oh-my-codex 0.11.11 → 0.11.13

package/src/scripts/notify-hook/auto-nudge.ts

@@ -5,7 +5,6 @@
  */
 
 import { readFile, writeFile } from 'fs/promises';
-import { execFileSync } from 'child_process';
 import { join } from 'path';
 import { homedir } from 'os';
 import { asNumber, safeString } from './utils.js';
@@ -13,7 +12,15 @@ import { readJsonIfExists, getScopedStateDirsForCurrentSession, readdir } from '
 import { runProcess } from './process-runner.js';
 import { logTmuxHookEvent } from './log.js';
 import { evaluatePaneInjectionReadiness, mapPaneInjectionReadinessReason, sendPaneInput } from './team-tmux-guard.js';
-import { buildCapturePaneArgv, DEFAULT_MARKER } from '../tmux-hook-engine.js';
+import { buildCapturePaneArgv, DEFAULT_MARKER, tmuxHookExplicitlyDisablesInjection } from '../tmux-hook-engine.js';
+import {
+  isManagedOmxSession,
+  resolveManagedCurrentPane,
+  resolveManagedPaneFromAnchor,
+  resolveManagedSessionPane,
+  resolveInvocationSessionId,
+  verifyManagedPaneTarget,
+} from './managed-tmux.js';
 
 export const SKILL_ACTIVE_STATE_FILE = 'skill-active-state.json';
 export const DEEP_INTERVIEW_BLOCKED_APPROVAL_INPUTS = ['yes', 'y', 'proceed', 'continue', 'ok', 'sure', 'go ahead', 'next i should'];
@@ -53,22 +60,29 @@ export function normalizeBlockedAutoApprovalInput(text) {
     .trim();
 }
 
+function buildBlockedAutoApprovalMatcher(blockedInputs) {
+  const normalizedBlockedInputs = blockedInputs.map((entry) => normalizeBlockedAutoApprovalInput(entry)).filter(Boolean);
+  return {
+    exactMatches: new Set(normalizedBlockedInputs),
+    prefixedMatches: normalizedBlockedInputs.filter((entry) => DEEP_INTERVIEW_BLOCKED_APPROVAL_PREFIXES.has(entry)),
+    blockedTokenSet: new Set(normalizedBlockedInputs.flatMap((entry) => entry.split(/\s+/).filter(Boolean))),
+  };
+}
+
 export function isBlockedAutoApprovalInput(text, blockedInputs = DEEP_INTERVIEW_BLOCKED_APPROVAL_INPUTS) {
   const normalized = normalizeBlockedAutoApprovalInput(text);
   if (!normalized) return false;
-  if (blockedInputs.some((entry) => normalizeBlockedAutoApprovalInput(entry) === normalized)) return true;
-  if (
-    blockedInputs
-      .map((entry) => normalizeBlockedAutoApprovalInput(entry))
-      .filter((entry) => DEEP_INTERVIEW_BLOCKED_APPROVAL_PREFIXES.has(entry))
-      .some((prefix) => normalized.startsWith(`${prefix} `))
-  ) return true;
+  const normalizedBlockedInputs = blockedInputs.map((entry) => normalizeBlockedAutoApprovalInput(entry)).filter(Boolean);
+  if (normalizedBlockedInputs.includes(normalized)) return true;
+
+  const blockedPrefixes = normalizedBlockedInputs.filter((entry) => DEEP_INTERVIEW_BLOCKED_APPROVAL_PREFIXES.has(entry));
+  if (blockedPrefixes.some((prefix) => normalized.startsWith(`${prefix} `))) return true;
 
   const tokens = normalized.split(/\s+/).filter(Boolean);
   if (tokens.length === 0) return false;
 
   const blockedTokenSet = new Set(
-    blockedInputs.flatMap((entry) => normalizeBlockedAutoApprovalInput(entry).split(/\s+/).filter(Boolean)),
+    normalizedBlockedInputs.flatMap((entry) => entry.split(/\s+/).filter(Boolean)),
   );
   return tokens.every((token) => blockedTokenSet.has(token));
 }
@@ -177,6 +191,11 @@ export async function isDeepInterviewStateActive(stateDir) {
   return Boolean(modeState && modeState.active === true);
 }
 
+export async function isDeepInterviewInputLockActive(stateDir) {
+  const skillState = await loadSkillActiveState(stateDir);
+  return isDeepInterviewAutoApprovalLocked(skillState);
+}
+
 export async function resolveAutoNudgeSignature(stateDir, payload, lastMessage = '') {
   const normalizedMessage = normalizeAutoNudgeSignatureText(lastMessage);
   const hudState = await readJsonIfExists(join(stateDir, 'hud-state.json'), null);
@@ -352,6 +371,13 @@ export async function loadAutoNudgeConfig() {
   return normalizeAutoNudgeConfig(raw.autoNudge);
 }
 
+async function localTmuxInjectionDisabled(cwd) {
+  const normalizedCwd = safeString(cwd).trim();
+  if (!normalizedCwd) return false;
+  const raw = await readJsonIfExists(join(normalizedCwd, '.omx', 'tmux-hook.json'), null);
+  return tmuxHookExplicitlyDisablesInjection(raw);
+}
+
 export function detectStallPattern(text, patterns) {
   if (!text || typeof text !== 'string') return false;
   const normalized = normalizeStallDetectionText(text);
@@ -373,105 +399,59 @@ export async function capturePane(paneId, lines = 10) {
   }
 }
 
-function resolveCodexPaneByCwdFallback(cwd) {
-  const normalizedCwd = safeString(cwd).trim();
-  if (!normalizedCwd) return '';
-
-  try {
-    const panes = execFileSync('tmux', [
-      'list-panes', '-a', '-F', '#{pane_id}	#{pane_current_path}	#{pane_current_command}	#{pane_start_command}',
-    ], { encoding: 'utf-8', timeout: 2000 })
-      .trim()
-      .split('\n')
-      .filter(Boolean);
-
-    for (const line of panes) {
-      const [paneId, panePath = '', paneCommand = '', startCommand = ''] = line.split('\t');
-      const normalizedPanePath = safeString(panePath).trim();
-      const normalizedStart = safeString(startCommand).toLowerCase();
-      const normalizedCommand = safeString(paneCommand).trim().toLowerCase();
-      if (!paneId || normalizedPanePath !== normalizedCwd) continue;
-      if (/\bomx\b.*\bhud\b.*--watch/i.test(normalizedStart)) continue;
-      if (normalizedStart.includes('codex')) return paneId;
-      if (normalizedCommand === 'codex' || normalizedCommand === 'node' || normalizedCommand === 'npx') return paneId;
-    }
-  } catch {
-    // Fall back to empty when tmux scan is unavailable.
-  }
-
-  return '';
-}
-
-async function resolveCodexPaneFromAnchor(anchorPane) {
-  const paneId = safeString(anchorPane).trim();
-  if (!paneId) return '';
-
-  try {
-    const sessionResult = await runProcess('tmux', ['display-message', '-t', paneId, '-p', '#S'], 2000);
-    const sessionName = safeString(sessionResult.stdout).trim();
-    if (!sessionName) return '';
-
-    const panesResult = await runProcess(
-      'tmux',
-      ['list-panes', '-s', '-t', sessionName, '-F', '#{pane_id}\t#{pane_current_command}\t#{pane_start_command}'],
-      2000,
-    );
-    const panes = safeString(panesResult.stdout).trim().split('\n').filter(Boolean);
-    for (const line of panes) {
-      const [candidatePaneId, , rawStartCommand = ''] = line.split('\t');
-      const startCommand = safeString(rawStartCommand).toLowerCase();
-      if (!candidatePaneId) continue;
-      if (/\bomx\b.*\bhud\b.*--watch/i.test(startCommand)) continue;
-      if (startCommand.includes('codex')) return candidatePaneId;
-    }
-  } catch {
-    // Fall back to the anchored pane when session scanning is unavailable.
-  }
-
-  return '';
-}
-
-export async function resolveNudgePaneTarget(stateDir: any, cwd = '') {
-  // Use canonical codex pane resolver — validates pane is running an agent, not a shell
-  const { resolveCodexPane } = await import('../tmux-hook-engine.js');
-  const codexPane = resolveCodexPane();
-  if (codexPane) return codexPane;
-
-  let fallbackPane = '';
-
-  try {
-    const scopedDirs = await getScopedStateDirsForCurrentSession(stateDir);
-    for (const dir of scopedDirs) {
-      const files = await readdir(dir).catch(() => []);
-      for (const f of files) {
-        if (!f.endsWith('-state.json')) continue;
-        const path = join(dir, f);
-        try {
-          const state = JSON.parse(await readFile(path, 'utf-8'));
-          if (state && state.active && state.tmux_pane_id) {
-            const anchoredPane = safeString(state.tmux_pane_id).trim();
-            if (!anchoredPane) continue;
-            const upgradedPane = await resolveCodexPaneFromAnchor(anchoredPane);
-            if (upgradedPane) return upgradedPane;
-            if (!fallbackPane) fallbackPane = anchoredPane;
-          }
-        } catch {
-          // skip malformed state
-        }
+export async function resolveNudgePaneTarget(stateDir: any, cwd = '', payload: any = undefined) {
+  const allowTeamWorker = safeString(process.env.OMX_TEAM_WORKER || '').trim() !== '';
+  const managedCurrentPane = await resolveManagedCurrentPane(cwd, payload, { allowTeamWorker });
+  if (managedCurrentPane) return managedCurrentPane;
+
+  const invocationSessionId = resolveInvocationSessionId(payload);
+  const scopedDirs = await getScopedStateDirsForCurrentSession(stateDir, invocationSessionId).catch(() => []);
+  for (const dir of scopedDirs) {
+    const files = await readdir(dir).catch(() => []);
+    for (const f of files) {
+      if (!f.endsWith('-state.json')) continue;
+      const path = join(dir, f);
+      try {
+        const state = JSON.parse(await readFile(path, 'utf-8'));
+        if (!state || !state.active || !state.tmux_pane_id) continue;
+        const anchoredPane = safeString(state.tmux_pane_id).trim();
+        if (!anchoredPane) continue;
+        const managedPane = await resolveManagedPaneFromAnchor(anchoredPane, cwd, payload, { allowTeamWorker });
+        if (managedPane) return managedPane;
+        const verdict = await verifyManagedPaneTarget(anchoredPane, cwd, payload, { allowTeamWorker });
+        if (verdict.ok) return anchoredPane;
+      } catch {
+        // skip malformed state
       }
     }
-  } catch {
-    // Non-critical
   }
 
-  if (fallbackPane) return fallbackPane;
-
-  return resolveCodexPaneByCwdFallback(cwd);
+  return await resolveManagedSessionPane(cwd, payload);
 }
 
 export async function maybeAutoNudge({ cwd, stateDir, logsDir, payload }) {
   const config = await loadAutoNudgeConfig();
   if (!config.enabled) return;
+  if (await localTmuxInjectionDisabled(cwd)) {
+    await logTmuxHookEvent(logsDir, {
+      timestamp: new Date().toISOString(),
+      type: 'auto_nudge_skipped',
+      reason: 'tmux_hook_disabled',
+    }).catch(() => {});
+    return;
+  }
+
+  const sourceName = safeString(payload?.source || '');
+  const managedSession = await isManagedOmxSession(cwd, payload, { allowTeamWorker: true });
+  if (!managedSession) {
+    if (sourceName === 'notify-fallback-watcher-stall') return;
+    await logTmuxHookEvent(logsDir, {
+      timestamp: new Date().toISOString(),
+      type: 'auto_nudge_skipped',
+      reason: 'unmanaged_session',
+    }).catch(() => {});
+    return;
+  }
 
   const lastMessage = safeString(payload['last-assistant-message'] || payload.last_assistant_message || '');
   const latestUserInput = latestUserInputFromPayload(payload);
@@ -493,7 +473,7 @@ export async function maybeAutoNudge({ cwd, stateDir, logsDir, payload }) {
     if (!nudgeState || typeof nudgeState !== 'object') {
       nudgeState = { nudgeCount: 0, lastNudgeAt: '', lastSignature: '', lastSemanticSignature: '' };
     }
-    const paneId = await resolveNudgePaneTarget(stateDir, cwd);
+    const paneId = await resolveNudgePaneTarget(stateDir, cwd, payload);
 
     let detected = detectStallPattern(lastMessage, config.patterns);
     let source = 'payload';
@@ -512,6 +492,18 @@ export async function maybeAutoNudge({ cwd, stateDir, logsDir, payload }) {
     const signature = await resolveAutoNudgeSignature(stateDir, payload, signatureSourceText);
     const semanticSignature = normalizeAutoNudgeSignatureText(signatureSourceText);
 
+    if (signature && safeString(nudgeState.lastSignature) === signature) {
+      await logTmuxHookEvent(logsDir, {
+        timestamp: new Date().toISOString(),
+        type: 'auto_nudge_skipped',
+        reason: 'already_nudged_for_signature',
+        source,
+        signature,
+        semantic_signature: semanticSignature,
+      }).catch(() => {});
+      return;
+    }
+
     const lastNudgeAtMs = Date.parse(safeString(nudgeState.lastNudgeAt));
     if (
       semanticSignature
@@ -532,7 +524,6 @@ export async function maybeAutoNudge({ cwd, stateDir, logsDir, payload }) {
       return;
     }
 
-    const sourceName = safeString(payload?.source || '');
     const isFallbackWatcherSource = sourceName === 'notify-fallback-watcher-stall';
     if (!isFallbackWatcherSource && config.stallMs > 0) {
       nudgeState.pendingSignature = signature;
@@ -564,7 +555,7 @@ export async function maybeAutoNudge({ cwd, stateDir, logsDir, payload }) {
     }
 
     const deepInterviewLockActive = isDeepInterviewAutoApprovalLocked(skillState) && !releaseReason;
-    if (deepInterviewLockActive && isBlockedAutoApprovalInput(config.response, skillState.input_lock?.blocked_inputs)) {
+    if (deepInterviewLockActive) {
       const blockedMessage = skillState.input_lock?.message || DEEP_INTERVIEW_INPUT_LOCK_MESSAGE;
       await logTmuxHookEvent(logsDir, {
         timestamp: new Date().toISOString(),
@@ -573,6 +564,9 @@ export async function maybeAutoNudge({ cwd, stateDir, logsDir, payload }) {
         response: config.response,
         source,
         blocked_by: 'deep-interview-lock',
+        block_kind: isBlockedAutoApprovalInput(config.response, skillState.input_lock?.blocked_inputs)
+          ? 'blocked-auto-approval'
+          : 'input-lock-active',
         message: blockedMessage,
         suppressed: true,
       }).catch(() => {});

package/src/scripts/notify-hook/managed-tmux.ts

@@ -0,0 +1,324 @@
+import { execFileSync } from 'child_process';
+import { readFileSync } from 'fs';
+import { basename, dirname, resolve as resolvePath } from 'path';
+import { readSessionState, isSessionStale } from '../../hooks/session.js';
+import { runProcess } from './process-runner.js';
+import { safeString } from './utils.js';
+
+function sanitizeTmuxToken(value: string): string {
+  const cleaned = safeString(value)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  return cleaned || 'unknown';
+}
+
+export function buildExpectedManagedTmuxSessionName(cwd: string, sessionId: string): string {
+  const parentPath = dirname(cwd);
+  const parentDir = basename(parentPath);
+  const dirName = basename(cwd);
+  const grandparentPath = dirname(parentPath);
+  const grandparentDir = basename(grandparentPath);
+  const repoDir = parentDir.endsWith('.omx-worktrees')
+    ? parentDir.slice(0, -'.omx-worktrees'.length)
+    : parentDir === 'worktrees' && grandparentDir === '.omx'
+      ? basename(dirname(grandparentPath))
+      : null;
+  const dirToken = repoDir
+    ? sanitizeTmuxToken(`${repoDir}-${dirName}`)
+    : sanitizeTmuxToken(dirName);
+  let branchToken = 'detached';
+  try {
+    const branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
+      cwd,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+      windowsHide: true,
+    }).trim();
+    if (branch) branchToken = sanitizeTmuxToken(branch);
+  } catch {
+    // best effort only
+  }
+  const sessionToken = sanitizeTmuxToken(sessionId.replace(/^omx-/, ''));
+  const name = `omx-${dirToken}-${branchToken}-${sessionToken}`;
+  return name.length > 120 ? name.slice(0, 120) : name;
+}
+
+export function resolveInvocationSessionId(payload: any): string {
+  return safeString(
+    payload?.session_id
+    || payload?.['session-id']
+    || process.env.OMX_SESSION_ID
+    || process.env.CODEX_SESSION_ID
+    || process.env.SESSION_ID
+    || '',
+  ).trim();
+}
+
+function readCurrentTmuxSessionName(): string {
+  if (!process.env.TMUX) return '';
+  try {
+    return execFileSync('tmux', ['display-message', '-p', '#S'], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+    }).trim();
+  } catch {
+    return '';
+  }
+}
+
+function readParentPid(pid: number): number | null {
+  if (!Number.isInteger(pid) || pid <= 1) return null;
+  try {
+    if (process.platform === 'linux') {
+      const stat = readFileSync(`/proc/${pid}/stat`, 'utf-8');
+      const commandEnd = stat.lastIndexOf(')');
+      if (commandEnd === -1) return null;
+      const remainder = stat.slice(commandEnd + 1).trim();
+      const fields = remainder.split(/\s+/);
+      if (fields.length === 0) return null;
+      const ppid = Number(fields[1]);
+      return Number.isFinite(ppid) && ppid > 0 ? ppid : null;
+    }
+    const raw = execFileSync('ps', ['-o', 'ppid=', '-p', String(pid)], {
+      encoding: 'utf-8',
+      timeout: 2000,
+    }).trim();
+    const ppid = Number(raw);
+    return Number.isFinite(ppid) && ppid > 0 ? ppid : null;
+  } catch {
+    return null;
+  }
+}
+
+function processHasAncestorPid(targetPid: number, currentPid = process.pid): boolean {
+  if (!Number.isInteger(targetPid) || targetPid <= 1) return false;
+  let pid = Number.isInteger(currentPid) && currentPid > 1 ? currentPid : process.pid;
+  for (let depth = 0; depth < 64 && pid > 1; depth += 1) {
+    if (pid === targetPid) return true;
+    const parent = readParentPid(pid);
+    if (!parent || parent === pid) break;
+    pid = parent;
+  }
+  return false;
+}
+
+export async function resolveManagedSessionContext(cwd: string, payload: any, { allowTeamWorker = true } = {}): Promise<any> {
+  if (allowTeamWorker && safeString(process.env.OMX_TEAM_WORKER || '').trim() !== '') {
+    return {
+      managed: true,
+      reason: 'team_worker',
+      invocationSessionId: '',
+      sessionState: null,
+      expectedTmuxSessionName: '',
+      currentTmuxSessionName: '',
+    };
+  }
+
+  const invocationSessionId = resolveInvocationSessionId(payload);
+  if (!invocationSessionId) {
+    return {
+      managed: false,
+      reason: 'missing_session_id',
+      invocationSessionId: '',
+      sessionState: null,
+      expectedTmuxSessionName: '',
+      currentTmuxSessionName: '',
+    };
+  }
+
+  try {
+    const sessionState = await readSessionState(cwd);
+    if (!sessionState) {
+      return { managed: false, reason: 'missing_session_state', invocationSessionId, sessionState: null, expectedTmuxSessionName: '', currentTmuxSessionName: '' };
+    }
+    if (resolvePath(safeString(sessionState.cwd || cwd)) !== resolvePath(cwd)) {
+      return { managed: false, reason: 'cwd_mismatch', invocationSessionId, sessionState, expectedTmuxSessionName: '', currentTmuxSessionName: '' };
+    }
+    if (safeString(sessionState.session_id).trim() !== invocationSessionId) {
+      return { managed: false, reason: 'session_id_mismatch', invocationSessionId, sessionState, expectedTmuxSessionName: '', currentTmuxSessionName: '' };
+    }
+    if (isSessionStale(sessionState)) {
+      return { managed: false, reason: 'stale_session', invocationSessionId, sessionState, expectedTmuxSessionName: '', currentTmuxSessionName: '' };
+    }
+
+    const expectedTmuxSessionName = buildExpectedManagedTmuxSessionName(cwd, invocationSessionId);
+    const currentTmuxSessionName = readCurrentTmuxSessionName();
+    if (currentTmuxSessionName && currentTmuxSessionName === expectedTmuxSessionName) {
+      return {
+        managed: true,
+        reason: 'tmux_session_match',
+        invocationSessionId,
+        sessionState,
+        expectedTmuxSessionName,
+        currentTmuxSessionName,
+      };
+    }
+
+    if (processHasAncestorPid(sessionState.pid)) {
+      return {
+        managed: true,
+        reason: currentTmuxSessionName ? 'pid_ancestry_match_tmux_mismatch' : 'pid_ancestry_match',
+        invocationSessionId,
+        sessionState,
+        expectedTmuxSessionName,
+        currentTmuxSessionName: '',
+      };
+    }
+
+    return {
+      managed: false,
+      reason: currentTmuxSessionName ? 'tmux_session_mismatch' : 'pid_ancestry_mismatch',
+      invocationSessionId,
+      sessionState,
+      expectedTmuxSessionName,
+      currentTmuxSessionName,
+    };
+  } catch {
+    return {
+      managed: false,
+      reason: 'session_check_failed',
+      invocationSessionId,
+      sessionState: null,
+      expectedTmuxSessionName: '',
+      currentTmuxSessionName: '',
+    };
+  }
+}
+
+export async function isManagedOmxSession(cwd: string, payload: any, options: { allowTeamWorker?: boolean } = {}): Promise<boolean> {
+  const context = await resolveManagedSessionContext(cwd, payload, options);
+  return context.managed === true;
+}
+
+export async function verifyManagedPaneTarget(paneId: string, cwd: string, payload: any, { allowTeamWorker = true } = {}): Promise<any> {
+  const paneTarget = safeString(paneId).trim();
+  if (!paneTarget) {
+    return { ok: false, reason: 'missing_pane_target', paneTarget: '' };
+  }
+
+  const managedContext = await resolveManagedSessionContext(cwd, payload, { allowTeamWorker });
+  if (!managedContext.managed) {
+    return { ok: false, reason: managedContext.reason || 'unmanaged_session', paneTarget, managedContext };
+  }
+
+  if (managedContext.reason === 'team_worker') {
+    return { ok: true, reason: 'ok', paneTarget, managedContext };
+  }
+
+  const expectedSession = safeString(managedContext.expectedTmuxSessionName).trim();
+  if (!expectedSession) {
+    return { ok: false, reason: 'missing_expected_tmux_session', paneTarget, managedContext };
+  }
+
+  try {
+    const sessionResult = await runProcess('tmux', ['display-message', '-p', '-t', paneTarget, '#S'], 2000);
+    const paneSessionName = safeString(sessionResult.stdout).trim();
+    if (!paneSessionName) {
+      return { ok: false, reason: 'pane_session_missing', paneTarget, managedContext };
+    }
+    if (paneSessionName !== expectedSession) {
+      return { ok: false, reason: 'pane_not_managed_session', paneTarget, paneSessionName, managedContext };
+    }
+    return { ok: true, reason: 'ok', paneTarget, paneSessionName, managedContext };
+  } catch {
+    return { ok: false, reason: 'pane_session_lookup_failed', paneTarget, managedContext };
+  }
+}
+
+
+async function readManagedPaneCommandState(paneTarget: string): Promise<{ currentCommand: string; startCommand: string }> {
+  try {
+    const [currentResult, startResult] = await Promise.all([
+      runProcess('tmux', ['display-message', '-p', '-t', paneTarget, '#{pane_current_command}'], 2000),
+      runProcess('tmux', ['display-message', '-p', '-t', paneTarget, '#{pane_start_command}'], 2000),
+    ]);
+    return {
+      currentCommand: safeString(currentResult.stdout).trim().toLowerCase(),
+      startCommand: safeString(startResult.stdout).trim().toLowerCase(),
+    };
+  } catch {
+    return { currentCommand: '', startCommand: '' };
+  }
+}
+
+function paneLooksLikeManagedAgent({ currentCommand, startCommand }: { currentCommand: string; startCommand: string }): boolean {
+  if (/\bomx\b.*\bhud\b.*--watch/i.test(startCommand)) return false;
+  if (startCommand.includes('codex')) return true;
+  return currentCommand === 'codex' || currentCommand === 'node' || currentCommand === 'npx';
+}
+export async function resolveManagedCurrentPane(cwd: string, payload: any, { allowTeamWorker = false } = {}): Promise<string> {
+  const paneTarget = safeString(process.env.TMUX_PANE || '').trim();
+  if (!paneTarget) return '';
+  const verdict = await verifyManagedPaneTarget(paneTarget, cwd, payload, { allowTeamWorker });
+  if (!verdict.ok) return '';
+  const commandState = await readManagedPaneCommandState(paneTarget);
+  return paneLooksLikeManagedAgent(commandState) ? paneTarget : '';
+}
+
+export async function resolveManagedSessionPane(cwd: string, payload: any): Promise<string> {
+  const managedContext = await resolveManagedSessionContext(cwd, payload, { allowTeamWorker: false });
+  if (!managedContext.managed) return '';
+  const expectedSession = safeString(managedContext.expectedTmuxSessionName).trim();
+  if (!expectedSession) return '';
+
+  try {
+    const panesResult = await runProcess(
+      'tmux',
+      ['list-panes', '-s', '-t', expectedSession, '-F', '#{pane_id}\t#{pane_current_command}\t#{pane_start_command}'],
+      2000,
+    );
+    const panes = safeString(panesResult.stdout)
+      .trim()
+      .split('\n')
+      .filter(Boolean);
+    for (const line of panes) {
+      const [candidatePaneId, rawCurrentCommand = '', rawStartCommand = ''] = line.split('\t');
+      const startCommand = safeString(rawStartCommand).toLowerCase();
+      const currentCommand = safeString(rawCurrentCommand).trim().toLowerCase();
+      if (!candidatePaneId) continue;
+      if (/\bomx\b.*\bhud\b.*--watch/i.test(startCommand)) continue;
+      if (startCommand.includes('codex')) return candidatePaneId;
+      if (currentCommand === 'codex') return candidatePaneId;
+    }
+  } catch {
+    // best effort only
+  }
+
+  return '';
+}
+
+export async function resolveManagedPaneFromAnchor(anchorPane: string, cwd: string, payload: any, { allowTeamWorker = false } = {}): Promise<string> {
+  const paneTarget = safeString(anchorPane).trim();
+  if (!paneTarget) return '';
+  const verdict = await verifyManagedPaneTarget(paneTarget, cwd, payload, { allowTeamWorker });
+  if (!verdict.ok) return '';
+
+  try {
+    const sessionResult = await runProcess('tmux', ['display-message', '-p', '-t', paneTarget, '#S'], 2000);
+    const sessionName = safeString(sessionResult.stdout).trim();
+    if (!sessionName) return paneTarget;
+
+    const panesResult = await runProcess(
+      'tmux',
+      ['list-panes', '-s', '-t', sessionName, '-F', '#{pane_id}\t#{pane_current_command}\t#{pane_start_command}'],
+      2000,
+    );
+    const panes = safeString(panesResult.stdout).trim().split('\n').filter(Boolean);
+    for (const line of panes) {
+      const [candidatePaneId, rawCurrentCommand = '', rawStartCommand = ''] = line.split('\t');
+      const startCommand = safeString(rawStartCommand).toLowerCase();
+      const currentCommand = safeString(rawCurrentCommand).trim().toLowerCase();
+      if (!candidatePaneId) continue;
+      if (/\bomx\b.*\bhud\b.*--watch/i.test(startCommand)) continue;
+      if (startCommand.includes('codex')) return candidatePaneId;
+      if (currentCommand === 'codex') return candidatePaneId;
+    }
+  } catch {
+    // best effort only
+  }
+
+  return paneTarget;
+}

package/src/scripts/notify-hook/operational-events.ts

@@ -39,6 +39,7 @@ function gitValue(cwd: any, args: string[]): string {
       encoding: 'utf-8',
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: 2000,
+      windowsHide: true,
     }).trim();
   } catch {
     return '';
@@ -83,6 +84,7 @@ export function resolveOperationalSessionName(cwd: any, sessionId = '', sessionN
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'ignore'],
         timeout: 2000,
+        windowsHide: true,
       }).trim();
       if (tmuxSession) return tmuxSession;
     } catch {