commandmate 0.31.3 → 0.32.1

package/dist/server/src/lib/detection/selection-shape.js

@@ -64,7 +64,8 @@
  * written once.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMMAND_CODE_SELECTION_LIST_FOOTER = exports.SET_AS_DEFAULT_FOOTER_PATTERN = exports.SESSION_SCOPE_FOOTER_PATTERN = exports.MAX_OPTION_NUMBER = exports.SELECTION_SHAPE_TAIL_LINE_COUNT = void 0;
+exports.DISMISSABLE_PANEL_FOOTER_PATTERN = exports.COMMAND_CODE_SELECTION_LIST_FOOTER = exports.SET_AS_DEFAULT_FOOTER_PATTERN = exports.SESSION_SCOPE_FOOTER_PATTERN = exports.MAX_OPTION_NUMBER = exports.SELECTION_SHAPE_TAIL_LINE_COUNT = void 0;
+exports.hasDismissablePanelFooter = hasDismissablePanelFooter;
 exports.extractCommandCodeSelectionListFrame = extractCommandCodeSelectionListFrame;
 exports.readSelectionListShape = readSelectionListShape;
 exports.shouldOfferOptionNumbers = shouldOfferOptionNumbers;
@@ -150,6 +151,76 @@ const FILTER_INPUT_PATTERN = /\btype\s+to\s+search\b|\bsearch\s+\w+\s*(?:…|\.\
  * settled on for the same reason.
  */
 exports.COMMAND_CODE_SELECTION_LIST_FOOTER = /\benter\s+to\s+select\b\s*[·•]\s*esc\s+to\s+cancel\b/i;
+/**
+ * The footer of an overlay whose ONLY exit is the dismiss (Issue #2369).
+ *
+ * Measured on Command Code 1.49's `/usage`, whose last row is verbatim
+ * `Press Esc to close`. The panel above it is read-only — a plan header, two
+ * meters, a breakdown URL — so there is no highlight to move and no key to
+ * confirm with. Before this pattern existed nothing matched the screen, it
+ * reached the `default` floor, and the chat surface answered an
+ * eighteen-button `unclassified` card to a panel with one working key.
+ *
+ * ## Why it is this narrow
+ *
+ * Three narrowings, and each one is there because this predicate SUPPRESSES
+ * controls — a false positive takes the arrow pad and the answer keys away from
+ * a screen that needed them:
+ *
+ *  - **a verb before the key.** `Press`/`Hit`/`Type`, or nothing at all, but not
+ *    an arbitrary run of prose. `esc to cancel` on its own is the tail of every
+ *    picker footer in this file, including
+ *    {@link COMMAND_CODE_SELECTION_LIST_FOOTER}, and those screens have a
+ *    highlight;
+ *  - **`close`/`dismiss`/`exit`, never `cancel` or `go back`.** The distinction
+ *    is measured rather than stylistic: `cancel` is what a screen with a
+ *    COMMITTABLE choice calls its escape (claude's `/model`, codex's picker,
+ *    Command Code's own), while `close` is what a panel that decided nothing
+ *    calls it;
+ *  - **the whole row.** Anchored at both ends (leading/trailing space aside), so
+ *    a hint bar that offers a dismiss ALONGSIDE something else — `↑/↓ navigate ·
+ *    enter to select · esc to close` — does not match, and keeps the arrows the
+ *    other half of its sentence promises.
+ *
+ * Case-insensitive because the measured row is `Press Esc to close` and Command
+ * Code writes its picker hints in lower case; nothing rests on which it uses.
+ */
+exports.DISMISSABLE_PANEL_FOOTER_PATTERN = /^\s*(?:press|hit|type)?\s*(?:<)?esc(?:ape)?(?:>)?\s+to\s+(?:close|dismiss|exit)\b[\s.·•]*$/im;
+/**
+ * How many rows from the end of the content the dismiss footer is looked for.
+ *
+ * The same 15-row tail the detection chain hands a tool module as
+ * `NormalizedFrame.lastLines` (`STATUS_CHECK_LINE_COUNT`), restated as a number
+ * here because this module is a browser-safe leaf and `tools/frame.ts` pulls in
+ * `cli-patterns`. `detect.ts` reads `frame.lastLines` and never this constant,
+ * so the two cannot disagree about the detector's own window; this one bounds
+ * the CLIENT-side reading in {@link hasDismissablePanelFooter}.
+ */
+const DISMISSABLE_PANEL_TAIL_LINE_COUNT = 15;
+/**
+ * Whether the tail of this frame is a dismiss-only panel (Issue #2369).
+ *
+ * The same question `commandCodeStatusDetector.afterPrompt` asks of
+ * `frame.lastLines`, asked of a raw capture, so the chat surface can answer for
+ * a frame whose server verdict has not reached it. The pattern is shared rather
+ * than restated — one expression, two call sites, exactly as
+ * {@link COMMAND_CODE_SELECTION_LIST_FOOTER} is shared between the detector and
+ * the dialog card.
+ *
+ * @param frame - a raw `capture-pane -p -e` frame, ANSI intact
+ */
+function hasDismissablePanelFooter(frame) {
+    if (!frame)
+        return false;
+    const lines = (0, ansi_1.stripAnsi)(frame.replace(/\r\n/g, '\n')).split('\n');
+    let last = lines.length - 1;
+    while (last >= 0 && lines[last].trim() === '')
+        last -= 1;
+    if (last < 0)
+        return false;
+    const tail = lines.slice(Math.max(0, last + 1 - DISMISSABLE_PANEL_TAIL_LINE_COUNT), last + 1);
+    return tail.some((line) => exports.DISMISSABLE_PANEL_FOOTER_PATTERN.test(line));
+}
 /**
  * The horizontal rule Command Code draws directly above a full-screen dialog.
  *

package/dist/server/src/lib/detection/status-reason.js

@@ -64,6 +64,34 @@ exports.STATUS_REASON = {
      * `Type to search models...` box.
      */
     COMMAND_CODE_SELECTION_LIST: 'command_code_selection_list',
+    /**
+     * Issue #2369: a Command Code overlay that only Esc leaves.
+     *
+     * `/usage` opens a read-only panel — a plan header, two usage meters, a
+     * breakdown URL — whose last row is `Press Esc to close`. There is no
+     * highlight to move, no numbered option and no confirm key; the ONE thing the
+     * screen accepts is the dismiss.
+     *
+     * Distinct from {@link STATUS_REASON.COMMAND_CODE_SELECTION_LIST} because the
+     * two screens want different controls, and that is the whole of this Issue:
+     * before it, this panel matched no rule at all, reached the `default` floor
+     * and so raised `isUnclassifiedActive` — which the chat surface answers with
+     * `TerminalEscapeHatch` plus `PromptAnswerKeys`, eighteen buttons (arrows,
+     * Enter, Esc, `1`-`9`, `y`, `n`) of which exactly one does anything. Reporting
+     * the selection-list token instead would put the arrow pad on the card and
+     * tell an operator reading `capture --json` that a moving highlight had been
+     * read off a panel that has none.
+     *
+     * Deliberately NOT a member of `SELECTION_LIST_REASONS`
+     * (`lib/detection/status-detector.ts`): that set is what `isSelectionListActive`
+     * — and therefore the arrow pad — is derived from. The flag this one feeds is
+     * `isDismissablePanelActive`, published beside it.
+     *
+     * The vocabulary is Command Code's alone for now (方針書 §4 D2's tool-by-tool
+     * rule): the SHAPE "an overlay whose footer offers only a dismiss" is general,
+     * the sentence that identifies it was measured on one tool.
+     */
+    COMMAND_CODE_DISMISSABLE_PANEL: 'command_code_dismissable_panel',
     COPILOT_SELECTION_LIST: 'copilot_selection_list',
     CODEX_SELECTION_LIST: 'codex_selection_list',
     /** Issue #1017: Codex pager / edit-previous (transcript) mode. */

package/dist/server/src/lib/detection/tools/antigravity/dialog.js

@@ -38,13 +38,19 @@
  *
  * ## Who calls it
  *
- * Both producers of the wire, so that they cannot disagree about one screen:
- * `antigravity/detect.ts` (the status verdict `/current-output` publishes) and
- * `polling/response-checker.ts` (the `prompt` row the poller stores and the
- * push notification it raises). The Auto-Yes poller is deliberately NOT a
- * caller: with Auto-Yes on, agy's `PreToolUse` hook answers the permission
- * request before the dialog is drawn (Issue #1779), so the dialogs this module
- * reads only appear when nothing is going to auto-answer them.
+ * Every producer of the wire, so that they cannot disagree about one screen:
+ * `antigravity/detect.ts` (the status verdict `/current-output` publishes),
+ * `polling/response-checker.ts` (`detectPromptOnCleanFrame` — the `prompt` row
+ * the poller stores, the push notification it raises, AND the Auto-Yes poller's
+ * reading) and the `prompt-response` route's re-verification.
+ *
+ * Issue #2364 left the Auto-Yes poller on the generic pass, on the premise that
+ * agy's `PreToolUse` hook answers the permission request before the dialog is
+ * drawn. Measured false (#2368): agy 1.1.27 ignores a hook `allow` in
+ * interactive mode and draws the dialog anyway (#1779), so agy's Auto-Yes
+ * depends entirely on this TUI reading — and without it every wrapped Bash
+ * approval sat unanswered while `/current-output` published it as waiting.
+ * #2368 put that poller on the same entry.
  *
  * Deliberately NOT a change to the generic multiple-choice parser: folding
  * continuation rows there would change what every other tool's dialogs read

package/dist/server/src/lib/detection/tools/command-code/detect.js

@@ -55,6 +55,13 @@
  * numbered-response path, because Command Code fires `PreToolUse` AFTER the
  * dialog is answered, so a hook-driven permission decision cannot dismiss it.
  *
+ * Issue #2369 added a second `afterPrompt` branch for the other screen the
+ * shared chain could not read: the `/usage` panel, whose last row is
+ * `Press Esc to close`. It is not a picker — nothing moves, nothing commits —
+ * so it gets a reason of its own rather than the selection-list token, and the
+ * chat surface answers it with the one key it accepts. See
+ * `STATUS_REASON.COMMAND_CODE_DISMISSABLE_PANEL`.
+ *
  * `afterPrompt` arrived with Issue #2297, for the one screen the shared chain
  * genuinely could not read: the picker `/model` opens. It is a provider-grouped
  * list of model NAMES — no option numbers — over a `› Type to search models...`
@@ -106,6 +113,32 @@ exports.commandCodeStatusDetector = (0, run_detection_1.createToolStatusDetector
     tool: 'command-code',
     verifiedAgainst: exports.VERIFIED_AGAINST,
     afterPrompt(frame) {
+        // Issue #2369. `/usage` opens a READ-ONLY panel: a plan header, two usage
+        // meters, a breakdown URL, and `Press Esc to close` as its last row. It is
+        // matched before the picker footer below because the two are mutually
+        // exclusive sentences and this one is the more specific — a whole row that
+        // offers a dismiss and nothing else.
+        //
+        // `waiting` rather than `running`, which is the half of this branch that
+        // fixes the reported defect: `isUnclassifiedFrame` (`session/status-evidence`)
+        // is `status === 'running' && <floor reason>`, so a `waiting` verdict takes
+        // `isUnclassifiedActive` down with it and the chat surface stops answering
+        // an eighteen-button card to a one-key panel. The reason is deliberately NOT
+        // in `SELECTION_LIST_REASONS`: there is no highlight here, so the arrow pad
+        // would be as wrong as the answer keys were. `current-output-builder`
+        // publishes it as `isDismissablePanelActive` instead.
+        //
+        // A human still has to press the key, so `waiting` is also the honest word:
+        // nothing on this pane will move until they do.
+        if (selection_shape_1.DISMISSABLE_PANEL_FOOTER_PATTERN.test(frame.lastLines)) {
+            return {
+                status: 'waiting',
+                confidence: 'high',
+                reason: status_reason_1.STATUS_REASON.COMMAND_CODE_DISMISSABLE_PANEL,
+                hasActivePrompt: false,
+                evidence: 'positive',
+            };
+        }
         // Issue #2297. Command Code's pickers (`/model` measured live on v1.40.1 at
         // 200x1000) are arrow-driven overlays with a search box and a lower-case
         // hint-bar footer. Nothing in the shared chain reads that footer, so before

package/dist/server/src/lib/history/user-turn-recorder.js

@@ -27,6 +27,17 @@
  * 1. **The key is already on a row** — nothing happens. The callers are pollers,
  *    so being asked to record the same prompt again is the normal case rather
  *    than an error.
+ * 1b. **A RELAY delivery's row already holds this text** (Issue #2392) — the
+ *    same answer, reached without the key. A relay hands session A the reply
+ *    session B wrote by sending it into A's composer, and the row it writes
+ *    carries `relay:<ledgerId>` so that the ledger can be read back out of it
+ *    (#2387). Being keyed is exactly what put it beyond outcome 2's claim, so
+ *    until this Issue every delivery left the operator reading the reply twice.
+ *    The row is recognised here but deliberately **not** claimed: nothing is
+ *    written, its key stays `relay:<ledgerId>`, and the caller is told
+ *    `already-recorded` with that row's id — because re-pointing it at a
+ *    transcript key would take the loop guard's only route back to the ledger
+ *    away with it.
  * 2. **An unkeyed row already holds this text** — that row is *claimed*, not
  *    duplicated. This is the `/send` case, and it is the whole reason the
  *    recorder is not simply an insert: `sendUserMessage` wrote the operator's
@@ -203,37 +214,46 @@ async function recordUserTurn(target, key, content, timestampMs, options = {}) {
     }
 }
 /**
- * Claim the `/send` row for this prompt, if there is one.
+ * Recognise the row this prompt is already on, if there is one.
  *
- * The candidates come back newest first and are compared on normalised content;
- * the one nearest the agent's clock wins, which only matters when the operator
- * sent the same text twice inside the window and is the right tie-break then
- * too.
+ * One window, two kinds of row in it, and what may be done with them differs:
  *
- * The claim itself can lose — `setMessageRequestId` refuses a row that acquired
- * a key between the read and the write. Losing means some other producer got
- * there first, so the next candidate is tried and, if none is left, the caller
- * falls through to the insert. It cannot loop: each attempt either claims a row
- * or removes it from contention.
+ * 1. the `/send` row, which carries no key and is **claimed** — this is #2196's
+ *    case and the reason the recorder is not simply an insert;
+ * 2. a relay delivery's row, which carries `relay:<ledgerId>` and is **left
+ *    exactly as it is** — Issue #2392. `includeRelayDelivered` is what puts it
+ *    in the answer at all, and `requestId` is what tells the two apart.
  *
- * @returns The claimed row, or null when nothing here belongs to this prompt
+ * The claim is tried across every unkeyed candidate first, so the presence of a
+ * delivery cannot cost an orphan row its key. It can lose —
+ * `setMessageRequestId` refuses a row that acquired a key between the read and
+ * the write. Losing means some other producer got there first, so the next
+ * candidate is tried and, if none is left, the delivery is considered and then
+ * the caller falls through to the insert. It cannot loop: each attempt either
+ * claims a row or removes it from contention.
+ *
+ * @returns The row this prompt is on, or null when nothing here is this prompt's
  */
 function adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, options) {
     // `Math.min` and not a replacement: {@link RecordUserTurnOptions} may widen
     // the search backwards and may never narrow it, so a caller that supplies a
     // bound *inside* the standard window changes nothing.
     const fromMs = Math.min(at - exports.USER_TURN_ADOPTION_WINDOW_MS, options.adoptionFromMs ?? Number.POSITIVE_INFINITY);
-    const candidates = chatDb
-        .findUnkeyedUserMessages(db, {
+    const candidates = sameText(chatDb.findUnkeyedUserMessages(db, {
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,
         instanceId,
         fromMs,
         toMs: at + exports.USER_TURN_ADOPTION_WINDOW_MS,
-    })
-        .filter((row) => normalizeUserTurnContent(row.content) === normalized)
-        .sort((a, b) => Math.abs(a.timestamp.getTime() - at) - Math.abs(b.timestamp.getTime() - at));
+        // Issue #2392. Without this the relay delivery's row is not in the answer
+        // at all, and the prompt it holds is inserted a second time.
+        includeRelayDelivered: true,
+    }), normalized, at);
     for (const candidate of candidates) {
+        // A relay delivery, kept for the pass below: claiming it would overwrite the
+        // `relay:<ledgerId>` the loop guard reads the ledger back out of.
+        if (candidate.requestId)
+            continue;
         if (!chatDb.setMessageRequestId(db, candidate.id, key))
             continue;
         logger.info('user-turn-adopted', {
@@ -248,5 +268,48 @@ function adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, o
             timestampMs: candidate.timestamp.getTime(),
         };
     }
+    // Issue #2392. Nothing is written here and that is the whole point: the row
+    // already says what this prompt says, and its `request_id` is the loop guard's
+    // only way back to the ledger entry that produced it (`findParentRelayHops`,
+    // #2387). So the prompt is reported as recorded on the row that holds it, and
+    // the insert below is not reached. `setMessageRequestId` would refuse the
+    // write anyway — it is a compare-and-set on `request_id IS NULL` — but the
+    // branch above says so explicitly rather than leaning on that.
+    //
+    // No direction test on the timestamp, unlike #2387's `isEchoOfRelayRow`: that
+    // one is deciding whether a row it can already see is an echo, while this is
+    // deciding whether to write a row at all, and a transcript whose clock rounds
+    // a prompt to a whole second would land just *before* the delivery and bring
+    // the duplicate straight back. The symmetric window is safe here because the
+    // text being matched is a relay body — `buildRelayReplyMessage`'s framing, not
+    // anything an operator types.
+    const delivered = candidates.find((candidate) => candidate.requestId);
+    if (delivered) {
+        logger.info('user-turn-already-relayed', {
+            ...describe(target),
+            requestId: key,
+            messageId: delivered.id,
+            relayRequestId: delivered.requestId ?? null,
+            driftMs: delivered.timestamp.getTime() - at,
+        });
+        return {
+            outcome: 'already-recorded',
+            messageId: delivered.id,
+            timestampMs: delivered.timestamp.getTime(),
+        };
+    }
     return null;
 }
+/**
+ * The rows here that hold this prompt's text, nearest the agent's clock first.
+ *
+ * Content is compared normalised, because that is the only comparison
+ * `chat_messages` cannot make for itself (see `findUnkeyedUserMessages`). The
+ * ordering only matters when the same text sits on two rows inside the window,
+ * and nearest-in-time is the right tie-break then too.
+ */
+function sameText(rows, normalized, at) {
+    return rows
+        .filter((row) => normalizeUserTurnContent(row.content) === normalized)
+        .sort((a, b) => Math.abs(a.timestamp.getTime() - at) - Math.abs(b.timestamp.getTime() - at));
+}

package/dist/server/src/lib/hooks/agent-event-service.js

@@ -161,16 +161,29 @@ function safeRealpath(target) {
  * skip it, and after `recordAgentStopEvent` because the reader resolves its
  * transcript through the session pointer that call refreshes.
  *
- * It is awaited rather than detached. The turn has already ended, so the cost is
- * paid by nobody who is waiting for an answer, and a detached promise here would
- * be one whose failures nothing observes.
+ * ## Exactly one read is awaited (Issue #2398)
+ *
+ * The comment that stood here said the read could be awaited freely, because
+ * "the turn has already ended, so the cost is paid by nobody who is waiting for
+ * an answer". That is true of Claude Code, which writes its transcript and then
+ * fires the hook, and false of codex, which does not append the record closing
+ * the turn until this hook's command exits — so for codex the agent *is* waiting
+ * for this answer, and the retries that were waiting for the file were waiting
+ * for themselves. Measured 2026-09-07: 105 codex stop events, 0 captured, 1 s of
+ * the agent's stop path spent on each.
+ *
+ * So the reader is asked once here, and anything further happens after this
+ * function has returned — detached, and observed through the log rather than
+ * through the return value, which is what
+ * {@link AgentStopOutcome.structuredHistoryOutcome} exists to say.
  *
  * Never throws. A hook is fire-and-forget from a CLI's stop handler, and a
  * failure here must not become the agent's problem.
  */
 async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
     (0, agent_event_state_1.recordAgentStopEvent)(worktree.id, cliToolId, instanceId);
-    const structuredHistoryCaptured = await (0, stop_history_capture_1.captureTranscriptTurnOnStop)(worktree, cliToolId, instanceId);
+    const { status: structuredHistoryOutcome } = await (0, stop_history_capture_1.resolveStopTranscriptCapture)(worktree, cliToolId, instanceId);
+    const structuredHistoryCaptured = structuredHistoryOutcome === 'captured';
     let task;
     try {
         task = (0, tasks_db_1.getActiveTaskForInstance)(db, worktree.id, cliToolId, instanceId);
@@ -185,6 +198,7 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
             taskEventApplied: false,
             verificationRunId: null,
             structuredHistoryCaptured,
+            structuredHistoryOutcome,
         };
     }
     if (!task) {
@@ -193,6 +207,7 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
             taskEventApplied: false,
             verificationRunId: null,
             structuredHistoryCaptured,
+            structuredHistoryOutcome,
         };
     }
     let taskEventApplied = false;
@@ -212,6 +227,7 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
             taskEventApplied,
             verificationRunId: null,
             structuredHistoryCaptured,
+            structuredHistoryOutcome,
         };
     }
     let verificationRunId = null;
@@ -235,5 +251,11 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
             });
         }
     }
-    return { taskId: task.id, taskEventApplied, verificationRunId, structuredHistoryCaptured };
+    return {
+        taskId: task.id,
+        taskEventApplied,
+        verificationRunId,
+        structuredHistoryCaptured,
+        structuredHistoryOutcome,
+    };
 }

package/dist/server/src/lib/hooks/sources/codex/history.js

@@ -323,6 +323,13 @@ async function scanForRollout(dir, sessionId, depth) {
  * attach` is the thing #2196 exists to record, and it is worth recording next to
  * a *scraped* reply just as much as next to a Markdown one.
  *
+ * A turn whose `task_started` fell outside the window is written too, behind
+ * `CODEX_TURN_HEAD_TRUNCATION_MARKER` and beside a
+ * `codex-transcript-turn-headless` report (Issue #2402). See `./transcript`'s
+ * module docblock for why codex may do that where `../claude/history` may not,
+ * and `docs/design/codex-transcript-reader.md` §4.5 for why the prompts that
+ * went out of the window with it are left unadopted rather than guessed at.
+ *
  * Never throws.
  *
  * @param target - The instance whose turn just ended
@@ -411,11 +418,17 @@ async function captureCodexTranscriptTurn(target, capture = {}) {
             const previousStartedAt = index === 0 ? pending.previousStartedAt : pending.turns[index - 1].startedAt;
             userRows.push(await recordCodexUserTurns(target, pending.turns[index], previousStartedAt));
         }
+        const windowFacts = {
+            path,
+            firstRecordAt: firstCodexRecordAt(parsed.records),
+            turnlessRecords: built.turnlessRecords,
+            malformedLines: parsed.malformedLines,
+        };
         const lastRecordAt = lastCodexRecordAt(parsed.records);
         let captured = false;
         for (let index = 0; index < pending.turns.length; index += 1) {
             const turn = pending.turns[index];
-            captured = await writeCodexTurn(target, turn, (0, transcript_1.renderCodexTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastRecordAt.get(turn.turnId) ?? 0, nextTurnOpensAt(pending.turns, userRows, index)), path);
+            captured = await writeCodexTurn(target, turn, (0, transcript_1.renderCodexTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastRecordAt.get(turn.turnId) ?? 0, nextTurnOpensAt(pending.turns, userRows, index)), windowFacts);
         }
         return captured;
     }
@@ -448,6 +461,21 @@ async function resolveCodexTranscriptPath(target, capture = {}) {
         return null;
     }
 }
+/**
+ * When the window's first timestamped record was written (Issue #2402).
+ *
+ * The floor on "everything this read could possibly have seen". For a headless
+ * turn it is also the only honest thing to say about where the missing head
+ * ends: the turn began before this instant, and by how much is not in the file
+ * this read opened.
+ */
+function firstCodexRecordAt(records) {
+    for (const record of records) {
+        if (record.timestampMs !== null)
+            return record.timestampMs;
+    }
+    return null;
+}
 /**
  * The turns {@link captureCodexTranscriptTurn} still has to write (Issue #2246).
  *
@@ -642,7 +670,7 @@ function nextTurnOpensAt(turns, userRows, index) {
  *
  * @returns Whether History holds this turn as the agent's own Markdown
  */
-async function writeCodexTurn(target, turn, rendered, timestampMs, path) {
+async function writeCodexTurn(target, turn, rendered, timestampMs, windowFacts) {
     const instanceId = target.instanceId ?? target.cliToolId;
     if (!turn.closed) {
         // codex has not written the `task_complete` for this `turn_id` yet, so what
@@ -706,6 +734,38 @@ async function writeCodexTurn(target, turn, rendered, timestampMs, path) {
         });
         return true;
     }
+    if (rendered.headless) {
+        // Issue #2402. The turn's `task_started` is outside the window, so this row
+        // carries `CODEX_TURN_HEAD_TRUNCATION_MARKER` and the operator can see that
+        // — but the operator cannot see WHY, and neither can anyone reading the logs
+        // afterwards. Everything below is measured: where the window opens, what it
+        // held that no turn claimed, and how many of the turn's prompts were inside
+        // it. How much fell out is deliberately NOT here. It is not knowable from a
+        // read that never saw those bytes, and a guess would be worse than silence.
+        //
+        // `promptsInWindow` is the one to read when a prompt is missing from the
+        // conversation: codex folds a prompt submitted mid-turn into that same turn
+        // (23 of 326 archived turns carry more than one), so a headless turn's
+        // earlier prompts can be outside the window too — and unlike the body, those
+        // are NOT recoverable. `recordCodexUserTurns` only ever sees `turn.prompts`,
+        // which is what the window held; a `/send` row for a prompt written before
+        // the window stays unkeyed. Adopting it would mean guessing which unkeyed
+        // row belongs to this turn with no text to match on — see
+        // `docs/design/codex-transcript-reader.md` §4.5.
+        logger.info('codex-transcript-turn-headless', {
+            worktreeId: target.worktreeId,
+            instanceId,
+            sessionId: rendered.sessionId,
+            turnId: rendered.turnId,
+            path: windowFacts.path,
+            windowBytes: exports.CODEX_TRANSCRIPT_TAIL_BYTES,
+            windowFirstRecordAt: windowFacts.firstRecordAt,
+            turnlessRecords: windowFacts.turnlessRecords,
+            malformedLines: windowFacts.malformedLines,
+            promptsInWindow: turn.prompts.length,
+            itemsInWindow: turn.items.length,
+        });
+    }
     const message = createMessage(db, {
         worktreeId: target.worktreeId,
         role: 'assistant',
@@ -722,7 +782,7 @@ async function writeCodexTurn(target, turn, rendered, timestampMs, path) {
         instanceId,
         sessionId: rendered.sessionId,
         requestId,
-        path,
+        path: windowFacts.path,
         bodyLength: rendered.body.length,
         textBlocks: rendered.textBlocks,
         toolBlocks: rendered.toolBlocks,

package/dist/server/src/lib/hooks/sources/codex/transcript.js

@@ -53,6 +53,34 @@
  * boundary is a field, and a turn is closed by the `task_complete` that carries
  * its id — measured on 326 of 326 archived turns.
  *
+ * ## A turn can begin outside the window (Issue #2402)
+ *
+ * `./history` reads the rollout's last `CODEX_TRANSCRIPT_TAIL_BYTES` and nothing
+ * more, because the largest rollout on this machine was 273 MB. A long turn
+ * outgrows that window: measured on 2026-09-07 on a 30 MB / 7,408-line rollout
+ * whose newest turn ran seven hours over 387 items and four compactions, so its
+ * `task_started` and its first two prompts sat outside the 4 MiB tail while its
+ * later items sat inside it.
+ *
+ * The `turn_id` stamp is what makes that recoverable. Because it is on **every**
+ * `item_completed` and not only on `task_started`, a window that opens in the
+ * middle of a turn still reads the turn's real id — so the turn can be rendered
+ * AND written under the key a later read will recognise. What is lost is the
+ * head of the body, and {@link CodexTurnAccumulator.started} is how that becomes
+ * a fact the writer can state: it is the opening mark, exactly as `closed` is
+ * the closing one, and a turn with `started: false` is rendered behind
+ * {@link CODEX_TURN_HEAD_TRUNCATION_MARKER}.
+ *
+ * **This is where codex and claude diverge, and the divergence is deliberate.**
+ * `../claude/history`'s `collectHeadlessClaudeTurn` renders the same situation
+ * and refuses to write it, because claude's transcript carries no link from a
+ * reply to the prompt it answers: a turn whose prompt record is outside the
+ * window has no key at all, so writing it would mean inventing one, and an
+ * invented key is a row no later run can recognise as already written. codex is
+ * not under that constraint — the key is a field on the records that ARE in the
+ * window — so the argument that stops claude does not reach here. Copying
+ * claude's refusal would drop a body codex handed over for free.
+ *
  * ## Pure on purpose
  *
  * No filesystem, no database, no `globalThis` — `./history` owns all three, the
@@ -63,7 +91,7 @@
  * @module lib/hooks/sources/codex/transcript
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CODEX_THINKING_LABEL = exports.MAX_CODEX_TOOL_DETAIL_LENGTH = exports.MAX_CODEX_TURN_ITEMS = exports.CODEX_TURN_TRUNCATION_MARKER = exports.MAX_CODEX_TURN_BODY_LENGTH = exports.CODEX_ROLLOUT_EXTENSION = exports.CODEX_SESSIONS_DIR_SEGMENTS = void 0;
+exports.CODEX_THINKING_LABEL = exports.MAX_CODEX_TOOL_DETAIL_LENGTH = exports.MAX_CODEX_TURN_ITEMS = exports.CODEX_TURN_HEAD_TRUNCATION_MARKER = exports.CODEX_TURN_TRUNCATION_MARKER = exports.MAX_CODEX_TURN_BODY_LENGTH = exports.CODEX_ROLLOUT_EXTENSION = exports.CODEX_SESSIONS_DIR_SEGMENTS = void 0;
 exports.readCodexRolloutItem = readCodexRolloutItem;
 exports.readCodexRolloutRecord = readCodexRolloutRecord;
 exports.parseCodexRollout = parseCodexRollout;
@@ -79,6 +107,17 @@ exports.CODEX_ROLLOUT_EXTENSION = '.jsonl';
 exports.MAX_CODEX_TURN_BODY_LENGTH = 200_000;
 /** Appended when {@link MAX_CODEX_TURN_BODY_LENGTH} truncates a turn. */
 exports.CODEX_TURN_TRUNCATION_MARKER = '\n\n_(truncated)_';
+/**
+ * Prepended when a turn's opening records fell outside the window (#2402).
+ *
+ * The mirror of {@link CODEX_TURN_TRUNCATION_MARKER} — same italic parenthetical
+ * in the same plain Markdown, on the other end of the body — because the two say
+ * the same thing about the same row and a reader who has learned to read one
+ * should not have to learn a second notation for the other. Written into
+ * `chat_messages.content` at read time like every other string these readers
+ * emit, so it is English and outlives any later locale change.
+ */
+exports.CODEX_TURN_HEAD_TRUNCATION_MARKER = '_(head truncated)_\n\n';
 /**
  * Cap on items kept for one turn.
  *
@@ -322,11 +361,19 @@ function buildCodexTurns(records, sessionId) {
                 startedAt: record.timestampMs ?? 0,
                 prompts: [],
                 items: [],
+                started: false,
                 closed: false,
                 overflowed: false,
             };
             turns.set(turnId, turn);
         }
+        if (record.payloadType === 'task_started') {
+            // The opening mark (Issue #2402). Recorded rather than assumed from "this
+            // is the first record we saw for the id", which is true of every turn in
+            // the window — including the one whose real first record is outside it.
+            turn.started = true;
+            continue;
+        }
         if (record.payloadType === 'task_complete') {
             turn.closed = true;
             continue;
@@ -432,6 +479,10 @@ function renderCodexTurn(turn) {
             unknown.add(item.type);
     }
     let body = (0, turn_body_1.separateTurnBody)(rendered).body;
+    // The head mark goes on before the length bound, so a headless turn long
+    // enough to be truncated at both ends still says so at both ends.
+    if (!turn.started && body.length > 0)
+        body = exports.CODEX_TURN_HEAD_TRUNCATION_MARKER + body;
     if (body.length > exports.MAX_CODEX_TURN_BODY_LENGTH) {
         body =
             body.slice(0, exports.MAX_CODEX_TURN_BODY_LENGTH - exports.CODEX_TURN_TRUNCATION_MARKER.length) +
@@ -441,6 +492,7 @@ function renderCodexTurn(turn) {
         sessionId: turn.sessionId,
         turnId: turn.turnId,
         body,
+        headless: !turn.started,
         textBlocks,
         toolBlocks,
         unknownBlockTypes: [...unknown],