grok-bot-cli 0.4.2 → 0.4.5

package/dist/bin/gbot.mjs

@@ -84503,7 +84503,7 @@ if (import.meta.main) {
         execute,
         name: "gbot",
         render,
-        version: "0.4.2"
+        version: "0.4.5"
     });
 }
 
@@ -84741,6 +84741,8 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var node_child_process__rspack_import_5 = __webpack_require__("node:child_process");
 /* import */ var node_module__rspack_import_6 = __webpack_require__("node:module");
 /* import */ var _codex_contract_js__rspack_import_7 = __webpack_require__("./src/core/codex/contract.js");
+/* import */ var _desktop_shim_js__rspack_import_8 = __webpack_require__("./src/core/desktop-shim.js");
+
 
 
 
@@ -84999,11 +85001,42 @@ function isObject(value) {
         const client = {
             refused,
             // Server-initiated requests are only *answered* once our own turn/start
-            // is in flight: anything earlier belongs to another client's turn
-            // (notably Desktop's) and must never be rejected on their behalf. Early
-            // requests are still recorded; the connection closes right after, so a
-            // pending request simply dies with it instead of denying someone's approval.
+            // is in flight, and then only when they name our own thread/turn:
+            // anything earlier — or naming another thread or Desktop turn — belongs
+            // to another client and must never be rejected on their behalf. Early
+            // and foreign requests are still recorded; the connection closes right
+            // after, so a pending request simply dies with it instead of denying
+            // someone's approval.
             answerServerRequests: false,
+            expectedThreadId: null,
+            expectedTurnId: null,
+            // Approvals that name a turn while our own turn id is still unknown
+            // (arriving before — or in the same socket batch as — the turn/start
+            // acknowledgment) wait here instead of being classified foreign: once
+            // the acknowledgment supplies the turn id, matching ones are answered
+            // and the rest stay silent.
+            deferred: [],
+            // Adopt the acknowledged turn id, answering deferred requests that
+            // prove to be ours. Runs inside the connection closure so it can send.
+            _adoptTurn (turnId) {
+                client.expectedTurnId = turnId;
+                for (const entry of client.deferred.splice(0)){
+                    const params = entry.params && typeof entry.params === "object" && !Array.isArray(entry.params) ? entry.params : null;
+                    const threadId = params ? params.threadId ?? params.thread_id : null;
+                    const namedTurnId = params ? params.turnId ?? params.turn_id ?? (params.turn && params.turn.id) : null;
+                    if (threadId === client.expectedThreadId && namedTurnId === turnId) {
+                        entry.answered = true;
+                        sendJson({
+                            jsonrpc: "2.0",
+                            id: entry.id,
+                            error: {
+                                code: -32601,
+                                message: "gbot codex does not answer " + entry.method + "; configure approval_policy on the daemon"
+                            }
+                        });
+                    }
+                }
+            },
             request (method, params) {
                 const id = nextId++;
                 return new Promise((res, rej)=>{
@@ -85067,13 +85100,36 @@ function isObject(value) {
         };
         const onMessage = (msg)=>{
             if (msg.id != null && msg.method) {
-                const answered = client.answerServerRequests;
-                refused.push({
+                let answered = client.answerServerRequests;
+                let defer = false;
+                // Approval ownership: only answer requests for the turn gbot itself
+                // started. A request naming another thread — or naming a turn that is
+                // not ours — is recorded foreign-silent, never rejected. A request
+                // naming a turn while our turn id is still unknown is deferred, not
+                // classified: the turn/start acknowledgment decides it.
+                if (answered) {
+                    const params = msg.params && typeof msg.params === "object" && !Array.isArray(msg.params) ? msg.params : null;
+                    if (params) {
+                        const threadId = params.threadId ?? params.thread_id;
+                        const turnId = params.turnId ?? params.turn_id ?? (params.turn && params.turn.id);
+                        if (threadId !== client.expectedThreadId || turnId == null) answered = false;
+                        else if (client.expectedTurnId == null) {
+                            answered = false;
+                            defer = true;
+                        } else if (turnId !== client.expectedTurnId) answered = false;
+                    } else answered = false;
+                }
+                const entry = {
                     id: msg.id,
                     method: msg.method,
                     params: msg.params,
                     answered
-                });
+                };
+                refused.push(entry);
+                if (defer) {
+                    client.deferred.push(entry);
+                    return;
+                }
                 if (!answered) return;
                 sendJson({
                     jsonrpc: "2.0",
@@ -85318,17 +85374,30 @@ function listDesktopProcesses(timeoutMs = DESKTOP_PROCESS_LIST_TIMEOUT_MS) {
 /**
  * Status contract: `reachable` is endpoint reachability only. `schema.compatibility` is
  * `exact` when the daemon reports the pinned version, otherwise `unverified` (methods
- * usually survive upgrades) or `unknown`. `desktopAttached` is `"private-stdio"` when a
- * Desktop-bundled app-server process is visible (see `detectDesktopPrivateAppServer`),
- * otherwise `"unknown"` — whether Desktop owns any thread is never observable from the
- * socket itself, and `"detached"` is never reported.
+ * usually survive upgrades) or `unknown`. `desktopShimConfigured` records an installed
+ * wrapper selected by Desktop-facing CODEX_CLI_PATH (the GUI domain on Darwin).
+ * Configuration does not prove a running Desktop inherited it or connected.
+ * `desktopAttached` is `"private-stdio"` when a Desktop-bundled app-server process
+ * is visible, otherwise `"unknown"`. Managed attachment is not observable here.
  *
  * @param {NodeJS.ProcessEnv} [env]
- * @param {{ listProcesses?: string | string[] }} [opts] injected process list for tests;
- *   defaults to a live `ps` snapshot. Never reads pipes or connects to Desktop.
- */ async function codexStatus(env = process.env, { listProcesses } = {}) {
+ * @param {{ listProcesses?: string | string[], shim?: { installed?: boolean, wrapperPointsAtShim?: boolean } | null }} [opts]
+ *   injected process list and shim state for tests; defaults to a live `ps` snapshot and
+ *   `desktopShimStatus`. Never reads pipes or connects to Desktop.
+ */ async function codexStatus(env = process.env, { listProcesses, shim } = {}) {
     const path = codexSocketPath(env);
     const cli = probeLocalCodexVersion();
+    let desktopShimConfigured = Boolean(shim && shim.installed && shim.wrapperPointsAtShim);
+    if (shim === undefined) {
+        try {
+            const live = (0,_desktop_shim_js__rspack_import_8/* .desktopShimStatus */.em)({
+                env
+            });
+            desktopShimConfigured = Boolean(live.installed && live.wrapperPointsAtShim);
+        } catch  {
+            desktopShimConfigured = false;
+        }
+    }
     const desktopAttached = detectDesktopPrivateAppServer({
         platform: process.platform,
         listProcesses: listProcesses ?? listDesktopProcesses()
@@ -85339,7 +85408,8 @@ function listDesktopProcesses(timeoutMs = DESKTOP_PROCESS_LIST_TIMEOUT_MS) {
         pinnedVersion: PINNED_CODEX_VERSION,
         cliVersion: cli.version,
         cliVersionProbe: cli.probe,
-        desktopAttached
+        desktopAttached,
+        desktopShimConfigured
     };
     let session;
     try {
@@ -85741,11 +85811,15 @@ async function sendToCodexThreadInner(threadId, text, { env, envelope, whenBusy
         // the daemon exposes no compare-and-start request. Upgrade path: thread/queue/add + thread/queue/start once stable.
         // Scope refusals to this turn: server requests from earlier calls belong to another context.
         const seenRefused = client.refused.length;
-        // Arm refusal replies only now that our own turn/start is in flight: an
-        // approval arriving in this window plausibly belongs to our turn. Anything
-        // recorded earlier (resume, busy reject, queue) stays unanswered so gbot
-        // never rejects another client's approval. Residual race: a concurrent
-        // foreign approval inside this window is indistinguishable from ours.
+        // Arm refusal replies only now that our own turn/start is in flight, scoped
+        // to our own thread/turn: anything recorded earlier (resume, busy reject,
+        // queue) — or naming another thread or Desktop turn — stays unanswered so
+        // gbot never rejects another client's approval. Requests naming a turn
+        // that arrives before the acknowledgment supplies our turn id wait in
+        // client.deferred and are adopted only on a match. Requests missing
+        // thread or turn IDs remain unanswered because ownership is unknown.
+        client.expectedThreadId = threadId;
+        client.expectedTurnId = null;
         client.answerServerRequests = true;
         let turn;
         try {
@@ -85781,7 +85855,17 @@ async function sendToCodexThreadInner(threadId, text, { env, envelope, whenBusy
                 envelope
             });
         }
-        const freshRefused = client.refused.slice(seenRefused).filter((r)=>r.answered && (!r.params || r.params.threadId == null || r.params.threadId === threadId));
+        client._adoptTurn(turnId);
+        const freshRefused = client.refused.slice(seenRefused).filter((r)=>{
+            if (!r.answered) return false;
+            const params = r.params && typeof r.params === "object" && !Array.isArray(r.params) ? r.params : null;
+            if (!params) return true;
+            const refusedThreadId = params.threadId ?? params.thread_id;
+            const refusedTurnId = params.turnId ?? params.turn_id ?? (params.turn && params.turn.id);
+            if (refusedThreadId != null && refusedThreadId !== threadId) return false;
+            if (refusedTurnId != null && refusedTurnId !== turnId) return false;
+            return true;
+        });
         if (freshRefused.length) {
             const methods = freshRefused.map((r)=>r.method).join(", ");
             throw new CodexSendError("Turn " + turnId + " started on thread " + threadId + " but Codex asked for " + methods + ", which gbot refused. " + "Answer it in a Codex client, or set `approval_policy = \"never\"` in the daemon's config.toml for unattended sends.", {
@@ -85811,8 +85895,7 @@ __webpack_require__.d(__webpack_exports__, {
   X$: () => (listCodexThreads),
   ZS: () => (sendToCodexThread),
   nq: () => (buildEnvelope),
-  pF: () => (singleLine),
-  ql: () => (codexSocketPath)
+  pF: () => (singleLine)
 });
 
 
@@ -86024,24 +86107,36 @@ __webpack_require__.d(__webpack_exports__, {
 // Codex app-server control socket. Vendored from uploads/codex-stdio-to-daemon-ws.py
 // (ChatGPT Desktop -> managed daemon shim) with fail-open deltas, marked below:
 // (1) ws_connect enforces one absolute monotonic deadline for connect + HTTP
-// upgrade (CODEX_BRIDGE_CONNECT_TIMEOUT, default 10s), validates the 101 status
-// and Sec-WebSocket-Accept, and retains bytes coalesced after the upgrade
-// headers instead of discarding the first data frame.
+// upgrade (CODEX_BRIDGE_CONNECT_TIMEOUT, default 10s), requires HTTP/1.1 101
+// plus a matching Sec-WebSocket-Accept (a 200 fails even with a valid hash),
+// and retains bytes coalesced after the upgrade headers instead of discarding
+// the first data frame.
 // (2) read_message assembles continuation frames; control frames answer inline;
-// socket writes are serialized with a lock shared by both threads.
-// (3) A first-message deadline (CODEX_BRIDGE_FIRST_MESSAGE_TIMEOUT, default
-// 30s) bounds connect-to-first-daemon-message covering the first RPC; the
-// preflight (3s) + upgrade (10s) + first RPC (30s) budget stays far below a
-// daemon-lock hang. Exits are 0 served, 1 pre-stdio (wrapper falls back to
-// real Codex), 2 mid-session (wrapper exits so Desktop reconnects).
-// (4) Byte-precise commit: os.read into a userspace line buffer counts every
-// stdin byte (buffered readline could readahead past the commit point), so the
-// fallback only ever runs on a truly pristine stdio. The reader signals a done
-// event so WS close wakes the select loop; no path leaves a thread hung.
+// every socket send/lock shares one monotonic budget (remaining first-RPC
+// budget, else the mid-session write budget) so a non-reading peer cannot
+// wedge pong writes or timeout cleanup; timeouts close and exit. Reads wait
+// with no timeout after the handshake so healthy idle sessions survive.
+// The wrapper never starts the daemon on the spawn path, so no daemon lock can
+// block pre-stdin Desktop.
+// (3) A first-response deadline (CODEX_BRIDGE_FIRST_MESSAGE_TIMEOUT, default
+// 30s) bounds connect-to-matching-daemon-response covering the first RPC;
+// unrelated notifications and foreign responses never satisfy it, only the
+// matching response/error (or timeout) clears it. The preflight (3s) +
+// upgrade (10s) + first RPC (30s) budget stays far below a daemon-lock hang.
+// Exits are 0 served, 1 pre-stdio (wrapper falls back to real Codex on pristine
+// stdio+stdout), 2 mid-session (wrapper exits so Desktop reconnects).
+// (4) Byte-precise commit on input OR output, committed BEFORE the stdout
+// write: os.read into a userspace line buffer counts every stdin byte (even
+// an unforwarded blank line), and any daemon payload marks stdout used before
+// it is written via a bounded stdout write, so the fallback only ever runs
+// on truly pristine stdio+stdout and never spawns a second Codex after used
+// stdout. Buffered EOF-tail data flushes before the WS Close, which drains
+// via shutdown+close with a bounded join. The reader signals a done event so
+// WS close wakes the select loop; no path leaves a thread hung.
 // Desktop stdio hangs with stock `codex app-server proxy`, so this custom
 // bridge is required. Install writes it to the CODEX_HOME bin dir. Never reads
 // Desktop private pipes (CODEX_APP_TOOLS_PIPE_PATH, /tmp/codex-browser-use/).
-const BRIDGE_SOURCE = "#!/usr/bin/env python3\n\"\"\"Stdio JSONL (Desktop) <-> WebSocket-over-unix (managed app-server daemon).\nReversible: remove CODEX_CLI_PATH wrapper. Does not read Desktop private pipes.\n\"\"\"\nfrom __future__ import annotations\nimport base64, hashlib, json, os, select, socket, struct, sys, threading, time\n\nSOCK = os.environ.get(\n    \"CODEX_APP_SERVER_SOCK\",\n    os.path.expanduser(\"~/.codex/app-server-control/app-server-control.sock\"),\n)\nLOG = os.environ.get(\"CODEX_STDIO_BRIDGE_LOG\", os.path.expanduser(\"~/.codex/bin/codex-stdio-to-daemon-ws.log\"))\nWS_GUID = \"258EAFA5-E914-47DA-95CA-C5AB0DC85B11\"\n\n# Wrapper contract: 0 served the session, 1 failed before any stdin was\n# consumed (wrapper falls back to real Codex on pristine stdio), 2 failed\n# mid-session (wrapper exits promptly so Desktop reconnects; the fallback\n# must never run on half-consumed stdin).\nEXIT_SERVED = 0\nEXIT_PRE_STDIO = 1\nEXIT_MID_SESSION = 2\n\nCONNECT_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_CONNECT_TIMEOUT\", \"10\"))\n# Bound from connect to the first daemon message: a daemon that completes the\n# upgrade but never answers the first RPC must not hold Desktop past this.\nFIRST_MESSAGE_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_FIRST_MESSAGE_TIMEOUT\", \"30\"))\n\ndef log(msg: str) -> None:\n    try:\n        with open(LOG, \"a\") as f:\n            f.write(time.strftime(\"%Y-%m-%dT%H:%M:%SZ\", time.gmtime()) + \" \" + msg + \"\\n\")\n    except OSError:\n        pass\n\ndef ws_connect(path: str, timeout: float = CONNECT_TIMEOUT_S):\n    \"\"\"Connect + HTTP upgrade under one absolute monotonic deadline.\n\n    Returns (socket, trailing) where trailing holds bytes coalesced after the\n    upgrade headers (TCP may deliver the 101 and the first WS frame together;\n    discarding them would lose the first message). Validates the 101 status\n    and Sec-WebSocket-Accept so a non-WebSocket listener fails fast.\n    \"\"\"\n    deadline = time.monotonic() + timeout\n    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)\n    s.settimeout(timeout)\n    try:\n        s.connect(path)\n        key = base64.b64encode(os.urandom(16)).decode()\n        expected = base64.b64encode(hashlib.sha1((key + WS_GUID).encode()).digest()).decode()\n        req = (\n            f\"GET /rpc HTTP/1.1\\r\\nHost: localhost\\r\\nUpgrade: websocket\\r\\n\"\n            f\"Connection: Upgrade\\r\\nSec-WebSocket-Key: {key}\\r\\nSec-WebSocket-Version: 13\\r\\n\\r\\n\"\n        ).encode()\n        s.sendall(req)\n        buf = b\"\"\n        while True:\n            if b\"\\r\\n\\r\\n\" in buf:\n                break\n            remaining = deadline - time.monotonic()\n            if remaining <= 0:\n                raise TimeoutError(\"WebSocket upgrade timed out\")\n            if len(buf) > 65536:\n                raise ConnectionError(\"WS upgrade headers too large\")\n            s.settimeout(remaining)\n            chunk = s.recv(4096)\n            if not chunk:\n                raise ConnectionError(\"daemon closed during WS upgrade\")\n            buf += chunk\n        head, _, trailing = buf.partition(b\"\\r\\n\\r\\n\")\n        lines = head.split(b\"\\r\\n\")\n        if b\"101\" not in lines[0]:\n            raise ConnectionError(f\"WS upgrade failed: {head[:200]!r}\")\n        accept = None\n        for line in lines[1:]:\n            name, sep, value = line.partition(b\":\")\n            if sep and name.strip().lower() == b\"sec-websocket-accept\":\n                accept = value.strip().decode(\"latin-1\")\n        if accept != expected:\n            raise ConnectionError(\"WS upgrade accept mismatch\")\n    except Exception:\n        try:\n            s.close()\n        except OSError:\n            pass\n        raise\n    s.settimeout(None)\n    return s, trailing\n\ndef mask_send(sock: socket.socket, payload: bytes, opcode: int = 1) -> None:\n    mask = os.urandom(4)\n    ln = len(payload)\n    if ln < 126:\n        hdr = bytes([0x80 | opcode, 0x80 | ln])\n    elif ln < 65536:\n        hdr = bytes([0x80 | opcode, 0x80 | 126]) + struct.pack(\"!H\", ln)\n    else:\n        hdr = bytes([0x80 | opcode, 0x80 | 127]) + struct.pack(\"!Q\", ln)\n    sock.sendall(hdr + mask + bytes(b ^ mask[i % 4] for i, b in enumerate(payload)))\n\ndef locked_send(sock: socket.socket, lock: threading.Lock, payload: bytes, opcode: int = 1) -> None:\n    with lock:\n        mask_send(sock, payload, opcode=opcode)\n\ndef _buffered_reader(sock: socket.socket, initial: bytes = b\"\"):\n    buf = bytearray(initial)\n    def recv(n):\n        while len(buf) < n:\n            chunk = sock.recv(n - len(buf))\n            if not chunk:\n                raise ConnectionError(\"eof\")\n            buf.extend(chunk)\n        out = bytes(buf[:n])\n        del buf[:n]\n        return out\n    return recv\n\ndef read_frame(recv):\n    hdr = recv(2)\n    fin = bool(hdr[0] & 0x80)\n    opcode = hdr[0] & 0x0F\n    masked = bool(hdr[1] & 0x80)\n    ln = hdr[1] & 0x7F\n    if ln == 126:\n        ln = struct.unpack(\"!H\", recv(2))[0]\n    elif ln == 127:\n        ln = struct.unpack(\"!Q\", recv(8))[0]\n    mask = recv(4) if masked else b\"\"\n    payload = recv(ln)\n    if masked:\n        payload = bytes(b ^ mask[i % 4] for i, b in enumerate(payload))\n    return fin, opcode, payload\n\ndef read_message(recv, send_pong):\n    \"\"\"Next complete data message, assembling continuation frames.\n\n    Control frames are handled inline (pong answered, close reported) so a\n    fragmented message split around a ping still reassembles.\n    \"\"\"\n    opcode = None\n    parts = []\n    while True:\n        fin, op, payload = read_frame(recv)\n        if op == 0x8:\n            return (\"close\", None, b\"\")\n        if op == 0x9:\n            send_pong(payload)\n            continue\n        if op == 0xA:\n            continue\n        if op in (0x1, 0x2):\n            if opcode is not None:\n                raise ConnectionError(\"data frame inside fragmented message\")\n            if fin:\n                return (\"data\", op, payload)\n            opcode = op\n            parts.append(payload)\n            continue\n        if op == 0x0:\n            if opcode is None:\n                raise ConnectionError(\"stray continuation frame\")\n            parts.append(payload)\n            if fin:\n                return (\"data\", opcode, b\"\".join(parts))\n            continue\n        raise ConnectionError(f\"unsupported opcode {op}\")\n\ndef stdout_writer(sock: socket.socket, recv, send_pong, done: threading.Event, first_msg: threading.Event) -> None:\n    out = sys.stdout.buffer\n    try:\n        while True:\n            kind, opcode, payload = read_message(recv, send_pong)\n            if kind == \"close\":\n                log(\"daemon WS close\")\n                return\n            if opcode == 0x1:\n                # Desktop StdioConnection expects newline-delimited JSON text\n                if not payload.endswith(b\"\\n\"):\n                    payload += b\"\\n\"\n                out.write(payload)\n                out.flush()\n            else:\n                out.write(payload)\n                out.flush()\n            first_msg.set()\n    except Exception as e:\n        log(f\"stdout_writer exit: {e}\")\n    finally:\n        done.set()\n\ndef main() -> int:\n    log(f\"start sock={SOCK}\")\n    try:\n        sock, pending = ws_connect(SOCK)\n    except Exception as e:\n        log(f\"connect failed: {e}\")\n        sys.stderr.write(f\"codex-stdio-to-daemon-ws: {e}\\n\")\n        return EXIT_PRE_STDIO\n    log(\"connected\")\n    connected_at = time.monotonic()\n    send_lock = threading.Lock()\n    def send_pong(payload: bytes) -> None:\n        locked_send(sock, send_lock, payload, opcode=0xA)\n    recv = _buffered_reader(sock, pending)\n    done = threading.Event()\n    first_msg = threading.Event()\n    t = threading.Thread(target=stdout_writer, args=(sock, recv, send_pong, done, first_msg), daemon=True)\n    t.start()\n    # Byte-precise commit point: the fallback may run only while zero stdin\n    # bytes have left the pipe. Reads use os.read into a userspace line buffer\n    # (buffered readline could readahead past the commit point), and every\n    # byte read counts — even a blank line. first_msg bounds the first RPC.\n    stdin_bytes = 0\n    pending_in = b\"\"\n    clean_eof = False\n    try:\n        fd = sys.stdin.fileno()\n        while not done.is_set():\n            if not first_msg.is_set() and time.monotonic() - connected_at > FIRST_MESSAGE_TIMEOUT_S:\n                log(\"first daemon message timed out\")\n                break\n            ready, _, _ = select.select([fd], [], [], 0.5)\n            if not ready:\n                continue\n            chunk = os.read(fd, 65536)\n            if not chunk:\n                clean_eof = True\n                break\n            stdin_bytes += len(chunk)\n            pending_in += chunk\n            while b\"\\n\" in pending_in:\n                line, _, pending_in = pending_in.partition(b\"\\n\")\n                line = line.strip()\n                if not line:\n                    continue\n                locked_send(sock, send_lock, line)\n    except Exception as e:\n        log(f\"stdin loop exit: {e}\")\n    try:\n        locked_send(sock, send_lock, b\"\", opcode=0x8)\n    except Exception:\n        pass\n    if clean_eof:\n        tail = pending_in.strip()\n        if tail and not done.is_set():\n            try:\n                locked_send(sock, send_lock, tail)\n            except Exception as e:\n                log(f\"eof flush failed: {e}\")\n        log(\"exit\")\n        return EXIT_SERVED\n    # Reader died, first RPC timed out, or stdin broke: fail open only if no\n    # stdin byte was ever consumed.\n    rc = EXIT_MID_SESSION if stdin_bytes else EXIT_PRE_STDIO\n    log(f\"exit rc={rc}\")\n    return rc\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n";
+const BRIDGE_SOURCE = "#!/usr/bin/env python3\n\"\"\"Stdio JSONL (Desktop) <-> WebSocket-over-unix (managed app-server daemon).\nReversible: remove CODEX_CLI_PATH wrapper. Does not read Desktop private pipes.\n\"\"\"\nfrom __future__ import annotations\nimport base64, hashlib, json, os, select, socket, struct, sys, threading, time\n\nSOCK = os.environ.get(\n    \"CODEX_APP_SERVER_SOCK\",\n    os.path.expanduser(\"~/.codex/app-server-control/app-server-control.sock\"),\n)\nLOG = os.environ.get(\"CODEX_STDIO_BRIDGE_LOG\", os.path.expanduser(\"~/.codex/bin/codex-stdio-to-daemon-ws.log\"))\nWS_GUID = \"258EAFA5-E914-47DA-95CA-C5AB0DC85B11\"\n\n# Wrapper contract: 0 served the session, 1 failed while stdio was still\n# pristine -- no stdin byte consumed and no stdout frame committed (wrapper\n# falls back to real Codex), 2 failed mid-session (wrapper exits promptly so\n# Desktop reconnects; the fallback must never run on half-consumed stdin or\n# dirty stdout).\nEXIT_SERVED = 0\nEXIT_PRE_STDIO = 1\nEXIT_MID_SESSION = 2\n\nCONNECT_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_CONNECT_TIMEOUT\", \"10\"))\n# Bound from connect to the matching first daemon response: a daemon that\n# completes the upgrade but never answers the first RPC must not hold Desktop\n# past this. Only the matching initialize response/error (or the deadline\n# itself) clears it; notifications never do.\nFIRST_MESSAGE_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_FIRST_MESSAGE_TIMEOUT\", \"30\"))\n# Bound on every mid-session socket send and stdout write: a wedged or\n# non-reading peer must not hang Desktop past this. Reads after a successful\n# init block with no timeout so healthy idle sessions survive silence.\nIO_TIMEOUT_S = float(os.environ.get(\"CODEX_BRIDGE_IO_TIMEOUT\", \"30\"))\n\ndef log(msg: str) -> None:\n    try:\n        with open(LOG, \"a\") as f:\n            f.write(time.strftime(\"%Y-%m-%dT%H:%M:%SZ\", time.gmtime()) + \" \" + msg + \"\\n\")\n    except OSError:\n        pass\n\ndef ws_connect(path: str, timeout: float = CONNECT_TIMEOUT_S):\n    \"\"\"Connect + HTTP upgrade under one absolute monotonic deadline.\n\n    Returns (socket, trailing) where trailing holds bytes coalesced after the\n    upgrade headers (TCP may deliver the 101 and the first WS frame together;\n    discarding them would lose the first message). Requires HTTP/1.1 101 plus\n    a matching Sec-WebSocket-Accept so a 200 (or any non-101) fails fast even\n    when the accept hash happens to be valid.\n    \"\"\"\n    deadline = time.monotonic() + timeout\n    s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)\n    s.settimeout(timeout)\n    try:\n        s.connect(path)\n        key = base64.b64encode(os.urandom(16)).decode()\n        expected = base64.b64encode(hashlib.sha1((key + WS_GUID).encode()).digest()).decode()\n        req = (\n            f\"GET /rpc HTTP/1.1\\r\\nHost: localhost\\r\\nUpgrade: websocket\\r\\n\"\n            f\"Connection: Upgrade\\r\\nSec-WebSocket-Key: {key}\\r\\nSec-WebSocket-Version: 13\\r\\n\\r\\n\"\n        ).encode()\n        s.settimeout(max(0.0, deadline - time.monotonic()))\n        s.sendall(req)\n        buf = b\"\"\n        while True:\n            if b\"\\r\\n\\r\\n\" in buf:\n                break\n            remaining = deadline - time.monotonic()\n            if remaining <= 0:\n                raise TimeoutError(\"WebSocket upgrade timed out\")\n            if len(buf) > 65536:\n                raise ConnectionError(\"WS upgrade headers too large\")\n            s.settimeout(remaining)\n            chunk = s.recv(4096)\n            if not chunk:\n                raise ConnectionError(\"daemon closed during WS upgrade\")\n            buf += chunk\n        head, _, trailing = buf.partition(b\"\\r\\n\\r\\n\")\n        lines = head.split(b\"\\r\\n\")\n        if not lines or lines[0].split(b\" \", 2)[:2] != [b\"HTTP/1.1\", b\"101\"]:\n            raise ConnectionError(f\"WS upgrade failed: {head[:200]!r}\")\n        accept = None\n        for line in lines[1:]:\n            name, sep, value = line.partition(b\":\")\n            if sep and name.strip().lower() == b\"sec-websocket-accept\":\n                accept = value.strip().decode(\"latin-1\")\n        if accept != expected:\n            raise ConnectionError(\"WS upgrade accept mismatch\")\n    except Exception:\n        try:\n            s.close()\n        except OSError:\n            pass\n        raise\n    # Keep one socket mode across reader and writer threads. Reads wait\n    # indefinitely in select; sends use their own absolute deadline.\n    s.setblocking(False)\n    return s, trailing\n\ndef mask_send(sock: socket.socket, payload: bytes, opcode: int = 1, deadline=None) -> None:\n    mask = os.urandom(4)\n    ln = len(payload)\n    if ln < 126:\n        hdr = bytes([0x80 | opcode, 0x80 | ln])\n    elif ln < 65536:\n        hdr = bytes([0x80 | opcode, 0x80 | 126]) + struct.pack(\"!H\", ln)\n    else:\n        hdr = bytes([0x80 | opcode, 0x80 | 127]) + struct.pack(\"!Q\", ln)\n    view = memoryview(hdr + mask + bytes(b ^ mask[i % 4] for i, b in enumerate(payload)))\n    while view:\n        remaining = deadline - time.monotonic()\n        if remaining <= 0:\n            raise TimeoutError(\"socket write timed out\")\n        _, writable, _ = select.select([], [sock], [], remaining)\n        if not writable:\n            raise TimeoutError(\"socket write timed out\")\n        try:\n            n = sock.send(view)\n        except BlockingIOError:\n            continue\n        if not n:\n            raise ConnectionError(\"socket closed during write\")\n        view = view[n:]\n\ndef locked_send(sock: socket.socket, lock: threading.Lock, payload: bytes, opcode: int = 1, timeout: float = CONNECT_TIMEOUT_S) -> None:\n    \"\"\"Serialized send sharing one monotonic budget across lock wait + send.\n\n    A non-reading peer must never wedge pong writes or timeout cleanup: on\n    expiry raise TimeoutError so the caller closes and exits without hanging.\n    \"\"\"\n    if timeout is None:\n        timeout = CONNECT_TIMEOUT_S\n    deadline = time.monotonic() + timeout\n    if timeout <= 0:\n        raise TimeoutError(\"send budget expired\")\n    if not lock.acquire(timeout=timeout):\n        raise TimeoutError(\"send lock timed out\")\n    try:\n        remaining = deadline - time.monotonic()\n        if remaining <= 0:\n            raise TimeoutError(\"send budget expired\")\n        mask_send(sock, payload, opcode=opcode, deadline=deadline)\n    finally:\n        lock.release()\n\ndef _buffered_reader(sock: socket.socket, initial: bytes = b\"\"):\n    buf = bytearray(initial)\n    def recv(n):\n        while len(buf) < n:\n            select.select([sock], [], [])\n            try:\n                chunk = sock.recv(n - len(buf))\n            except BlockingIOError:\n                continue\n            if not chunk:\n                raise ConnectionError(\"eof\")\n            buf.extend(chunk)\n        out = bytes(buf[:n])\n        del buf[:n]\n        return out\n    return recv\n\ndef read_frame(recv):\n    hdr = recv(2)\n    fin = bool(hdr[0] & 0x80)\n    opcode = hdr[0] & 0x0F\n    masked = bool(hdr[1] & 0x80)\n    ln = hdr[1] & 0x7F\n    if ln == 126:\n        ln = struct.unpack(\"!H\", recv(2))[0]\n    elif ln == 127:\n        ln = struct.unpack(\"!Q\", recv(8))[0]\n    mask = recv(4) if masked else b\"\"\n    payload = recv(ln)\n    if masked:\n        payload = bytes(b ^ mask[i % 4] for i, b in enumerate(payload))\n    return fin, opcode, payload\n\ndef read_message(recv, send_pong):\n    \"\"\"Next complete data message, assembling continuation frames.\n\n    Control frames are handled inline (pong answered, close reported) so a\n    fragmented message split around a ping still reassembles.\n    \"\"\"\n    opcode = None\n    parts = []\n    while True:\n        fin, op, payload = read_frame(recv)\n        if op == 0x8:\n            return (\"close\", None, b\"\")\n        if op == 0x9:\n            send_pong(payload)\n            continue\n        if op == 0xA:\n            continue\n        if op in (0x1, 0x2):\n            if opcode is not None:\n                raise ConnectionError(\"data frame inside fragmented message\")\n            if fin:\n                return (\"data\", op, payload)\n            opcode = op\n            parts.append(payload)\n            continue\n        if op == 0x0:\n            if opcode is None:\n                raise ConnectionError(\"stray continuation frame\")\n            parts.append(payload)\n            if fin:\n                return (\"data\", opcode, b\"\".join(parts))\n            continue\n        raise ConnectionError(f\"unsupported opcode {op}\")\n\ndef _is_daemon_response(payload: bytes, expect_id=None, known_ids=None) -> bool:\n    \"\"\"True only for the matching JSON-RPC response/error, never a notification.\n\n    The first-RPC timer must survive unrelated daemon notifications and foreign\n    responses: only the response/error whose id matches the client's initialize\n    (or, before it is known, any id the client already sent) proves the first\n    RPC got an answer. Timeouts clear it via the deadline, never via data.\n    \"\"\"\n    try:\n        text = payload.decode(\"utf-8\").strip()\n        msg = json.loads(text)\n    except Exception:\n        return False\n    if not isinstance(msg, dict):\n        return False\n    rid = msg.get(\"id\")\n    if rid is None or \"method\" in msg or (\"result\" not in msg and \"error\" not in msg):\n        return False\n    if expect_id is not None:\n        return rid == expect_id\n    if known_ids:\n        return rid in known_ids\n    return False\n\ndef _bounded_stdout_write(data: bytes, timeout: float = IO_TIMEOUT_S) -> None:\n    \"\"\"Write one daemon frame to stdout without hanging on a non-reading peer.\n\n    Waits for writability under the mid-session write budget and writes via\n    os.write in a loop, so a Desktop that stopped reading cannot hang the\n    bridge and then exit 1 on dirty stdout.\n    \"\"\"\n    if timeout is None:\n        timeout = IO_TIMEOUT_S\n    if timeout <= 0:\n        raise TimeoutError(\"stdout budget expired\")\n    fd = sys.stdout.fileno()\n    deadline = time.monotonic() + timeout\n    was_blocking = os.get_blocking(fd)\n    os.set_blocking(fd, False)\n    try:\n        view = memoryview(data)\n        while view:\n            remaining = deadline - time.monotonic()\n            if remaining <= 0:\n                raise TimeoutError(\"stdout write timed out\")\n            _, writable, _ = select.select([], [fd], [], remaining)\n            if not writable:\n                raise TimeoutError(\"stdout write timed out\")\n            try:\n                n = os.write(fd, view)\n            except BlockingIOError:\n                continue\n            view = view[n:]\n    finally:\n        os.set_blocking(fd, was_blocking)\n\ndef stdout_writer(sock: socket.socket, recv, send_pong, done: threading.Event, first_msg: threading.Event, output_forwarded: threading.Event, client_ids=None, init_state=None) -> None:\n    try:\n        while True:\n            kind, opcode, payload = read_message(recv, send_pong)\n            if kind == \"close\":\n                log(\"daemon WS close\")\n                return\n            if opcode == 0x1:\n                # Desktop StdioConnection expects newline-delimited JSON text\n                if not payload.endswith(b\"\\n\"):\n                    payload += b\"\\n\"\n            # Commit BEFORE writing: once a daemon byte is about to hit\n            # stdout, the session is dirty and the fallback must never run,\n            # even if the write itself blocks or fails.\n            output_forwarded.set()\n            _bounded_stdout_write(payload)\n            if opcode == 0x1:\n                expect = (init_state or {}).get(\"initialize_id\") if isinstance(init_state, dict) else None\n                if _is_daemon_response(payload, expect, client_ids or ()):\n                    first_msg.set()\n    except Exception as e:\n        log(f\"stdout_writer exit: {e}\")\n    finally:\n        done.set()\n\ndef main() -> int:\n    log(f\"start sock={SOCK}\")\n    try:\n        sock, pending = ws_connect(SOCK)\n    except Exception as e:\n        log(f\"connect failed: {e}\")\n        sys.stderr.write(f\"codex-stdio-to-daemon-ws: {e}\\n\")\n        return EXIT_PRE_STDIO\n    log(\"connected\")\n    connected_at = time.monotonic()\n    first_deadline = connected_at + FIRST_MESSAGE_TIMEOUT_S\n    send_lock = threading.Lock()\n    done = threading.Event()\n    first_msg = threading.Event()\n    output_forwarded = threading.Event()\n    client_ids = set()\n    init_state = {\"initialize_id\": None}\n\n    def _send_timeout() -> float:\n        # Before the first matching daemon response the remaining first-RPC\n        # budget bounds every send; after it each send gets the mid-session\n        # write budget. Idle reads are never timed out.\n        if not first_msg.is_set():\n            return max(0.0, first_deadline - time.monotonic())\n        return IO_TIMEOUT_S\n\n    def _cleanup_timeout() -> float:\n        # Timeout cleanup stays within the expired session budget: once the\n        # first-RPC deadline has passed, close directly instead of opening\n        # fresh windows that let a short budget take several timeout periods.\n        if not first_msg.is_set():\n            return max(0.0, first_deadline - time.monotonic())\n        return CONNECT_TIMEOUT_S\n\n    def send_pong(payload: bytes) -> None:\n        locked_send(sock, send_lock, payload, opcode=0xA, timeout=_send_timeout())\n    recv = _buffered_reader(sock, pending)\n    t = threading.Thread(target=stdout_writer, args=(sock, recv, send_pong, done, first_msg, output_forwarded, client_ids, init_state), daemon=True)\n    t.start()\n    # Byte-precise commit point: the fallback may run only while zero stdin\n    # bytes have left the pipe and no daemon payload was committed to stdout.\n    # Reads use os.read into a userspace line buffer (buffered readline could\n    # readahead past the commit point), and every byte read counts -- even a\n    # blank line. first_msg tracks the matching daemon response/error, never\n    # a notification.\n    stdin_bytes = 0\n    pending_in = b\"\"\n    clean_eof = False\n    try:\n        fd = sys.stdin.fileno()\n        while not done.is_set():\n            if not first_msg.is_set() and time.monotonic() >= first_deadline:\n                log(\"first daemon message timed out\")\n                break\n            ready, _, _ = select.select([fd], [], [], 0.5)\n            if not ready:\n                continue\n            chunk = os.read(fd, 65536)\n            if not chunk:\n                clean_eof = True\n                break\n            stdin_bytes += len(chunk)\n            pending_in += chunk\n            while b\"\\n\" in pending_in:\n                line, _, pending_in = pending_in.partition(b\"\\n\")\n                line = line.strip()\n                if not line:\n                    continue\n                try:\n                    try:\n                        obj = json.loads(line.decode(\"utf-8\"))\n                    except Exception:\n                        obj = None\n                    if isinstance(obj, dict) and obj.get(\"id\") is not None:\n                        client_ids.add(obj.get(\"id\"))\n                        if obj.get(\"method\") == \"initialize\" and init_state[\"initialize_id\"] is None:\n                            init_state[\"initialize_id\"] = obj.get(\"id\")\n                except Exception:\n                    pass\n                try:\n                    locked_send(sock, send_lock, line, timeout=_send_timeout())\n                except TimeoutError as e:\n                    log(f\"stdin forward timed out: {e}\")\n                    break\n                except Exception as e:\n                    log(f\"stdin forward failed: {e}\")\n                    break\n            else:\n                continue\n            break\n    except Exception as e:\n        log(f\"stdin loop exit: {e}\")\n    # Flush any buffered EOF-tail data BEFORE the WS Close: sending Close\n    # first would let the daemon discard the tail.\n    if clean_eof:\n        tail = pending_in.strip()\n        if tail and not done.is_set():\n            try:\n                locked_send(sock, send_lock, tail, timeout=_cleanup_timeout())\n            except Exception as e:\n                log(f\"eof flush failed: {e}\")\n    try:\n        locked_send(sock, send_lock, b\"\", opcode=0x8, timeout=_cleanup_timeout())\n    except Exception as e:\n        log(f\"close send failed: {e}\")\n    try:\n        try:\n            sock.shutdown(socket.SHUT_RDWR)\n        except OSError:\n            pass\n        sock.close()\n    except OSError:\n        pass\n    # Bound termination: wake the reader so no thread is left hung on recv.\n    t.join(timeout=0.5)\n    # A reader still exiting could commit output after this check. In that\n    # case pristine stdio cannot be proven, so never permit fallback.\n    if t.is_alive():\n        output_forwarded.set()\n    if clean_eof:\n        log(\"exit\")\n        return EXIT_SERVED\n    # Reader died, first RPC timed out, post-upgrade I/O timed out, or stdin\n    # broke: fail open only while stdio is still pristine -- no stdin byte\n    # ever consumed AND no daemon payload ever committed to stdout. Committed\n    # output forces a mid-session exit so Desktop reconnects instead of\n    # falling back to stock Codex on a corrupted stream.\n    rc = EXIT_MID_SESSION if (stdin_bytes or output_forwarded.is_set()) else EXIT_PRE_STDIO\n    log(f\"exit rc={rc}\")\n    return rc\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n";
 
 __webpack_require__.d(__webpack_exports__, {
 }, {
@@ -86055,9 +86150,7 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var node_fs__rspack_import_1 = __webpack_require__("node:fs");
 /* import */ var node_os__rspack_import_2 = __webpack_require__("node:os");
 /* import */ var node_path__rspack_import_3 = __webpack_require__("node:path");
-/* import */ var _desktop_shim_bridge_js__rspack_import_5 = __webpack_require__("./src/core/desktop-shim-bridge.js");
-/* import */ var _codex_bridge_js__rspack_import_4 = __webpack_require__("./src/core/codex-bridge.js");
-
+/* import */ var _desktop_shim_bridge_js__rspack_import_4 = __webpack_require__("./src/core/desktop-shim-bridge.js");
 
 
 
@@ -86135,11 +86228,12 @@ function renderWrapperScript({ realPath, bridgePath, wrapperLogPath, codexHome,
 # daemon's control socket. Reversible: \`gbot codex desktop-shim uninstall\`.
 # The daemon is kept up by the LaunchAgent login script, not here: this hot path
 # never starts the daemon itself, so a wedged daemon lock cannot hang
-# Desktop. Fail-open runs ONLY before any stdin is consumed: an absent socket
-# fails the preflight and a pre-session bridge failure (exit 1) falls through
+# Desktop. Fail-open runs ONLY while stdio is still pristine (no stdin
+# consumed, no stdout written): an absent socket fails the preflight and a
+# pre-session bridge failure (exit 1) falls through
 # to the real standalone codex on pristine stdio. A mid-session bridge failure
 # (exit 2+) exits promptly so Desktop reconnects; the fallback never runs on
-# half-consumed stdin. Bridge exit 0 means it served the session. Never touches
+# half-consumed stdin or dirty stdout. Bridge exit 0 means it served the session. Never touches
 # Desktop binaries or its private tool pipe.
 set -u
 REAL="\${CODEX_DESKTOP_WRAPPER_REAL:-${realPath}}"
@@ -86156,7 +86250,11 @@ echo "$(ts) argv: $*" >>"$LOG" 2>/dev/null || true
 if [[ ! -x "$REAL" ]]; then
   FALLBACK="$(command -v codex 2>/dev/null || true)"
   if [[ -n "$FALLBACK" && -x "$FALLBACK" ]]; then
-    REAL="$FALLBACK"
+    if [[ "$FALLBACK" -ef "$0" ]] 2>/dev/null || { [[ -n "\${CODEX_CLI_PATH:-}" ]] && [[ "$FALLBACK" -ef "\${CODEX_CLI_PATH}" ]] 2>/dev/null; }; then
+      echo "$(ts) refusing self fallback $FALLBACK" >>"$LOG" 2>/dev/null || true
+    else
+      REAL="$FALLBACK"
+    fi
   fi
 fi
 
@@ -86177,7 +86275,7 @@ preflight() {
 }
 
 if [[ "$has_app_server" -eq 1 && "$has_daemon" -eq 0 && "$has_proxy" -eq 0 && "$has_generate" -eq 0 ]]; then
-  if [[ -x "$REAL" && -f "$BRIDGE" ]] && command -v python3 >/dev/null 2>&1; then
+  if [[ -f "$BRIDGE" ]] && command -v python3 >/dev/null 2>&1; then
     if preflight; then
       echo "$(ts) rewrite -> stdio-ws bridge" >>"$LOG" 2>/dev/null || true
       python3 "$BRIDGE"
@@ -86327,7 +86425,7 @@ function fileExists(path) {
         recursive: true
     });
     writeExecutable(paths.wrapperPath, renderWrapperScript(paths));
-    (0,node_fs__rspack_import_1.writeFileSync)(paths.bridgePath, _desktop_shim_bridge_js__rspack_import_5/* .BRIDGE_SOURCE.endsWith */.w.endsWith("\n") ? _desktop_shim_bridge_js__rspack_import_5/* .BRIDGE_SOURCE */.w : `${_desktop_shim_bridge_js__rspack_import_5/* .BRIDGE_SOURCE */.w}\n`, {
+    (0,node_fs__rspack_import_1.writeFileSync)(paths.bridgePath, _desktop_shim_bridge_js__rspack_import_4/* .BRIDGE_SOURCE.endsWith */.w.endsWith("\n") ? _desktop_shim_bridge_js__rspack_import_4/* .BRIDGE_SOURCE */.w : `${_desktop_shim_bridge_js__rspack_import_4/* .BRIDGE_SOURCE */.w}\n`, {
         mode: 420
     });
     writeExecutable(paths.envScriptPath, renderEnvScript(paths));
@@ -86407,11 +86505,12 @@ function fileExists(path) {
         paths.bridgePath,
         paths.envScriptPath
     ]){
+        const existed = fileExists(path);
         try {
             if ((0,node_fs__rspack_import_1.rmSync)(path, {
                 force: true
             }) === undefined && fileExists(path)) warnings.push(`could not remove ${path}`);
-            else if (!fileExists(path)) removed.push(path);
+            else if (existed && !fileExists(path)) removed.push(path);
         } catch (error) {
             warnings.push(`could not remove ${path} (${error instanceof Error ? error.message : String(error)})`);
         }
@@ -86505,12 +86604,10 @@ function socketStateOf(path) {
     // Desktop-facing value: the GUI domain on macOS, the caller env elsewhere.
     const desktopCliPath = platform === "darwin" ? guiCliPath : cliPath;
     const installed = wrapperPresent && isExecutable(paths.wrapperPath) && bridgePresent;
-    // Effective socket, resolved exactly like gbot's own client so status and
-    // send/queue/status never disagree: CODEX_APP_SERVER_SOCK wins, else CODEX_HOME.
-    const socketPath = (0,_codex_bridge_js__rspack_import_4/* .codexSocketPath */.ql)({
-        ...env,
-        CODEX_HOME: paths.codexHome
-    });
+    // Effective socket, resolved exactly like gbot's own client (CODEX_APP_SERVER_SOCK
+    // wins, else the install-time CODEX_HOME) so status and send/queue/status never
+    // disagree. Inlined here so codex-bridge can reuse desktopShimStatus without a cycle.
+    const socketPath = env.CODEX_APP_SERVER_SOCK || (0,node_path__rspack_import_3.join)(paths.codexHome, "app-server-control", "app-server-control.sock");
     return {
         action: "status",
         bridgePath: paths.bridgePath,
@@ -86618,6 +86715,7 @@ function formatCodexStatus(s) {
     const lines = [
         "socket: " + s.socketPath + " (" + s.socketState + ")"
     ];
+    if (s.desktopShimConfigured) lines.push("desktop shim: configured (managed attachment unverified)");
     if (!s.reachable) return lines.concat("reachable: no (" + s.mode + ")", s.message).join("\n");
     if (s.mode !== "daemon") {
         return lines.concat("reachable: yes, but unusable (" + s.mode + ")", s.message).join("\n");
@@ -86625,7 +86723,7 @@ function formatCodexStatus(s) {
     lines.push("reachable: yes (daemon)");
     const cli = s.cliVersion ?? (s.cliVersionProbe === "ok" ? "unknown" : "unknown, probe " + s.cliVersionProbe);
     lines.push("daemon version: " + (s.daemonVersion ?? "unknown") + "  cli version: " + cli + "  pinned schema: " + s.pinnedVersion + " (" + s.schema.compatibility + ")");
-    lines.push(s.desktopAttached === "private-stdio" ? "desktop attached: private-stdio (ChatGPT Desktop runs its own private stdio app-server; start a managed daemon with `codex app-server daemon start`)" : "desktop attached: unknown (not observable from the socket)");
+    lines.push(s.desktopAttached === "private-stdio" ? "desktop attached: private-stdio (Desktop-bundled app-server process observed; managed attachment unverified)" : "desktop attached: unknown (not observable from the socket)");
     if (s.versionMismatch) {
         lines.push("warning: daemon and CLI versions differ; `codex app-server daemon restart` picks up the installed CLI");
     }
@@ -86640,6 +86738,9 @@ function formatCodexThread(t) {
     const preview = t.preview ? "\n    " + stripTerminalControls(String(t.preview).replace(/\s+/g, " ")).slice(0, 200) : "";
     return stripTerminalControls(t.id) + "  " + stripTerminalControls(t.status) + title + "\n    " + stripTerminalControls(t.cwd ?? "") + preview;
 }
+/** Shell-safe single-quoting for copy-pasteable export lines (spaces, quotes, $). */ function shellQuote(value) {
+    return "'" + String(value).replace(/'/g, "'\\''") + "'";
+}
 function formatDesktopShimStatus(s) {
     const mark = (ok)=>ok ? "yes" : "no";
     const cliLine = s.platform === "darwin" ? "CODEX_CLI_PATH: GUI domain " + (s.guiCliPath ?? "(unset)") + " / this shell " + (s.cliPath ?? "(unset)") + (s.wrapperPointsAtShim ? " (Desktop-facing value points at shim)" : "") : "CODEX_CLI_PATH: " + (s.cliPath ?? "(unset)") + (s.wrapperPointsAtShim ? " (points at shim)" : "");
@@ -86654,7 +86755,7 @@ function formatDesktopShimStatus(s) {
     if (!s.installed) {
         lines.push("shim: not installed — run `gbot codex desktop-shim install` (Desktop keeps stock behavior until then)");
     } else if (!s.wrapperPointsAtShim) {
-        lines.push("shim: installed but CODEX_CLI_PATH does not point at it — reinstall or relaunch ChatGPT.app after login");
+        lines.push(s.platform === "darwin" ? "shim: installed but CODEX_CLI_PATH does not point at it — reinstall or relaunch ChatGPT.app after login" : "shim: installed but CODEX_CLI_PATH does not point at it — export CODEX_CLI_PATH=" + shellQuote(s.wrapperPath));
     } else {
         lines.push("shim: active — Desktop app-server spawns bridge onto the managed daemon");
     }
@@ -87751,6 +87852,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -87761,6 +87864,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -87800,6 +87906,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");

package/dist/install.mjs

@@ -7,7 +7,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { fileURLToPath } from 'node:url';
 
 const pluginName = "gbot";
-const pluginVersion = "0.4.2";
+const pluginVersion = "0.4.5";
 const receiptFile = ".agent-bundle-install.json";
 const receiptFormat = "agent-bundle-install-receipt/2";
 const legacyReceiptFormat = "agent-bundle-install-receipt/1";

package/dist/mcp/mcp-grok-bot-b8c2461e-flight.mjs

@@ -25987,6 +25987,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -25997,6 +25999,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -26036,6 +26041,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");
@@ -26173,7 +26184,7 @@ globalThis.__rspack_rsc_manifest__ ??= Object.freeze({
 });
 if (node_worker_threads__rspack_import_0.parentPort === null) throw new Error('Generated Flight worker requires a parent port.');
 process.stdout.write = process.stderr.write.bind(process.stderr);
-const ARTIFACT_EPOCH = "gbot@0.4.2";
+const ARTIFACT_EPOCH = "gbot@0.4.5";
 const processLifetime = {
     hits: 0,
     instanceId: crypto.randomUUID(),

package/dist/mcp/mcp-grok-bot-b8c2461e.mjs

@@ -106202,7 +106202,7 @@ __webpack_require__.r(__webpack_exports__);
 const route0 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_3, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_3);
 
 const route1 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_4, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_4);
-const ARTIFACT_EPOCH = "gbot@0.4.2";
+const ARTIFACT_EPOCH = "gbot@0.4.5";
 const pluginRoot = (0,_agent_bundle_runtime__rspack_import_5/* .resolvePluginRoot */.E7)({
     fallback: (0,node_url__rspack_import_0.fileURLToPath)(new URL('..', import.meta.url)),
     stateAnchor: 'user-data'
@@ -106291,7 +106291,7 @@ const routes = Object.freeze({
         lineage: lineage.registry,
         plugin: {
             "name": "gbot",
-            "version": "0.4.2"
+            "version": "0.4.5"
         },
         pluginRoot: pluginRoot.identity,
         routes
@@ -107476,6 +107476,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -107486,6 +107488,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -107525,6 +107530,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.4.2",
+  "version": "0.4.5",
   "description": "CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "engines": {

package/dist/plugin.json

@@ -1 +1 @@
-{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","author":{"name":"Zack Jackson","url":"https://github.com/ScriptedAlchemy"},"description":"Message Grok Bot bots and groups and read their threads from Codex, Claude Code, and Cursor.","homepage":"https://github.com/ScriptedAlchemy/grok-bot-cli#readme","keywords":["grok","grok-bot","grokbot","gbot","cursor","ai-agents","automation","terminal","cli","agent-bundle"],"license":"MIT","name":"gbot","repository":"https://github.com/ScriptedAlchemy/grok-bot-cli","version":"0.4.2"}
+{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","author":{"name":"Zack Jackson","url":"https://github.com/ScriptedAlchemy"},"description":"Message Grok Bot bots and groups and read their threads from Codex, Claude Code, and Cursor.","homepage":"https://github.com/ScriptedAlchemy/grok-bot-cli#readme","keywords":["grok","grok-bot","grokbot","gbot","cursor","ai-agents","automation","terminal","cli","agent-bundle"],"license":"MIT","name":"gbot","repository":"https://github.com/ScriptedAlchemy/grok-bot-cli","version":"0.4.5"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.4.2",
+  "version": "0.4.5",
   "description": "CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "bin": {