — ` +
-        `confirm the Codex executable is installed and available on PATH. ` +
-        `Remote wake is unavailable for this session; run borg_regen manually to catch up.`
-    );
-  }
-  if (child.pid != null) {
+  let lastRefusal = refuse('the Codex app-server did not become ready');
+  for (let launchAttempt = 0; launchAttempt < 2; launchAttempt += 1) {
+    // Each retry owns a fresh, non-predictable socket and pidfile.
+    const id = (deps.socketId ?? (() => randomBytes(16).toString('hex')))();
+    const socketPath = join(runtimeDir, `${id}.sock`);
+    const pidPath = join(runtimeDir, `${id}.pid`);
+    let child: CodexChild;
     try {
-      writeFileSync(pidPath, String(child.pid));
-    } catch {
-      // pidfile is only for stale-prune; launch still proceeds.
+      child = deps.spawnAppServer(socketPath);
+    } catch (err: any) {
+      safeRm(socketPath);
+      safeRm(pidPath);
+      lastRefusal = refuse(
+        `could not start \`codex app-server\` (${sanitizeCodexDiagnostic(String(err?.message ?? err))}); confirm the Codex executable is installed and available on PATH`
+      );
+      continue;
     }
-  }
-
-  const cleanup = () => {
-    try {
-      child.kill();
-    } catch {
-      // best-effort
+    if (child.pid != null) {
+      try {
+        writeFileSync(pidPath, String(child.pid));
+      } catch {
+        // pidfile is only for stale-prune; launch still proceeds.
+      }
     }
-    safeRm(socketPath);
-    safeRm(pidPath);
-  };
 
-  // 4. readiness via a real protocol round-trip — bounded attempts (no clock dep).
-  const attempts = Math.max(1, Math.ceil(readyTimeoutMs / pollIntervalMs));
-  let ready = false;
-  let exitDiagnostics: CodexChildDiagnostics | undefined;
-  for (let i = 0; i < attempts && !ready; i++) {
-    try {
-      ready = await deps.probeReady(socketPath);
-    } catch {
-      ready = false;
-    }
-    if (!ready) {
+    const cleanup = () => {
+      try {
+        child.kill();
+      } catch {
+        // best-effort
+      }
+      safeRm(socketPath);
+      safeRm(pidPath);
+    };
+
+    // Readiness is bounded by elapsed wall time, so slow protocol probes count
+    // against the same cold-start budget as the poll sleeps.
+    const startedAt = now();
+    let ready = false;
+    let exitDiagnostics: CodexChildDiagnostics | undefined;
+    for (;;) {
+      try {
+        ready = await deps.probeReady(socketPath);
+      } catch {
+        ready = false;
+      }
+      if (ready) break;
       const diagnostics = child.diagnostics?.();
       if (diagnostics?.exited) {
         exitDiagnostics = diagnostics;
         break;
       }
+      const remainingMs = readyTimeoutMs - (now() - startedAt);
+      if (remainingMs <= 0) break;
+      await deps.sleep(Math.min(pollIntervalMs, remainingMs));
     }
-    if (!ready && i < attempts - 1) await deps.sleep(pollIntervalMs);
-  }
 
-  if (!ready) {
     const diagnostics = exitDiagnostics ?? child.diagnostics?.();
-    cleanup();
-    if (diagnostics?.exited) {
-      return failLoud(
-        `Codex remote-wake disabled: \`codex app-server\` exited before becoming ready ` +
-          `(${formatExitReason(diagnostics)}).${formatStderr(diagnostics.stderr)} ` +
-          `Run borg_regen manually to catch up.`
-      );
+    if (!ready) {
+      cleanup();
+      if (diagnostics?.exited) {
+        lastRefusal = refuse(
+          `\`codex app-server\` exited before becoming ready (${formatExitReason(diagnostics)})`,
+          diagnostics.stderr,
+        );
+      } else {
+        lastRefusal = refuse(
+          `\`codex app-server\` remained running but did not become ready within ${readyTimeoutMs}ms`,
+          diagnostics?.stderr ?? '',
+        );
+      }
+      continue;
     }
-    return failLoud(
-      `Codex remote-wake disabled: \`codex app-server\` remained running but did not become ready ` +
-        `at ${sanitizeCodexDiagnostic(socketPath)} within ${readyTimeoutMs}ms.${formatStderr(diagnostics?.stderr ?? '')} ` +
-        `Run borg_regen manually to catch up.`
-    );
+
+    return {
+      ready: true,
+      args: ['--remote', `unix://${socketPath}`],
+      env: { [BORG_CODEX_REMOTE_WAKE_ENV]: '1' },
+      server: { pid: child.pid, socketPath, cleanup },
+    };
   }
 
-  // 5. ready → owned remote launch.
-  return {
-    args: ['--remote', `unix://${socketPath}`],
-    env: { [BORG_CODEX_REMOTE_WAKE_ENV]: '1' },
-    server: { pid: child.pid, socketPath, cleanup },
-  };
+  return lastRefusal;
 }
 
 /**