grok-bot-cli 0.4.0 → 0.4.2

package/dist/bin/gbot-flight.mjs

@@ -13884,6 +13884,140 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+"./src/cli/codex/desktop-shim.tsx"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+__webpack_require__.r(__webpack_exports__);
+/* import */ var react_jsx_runtime__rspack_import_0 = __webpack_require__("./node_modules/react/jsx-runtime.react-server.js");
+/* import */ var _agent_bundle_runtime__rspack_import_3 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/506.js");
+/* import */ var zod__rspack_import_2 = __webpack_require__("./node_modules/zod/v4/classic/schemas.js");
+/* import */ var _core_desktop_shim_js__rspack_import_1 = __webpack_require__("./src/core/desktop-shim.js");
+/* import */ var _core_format_js__rspack_import_4 = __webpack_require__("./src/core/format.js");
+
+
+
+
+
+const config = {
+    description: 'Install, remove, or check the ChatGPT Desktop shim: a CODEX_CLI_PATH wrapper that bridges Desktop stdio onto the managed Codex daemon (stock app-server proxy hangs). macOS persists via LaunchAgent; always fails open to real Codex.',
+    exitCode: 'result',
+    inputJsonSchema: {
+        additionalProperties: false,
+        properties: {
+            action: {
+                description: 'install | uninstall | status',
+                enum: [
+                    'install',
+                    'uninstall',
+                    'status'
+                ],
+                type: 'string'
+            }
+        },
+        required: [
+            'action'
+        ],
+        type: 'object'
+    },
+    positionals: [
+        'action'
+    ]
+};
+const inputSchema = zod__rspack_import_2/* .object */.Ikc({
+    action: zod__rspack_import_2/* ["enum"] */.k5n([
+        'install',
+        'uninstall',
+        'status'
+    ])
+}).strict();
+const resultSchema = zod__rspack_import_2/* .object */.Ikc({
+    exitCode: zod__rspack_import_2/* .union */.KCZ([
+        zod__rspack_import_2/* .literal */.euz(0),
+        zod__rspack_import_2/* .literal */.euz(1)
+    ])
+}).passthrough();
+const formatWarnings = (warnings)=>warnings.length === 0 ? '' : `\nwarnings:\n${warnings.map((w)=>`  - ${String(w)}`).join('\n')}`;
+async function codexDesktopShim({ input }) {
+    switch(input.action){
+        case 'install':
+            {
+                let out;
+                try {
+                    out = (0,_core_desktop_shim_js__rspack_import_1/* .installDesktopShim */.B0)();
+                } catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g6.Result, {
+                        value: {
+                            action: 'install',
+                            error: message,
+                            exitCode: 1
+                        },
+                        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g6.Text, {
+                            children: `Desktop shim install failed: ${message}`
+                        })
+                    });
+                }
+                const text = `Installed ChatGPT Desktop shim:\n` + `  wrapper: ${out.wrapperPath}\n` + `  bridge: ${out.bridgePath}\n` + `  login env: ${out.envScriptPath}` + (out.plistPath ? `\n  LaunchAgent: ${out.plistPath}` : '\n  LaunchAgent: n/a (macOS-only)') + `\nFully quit and relaunch ChatGPT.app so it inherits CODEX_CLI_PATH; ` + `Desktop falls back to stock Codex if the shim is ever removed.` + formatWarnings(out.warnings);
+                return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g6.Result, {
+                    value: out,
+                    children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g6.Text, {
+                        children: text
+                    })
+                });
+            }
+        case 'uninstall':
+            {
+                let out;
+                try {
+                    out = (0,_core_desktop_shim_js__rspack_import_1/* .uninstallDesktopShim */.gM)();
+                } catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g6.Result, {
+                        value: {
+                            action: 'uninstall',
+                            error: message,
+                            exitCode: 1
+                        },
+                        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g6.Text, {
+                            children: `Desktop shim uninstall failed: ${message}`
+                        })
+                    });
+                }
+                const removed = out.removed.length === 0 ? '(nothing installed)' : out.removed.join(', ');
+                const text = `Removed ChatGPT Desktop shim: ${removed}. ` + `Desktop and Codex fall back to stock behavior; relaunch ChatGPT.app to pick it up.` + formatWarnings(out.warnings);
+                return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g6.Result, {
+                    value: out,
+                    children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g6.Text, {
+                        children: text
+                    })
+                });
+            }
+        case 'status':
+            {
+                const out = (0,_core_desktop_shim_js__rspack_import_1/* .desktopShimStatus */.em)();
+                return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g6.Result, {
+                    value: out,
+                    children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g6.Text, {
+                        children: (0,_core_format_js__rspack_import_4/* .formatDesktopShimStatus */.fX)(out)
+                    })
+                });
+            }
+        default:
+            {
+                const _exhaustive = input.action;
+                throw new Error(`unknown desktop-shim action: ${String(_exhaustive)}`);
+            }
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  "default": () => (codexDesktopShim)
+}, {
+  config: config,
+  inputSchema: inputSchema,
+  resultSchema: resultSchema
+});
+
+
 },
 "./src/cli/codex/list-threads.tsx"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 __webpack_require__.r(__webpack_exports__);
@@ -26303,6 +26437,9 @@ const textDecoder = new TextDecoder("utf-8", {
 });
 const pkg = (0,node_module__rspack_import_6.createRequire)(import.meta.url)("../../package.json");
 function codexSocketPath(env = process.env) {
+    // Explicit socket wins so status/send/queue agree with a shim-installed or
+    // operator-exported CODEX_APP_SERVER_SOCK; otherwise derive from CODEX_HOME.
+    if (env.CODEX_APP_SERVER_SOCK) return env.CODEX_APP_SERVER_SOCK;
     const home = env.CODEX_HOME || (0,node_path__rspack_import_4.join)((0,node_os__rspack_import_3.homedir)(), ".codex");
     return (0,node_path__rspack_import_4.join)(home, "app-server-control", "app-server-control.sock");
 }
@@ -26319,7 +26456,15 @@ function codexSocketPath(env = process.env) {
 /** Single-line fields (ids, names, paths, cursors, header tokens): no line breaks or tabs survive. */ function singleLine(text) {
     return stripTerminalControls(text).replace(/[\t\n\r\u2028\u2029]+/g, " ");
 }
-function unreachableMessage(path) {
+function unreachableMessage(path, desktopAttached = "unknown") {
+    if (desktopAttached === "private-stdio") {
+        return [
+            "ChatGPT Desktop is running its private stdio app-server, which external clients cannot reach",
+            "(" + UPSTREAM_DESKTOP_ISSUES.join(", ") + ").",
+            "No Codex app-server control socket at " + path + ": start a managed standalone daemon with `codex app-server daemon start`.",
+            "gbot codex targets daemon-managed threads only."
+        ].join("\n");
+    }
     return [
         "No Codex app-server control socket at " + path + ".",
         "Either no daemon is running (start one with `codex app-server daemon start`),",
@@ -26522,6 +26667,12 @@ function isObject(value) {
         const sendJson = (obj)=>write(0x1, Buffer.from(JSON.stringify(obj)));
         const client = {
             refused,
+            // Server-initiated requests are only *answered* once our own turn/start
+            // is in flight: anything earlier belongs to another client's turn
+            // (notably Desktop's) and must never be rejected on their behalf. Early
+            // requests are still recorded; the connection closes right after, so a
+            // pending request simply dies with it instead of denying someone's approval.
+            answerServerRequests: false,
             request (method, params) {
                 const id = nextId++;
                 return new Promise((res, rej)=>{
@@ -26585,11 +26736,14 @@ function isObject(value) {
         };
         const onMessage = (msg)=>{
             if (msg.id != null && msg.method) {
+                const answered = client.answerServerRequests;
                 refused.push({
                     id: msg.id,
                     method: msg.method,
-                    params: msg.params
+                    params: msg.params,
+                    answered
                 });
+                if (!answered) return;
                 sendJson({
                     jsonrpc: "2.0",
                     id: msg.id,
@@ -26793,32 +26947,84 @@ const CODEX_VERSION_PROBE_TIMEOUT_MS = 3000;
         probe: "error"
     };
 }
+/** Bounded `ps` snapshot for Desktop detection: process names only, never pipes or sockets. */ const DESKTOP_PROCESS_LIST_TIMEOUT_MS = 3000;
+function listDesktopProcesses(timeoutMs = DESKTOP_PROCESS_LIST_TIMEOUT_MS) {
+    if (process.platform === "win32") return "";
+    try {
+        const out = (0,node_child_process__rspack_import_5.spawnSync)("ps", [
+            "-eo",
+            "args"
+        ], {
+            encoding: "utf8",
+            timeout: timeoutMs
+        });
+        if (out.error || out.status !== 0 || typeof out.stdout !== "string") return "";
+        return out.stdout;
+    } catch  {
+        return "";
+    }
+}
+/**
+ * Pure Desktop private-stdio detector. Returns `"private-stdio"` when the process list
+ * shows Desktop's bundled `.../ChatGPT.app/.../Resources/codex` running `app-server`
+ * (the `codex_app` override corroborates, the Resources path alone suffices); `"unknown"`
+ * otherwise. Never `"detached"`: absence of a match means "not observed", not "not running".
+ * Windows stays `"unknown"` (unsupported route, unchanged).
+ *
+ * @param {{ platform?: string, listProcesses?: string | string[] | null }} [opts]
+ */ function detectDesktopPrivateAppServer({ platform = process.platform, listProcesses = "" } = {}) {
+    if (platform === "win32") return "unknown";
+    const lines = Array.isArray(listProcesses) ? listProcesses : String(listProcesses ?? "").split(/\r?\n/);
+    for (const line of lines){
+        if (!/app-server/.test(line)) continue;
+        // Desktop's bundled binary, Mac or Windows-style separators with optional .exe.
+        if (/ChatGPT\.app[\\/].*Resources[\\/]codex(\.exe)?(["'\s]|$)/.test(line)) return "private-stdio";
+        // Same app-server line owned by ChatGPT.app carrying the app-tools override.
+        if (/ChatGPT\.app/.test(line) && /(codex_app|mcp_servers\.codex_app|codex-app-tools)/.test(line)) return "private-stdio";
+    }
+    return "unknown";
+}
 /**
  * Status contract: `reachable` is endpoint reachability only. `schema.compatibility` is
  * `exact` when the daemon reports the pinned version, otherwise `unverified` (methods
- * usually survive upgrades) or `unknown`. Whether ChatGPT Desktop owns any thread is not
- * observable from the socket, so `desktopAttached` is always `"unknown"`.
- */ async function codexStatus(env = process.env) {
+ * usually survive upgrades) or `unknown`. `desktopAttached` is `"private-stdio"` when a
+ * Desktop-bundled app-server process is visible (see `detectDesktopPrivateAppServer`),
+ * otherwise `"unknown"` — whether Desktop owns any thread is never observable from the
+ * socket itself, and `"detached"` is never reported.
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @param {{ listProcesses?: string | string[] }} [opts] injected process list for tests;
+ *   defaults to a live `ps` snapshot. Never reads pipes or connects to Desktop.
+ */ async function codexStatus(env = process.env, { listProcesses } = {}) {
     const path = codexSocketPath(env);
     const cli = probeLocalCodexVersion();
+    const desktopAttached = detectDesktopPrivateAppServer({
+        platform: process.platform,
+        listProcesses: listProcesses ?? listDesktopProcesses()
+    });
     const base = {
         socketPath: path,
         socketState: socketState(path),
         pinnedVersion: PINNED_CODEX_VERSION,
         cliVersion: cli.version,
         cliVersionProbe: cli.probe,
-        desktopAttached: "unknown"
+        desktopAttached
     };
     let session;
     try {
         session = await openSession(env);
     } catch (err) {
-        if (err instanceof CodexRouteError) return (0,_codex_contract_js__rspack_import_7/* .withStatusExitCode */.AQ)({
-            ...base,
-            reachable: false,
-            mode: err.mode,
-            message: err.message
-        });
+        if (err instanceof CodexRouteError) {
+            // Name the private-stdio case explicitly: Desktop is up but unreachable, so the
+            // operator needs a managed standalone daemon, not a Desktop reconnect.
+            const message = err.mode === "socket-absent" ? unreachableMessage(path, desktopAttached) : err.message;
+            return (0,_codex_contract_js__rspack_import_7/* .withStatusExitCode */.AQ)({
+                ...base,
+                reachable: false,
+                mode: err.mode,
+                message
+            });
+        }
         // The endpoint answered; what it said does not match the pinned schema.
         if (err instanceof CodexProtocolError) return (0,_codex_contract_js__rspack_import_7/* .withStatusExitCode */.AQ)({
             ...base,
@@ -27204,6 +27410,12 @@ async function sendToCodexThreadInner(threadId, text, { env, envelope, whenBusy
         // the daemon exposes no compare-and-start request. Upgrade path: thread/queue/add + thread/queue/start once stable.
         // Scope refusals to this turn: server requests from earlier calls belong to another context.
         const seenRefused = client.refused.length;
+        // Arm refusal replies only now that our own turn/start is in flight: an
+        // approval arriving in this window plausibly belongs to our turn. Anything
+        // recorded earlier (resume, busy reject, queue) stays unanswered so gbot
+        // never rejects another client's approval. Residual race: a concurrent
+        // foreign approval inside this window is indistinguishable from ours.
+        client.answerServerRequests = true;
         let turn;
         try {
             turn = await client.request("turn/start", {
@@ -27238,7 +27450,7 @@ async function sendToCodexThreadInner(threadId, text, { env, envelope, whenBusy
                 envelope
             });
         }
-        const freshRefused = client.refused.slice(seenRefused).filter((r)=>!r.params || r.params.threadId == null || r.params.threadId === threadId);
+        const freshRefused = client.refused.slice(seenRefused).filter((r)=>r.answered && (!r.params || r.params.threadId == null || r.params.threadId === threadId));
         if (freshRefused.length) {
             const methods = freshRefused.map((r)=>r.method).join(", ");
             throw new CodexSendError("Turn " + turnId + " started on thread " + threadId + " but Codex asked for " + methods + ", which gbot refused. " + "Answer it in a Codex client, or set `approval_policy = \"never\"` in the daemon's config.toml for unattended sends.", {
@@ -27268,7 +27480,8 @@ __webpack_require__.d(__webpack_exports__, {
   X$: () => (listCodexThreads),
   ZS: () => (sendToCodexThread),
   nq: () => (buildEnvelope),
-  pF: () => (singleLine)
+  pF: () => (singleLine),
+  ql: () => (codexSocketPath)
 });
 
 
@@ -27474,6 +27687,534 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+"./src/core/desktop-shim-bridge.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
+// Stdio JSONL (Desktop) <-> WebSocket-over-unix bridge onto the managed
+// Codex app-server control socket. Vendored from uploads/codex-stdio-to-daemon-ws.py
+// (ChatGPT Desktop -> managed daemon shim) with fail-open deltas, marked below:
+// (1) ws_connect enforces one absolute monotonic deadline for connect + HTTP
+// upgrade (CODEX_BRIDGE_CONNECT_TIMEOUT, default 10s), validates the 101 status
+// and Sec-WebSocket-Accept, and retains bytes coalesced after the upgrade
+// headers instead of discarding the first data frame.
+// (2) read_message assembles continuation frames; control frames answer inline;
+// socket writes are serialized with a lock shared by both threads.
+// (3) A first-message deadline (CODEX_BRIDGE_FIRST_MESSAGE_TIMEOUT, default
+// 30s) bounds connect-to-first-daemon-message covering the first RPC; the
+// preflight (3s) + upgrade (10s) + first RPC (30s) budget stays far below a
+// daemon-lock hang. Exits are 0 served, 1 pre-stdio (wrapper falls back to
+// real Codex), 2 mid-session (wrapper exits so Desktop reconnects).
+// (4) Byte-precise commit: os.read into a userspace line buffer counts every
+// stdin byte (buffered readline could readahead past the commit point), so the
+// fallback only ever runs on a truly pristine stdio. The reader signals a done
+// event so WS close wakes the select loop; no path leaves a thread hung.
+// Desktop stdio hangs with stock `codex app-server proxy`, so this custom
+// bridge is required. Install writes it to the CODEX_HOME bin dir. Never reads
+// Desktop private pipes (CODEX_APP_TOOLS_PIPE_PATH, /tmp/codex-browser-use/).
+const BRIDGE_SOURCE = "#!/usr/bin/env python3\n\"\"\"Stdio JSONL (Desktop) <-> WebSocket-over-unix (managed app-server daemon).\nReversible: remove CODEX_CLI_PATH wrapper. Does not read Desktop private pipes.\n\"\"\"\nfrom __future__ import annotations\nimport base64, hashlib, json, os, select, socket, struct, sys, threading, time\n\nSOCK = os.environ.get(\n    \"CODEX_APP_SERVER_SOCK\",\n    os.path.expanduser(\"~/.codex/app-server-control/app-server-control.sock\"),\n)\nLOG = os.environ.get(\"CODEX_STDIO_BRIDGE_LOG\", os.path.expanduser(\"~/.codex/bin/codex-stdio-to-daemon-ws.log\"))\nWS_GUID = \"258EAFA5-E914-47DA-95CA-C5AB0DC85B11\"\n\n# Wrapper contract: 0 served the session, 1 failed before any stdin was\n# consumed (wrapper falls back to real Codex on pristine stdio), 2 failed\n# mid-session (wrapper exits promptly so Desktop reconnects; the fallback\n# must never run on half-consumed stdin).\nEXIT_SERVED = 0\nEXIT_PRE_STDIO = 1\nEXIT_MID_SESSION = 2\n\nCONNECT_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_CONNECT_TIMEOUT\", \"10\"))\n# Bound from connect to the first daemon message: a daemon that completes the\n# upgrade but never answers the first RPC must not hold Desktop past this.\nFIRST_MESSAGE_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_FIRST_MESSAGE_TIMEOUT\", \"30\"))\n\ndef log(msg: str) -> None:\n    try:\n        with open(LOG, \"a\") as f:\n            f.write(time.strftime(\"%Y-%m-%dT%H:%M:%SZ\", time.gmtime()) + \" \" + msg + \"\\n\")\n    except OSError:\n        pass\n\ndef ws_connect(path: str, timeout: float = CONNECT_TIMEOUT_S):\n    \"\"\"Connect + HTTP upgrade under one absolute monotonic deadline.\n\n    Returns (socket, trailing) where trailing holds bytes coalesced after the\n    upgrade headers (TCP may deliver the 101 and the first WS frame together;\n    discarding them would lose the first message). Validates the 101 status\n    and Sec-WebSocket-Accept so a non-WebSocket listener fails fast.\n    \"\"\"\n    deadline = time.monotonic() + timeout\n    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)\n    s.settimeout(timeout)\n    try:\n        s.connect(path)\n        key = base64.b64encode(os.urandom(16)).decode()\n        expected = base64.b64encode(hashlib.sha1((key + WS_GUID).encode()).digest()).decode()\n        req = (\n            f\"GET /rpc HTTP/1.1\\r\\nHost: localhost\\r\\nUpgrade: websocket\\r\\n\"\n            f\"Connection: Upgrade\\r\\nSec-WebSocket-Key: {key}\\r\\nSec-WebSocket-Version: 13\\r\\n\\r\\n\"\n        ).encode()\n        s.sendall(req)\n        buf = b\"\"\n        while True:\n            if b\"\\r\\n\\r\\n\" in buf:\n                break\n            remaining = deadline - time.monotonic()\n            if remaining <= 0:\n                raise TimeoutError(\"WebSocket upgrade timed out\")\n            if len(buf) > 65536:\n                raise ConnectionError(\"WS upgrade headers too large\")\n            s.settimeout(remaining)\n            chunk = s.recv(4096)\n            if not chunk:\n                raise ConnectionError(\"daemon closed during WS upgrade\")\n            buf += chunk\n        head, _, trailing = buf.partition(b\"\\r\\n\\r\\n\")\n        lines = head.split(b\"\\r\\n\")\n        if b\"101\" not in lines[0]:\n            raise ConnectionError(f\"WS upgrade failed: {head[:200]!r}\")\n        accept = None\n        for line in lines[1:]:\n            name, sep, value = line.partition(b\":\")\n            if sep and name.strip().lower() == b\"sec-websocket-accept\":\n                accept = value.strip().decode(\"latin-1\")\n        if accept != expected:\n            raise ConnectionError(\"WS upgrade accept mismatch\")\n    except Exception:\n        try:\n            s.close()\n        except OSError:\n            pass\n        raise\n    s.settimeout(None)\n    return s, trailing\n\ndef mask_send(sock: socket.socket, payload: bytes, opcode: int = 1) -> None:\n    mask = os.urandom(4)\n    ln = len(payload)\n    if ln < 126:\n        hdr = bytes([0x80 | opcode, 0x80 | ln])\n    elif ln < 65536:\n        hdr = bytes([0x80 | opcode, 0x80 | 126]) + struct.pack(\"!H\", ln)\n    else:\n        hdr = bytes([0x80 | opcode, 0x80 | 127]) + struct.pack(\"!Q\", ln)\n    sock.sendall(hdr + mask + bytes(b ^ mask[i % 4] for i, b in enumerate(payload)))\n\ndef locked_send(sock: socket.socket, lock: threading.Lock, payload: bytes, opcode: int = 1) -> None:\n    with lock:\n        mask_send(sock, payload, opcode=opcode)\n\ndef _buffered_reader(sock: socket.socket, initial: bytes = b\"\"):\n    buf = bytearray(initial)\n    def recv(n):\n        while len(buf) < n:\n            chunk = sock.recv(n - len(buf))\n            if not chunk:\n                raise ConnectionError(\"eof\")\n            buf.extend(chunk)\n        out = bytes(buf[:n])\n        del buf[:n]\n        return out\n    return recv\n\ndef read_frame(recv):\n    hdr = recv(2)\n    fin = bool(hdr[0] & 0x80)\n    opcode = hdr[0] & 0x0F\n    masked = bool(hdr[1] & 0x80)\n    ln = hdr[1] & 0x7F\n    if ln == 126:\n        ln = struct.unpack(\"!H\", recv(2))[0]\n    elif ln == 127:\n        ln = struct.unpack(\"!Q\", recv(8))[0]\n    mask = recv(4) if masked else b\"\"\n    payload = recv(ln)\n    if masked:\n        payload = bytes(b ^ mask[i % 4] for i, b in enumerate(payload))\n    return fin, opcode, payload\n\ndef read_message(recv, send_pong):\n    \"\"\"Next complete data message, assembling continuation frames.\n\n    Control frames are handled inline (pong answered, close reported) so a\n    fragmented message split around a ping still reassembles.\n    \"\"\"\n    opcode = None\n    parts = []\n    while True:\n        fin, op, payload = read_frame(recv)\n        if op == 0x8:\n            return (\"close\", None, b\"\")\n        if op == 0x9:\n            send_pong(payload)\n            continue\n        if op == 0xA:\n            continue\n        if op in (0x1, 0x2):\n            if opcode is not None:\n                raise ConnectionError(\"data frame inside fragmented message\")\n            if fin:\n                return (\"data\", op, payload)\n            opcode = op\n            parts.append(payload)\n            continue\n        if op == 0x0:\n            if opcode is None:\n                raise ConnectionError(\"stray continuation frame\")\n            parts.append(payload)\n            if fin:\n                return (\"data\", opcode, b\"\".join(parts))\n            continue\n        raise ConnectionError(f\"unsupported opcode {op}\")\n\ndef stdout_writer(sock: socket.socket, recv, send_pong, done: threading.Event, first_msg: threading.Event) -> None:\n    out = sys.stdout.buffer\n    try:\n        while True:\n            kind, opcode, payload = read_message(recv, send_pong)\n            if kind == \"close\":\n                log(\"daemon WS close\")\n                return\n            if opcode == 0x1:\n                # Desktop StdioConnection expects newline-delimited JSON text\n                if not payload.endswith(b\"\\n\"):\n                    payload += b\"\\n\"\n                out.write(payload)\n                out.flush()\n            else:\n                out.write(payload)\n                out.flush()\n            first_msg.set()\n    except Exception as e:\n        log(f\"stdout_writer exit: {e}\")\n    finally:\n        done.set()\n\ndef main() -> int:\n    log(f\"start sock={SOCK}\")\n    try:\n        sock, pending = ws_connect(SOCK)\n    except Exception as e:\n        log(f\"connect failed: {e}\")\n        sys.stderr.write(f\"codex-stdio-to-daemon-ws: {e}\\n\")\n        return EXIT_PRE_STDIO\n    log(\"connected\")\n    connected_at = time.monotonic()\n    send_lock = threading.Lock()\n    def send_pong(payload: bytes) -> None:\n        locked_send(sock, send_lock, payload, opcode=0xA)\n    recv = _buffered_reader(sock, pending)\n    done = threading.Event()\n    first_msg = threading.Event()\n    t = threading.Thread(target=stdout_writer, args=(sock, recv, send_pong, done, first_msg), daemon=True)\n    t.start()\n    # Byte-precise commit point: the fallback may run only while zero stdin\n    # bytes have left the pipe. Reads use os.read into a userspace line buffer\n    # (buffered readline could readahead past the commit point), and every\n    # byte read counts — even a blank line. first_msg bounds the first RPC.\n    stdin_bytes = 0\n    pending_in = b\"\"\n    clean_eof = False\n    try:\n        fd = sys.stdin.fileno()\n        while not done.is_set():\n            if not first_msg.is_set() and time.monotonic() - connected_at > FIRST_MESSAGE_TIMEOUT_S:\n                log(\"first daemon message timed out\")\n                break\n            ready, _, _ = select.select([fd], [], [], 0.5)\n            if not ready:\n                continue\n            chunk = os.read(fd, 65536)\n            if not chunk:\n                clean_eof = True\n                break\n            stdin_bytes += len(chunk)\n            pending_in += chunk\n            while b\"\\n\" in pending_in:\n                line, _, pending_in = pending_in.partition(b\"\\n\")\n                line = line.strip()\n                if not line:\n                    continue\n                locked_send(sock, send_lock, line)\n    except Exception as e:\n        log(f\"stdin loop exit: {e}\")\n    try:\n        locked_send(sock, send_lock, b\"\", opcode=0x8)\n    except Exception:\n        pass\n    if clean_eof:\n        tail = pending_in.strip()\n        if tail and not done.is_set():\n            try:\n                locked_send(sock, send_lock, tail)\n            except Exception as e:\n                log(f\"eof flush failed: {e}\")\n        log(\"exit\")\n        return EXIT_SERVED\n    # Reader died, first RPC timed out, or stdin broke: fail open only if no\n    # stdin byte was ever consumed.\n    rc = EXIT_MID_SESSION if stdin_bytes else EXIT_PRE_STDIO\n    log(f\"exit rc={rc}\")\n    return rc\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n";
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  w: BRIDGE_SOURCE
+});
+
+
+},
+"./src/core/desktop-shim.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
+/* import */ var node_child_process__rspack_import_0 = __webpack_require__("node:child_process");
+/* import */ var node_fs__rspack_import_1 = __webpack_require__("node:fs");
+/* import */ var node_os__rspack_import_2 = __webpack_require__("node:os");
+/* import */ var node_path__rspack_import_3 = __webpack_require__("node:path");
+/* import */ var _desktop_shim_bridge_js__rspack_import_5 = __webpack_require__("./src/core/desktop-shim-bridge.js");
+/* import */ var _codex_bridge_js__rspack_import_4 = __webpack_require__("./src/core/codex-bridge.js");
+
+
+
+
+
+
+/**
+ * ChatGPT Desktop -> managed Codex daemon shim (CODEX_CLI_PATH bridge).
+ *
+ * Desktop injects `codex_app` overrides so CODEX_APP_SERVER_USE_LOCAL_DAEMON=1
+ * alone cannot select the managed daemon, and stock `codex app-server proxy`
+ * hangs for Desktop stdio. The winning path is a wrapper on CODEX_CLI_PATH
+ * that rewrites Desktop's `codex ... app-server` spawn into the stdio<->WS
+ * bridge (desktop-shim-bridge.js) onto the managed control socket.
+ * Provenance: uploads/codex-desktop-to-daemon + codex-desktop-shared-daemon-env.sh.
+ *
+ * Fail-open is the hard rule: the wrapper execs the real standalone `codex`
+ * for non-app-server spawns and whenever the bridge/python/socket side is
+ * missing or broken. Never touches Desktop binaries, /tmp/codex-browser-use/,
+ * or CODEX_APP_TOOLS_PIPE_PATH. No protocol change: gbot already speaks the
+ * managed control socket.
+ */ const SHIM_LABEL = "com.zackjackson.codex-desktop-shared-daemon";
+const WRAPPER_FILENAME = "codex-desktop-to-daemon";
+const BRIDGE_FILENAME = "codex-stdio-to-daemon-ws.py";
+const ENV_SCRIPT_FILENAME = "codex-desktop-shared-daemon-env.sh";
+const BRIDGE_LOG_FILENAME = "codex-stdio-to-daemon-ws.log";
+const WRAPPER_LOG_FILENAME = "codex-desktop-to-daemon.log";
+const ENV_LOG_FILENAME = "codex-desktop-shared-daemon-env.log";
+const STANDALONE_REAL_SUFFIX = (0,node_path__rspack_import_3.join)("packages", "standalone", "current", "bin", "codex");
+function codexHomeDir(env = process.env) {
+    return env.CODEX_HOME || join(env.HOME || homedir(), ".codex");
+}
+function userHomeDir(env = process.env) {
+    return env.HOME || (0,node_os__rspack_import_2.homedir)();
+}
+function defaultPaths({ env = process.env, home = userHomeDir(env) } = {}) {
+    const codexHome = env.CODEX_HOME || (0,node_path__rspack_import_3.join)(home, ".codex");
+    const binDir = (0,node_path__rspack_import_3.join)(codexHome, "bin");
+    return {
+        binDir,
+        bridgeLogPath: (0,node_path__rspack_import_3.join)(binDir, BRIDGE_LOG_FILENAME),
+        bridgePath: (0,node_path__rspack_import_3.join)(binDir, BRIDGE_FILENAME),
+        codexHome,
+        envLogPath: (0,node_path__rspack_import_3.join)(binDir, ENV_LOG_FILENAME),
+        envScriptPath: (0,node_path__rspack_import_3.join)(binDir, ENV_SCRIPT_FILENAME),
+        label: SHIM_LABEL,
+        launchAgentsDir: (0,node_path__rspack_import_3.join)(home, "Library", "LaunchAgents"),
+        plistPath: (0,node_path__rspack_import_3.join)(home, "Library", "LaunchAgents", `${SHIM_LABEL}.plist`),
+        realPath: (0,node_path__rspack_import_3.join)(codexHome, STANDALONE_REAL_SUFFIX),
+        socketPath: (0,node_path__rspack_import_3.join)(codexHome, "app-server-control", "app-server-control.sock"),
+        wrapperLogPath: (0,node_path__rspack_import_3.join)(binDir, WRAPPER_LOG_FILENAME),
+        wrapperPath: (0,node_path__rspack_import_3.join)(binDir, WRAPPER_FILENAME)
+    };
+}
+/**
+ * Pure passthrough decision, mirroring the wrapper's argv scan. True only for
+ * a bare `app-server` spawn: Desktop's private-stdio case. `daemon`, `proxy`,
+ * and schema generations always exec the real Codex.
+ */ function shouldBridge(argv) {
+    let appServer = false;
+    let daemon = false;
+    let proxy = false;
+    let generate = false;
+    for (const arg of argv ?? []){
+        if (arg === "app-server") appServer = true;
+        else if (arg === "daemon") daemon = true;
+        else if (arg === "proxy") proxy = true;
+        else if (arg === "generate-ts" || arg === "generate-json-schema") generate = true;
+    }
+    return appServer && !daemon && !proxy && !generate;
+}
+function renderWrapperScript({ realPath, bridgePath, wrapperLogPath, codexHome, bridgeLogPath }) {
+    return `#!/bin/bash
+# Installed by \`gbot codex desktop-shim install\`. Rewrites ChatGPT Desktop's
+# \`codex ... app-server\` spawn into a stdio<->WebSocket bridge onto the managed
+# daemon's control socket. Reversible: \`gbot codex desktop-shim uninstall\`.
+# The daemon is kept up by the LaunchAgent login script, not here: this hot path
+# never starts the daemon itself, so a wedged daemon lock cannot hang
+# Desktop. Fail-open runs ONLY before any stdin is consumed: an absent socket
+# fails the preflight and a pre-session bridge failure (exit 1) falls through
+# to the real standalone codex on pristine stdio. A mid-session bridge failure
+# (exit 2+) exits promptly so Desktop reconnects; the fallback never runs on
+# half-consumed stdin. Bridge exit 0 means it served the session. Never touches
+# Desktop binaries or its private tool pipe.
+set -u
+REAL="\${CODEX_DESKTOP_WRAPPER_REAL:-${realPath}}"
+BRIDGE="\${CODEX_DESKTOP_BRIDGE:-${bridgePath}}"
+export CODEX_HOME="\${CODEX_HOME:-${codexHome}}"
+SOCK="\${CODEX_APP_SERVER_SOCK:-$CODEX_HOME/app-server-control/app-server-control.sock}"
+BRIDGE_LOG="\${CODEX_STDIO_BRIDGE_LOG:-${bridgeLogPath}}"
+LOG="\${CODEX_DESKTOP_WRAPPER_LOG:-${wrapperLogPath}}"
+export CODEX_APP_SERVER_SOCK="$SOCK"
+export CODEX_STDIO_BRIDGE_LOG="$BRIDGE_LOG"
+ts() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+echo "$(ts) argv: $*" >>"$LOG" 2>/dev/null || true
+
+if [[ ! -x "$REAL" ]]; then
+  FALLBACK="$(command -v codex 2>/dev/null || true)"
+  if [[ -n "$FALLBACK" && -x "$FALLBACK" ]]; then
+    REAL="$FALLBACK"
+  fi
+fi
+
+has_app_server=0; has_daemon=0; has_proxy=0; has_generate=0
+for a in "$@"; do
+  case "$a" in
+    app-server) has_app_server=1 ;;
+    daemon) has_daemon=1 ;;
+    proxy) has_proxy=1 ;;
+    generate-ts|generate-json-schema) has_generate=1 ;;
+  esac
+done
+
+# Preflight the daemon socket with a short deadline: a refused/absent socket
+# means starting the bridge could never succeed, so skip straight to real codex.
+preflight() {
+  python3 -c 'import os,socket,sys; s=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM); s.settimeout(float(os.environ.get("CODEX_DESKTOP_PREFLIGHT_TIMEOUT","3"))); s.connect(sys.argv[1]); s.close()' "$SOCK" 2>/dev/null
+}
+
+if [[ "$has_app_server" -eq 1 && "$has_daemon" -eq 0 && "$has_proxy" -eq 0 && "$has_generate" -eq 0 ]]; then
+  if [[ -x "$REAL" && -f "$BRIDGE" ]] && command -v python3 >/dev/null 2>&1; then
+    if preflight; then
+      echo "$(ts) rewrite -> stdio-ws bridge" >>"$LOG" 2>/dev/null || true
+      python3 "$BRIDGE"
+      rc=$?
+      case "$rc" in
+        0)
+          echo "$(ts) bridge served session" >>"$LOG" 2>/dev/null || true
+          exit 0
+          ;;
+        1)
+          echo "$(ts) bridge failed before session start, falling through to real codex" >>"$LOG" 2>/dev/null || true
+          ;;
+        *)
+          echo "$(ts) bridge failed mid-session (rc=$rc); exiting so Desktop reconnects" >>"$LOG" 2>/dev/null || true
+          exit "$rc"
+          ;;
+      esac
+    else
+      echo "$(ts) daemon socket unreachable, passthrough to real codex" >>"$LOG" 2>/dev/null || true
+    fi
+  else
+    echo "$(ts) bridge unavailable, passthrough to real codex" >>"$LOG" 2>/dev/null || true
+  fi
+fi
+if [[ -x "$REAL" ]]; then
+  exec "$REAL" "$@"
+fi
+echo "codex-desktop-to-daemon: no runnable codex found" >&2
+exit 1
+`;
+}
+function renderEnvScript({ wrapperPath, realPath, envLogPath, codexHome }) {
+    return `#!/bin/bash
+# Installed by \`gbot codex desktop-shim install\`. Re-applies the GUI-domain env
+# so ChatGPT.app inherits CODEX_CLI_PATH after login, then best-effort starts the
+# managed daemon (this login script — never Desktop's spawn hot path — owns
+# daemon upkeep). No -e: every step is best-effort so login never breaks.
+# Revert: \`gbot codex desktop-shim uninstall\`.
+set -u
+WRAPPER="${wrapperPath}"
+REAL="${realPath}"
+LOG="${envLogPath}"
+CODEX_HOME_DIR="${codexHome}"
+# One CODEX_HOME for the GUI domain and this script's own daemon start, so the
+# daemon that is kept up is the one the wrapper bridges to.
+export CODEX_HOME="$CODEX_HOME_DIR"
+ts() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+{
+  echo "$(ts) start"
+  if [[ ! -x "$WRAPPER" ]]; then
+    echo "$(ts) missing wrapper: $WRAPPER"
+    exit 0
+  fi
+  # GUI domain setenv so ChatGPT.app inherits CODEX_CLI_PATH after login
+  launchctl setenv CODEX_CLI_PATH "$WRAPPER"
+  launchctl setenv CODEX_HOME "$CODEX_HOME_DIR"
+  launchctl setenv CODEX_APP_SERVER_USE_LOCAL_DAEMON 1
+  launchctl unsetenv CODEX_APP_SERVER_WS_URL 2>/dev/null || true
+  echo "$(ts) CODEX_CLI_PATH=$(launchctl getenv CODEX_CLI_PATH)"
+  if [[ -x "$REAL" ]]; then
+    "$REAL" app-server daemon start >/dev/null 2>&1 || true
+    echo "$(ts) daemon start attempted"
+  fi
+  echo "$(ts) done"
+} >>"$LOG" 2>&1
+`;
+}
+function renderPlist({ envScriptPath, label = SHIM_LABEL }) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+\t<key>Label</key>
+\t<string>${label}</string>
+\t<key>ProgramArguments</key>
+\t<array>
+\t\t<string>/bin/bash</string>
+\t\t<string>${envScriptPath}</string>
+\t</array>
+\t<key>RunAtLoad</key>
+\t<true/>
+\t<key>LimitLoadToSessionType</key>
+\t<string>Aqua</string>
+</dict>
+</plist>
+`;
+}
+const defaultRunner = (file, args)=>{
+    try {
+        return (0,node_child_process__rspack_import_0.spawnSync)(file, args, {
+            encoding: "utf8",
+            timeout: 15000
+        });
+    } catch (error) {
+        return {
+            error,
+            status: null
+        };
+    }
+};
+function runBestEffort(runner, warnings, what, file, args) {
+    const out = runner(file, args);
+    if (out && (out.error || typeof out.status === "number" && out.status !== 0)) {
+        const detail = out.error && out.error.message || out.stderr && String(out.stderr).trim() || `exit ${out.status}`;
+        warnings.push(`${what} failed (${detail}); continuing`);
+    }
+    return out;
+}
+function writeExecutable(path, content) {
+    (0,node_fs__rspack_import_1.writeFileSync)(path, content, {
+        mode: 493
+    });
+    (0,node_fs__rspack_import_1.chmodSync)(path, 493);
+}
+function isExecutable(path) {
+    try {
+        (0,node_fs__rspack_import_1.statSync)(path);
+    } catch  {
+        return false;
+    }
+    try {
+        // X_OK without throwing: accessSync is clearer; stat mode bit check is sync-safe.
+        return ((0,node_fs__rspack_import_1.statSync)(path).mode & 73) !== 0;
+    } catch  {
+        return false;
+    }
+}
+function fileExists(path) {
+    try {
+        (0,node_fs__rspack_import_1.statSync)(path);
+        return true;
+    } catch  {
+        return false;
+    }
+}
+/**
+ * Copy the wrapper + bridge + login env script out of the package into durable
+ * ~/.codex paths (never a git checkout), then persist CODEX_CLI_PATH for the
+ * macOS Aqua session via LaunchAgent. Idempotent.
+ */ function installDesktopShim({ env = process.env, home = userHomeDir(env), platform = process.platform, runner = defaultRunner } = {}) {
+    const paths = defaultPaths({
+        env,
+        home
+    });
+    const warnings = [];
+    (0,node_fs__rspack_import_1.mkdirSync)(paths.binDir, {
+        recursive: true
+    });
+    writeExecutable(paths.wrapperPath, renderWrapperScript(paths));
+    (0,node_fs__rspack_import_1.writeFileSync)(paths.bridgePath, _desktop_shim_bridge_js__rspack_import_5/* .BRIDGE_SOURCE.endsWith */.w.endsWith("\n") ? _desktop_shim_bridge_js__rspack_import_5/* .BRIDGE_SOURCE */.w : `${_desktop_shim_bridge_js__rspack_import_5/* .BRIDGE_SOURCE */.w}\n`, {
+        mode: 420
+    });
+    writeExecutable(paths.envScriptPath, renderEnvScript(paths));
+    let persisted = false;
+    if (platform === "darwin") {
+        (0,node_fs__rspack_import_1.mkdirSync)(paths.launchAgentsDir, {
+            recursive: true
+        });
+        (0,node_fs__rspack_import_1.writeFileSync)(paths.plistPath, renderPlist({
+            envScriptPath: paths.envScriptPath
+        }), {
+            mode: 420
+        });
+        const uid = typeof process.getuid === "function" ? process.getuid() : null;
+        if (uid === null || uid === undefined) {
+            warnings.push("could not determine uid; LaunchAgent file written but not bootstrapped — log out/in or bootstrap it manually");
+        } else {
+            const target = `gui/${uid}/${paths.label}`;
+            runBestEffort(runner, warnings, "launchctl bootout (previous agent)", "launchctl", [
+                "bootout",
+                target
+            ]);
+            runBestEffort(runner, warnings, "launchctl bootstrap", "launchctl", [
+                "bootstrap",
+                `gui/${uid}`,
+                paths.plistPath
+            ]);
+        }
+        runBestEffort(runner, warnings, "launchctl setenv CODEX_CLI_PATH", "launchctl", [
+            "setenv",
+            "CODEX_CLI_PATH",
+            paths.wrapperPath
+        ]);
+        runBestEffort(runner, warnings, "launchctl setenv CODEX_APP_SERVER_USE_LOCAL_DAEMON", "launchctl", [
+            "setenv",
+            "CODEX_APP_SERVER_USE_LOCAL_DAEMON",
+            "1"
+        ]);
+        runBestEffort(runner, warnings, "launchctl unsetenv CODEX_APP_SERVER_WS_URL", "launchctl", [
+            "unsetenv",
+            "CODEX_APP_SERVER_WS_URL"
+        ]);
+        persisted = true;
+    } else {
+        warnings.push("LaunchAgent persistence is macOS-only; wrapper and bridge installed — export CODEX_CLI_PATH manually");
+    }
+    if (isExecutable(paths.realPath)) {
+        runBestEffort(runner, warnings, "codex app-server daemon start", paths.realPath, [
+            "app-server",
+            "daemon",
+            "start"
+        ]);
+    } else {
+        warnings.push(`managed daemon not started: no executable at ${paths.realPath}`);
+    }
+    return {
+        action: "install",
+        bridgePath: paths.bridgePath,
+        envScriptPath: paths.envScriptPath,
+        exitCode: 0,
+        persisted,
+        plistPath: platform === "darwin" ? paths.plistPath : null,
+        realPath: paths.realPath,
+        warnings,
+        wrapperPath: paths.wrapperPath
+    };
+}
+/** Remove what install wrote and unset the GUI env; Desktop/Codex fall back to stock. */ function uninstallDesktopShim({ env = process.env, home = userHomeDir(env), platform = process.platform, runner = defaultRunner } = {}) {
+    const paths = defaultPaths({
+        env,
+        home
+    });
+    const warnings = [];
+    const removed = [];
+    for (const path of [
+        paths.wrapperPath,
+        paths.bridgePath,
+        paths.envScriptPath
+    ]){
+        try {
+            if ((0,node_fs__rspack_import_1.rmSync)(path, {
+                force: true
+            }) === undefined && fileExists(path)) warnings.push(`could not remove ${path}`);
+            else if (!fileExists(path)) removed.push(path);
+        } catch (error) {
+            warnings.push(`could not remove ${path} (${error instanceof Error ? error.message : String(error)})`);
+        }
+    }
+    let plistRemoved = false;
+    if (platform === "darwin") {
+        const uid = typeof process.getuid === "function" ? process.getuid() : null;
+        if (uid !== null && uid !== undefined) {
+            runBestEffort(runner, warnings, "launchctl bootout", "launchctl", [
+                "bootout",
+                `gui/${uid}/${paths.label}`
+            ]);
+        }
+        try {
+            (0,node_fs__rspack_import_1.rmSync)(paths.plistPath, {
+                force: true
+            });
+            plistRemoved = !fileExists(paths.plistPath);
+        } catch (error) {
+            warnings.push(`could not remove ${paths.plistPath} (${error instanceof Error ? error.message : String(error)})`);
+        }
+        runBestEffort(runner, warnings, "launchctl unsetenv CODEX_CLI_PATH", "launchctl", [
+            "unsetenv",
+            "CODEX_CLI_PATH"
+        ]);
+        runBestEffort(runner, warnings, "launchctl unsetenv CODEX_HOME", "launchctl", [
+            "unsetenv",
+            "CODEX_HOME"
+        ]);
+        runBestEffort(runner, warnings, "launchctl unsetenv CODEX_APP_SERVER_USE_LOCAL_DAEMON", "launchctl", [
+            "unsetenv",
+            "CODEX_APP_SERVER_USE_LOCAL_DAEMON"
+        ]);
+        runBestEffort(runner, warnings, "launchctl unsetenv CODEX_APP_SERVER_WS_URL", "launchctl", [
+            "unsetenv",
+            "CODEX_APP_SERVER_WS_URL"
+        ]);
+    }
+    return {
+        action: "uninstall",
+        exitCode: 0,
+        plistPath: platform === "darwin" ? paths.plistPath : null,
+        plistRemoved,
+        removed,
+        warnings,
+        wrapperPath: paths.wrapperPath
+    };
+}
+function socketStateOf(path) {
+    try {
+        return (0,node_fs__rspack_import_1.statSync)(path).isSocket() ? "socket" : "not-a-socket";
+    } catch (error) {
+        return error && (error.code === "EACCES" || error.code === "EPERM") ? "permission-denied" : "absent";
+    }
+}
+/**
+ * Inspect the shim without touching Desktop, pipes, or sockets beyond a stat.
+ * On macOS the Desktop-facing CODEX_CLI_PATH lives in launchd's GUI domain,
+ * which a shell-spawned `gbot` does not inherit — so status queries
+ * `launchctl getenv` there (via the injectable runner) and reports the caller
+ * environment separately. Elsewhere the process env is the whole story.
+ */ function desktopShimStatus({ env = process.env, home = userHomeDir(env), platform = process.platform, runner = defaultRunner } = {}) {
+    const paths = defaultPaths({
+        env,
+        home
+    });
+    const warnings = [];
+    const wrapperPresent = fileExists(paths.wrapperPath);
+    const bridgePresent = fileExists(paths.bridgePath);
+    const envScriptPresent = fileExists(paths.envScriptPath);
+    const plistPresent = platform === "darwin" ? fileExists(paths.plistPath) : false;
+    const cliPath = env.CODEX_CLI_PATH || null;
+    let guiCliPath = null;
+    if (platform === "darwin") {
+        try {
+            const out = runner("launchctl", [
+                "getenv",
+                "CODEX_CLI_PATH"
+            ]);
+            const value = out && typeof out.stdout === "string" ? out.stdout.trim() : "";
+            guiCliPath = value || null;
+            if (out && (out.error || typeof out.status === "number" && out.status !== 0)) {
+                warnings.push("launchctl getenv CODEX_CLI_PATH failed; GUI-domain state unknown");
+                guiCliPath = null;
+            }
+        } catch (error) {
+            warnings.push(`launchctl getenv CODEX_CLI_PATH failed (${error instanceof Error ? error.message : String(error)})`);
+            guiCliPath = null;
+        }
+    }
+    // Desktop-facing value: the GUI domain on macOS, the caller env elsewhere.
+    const desktopCliPath = platform === "darwin" ? guiCliPath : cliPath;
+    const installed = wrapperPresent && isExecutable(paths.wrapperPath) && bridgePresent;
+    // Effective socket, resolved exactly like gbot's own client so status and
+    // send/queue/status never disagree: CODEX_APP_SERVER_SOCK wins, else CODEX_HOME.
+    const socketPath = (0,_codex_bridge_js__rspack_import_4/* .codexSocketPath */.ql)({
+        ...env,
+        CODEX_HOME: paths.codexHome
+    });
+    return {
+        action: "status",
+        bridgePath: paths.bridgePath,
+        bridgePresent,
+        cliPath,
+        codexHome: paths.codexHome,
+        desktopCliPath,
+        envScriptPath: paths.envScriptPath,
+        envScriptPresent,
+        exitCode: installed ? 0 : 1,
+        guiCliPath,
+        installed,
+        persisted: platform === "darwin" ? plistPresent : null,
+        platform,
+        plistPath: platform === "darwin" ? paths.plistPath : null,
+        plistPresent,
+        realPath: paths.realPath,
+        socketPath,
+        socketSource: env.CODEX_APP_SERVER_SOCK ? "CODEX_APP_SERVER_SOCK" : "CODEX_HOME",
+        socketState: socketStateOf(socketPath),
+        warnings,
+        wrapperExecutable: wrapperPresent && isExecutable(paths.wrapperPath),
+        wrapperPath: paths.wrapperPath,
+        wrapperPointsAtShim: desktopCliPath === paths.wrapperPath,
+        wrapperPresent
+    };
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  B0: () => (installDesktopShim),
+  em: () => (desktopShimStatus),
+  gM: () => (uninstallDesktopShim)
+});
+
+
 },
 "./src/core/format.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 /* import */ var _transcript_js__rspack_import_0 = __webpack_require__("./src/core/transcript.js");
@@ -27553,7 +28294,7 @@ function formatCodexStatus(s) {
     lines.push("reachable: yes (daemon)");
     const cli = s.cliVersion ?? (s.cliVersionProbe === "ok" ? "unknown" : "unknown, probe " + s.cliVersionProbe);
     lines.push("daemon version: " + (s.daemonVersion ?? "unknown") + "  cli version: " + cli + "  pinned schema: " + s.pinnedVersion + " (" + s.schema.compatibility + ")");
-    lines.push("desktop attached: unknown (not observable from the socket)");
+    lines.push(s.desktopAttached === "private-stdio" ? "desktop attached: private-stdio (ChatGPT Desktop runs its own private stdio app-server; start a managed daemon with `codex app-server daemon start`)" : "desktop attached: unknown (not observable from the socket)");
     if (s.versionMismatch) {
         lines.push("warning: daemon and CLI versions differ; `codex app-server daemon restart` picks up the installed CLI");
     }
@@ -27568,12 +28309,34 @@ function formatCodexThread(t) {
     const preview = t.preview ? "\n    " + stripTerminalControls(String(t.preview).replace(/\s+/g, " ")).slice(0, 200) : "";
     return stripTerminalControls(t.id) + "  " + stripTerminalControls(t.status) + title + "\n    " + stripTerminalControls(t.cwd ?? "") + preview;
 }
+function formatDesktopShimStatus(s) {
+    const mark = (ok)=>ok ? "yes" : "no";
+    const cliLine = s.platform === "darwin" ? "CODEX_CLI_PATH: GUI domain " + (s.guiCliPath ?? "(unset)") + " / this shell " + (s.cliPath ?? "(unset)") + (s.wrapperPointsAtShim ? " (Desktop-facing value points at shim)" : "") : "CODEX_CLI_PATH: " + (s.cliPath ?? "(unset)") + (s.wrapperPointsAtShim ? " (points at shim)" : "");
+    const lines = [
+        "wrapper: " + s.wrapperPath + " (" + (s.wrapperExecutable ? "executable" : s.wrapperPresent ? "present, not executable" : "absent") + ")",
+        "bridge: " + s.bridgePath + " (" + mark(s.bridgePresent) + ")",
+        "login env: " + s.envScriptPath + " (" + mark(s.envScriptPresent) + ")",
+        s.platform === "darwin" ? "LaunchAgent: " + s.plistPath + " (" + mark(s.plistPresent) + ")" : "LaunchAgent: n/a (macOS-only)",
+        cliLine,
+        "daemon socket: " + s.socketPath + " (" + s.socketState + ", from " + (s.socketSource ?? "CODEX_HOME") + ")"
+    ];
+    if (!s.installed) {
+        lines.push("shim: not installed — run `gbot codex desktop-shim install` (Desktop keeps stock behavior until then)");
+    } else if (!s.wrapperPointsAtShim) {
+        lines.push("shim: installed but CODEX_CLI_PATH does not point at it — reinstall or relaunch ChatGPT.app after login");
+    } else {
+        lines.push("shim: active — Desktop app-server spawns bridge onto the managed daemon");
+    }
+    for (const warning of s.warnings ?? [])lines.push("warning: " + String(warning));
+    return lines.join("\n");
+}
 
 __webpack_require__.d(__webpack_exports__, {
   P2: () => (formatCodexStatus),
   bM: () => (formatRecord),
   e_: () => (formatCodexQueue),
   eh: () => (summarize),
+  fX: () => (formatDesktopShimStatus),
   nz: () => (formatCodexThread),
   oZ: () => (formatTranscript)
 });
@@ -28821,32 +29584,33 @@ __webpack_require__.r = (exports) => {
 var __webpack_exports__ = {};
 /* import */ var node_worker_threads__rspack_import_0 = __webpack_require__("node:worker_threads");
 /* import */ var react__rspack_import_1 = __webpack_require__("./node_modules/react/react.react-server.js");
-/* import */ var _agent_bundle_runtime_flight_server__rspack_import_27 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/flight/server.js");
-/* import */ var _agent_bundle_runtime__rspack_import_25 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/49.js");
-/* import */ var _agent_bundle_runtime__rspack_import_26 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/736.js");
+/* import */ var _agent_bundle_runtime_flight_server__rspack_import_28 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/flight/server.js");
+/* import */ var _agent_bundle_runtime__rspack_import_26 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/49.js");
+/* import */ var _agent_bundle_runtime__rspack_import_27 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/736.js");
 /* import */ var node_url__rspack_import_2 = __webpack_require__("node:url");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_create_tsx__rspack_import_3 = __webpack_require__("./src/cli/bots/create.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_delete_tsx__rspack_import_4 = __webpack_require__("./src/cli/bots/delete.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_get_tsx__rspack_import_5 = __webpack_require__("./src/cli/bots/get.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_list_tsx__rspack_import_6 = __webpack_require__("./src/cli/bots/list.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_update_tsx__rspack_import_7 = __webpack_require__("./src/cli/bots/update.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_list_threads_tsx__rspack_import_8 = __webpack_require__("./src/cli/codex/list-threads.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_queue_tsx__rspack_import_9 = __webpack_require__("./src/cli/codex/queue.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_send_tsx__rspack_import_10 = __webpack_require__("./src/cli/codex/send.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_status_tsx__rspack_import_11 = __webpack_require__("./src/cli/codex/status.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_doctor_tsx__rspack_import_12 = __webpack_require__("./src/cli/doctor.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_add_tsx__rspack_import_13 = __webpack_require__("./src/cli/groups/add.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_create_tsx__rspack_import_14 = __webpack_require__("./src/cli/groups/create.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_delete_tsx__rspack_import_15 = __webpack_require__("./src/cli/groups/delete.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_get_tsx__rspack_import_16 = __webpack_require__("./src/cli/groups/get.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_list_tsx__rspack_import_17 = __webpack_require__("./src/cli/groups/list.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_members_tsx__rspack_import_18 = __webpack_require__("./src/cli/groups/members.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_remove_tsx__rspack_import_19 = __webpack_require__("./src/cli/groups/remove.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_set_tsx__rspack_import_20 = __webpack_require__("./src/cli/groups/set.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_update_tsx__rspack_import_21 = __webpack_require__("./src/cli/groups/update.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_history_tsx__rspack_import_22 = __webpack_require__("./src/cli/history.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_send_tsx__rspack_import_23 = __webpack_require__("./src/cli/send.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_thread_tsx__rspack_import_24 = __webpack_require__("./src/cli/thread.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_desktop_shim_tsx__rspack_import_8 = __webpack_require__("./src/cli/codex/desktop-shim.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_list_threads_tsx__rspack_import_9 = __webpack_require__("./src/cli/codex/list-threads.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_queue_tsx__rspack_import_10 = __webpack_require__("./src/cli/codex/queue.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_send_tsx__rspack_import_11 = __webpack_require__("./src/cli/codex/send.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_status_tsx__rspack_import_12 = __webpack_require__("./src/cli/codex/status.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_doctor_tsx__rspack_import_13 = __webpack_require__("./src/cli/doctor.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_add_tsx__rspack_import_14 = __webpack_require__("./src/cli/groups/add.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_create_tsx__rspack_import_15 = __webpack_require__("./src/cli/groups/create.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_delete_tsx__rspack_import_16 = __webpack_require__("./src/cli/groups/delete.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_get_tsx__rspack_import_17 = __webpack_require__("./src/cli/groups/get.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_list_tsx__rspack_import_18 = __webpack_require__("./src/cli/groups/list.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_members_tsx__rspack_import_19 = __webpack_require__("./src/cli/groups/members.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_remove_tsx__rspack_import_20 = __webpack_require__("./src/cli/groups/remove.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_set_tsx__rspack_import_21 = __webpack_require__("./src/cli/groups/set.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_update_tsx__rspack_import_22 = __webpack_require__("./src/cli/groups/update.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_history_tsx__rspack_import_23 = __webpack_require__("./src/cli/history.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_send_tsx__rspack_import_24 = __webpack_require__("./src/cli/send.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_thread_tsx__rspack_import_25 = __webpack_require__("./src/cli/thread.tsx");
 
 
 
@@ -28863,40 +29627,42 @@ const route3 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok
 
 const route4 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_update_tsx__rspack_import_7, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_bots_update_tsx__rspack_import_7);
 
-const route5 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_list_threads_tsx__rspack_import_8, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_list_threads_tsx__rspack_import_8);
+const route5 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_desktop_shim_tsx__rspack_import_8, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_desktop_shim_tsx__rspack_import_8);
 
-const route6 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_queue_tsx__rspack_import_9, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_queue_tsx__rspack_import_9);
+const route6 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_list_threads_tsx__rspack_import_9, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_list_threads_tsx__rspack_import_9);
 
-const route7 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_send_tsx__rspack_import_10, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_send_tsx__rspack_import_10);
+const route7 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_queue_tsx__rspack_import_10, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_queue_tsx__rspack_import_10);
 
-const route8 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_status_tsx__rspack_import_11, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_status_tsx__rspack_import_11);
+const route8 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_send_tsx__rspack_import_11, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_send_tsx__rspack_import_11);
 
-const route9 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_doctor_tsx__rspack_import_12, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_doctor_tsx__rspack_import_12);
+const route9 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_status_tsx__rspack_import_12, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_codex_status_tsx__rspack_import_12);
 
-const route10 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_add_tsx__rspack_import_13, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_add_tsx__rspack_import_13);
+const route10 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_doctor_tsx__rspack_import_13, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_doctor_tsx__rspack_import_13);
 
-const route11 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_create_tsx__rspack_import_14, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_create_tsx__rspack_import_14);
+const route11 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_add_tsx__rspack_import_14, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_add_tsx__rspack_import_14);
 
-const route12 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_delete_tsx__rspack_import_15, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_delete_tsx__rspack_import_15);
+const route12 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_create_tsx__rspack_import_15, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_create_tsx__rspack_import_15);
 
-const route13 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_get_tsx__rspack_import_16, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_get_tsx__rspack_import_16);
+const route13 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_delete_tsx__rspack_import_16, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_delete_tsx__rspack_import_16);
 
-const route14 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_list_tsx__rspack_import_17, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_list_tsx__rspack_import_17);
+const route14 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_get_tsx__rspack_import_17, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_get_tsx__rspack_import_17);
 
-const route15 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_members_tsx__rspack_import_18, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_members_tsx__rspack_import_18);
+const route15 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_list_tsx__rspack_import_18, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_list_tsx__rspack_import_18);
 
-const route16 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_remove_tsx__rspack_import_19, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_remove_tsx__rspack_import_19);
+const route16 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_members_tsx__rspack_import_19, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_members_tsx__rspack_import_19);
 
-const route17 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_set_tsx__rspack_import_20, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_set_tsx__rspack_import_20);
+const route17 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_remove_tsx__rspack_import_20, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_remove_tsx__rspack_import_20);
 
-const route18 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_update_tsx__rspack_import_21, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_update_tsx__rspack_import_21);
+const route18 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_set_tsx__rspack_import_21, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_set_tsx__rspack_import_21);
 
-const route19 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_history_tsx__rspack_import_22, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_history_tsx__rspack_import_22);
+const route19 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_update_tsx__rspack_import_22, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_groups_update_tsx__rspack_import_22);
 
-const route20 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_send_tsx__rspack_import_23, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_send_tsx__rspack_import_23);
+const route20 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_history_tsx__rspack_import_23, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_history_tsx__rspack_import_23);
 
-const route21 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_thread_tsx__rspack_import_24, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_thread_tsx__rspack_import_24);
-const pluginRoot = (0,_agent_bundle_runtime__rspack_import_25/* .resolvePluginRoot */.E7)({
+const route21 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_send_tsx__rspack_import_24, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_send_tsx__rspack_import_24);
+
+const route22 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_thread_tsx__rspack_import_25, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_cli_thread_tsx__rspack_import_25);
+const pluginRoot = (0,_agent_bundle_runtime__rspack_import_26/* .resolvePluginRoot */.E7)({
     fallback: (0,node_url__rspack_import_2.fileURLToPath)(new URL('..', import.meta.url)),
     stateAnchor: 'user-data'
 });
@@ -28944,107 +29710,113 @@ const routes = Object.freeze({
         name: "bots update",
         module: route4
     }),
+    "cli:codex/desktop-shim": Object.freeze({
+        id: "cli:codex/desktop-shim",
+        kind: "cli",
+        name: "codex desktop-shim",
+        module: route5
+    }),
     "cli:codex/list-threads": Object.freeze({
         id: "cli:codex/list-threads",
         kind: "cli",
         name: "codex list-threads",
-        module: route5
+        module: route6
     }),
     "cli:codex/queue": Object.freeze({
         id: "cli:codex/queue",
         kind: "cli",
         name: "codex queue",
-        module: route6
+        module: route7
     }),
     "cli:codex/send": Object.freeze({
         id: "cli:codex/send",
         kind: "cli",
         name: "codex send",
-        module: route7
+        module: route8
     }),
     "cli:codex/status": Object.freeze({
         id: "cli:codex/status",
         kind: "cli",
         name: "codex status",
-        module: route8
+        module: route9
     }),
     "cli:doctor": Object.freeze({
         id: "cli:doctor",
         kind: "cli",
         name: "doctor",
-        module: route9
+        module: route10
     }),
     "cli:groups/add": Object.freeze({
         id: "cli:groups/add",
         kind: "cli",
         name: "groups add",
-        module: route10
+        module: route11
     }),
     "cli:groups/create": Object.freeze({
         id: "cli:groups/create",
         kind: "cli",
         name: "groups create",
-        module: route11
+        module: route12
     }),
     "cli:groups/delete": Object.freeze({
         id: "cli:groups/delete",
         kind: "cli",
         name: "groups delete",
-        module: route12
+        module: route13
     }),
     "cli:groups/get": Object.freeze({
         id: "cli:groups/get",
         kind: "cli",
         name: "groups get",
-        module: route13
+        module: route14
     }),
     "cli:groups/list": Object.freeze({
         id: "cli:groups/list",
         kind: "cli",
         name: "groups list",
-        module: route14
+        module: route15
     }),
     "cli:groups/members": Object.freeze({
         id: "cli:groups/members",
         kind: "cli",
         name: "groups members",
-        module: route15
+        module: route16
     }),
     "cli:groups/remove": Object.freeze({
         id: "cli:groups/remove",
         kind: "cli",
         name: "groups remove",
-        module: route16
+        module: route17
     }),
     "cli:groups/set": Object.freeze({
         id: "cli:groups/set",
         kind: "cli",
         name: "groups set",
-        module: route17
+        module: route18
     }),
     "cli:groups/update": Object.freeze({
         id: "cli:groups/update",
         kind: "cli",
         name: "groups update",
-        module: route18
+        module: route19
     }),
     "cli:history": Object.freeze({
         id: "cli:history",
         kind: "cli",
         name: "history",
-        module: route19
+        module: route20
     }),
     "cli:send": Object.freeze({
         id: "cli:send",
         kind: "cli",
         name: "send",
-        module: route20
+        module: route21
     }),
     "cli:thread": Object.freeze({
         id: "cli:thread",
         kind: "cli",
         name: "thread",
-        module: route21
+        module: route22
     })
 });
 const requests = new Map();
@@ -29079,18 +29851,18 @@ const render = async (message)=>{
     };
     try {
         const cwd = process.cwd();
-        await (0,_agent_bundle_runtime__rspack_import_26/* .runAgentRequest */.iC)({
+        await (0,_agent_bundle_runtime__rspack_import_27/* .runAgentRequest */.iC)({
             capabilities: {
-                command: (0,_agent_bundle_runtime__rspack_import_26/* .unavailable */.hU)(),
-                filesystem: (0,_agent_bundle_runtime__rspack_import_26/* .unavailable */.hU)(),
-                network: (0,_agent_bundle_runtime__rspack_import_26/* .unavailable */.hU)(),
-                projectRoot: (0,_agent_bundle_runtime__rspack_import_26/* .available */.qC)({
+                command: (0,_agent_bundle_runtime__rspack_import_27/* .unavailable */.hU)(),
+                filesystem: (0,_agent_bundle_runtime__rspack_import_27/* .unavailable */.hU)(),
+                network: (0,_agent_bundle_runtime__rspack_import_27/* .unavailable */.hU)(),
+                projectRoot: (0,_agent_bundle_runtime__rspack_import_27/* .available */.qC)({
                     root: cwd
                 }, 'derived')
             },
-            host: (0,_agent_bundle_runtime__rspack_import_26/* .unavailable */.hU)('unsupported-surface'),
+            host: (0,_agent_bundle_runtime__rspack_import_27/* .unavailable */.hU)('unsupported-surface'),
             invocation: message.request,
-            lineage: (0,_agent_bundle_runtime__rspack_import_26/* .unavailable */.hU)('unsupported-surface'),
+            lineage: (0,_agent_bundle_runtime__rspack_import_27/* .unavailable */.hU)('unsupported-surface'),
             plugin: pluginRoot.identity,
             progress: {
                 report: async (update)=>{
@@ -29103,8 +29875,8 @@ const render = async (message)=>{
             },
             process: processHit,
             signal: controller.signal,
-            terminal: message.terminal === undefined ? (0,_agent_bundle_runtime__rspack_import_26/* .unavailable */.hU)('not-provided') : (0,_agent_bundle_runtime__rspack_import_26/* .available */.qC)(message.terminal, 'native'),
-            workspace: (0,_agent_bundle_runtime__rspack_import_26/* .available */.qC)({
+            terminal: message.terminal === undefined ? (0,_agent_bundle_runtime__rspack_import_27/* .unavailable */.hU)('not-provided') : (0,_agent_bundle_runtime__rspack_import_27/* .available */.qC)(message.terminal, 'native'),
+            workspace: (0,_agent_bundle_runtime__rspack_import_27/* .available */.qC)({
                 root: cwd
             }, 'derived')
         }, async ()=>{
@@ -29113,7 +29885,7 @@ const render = async (message)=>{
                 type: 'observed-render-start'
             });
             const renderStartedAt = performance.now();
-            const flight = (0,_agent_bundle_runtime_flight_server__rspack_import_27/* .renderAgentFlight */.y)(composeLayouts(observedRoute, {
+            const flight = (0,_agent_bundle_runtime_flight_server__rspack_import_28/* .renderAgentFlight */.y)(composeLayouts(observedRoute, {
                 ...message.props,
                 signal: controller.signal
             }, controller.signal), {