fraim-hub 2.0.270 → 2.0.271

package/dist/src/ai-hub/catalog.js

@@ -14,6 +14,7 @@ exports.getAiHubCategories = getAiHubCategories;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+const resolve_phase_edge_1 = require("../core/resolve-phase-edge");
 // Directories scanned for employee jobs at runtime, in lowest-to-highest
 // precedence order. Later entries win on {categoryId, jobId} collision.
 //
@@ -411,21 +412,6 @@ function findJobStubPath(projectPath, jobId) {
     }
     return null;
 }
-// Resolve a phase's `onSuccess` edge to the next phase id given the run's
-// discriminant. Returns null when the edge is absent or terminal.
-function nextPhase(edge, discriminant) {
-    if (edge == null)
-        return null;
-    if (typeof edge === 'string')
-        return edge;
-    if (typeof edge === 'object') {
-        if (typeof edge[discriminant] === 'string')
-            return edge[discriminant];
-        if (typeof edge.default === 'string')
-            return edge.default;
-    }
-    return null;
-}
 // Parse the ordered phase list from a job stub's ## Steps section.
 // Real FRAIM job stubs use Markdown steps rather than JSON frontmatter;
 // this is the fallback parser that makes the pizza tracker work for them.
@@ -460,7 +446,7 @@ function loadJobPhases(jobId, projectPath, discriminant = 'feature') {
         const phaseDef = fm.phases[cursor];
         if (!phaseDef)
             break;
-        cursor = nextPhase(phaseDef.onSuccess, discriminant);
+        cursor = (0, resolve_phase_edge_1.resolvePhaseEdge)(fm.phases[cursor]?.onSuccess, discriminant);
     }
     const labels = fm.phaseLabels || {};
     return ordered.map((id) => ({ id, label: friendlyPhaseLabel(id, labels[id]) }));
@@ -482,7 +468,7 @@ function resolveJobPhaseTransition(jobId, projectPath, phaseId, outcome, discrim
     if (!phaseDef)
         return null;
     const edge = outcome === 'complete' ? phaseDef.onSuccess : phaseDef.onFailure;
-    return nextPhase(edge, discriminant);
+    return (0, resolve_phase_edge_1.resolvePhaseEdge)(edge, discriminant);
 }
 function loadAllJobPhaseIds(jobId, projectPath) {
     const stubPath = findJobStubPath(projectPath, jobId);

package/dist/src/ai-hub/conversation-store.js

@@ -26,7 +26,6 @@ const HEADER_OMITTED_FIELDS = [
     'events',
     'artifacts',
     'run',
-    'delegation',
     'handoffSummary',
     '_bodyLoaded',
     '_stopping',
@@ -181,13 +180,34 @@ function placeConversationInBucket(bucket, conv) {
     const existingScore = conversationRichness(existing);
     const incomingScore = conversationRichness(conv);
     if (incomingScore > existingScore) {
-        bucket.conversations[idx] = conv;
+        bucket.conversations[idx] = withStableConversationCreatedAt(existing, conv);
     }
     else if (incomingScore === existingScore
         && timestampValue(value?.lastUpdatedAt) > timestampValue(existing.lastUpdatedAt)) {
-        bucket.conversations[idx] = conv;
+        bucket.conversations[idx] = withStableConversationCreatedAt(existing, conv);
     }
 }
+function stableConversationCreatedAt(existing, incoming) {
+    const existingValue = existing?.createdAt;
+    const incomingValue = incoming?.createdAt;
+    const existingTs = timestampValue(existingValue);
+    const incomingTs = timestampValue(incomingValue);
+    if (existingTs > 0 && incomingTs > 0)
+        return existingTs <= incomingTs ? existingValue : incomingValue;
+    if (existingTs > 0)
+        return existingValue;
+    if (incomingTs > 0)
+        return incomingValue;
+    return existingValue ?? incomingValue;
+}
+function withStableConversationCreatedAt(existing, incoming) {
+    if (!incoming || typeof incoming !== 'object')
+        return incoming;
+    const createdAt = stableConversationCreatedAt(existing, incoming);
+    if (createdAt === undefined)
+        return incoming;
+    return { ...incoming, createdAt };
+}
 // Relocate any project-scoped record mis-filed under the wrong project bucket back to its own
 // project (see docs/rca/hub-conversation-cross-project-leak.md). Sentinel buckets are left as-is.
 function migrateProjectBuckets(store) {
@@ -303,14 +323,45 @@ function newestFirst(a, b) {
 }
 function toHeader(conv) {
     const header = { ...conv };
+    const delegation = compactDelegationForHeader(header.delegation);
     for (const field of HEADER_OMITTED_FIELDS)
         delete header[field];
+    if (delegation)
+        header.delegation = delegation;
     for (const field of Object.keys(header)) {
         if (field.startsWith('_'))
             delete header[field];
     }
     return header;
 }
+function compactDelegationForHeader(raw) {
+    if (!raw || typeof raw !== 'object')
+        return undefined;
+    const delegation = raw;
+    const tasks = Array.isArray(delegation.tasks) ? delegation.tasks : [];
+    if (!tasks.length)
+        return undefined;
+    return {
+        delegationRequired: delegation.delegationRequired === true,
+        objective: delegation.objective,
+        orchestratorPersonaKey: delegation.orchestratorPersonaKey,
+        rootRunId: delegation.rootRunId,
+        managerRunId: delegation.managerRunId,
+        tasks: tasks.map((task) => {
+            const value = task && typeof task === 'object' ? task : {};
+            return {
+                taskId: value.taskId,
+                title: value.title,
+                status: value.status,
+                personaKey: value.personaKey,
+                jobId: value.jobId,
+                runId: value.runId,
+                conversationId: value.conversationId,
+                dependsOn: Array.isArray(value.dependsOn) ? value.dependsOn : [],
+            };
+        }),
+    };
+}
 function headerNeedsSanitization(header) {
     const value = header;
     return Object.keys(value).some((field) => HEADER_OMITTED_FIELD_SET.has(field) || field.startsWith('_'));
@@ -345,6 +396,17 @@ class AiHubConversationStore {
         // Sibling directory of the legacy file, e.g. ~/.fraim/ai-hub-conversations/
         this.shardRoot = path_1.default.join(dir, base);
     }
+    /**
+     * Root directory holding the per-bucket shards.
+     *
+     * Issue #1164: exposed read-only so callers that walk the shard layout, such as
+     * the stale-bucket sweep, ask the store where its data lives instead of
+     * re-deriving the path. Two independent derivations of the same layout drift the
+     * moment one changes, and a sweep pointed at the wrong directory fails silently.
+     */
+    get shardRootPath() {
+        return this.shardRoot;
+    }
     // ---- path helpers ----
     bucketDir(bucketKey) {
         const canonical = bucketKey === exports.MANAGER_SCOPE_KEY || bucketKey === exports.COMPANY_SCOPE_KEY
@@ -732,6 +794,7 @@ class AiHubConversationStore {
                 id: existing.id,
                 projectPath: key,
                 agentName: patch.agentName || existing.agentName,
+                createdAt: stableConversationCreatedAt(existing, patch) ?? existing.createdAt,
                 lastUpdatedAt: patch.lastUpdatedAt ?? new Date().toISOString(),
             }) ?? existing;
             this.writeConvFile(bucketDir, key, merged);

package/dist/src/ai-hub/hosts.js

@@ -381,7 +381,19 @@ function extractSignalFromArgs(args) {
         : 'starting';
     const findings = args.findings;
     const findingsText = findings && typeof findings.summary === 'string' ? findings.summary : undefined;
-    const discriminant = typeof args.runDiscriminant === 'string' ? args.runDiscriminant : undefined;
+    // Issue #1135: `runDiscriminant` is not a field of the seekMentoring tool schema
+    // and no agent sends it, so before issue #1123 this was populated only by the
+    // scripted test double and production always resolved with the literal default
+    // 'feature'. The real discriminant is the one the mentor routes on
+    // (`findings.phaseOutcome`), so read that first and keep the legacy field as a
+    // fallback for the test double.
+    const evidenceArgs = args.evidence;
+    const discriminantFromFindings = findings && typeof findings.phaseOutcome === 'string' ? findings.phaseOutcome
+        : findings && typeof findings.issueType === 'string' ? findings.issueType
+            : evidenceArgs && typeof evidenceArgs.issueType === 'string' ? evidenceArgs.issueType
+                : undefined;
+    const discriminant = discriminantFromFindings
+        ?? (typeof args.runDiscriminant === 'string' ? args.runDiscriminant : undefined);
     const jobName = typeof args.jobName === 'string' ? args.jobName : undefined;
     const jobId = typeof args.jobId === 'string' ? args.jobId : undefined;
     const issueNumber = typeof args.issueNumber === 'string' ? args.issueNumber
@@ -1787,6 +1799,7 @@ class CliHostRuntime {
 exports.CliHostRuntime = CliHostRuntime;
 class FakeHostRuntime {
     constructor() {
+        this.isTestDouble = true;
         this.employees = [
             { id: 'codex', label: 'Codex', available: true, detail: 'Test double employee.', supportsRaw: true },
             { id: 'claude', label: 'Claude Code', available: true, detail: 'Test double employee.', supportsRaw: true },
@@ -1878,6 +1891,7 @@ exports.FakeHostRuntime = FakeHostRuntime;
 // FakeHostRuntime (smaller surface, no seekMentoring).
 class ScriptedHostRuntime {
     constructor() {
+        this.isTestDouble = true;
         this.employees = [
             { id: 'codex', label: 'Codex', available: true, detail: 'Scripted test double.', supportsRaw: true },
             { id: 'claude', label: 'Claude Code', available: true, detail: 'Scripted test double.', supportsRaw: true },

package/dist/src/ai-hub/restart-recovery-policy.js

@@ -8,6 +8,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = require("crypto");
 const conversation_store_1 = require("./conversation-store");
+const process_liveness_1 = require("./process-liveness");
 exports.DEFAULT_RESTART_RECOVERY_LEASE_MS = 60_000;
 function normalizedDirectoryPath(projectPath) {
     const resolved = path_1.default.resolve(projectPath);
@@ -49,6 +50,8 @@ class RestartRecoveryPolicy {
         this.recoveryLeaseMs = options.recoveryLeaseMs ?? exports.DEFAULT_RESTART_RECOVERY_LEASE_MS;
         this.projectExists = options.projectExists || ((projectPath) => fs_1.default.existsSync(projectPath));
         this.machineLevelJobIds = options.machineLevelJobIds || new Set();
+        this.currentPid = options.currentPid ?? process.pid;
+        this.pidAlive = options.pidAlive || process_liveness_1.isPidAlive;
     }
     classify(conversation, bucketKey, options = {}) {
         const bucketReason = restartRecoveryBucketOwnershipReason(conversation, bucketKey);
@@ -81,6 +84,17 @@ class RestartRecoveryPolicy {
         if (options.activeRunExists) {
             return { action: 'defer', reason: 'active_run_exists' };
         }
+        // Issue #1159: `activeRunExists` only sees this process's run registry, so it
+        // cannot tell that a *different* live Hub owns this run. Two Hubs on one
+        // machine is the normal case here: the desktop Hub plus any Hub a job starts
+        // for validation. Without this check the second one adopts the first one's
+        // in-flight work, replaces its run id, and parks it as "Waiting on you".
+        // A dead owner pid is exactly the restart case recovery exists for, so only
+        // a live foreign owner defers.
+        const ownerPid = typeof conversation.ownerPid === 'number' ? conversation.ownerPid : 0;
+        if (ownerPid > 0 && ownerPid !== this.currentPid && this.pidAlive(ownerPid)) {
+            return { action: 'defer', reason: 'owner_process_alive' };
+        }
         const recoveredAt = timestampMs(conversation.restartRecovery?.recoveredAt);
         if (recoveredAt > 0 && this.nowMs() - recoveredAt < this.recoveryLeaseMs) {
             return { action: 'defer', reason: 'recent_recovery' };

package/dist/src/ai-hub/server.js

@@ -325,11 +325,14 @@ function directoryExists(projectPath) {
 // when none is recorded the Hub has no active project and opens on an empty
 // project list. This deliberately never falls back to process.cwd() — the launch
 // directory must not masquerade as a project.
-function resolveInitialHubProjectPath(preferencesStore) {
+function resolveInitialHubProjectPath(preferencesStore, options = {}) {
     const recorded = preferencesStore.load('').projectPath;
     if (typeof recorded === 'string' && recorded.trim().length > 0) {
         const resolved = path_1.default.resolve(recorded);
-        if (directoryExists(resolved))
+        const allowedTemporary = options.allowTemporaryRelatedTo
+            ? isRelatedTemporaryProjectPath(resolved, options.allowTemporaryRelatedTo)
+            : false;
+        if (directoryExists(resolved) && (!isLikelyTemporaryProjectPath(resolved) || allowedTemporary))
             return resolved;
     }
     return '';
@@ -1267,6 +1270,11 @@ function isCodexMissingReasoningResumeError(run) {
             text.includes('provided without its required "reasoning" item');
     });
 }
+function isCodexMissingReasoningResumeText(value) {
+    const text = String(value || '');
+    return text.includes("provided without its required 'reasoning' item") ||
+        text.includes('provided without its required "reasoning" item');
+}
 // Apply a parsed seekMentoring tool-use signal from the host stream to
 // the run state. Returns the updated currentPhase.
 function applySeekMentoringSignal(run, signal) {
@@ -1302,6 +1310,7 @@ function applySeekMentoringSignal(run, signal) {
             : [];
         if (run.reviewHandoff?.reviewRequired === true) {
             run.pauseReason = 'awaiting_review';
+            run.nextJobRecommendations = null;
         }
         else if (run.reviewHandoff?.reviewRequired === false && run.pauseReason === 'awaiting_review') {
             run.pauseReason = 'working';
@@ -1682,6 +1691,22 @@ function normalizedDirectoryPath(projectPath) {
 function sameDirectoryPath(left, right) {
     return normalizedDirectoryPath(left) === normalizedDirectoryPath(right);
 }
+function isPathInsideDirectory(candidatePath, parentPath) {
+    const relative = path_1.default.relative(path_1.default.resolve(parentPath), path_1.default.resolve(candidatePath));
+    return relative === '' || (!!relative && !relative.startsWith('..') && !path_1.default.isAbsolute(relative));
+}
+function isLikelyTemporaryProjectPath(projectPath) {
+    if (!projectPath)
+        return false;
+    return isPathInsideDirectory(projectPath, os_1.default.tmpdir());
+}
+function isRelatedTemporaryProjectPath(projectPath, activeProjectPath) {
+    if (!isLikelyTemporaryProjectPath(projectPath))
+        return true;
+    if (!activeProjectPath || !isLikelyTemporaryProjectPath(activeProjectPath))
+        return false;
+    return isPathInsideDirectory(projectPath, path_1.default.dirname(path_1.default.resolve(activeProjectPath)));
+}
 function deploymentProjectFilter(rawProjectPath, fallbackProjectPath) {
     return ensureDirectoryPath(typeof rawProjectPath === 'string' && rawProjectPath.trim() ? rawProjectPath : fallbackProjectPath);
 }
@@ -1768,6 +1793,14 @@ function countMarkdownFilesRecursive(dirPath) {
 //   conservative park.
 // ---------------------------------------------------------------------------
 const MAX_RECOVERY_ATTEMPTS = 3;
+// Issue #1150: a run launched through a user-defined configured agent depends on that
+// profile's setup-script env (CODEX_HOME, AWS_REGION, ...) to reach the right provider
+// and the right host session store. A synthesized `<host>-default` agent has no setup
+// script, so it contributes nothing and its absence costs nothing.
+function usesCustomConfiguredAgent(run) {
+    const configuredAgentId = typeof run.configuredAgentId === 'string' ? run.configuredAgentId.trim() : '';
+    return configuredAgentId.length > 0 && !configuredAgentId.endsWith('-default');
+}
 function recoveryBackoffMs(attempt) {
     const base = 600 * Math.pow(2, attempt - 1); // 600, 1200, 2400ms
     return base + Math.floor(0.2 * base); // +20% deterministic jitter
@@ -1997,6 +2030,9 @@ class AiHubServer {
             res.setHeader('Expires', '0');
             next();
         });
+        this.app.get('/favicon.ico', (_req, res) => {
+            res.status(204).end();
+        });
         this.app.use('/ai-hub', express_1.default.static(resolveAiHubPublicDir()));
         this.app.use('/_fraim-hub-ui', (req, res, next) => {
             try {
@@ -2135,7 +2171,7 @@ class AiHubServer {
         // Prefer the recorded project (reflects a project switch), then the active
         // project resolved at construction, then '' when no project has been chosen
         // (#866 R2). Never falls back to cwd.
-        return resolveInitialHubProjectPath(this.preferencesStore) || this.projectPath;
+        return resolveInitialHubProjectPath(this.preferencesStore, { allowTemporaryRelatedTo: this.projectPath }) || this.projectPath;
     }
     // Issue #892: resolve the working directory for a run start/resume. Project-scoped
     // runs require an existing project directory (unchanged — an empty path still throws
@@ -2296,12 +2332,14 @@ class AiHubServer {
         const preferences = this.preferencesStore.load(normalizedProjectPath);
         const includeConversationProjects = options.includeConversationProjects !== false;
         const conversationProjects = includeConversationProjects
-            ? this.conversationStore.listProjectPaths().map((folderPath) => ({ folderPath }))
+            ? this.conversationStore.listProjectPaths()
+                .filter((folderPath) => isRelatedTemporaryProjectPath(folderPath, normalizedProjectPath))
+                .map((folderPath) => ({ folderPath }))
             : [];
         return (0, preferences_1.normalizeAiHubProjectList)([
-            ...(preferences.projects || []),
+            ...(preferences.projects || []).filter((project) => isRelatedTemporaryProjectPath(project.folderPath, normalizedProjectPath)),
             ...conversationProjects,
-            ...extras,
+            ...extras.filter((project) => isRelatedTemporaryProjectPath(project.folderPath, normalizedProjectPath)),
         ], normalizedProjectPath, { removedProjectPaths: preferences.removedProjectPaths || [] });
     }
     /**
@@ -2652,6 +2690,9 @@ class AiHubServer {
             status: run.status,
             // Issue #904: carry auxiliary exit classification to the persisted record.
             ...(run.pauseReason !== undefined && { pauseReason: run.pauseReason }),
+            // Issue #1159: record which Hub process owns this run, so another Hub can
+            // ask whether the owner is still alive before adopting it on restart.
+            ownerPid: process.pid,
             createdAt: run.createdAt,
             lastUpdatedAt,
             messages: run.messages.map((message) => {
@@ -2769,7 +2810,7 @@ class AiHubServer {
         const startedFresh = this.runRegistry.get(run.id);
         if (startedFresh)
             this.persistRunConversation(startedFresh, startedFresh.conversationId || startedFresh.id);
-        this.runRegistry.create(run, {});
+        this.runRegistry.create(startedFresh || run, {});
         const freshLaunch = this.resolveLaunchAgent(run.configuredAgentId, run.hostId);
         const freshChild = this.hostRuntime.startRun(run.hostId, run.projectPath, freshPayload.message, {
             onEvent: (event, channel) => {
@@ -2828,13 +2869,48 @@ class AiHubServer {
         fs_1.default.mkdirSync(dir, { recursive: true });
         return path_1.default.join(dir, 'hub-restart-recovery.lock');
     }
+    /**
+     * Issue #1159: recover only what this Hub actually manages.
+     *
+     * This used to iterate `conversationStore.listProjectPaths()`, i.e. every bucket
+     * in the store. Because tests boot real `AiHubServer` instances against the
+     * default store at `~/.fraim/ai-hub-conversations/`, a Hub started for a temp
+     * fixture directory swept the developer's real projects, took ownership of
+     * three in-flight runs, and parked them as "Waiting on you".
+     *
+     * The bound is the Hub's own project list, the same bound issue #1065 applied
+     * to search scope. `includeConversationProjects: false` matters: the default
+     * form folds `listProjectPaths()` back in, and `isRelatedTemporaryProjectPath`
+     * returns true for every non-temp path, so the developer's real projects would
+     * survive the filter.
+     */
     restartRecoveryBucketKeys() {
-        const keys = new Set(this.conversationStore.listProjectPaths());
+        const keys = new Set(this.knownProjects(this.projectPath, [], { includeConversationProjects: false })
+            .map((project) => project.folderPath)
+            .filter((folderPath) => typeof folderPath === 'string' && !!folderPath));
         keys.add(conversation_store_1.MANAGER_SCOPE_KEY);
         keys.add(conversation_store_1.COMPANY_SCOPE_KEY);
         return Array.from(keys);
     }
+    /**
+     * Issue #1159: a test double answers any continue with a canned line and exits
+     * 0 within milliseconds, which `handleRunExit` parks as completed/awaiting_user.
+     * Running restart recovery under one therefore converts live work into
+     * "Waiting on you" on contact. Recovery is a production-only concern; tests that
+     * exercise it inject a purpose-built runtime instead.
+     *
+     * Reads the runtime's own `isTestDouble` marker rather than testing `instanceof`
+     * against specific classes, so a new double opts itself in and this file never
+     * imports a test class.
+     */
+    hostRuntimeIsTestDouble() {
+        return this.hostRuntime.isTestDouble === true;
+    }
     recoverInProgressConversationsAfterRestart() {
+        if (this.hostRuntimeIsTestDouble()) {
+            console.warn('[ai-hub] restart recovery skipped: host runtime is a test double.');
+            return;
+        }
         try {
             (0, conversation_store_lock_1.withBucketLock)(this.restartRecoveryLockPath(), () => {
                 const bucketKeys = this.restartRecoveryBucketKeys();
@@ -3001,7 +3077,7 @@ class AiHubServer {
             },
             restartRecoverySkippedReason: null,
             hostLifecycle: conversation.hostLifecycle || undefined,
-            nextJobRecommendations: conversation.nextJobRecommendations || null,
+            nextJobRecommendations: null,
             issueNumber: conversation.issueNumber ?? null,
             agentSwitches: conversation.agentSwitches || [],
             handoffSummary: conversation.handoffSummary || null,
@@ -3538,7 +3614,7 @@ class AiHubServer {
                 if (latestManager)
                     this.drainPendingDelegatedReviews(latestManager);
             },
-        });
+        }, managerLaunch.launchContext);
         this.runRegistry.attachChildIfRunning(managerRun.id, child);
     }
     computeFirstRun(projectPath, jobCount, personas) {
@@ -4341,7 +4417,7 @@ class AiHubServer {
                         reviewHandoff: conversation.reviewHandoff || null,
                         delegation: conversation.delegation || null,
                         delegationTaskId: conversation.delegationTaskId || null,
-                        nextJobRecommendations: conversation.nextJobRecommendations || null,
+                        nextJobRecommendations: null,
                         issueNumber: conversation.issueNumber ?? null,
                         managedByRunId: conversation.managedByRunId || null,
                         managedByPersonaKey: conversation.managedByPersonaKey || null,
@@ -5346,8 +5422,15 @@ class AiHubServer {
                     this.persistRunConversation(started, started.conversationId || started.id);
                 this.runRegistry.create(run, {});
                 const continueLaunch = this.resolveLaunchAgent(run.configuredAgentId, run.hostId);
+                let codexMissingReasoningResumeError = false;
+                let startedCodexReviewApprovalFallback = false;
                 const child = this.hostRuntime.continueRun(run.hostId, run.projectPath, run.sessionId, message, {
                     onEvent: (event, channel) => {
+                        if (run.hostId === 'codex' && reviewApprovalSystemEventText) {
+                            codexMissingReasoningResumeError = codexMissingReasoningResumeError ||
+                                isCodexMissingReasoningResumeText(event.raw) ||
+                                isCodexMissingReasoningResumeText(event.message);
+                        }
                         this.runRegistry.update(run.id, (current) => {
                             if (event.sessionId) {
                                 this.applyRunHostSessionSignal(current, event.sessionId, run.hostId);
@@ -5372,7 +5455,8 @@ class AiHubServer {
                     },
                     onExit: (exitCode) => {
                         const exited = this.runRegistry.get(run.id);
-                        if (exitCode !== 0 && run.hostId === 'codex' && reviewApprovalSystemEventText && exited && isCodexMissingReasoningResumeError(exited)) {
+                        if (exitCode !== 0 && run.hostId === 'codex' && reviewApprovalSystemEventText && exited && (codexMissingReasoningResumeError || isCodexMissingReasoningResumeError(exited))) {
+                            startedCodexReviewApprovalFallback = true;
                             this.startFreshCodexReviewApprovalFallback(run.id, prepared.display || message);
                             return;
                         }
@@ -5381,7 +5465,8 @@ class AiHubServer {
                         });
                     },
                 }, continueLaunch.launchContext);
-                this.runRegistry.attachChildIfRunning(run.id, child);
+                if (!startedCodexReviewApprovalFallback)
+                    this.runRegistry.attachChildIfRunning(run.id, child);
                 const refreshed = this.runRegistry.get(run.id);
                 res.json(refreshed ? this.enrichRunForResponse(refreshed) : refreshed);
             }
@@ -6343,6 +6428,28 @@ class AiHubServer {
         return run;
     }
     // ─── End Issue #578 helpers ───────────────────────────────────────────────
+    // Issue #1150: terminal park for a run whose auto-recovery must stop rather than
+    // relaunch. Mirrors the tail of the normal park path in handleRunExit, so a delegated
+    // child parked here still hands control back to its manager.
+    parkRunAsRecoveryError(runId, exitCode, reason, postPark) {
+        this.runRegistry.update(runId, (run) => {
+            run.exitCode = exitCode;
+            run.status = 'failed';
+            run.pauseReason = 'error';
+            clearCompactionLifecycle(run);
+            run.events.push((0, hosts_1.createHubEvent)('system', reason));
+        });
+        const parked = this.runRegistry.get(runId);
+        if (parked) {
+            if (postPark)
+                postPark(parked);
+            this.finalizeRunConversationProjection(runId, parked.conversationId || parked.id);
+        }
+        this.runRegistry.dispose(runId);
+        const latest = this.runRegistry.get(runId);
+        if (latest)
+            this.drainPendingDelegatedReviews(latest);
+    }
     // Issue #904: shared exit handler for all FRAIM onExit chokepoints.
     // Classifies the exit (classifyExit), writes pauseReason onto the run,
     // then either parks the run or schedules a recovery continue turn.
@@ -6384,6 +6491,29 @@ class AiHubServer {
                 const message = classification.recoveryKind === 'compaction'
                     ? buildHubCompactionRecoveryContinueMessage(current, exitCode, attempt)
                     : buildHubRecoveryContinueMessage(current, exitCode, attempt);
+                // Issue #1150: recovery must relaunch as the SAME configured agent. Its setup
+                // script supplies the env that selects the profile the host session lives in
+                // (CODEX_HOME for Codex), and resuming without it sends `codex exec resume`
+                // looking for the thread in a home that never held it. HostRuntime now requires
+                // a launch context on every relaunch, so this can no longer be omitted silently.
+                let launchContext;
+                try {
+                    launchContext = this.resolveLaunchAgent(current.configuredAgentId, current.hostId).launchContext;
+                }
+                catch (error) {
+                    if (usesCustomConfiguredAgent(current)) {
+                        // A real profile that we can no longer resolve. Resuming anyway would run
+                        // the host against the wrong provider/home, which is the failure this issue
+                        // is about, so park with the reason rather than retry blind.
+                        this.parkRunAsRecoveryError(runId, exitCode, `Auto-recovery stopped: ${current.configuredAgentLabel || current.configuredAgentId} could not be resolved for this run. `
+                            + `${error instanceof Error ? error.message : String(error)}`, postPark);
+                        return;
+                    }
+                    // Synthesized `<host>-default` agents carry no setup-script env, so there is
+                    // nothing to preserve and nothing to protect against. An empty context is
+                    // exactly what one resolves to, and leaves the host plan undecorated.
+                    launchContext = {};
+                }
                 const child = this.hostRuntime.continueRun(current.hostId, current.projectPath, current.sessionId, message, {
                     onEvent: (event, channel) => {
                         this.runRegistry.update(runId, (r) => {
@@ -6403,7 +6533,7 @@ class AiHubServer {
                             this.scheduleRunConversationPersistence(updated, updated.conversationId || updated.id);
                     },
                     onExit: (code) => this.handleRunExit(runId, code, postPark),
-                });
+                }, launchContext);
                 this.runRegistry.attachChildIfRunning(runId, child);
             }, delay);
             if (tid.unref)