oh-my-codex 0.17.3 → 0.18.1

package/dist/cli/index.js

@@ -7,6 +7,7 @@ import { basename, dirname, join, posix, win32 } from "path";
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
 import { copyFile, cp, lstat, mkdir, readFile, readdir, rm, symlink, writeFile } from "fs/promises";
 import { constants as osConstants, homedir } from "os";
+import { createHash } from "crypto";
 import { setup, SETUP_MCP_MODES, SETUP_SCOPES, } from "./setup.js";
 import { uninstall } from "./uninstall.js";
 import { version } from "./version.js";
@@ -24,6 +25,7 @@ import { stateCommand } from "./state.js";
 import { cleanupCommand, cleanupOmxMcpProcesses, findLaunchSafeCleanupCandidates, } from "./cleanup.js";
 import { exploreCommand } from "./explore.js";
 import { sparkshellCommand } from "./sparkshell.js";
+import { apiCommand } from "./api.js";
 import { agentsInitCommand } from "./agents-init.js";
 import { agentsCommand } from "./agents.js";
 import { sessionCommand } from "./session-search.js";
@@ -51,7 +53,7 @@ import { cleanCodexModelAvailabilityNuxIfNeeded, extractSharedMcpRegistryServers
 import { OMX_FIRST_PARTY_MCP_SERVER_NAMES } from "../config/omx-first-party-mcp.js";
 import { HUD_TMUX_HEIGHT_LINES } from "../hud/constants.js";
 import { OMX_TMUX_HUD_OWNER_ENV } from "../hud/reconcile.js";
-import { createHudWatchPane as createSharedHudWatchPane, killTmuxPane as killSharedTmuxPane, listCurrentWindowHudPaneIds, parsePaneIdFromTmuxOutput, } from "../hud/tmux.js";
+import { createHudWatchPane as createSharedHudWatchPane, killTmuxPane as killSharedTmuxPane, listCurrentWindowHudPaneIds, parsePaneIdFromTmuxOutput, registerHudResizeHook, } from "../hud/tmux.js";
 export { parseTmuxPaneSnapshot, isHudWatchPane, findHudWatchPaneIds } from "../hud/tmux.js";
 rememberOmxLaunchContext();
 import { classifySpawnError, resolveTmuxBinaryForPlatform, spawnPlatformCommandSync, } from "../utils/platform-command.js";
@@ -98,6 +100,7 @@ Usage:
   omx adapt     Scaffold OMX-owned adapter foundations for persistent external targets
   omx resume    Resume a previous interactive Codex session
   omx explore   Default read-only exploration entrypoint (may adaptively use sparkshell backend)
+  omx api       Run native omx-api localhost gateway commands (serve|status|stop|generate)
   omx session   Search prior local session transcripts and history artifacts
   omx agents-init [path]
                 Bootstrap lightweight AGENTS.md files for a repo/subtree
@@ -250,6 +253,7 @@ const NESTED_HELP_COMMANDS = new Set([
     "performance-goal",
     "resume",
     "session",
+    "api",
     "sparkshell",
     "team",
     "tmux-hook",
@@ -475,6 +479,27 @@ async function linkOrCopyCodexHomeEntry(source, destination) {
 function isCodexSqliteArtifact(entryName) {
     return /^(?:state|logs)_\d+\.sqlite(?:-(?:shm|wal))?$/.test(entryName);
 }
+const PROJECT_LAUNCH_PERSISTED_RUNTIME_ENTRY_NAMES = new Set([
+    // Codex CLI writes browser/OTP login state here when CODEX_HOME points at
+    // the per-session mirror. Persist only the opaque file itself; never parse or
+    // log the contents.
+    "auth.json",
+]);
+function shouldPersistProjectLaunchRuntimeEntry(entryName) {
+    return PROJECT_LAUNCH_PERSISTED_RUNTIME_ENTRY_NAMES.has(entryName);
+}
+export async function persistProjectLaunchRuntimeAuthState(runtimeCodexHome, projectCodexHome) {
+    if (!runtimeCodexHome || !projectCodexHome)
+        return;
+    if (!existsSync(runtimeCodexHome))
+        return;
+    await mkdir(projectCodexHome, { recursive: true });
+    for (const entry of await readdir(runtimeCodexHome, { withFileTypes: true })) {
+        if (!shouldPersistProjectLaunchRuntimeEntry(entry.name) || !entry.isFile())
+            continue;
+        await copyFile(join(runtimeCodexHome, entry.name), join(projectCodexHome, entry.name));
+    }
+}
 /**
  * Project-scope setup keeps durable Codex config under <repo>/.codex, but the
  * Codex TUI also stores model-availability NUX counters in CODEX_HOME/config.toml.
@@ -530,9 +555,10 @@ export async function prepareCodexHomeForLaunch(cwd, sessionId, env = process.en
         projectLocalCodexHomeForCleanup,
     };
 }
-async function cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup) {
+async function cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence) {
     if (!runtimeCodexHomeForCleanup)
         return;
+    await persistProjectLaunchRuntimeAuthState(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence);
     await rm(runtimeCodexHomeForCleanup, { recursive: true, force: true });
 }
 function execTmuxFileSync(args, options) {
@@ -797,22 +823,192 @@ export function shouldAutoIsolateMadmaxLaunch(command, launchArgs, env = process
 function sanitizeRunIdSegment(value) {
     return value.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
+const MADMAX_DETACHED_ACTIVE_DIR = "active-detached";
+const MADMAX_DETACHED_LOCK_STALE_MS = 30_000;
+const MADMAX_DETACHED_LOCK_RETRY_MS = 50;
+const MADMAX_DETACHED_LOCK_MAX_ATTEMPTS = 100;
+const OMX_MADMAX_DETACHED_CONTEXT_ENV = "OMX_MADMAX_DETACHED_CONTEXT";
+function resolveMadmaxRunsRoot(env = process.env) {
+    return env.OMX_RUNS_DIR || join(homedir(), ".omx-runs");
+}
+function canonicalizeLaunchCwd(cwd) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim() || cwd;
+    }
+    catch {
+        return cwd;
+    }
+}
+function normalizeMadmaxDetachedLaunchArgv(argv) {
+    const passthrough = [];
+    const semanticFlags = new Set();
+    let reasoningFlag = null;
+    let afterEndOfOptions = false;
+    for (const arg of argv) {
+        if (afterEndOfOptions) {
+            passthrough.push(arg);
+            continue;
+        }
+        if (arg === "--") {
+            afterEndOfOptions = true;
+            passthrough.push(arg);
+            continue;
+        }
+        if (arg === "--tmux" || arg === "--direct") {
+            continue;
+        }
+        if (arg === MADMAX_FLAG ||
+            arg === MADMAX_SPARK_FLAG) {
+            semanticFlags.add(arg);
+            continue;
+        }
+        if (arg === HIGH_REASONING_FLAG || arg === XHIGH_REASONING_FLAG) {
+            reasoningFlag = arg;
+            continue;
+        }
+        passthrough.push(arg);
+    }
+    return [
+        ...Array.from(semanticFlags).sort(),
+        ...(reasoningFlag ? [reasoningFlag] : []),
+        ...passthrough,
+    ];
+}
+export function buildMadmaxDetachedLaunchContextKey(sourceCwd, argv) {
+    const payload = JSON.stringify({
+        source_cwd: canonicalizeLaunchCwd(sourceCwd),
+        argv: normalizeMadmaxDetachedLaunchArgv(argv),
+    });
+    return createHash("sha256").update(payload).digest("hex").slice(0, 32);
+}
+function madmaxDetachedActiveRecordPath(runsRoot, contextKey) {
+    return join(runsRoot, MADMAX_DETACHED_ACTIVE_DIR, `${contextKey}.json`);
+}
+function readMadmaxDetachedActiveRecord(recordPath) {
+    if (!existsSync(recordPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(recordPath, "utf-8"));
+        if (parsed.version !== 1 ||
+            typeof parsed.context_key !== "string" ||
+            typeof parsed.source_cwd !== "string" ||
+            typeof parsed.run_dir !== "string" ||
+            typeof parsed.tmux_session_name !== "string" ||
+            !Array.isArray(parsed.argv) ||
+            !parsed.argv.every((arg) => typeof arg === "string")) {
+            return null;
+        }
+        return {
+            version: 1,
+            context_key: parsed.context_key,
+            created_at: typeof parsed.created_at === "string" ? parsed.created_at : "",
+            source_cwd: parsed.source_cwd,
+            argv: [...parsed.argv],
+            run_dir: parsed.run_dir,
+            tmux_session_name: parsed.tmux_session_name,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function detachedTmuxSessionExists(sessionName) {
+    try {
+        execTmuxFileSync(["has-session", "-t", sessionName], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function withMadmaxDetachedContextLock(runsRoot, contextKey, run) {
+    const lockPath = join(runsRoot, MADMAX_DETACHED_ACTIVE_DIR, `${contextKey}.lock`);
+    mkdirSync(dirname(lockPath), { recursive: true });
+    for (let attempt = 0; attempt < MADMAX_DETACHED_LOCK_MAX_ATTEMPTS; attempt++) {
+        try {
+            mkdirSync(lockPath);
+            try {
+                writeFileSync(join(lockPath, "pid"), String(process.pid));
+                return run();
+            }
+            finally {
+                rmSync(lockPath, { recursive: true, force: true });
+            }
+        }
+        catch (err) {
+            const code = err && typeof err === "object" && "code" in err
+                ? String(err.code)
+                : "";
+            if (code !== "EEXIST")
+                throw err;
+            const lockStat = statSync(lockPath, { throwIfNoEntry: false });
+            if (lockStat && Date.now() - lockStat.mtimeMs > MADMAX_DETACHED_LOCK_STALE_MS) {
+                let holderAlive = false;
+                try {
+                    const holderPid = Number.parseInt(readFileSync(join(lockPath, "pid"), "utf-8").trim(), 10);
+                    if (Number.isSafeInteger(holderPid) && holderPid > 0) {
+                        process.kill(holderPid, 0);
+                        holderAlive = true;
+                    }
+                }
+                catch {
+                    holderAlive = false;
+                }
+                if (!holderAlive) {
+                    rmSync(lockPath, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            blockMs(MADMAX_DETACHED_LOCK_RETRY_MS);
+        }
+    }
+    throw new MadmaxDetachedGuardError(`timed out waiting for madmax detached launch context lock: ${lockPath}`);
+}
+function isMadmaxDetachedGuardEnabled(env) {
+    return env.OMXBOX_ACTIVE === "1" && typeof env[OMX_MADMAX_DETACHED_CONTEXT_ENV] === "string";
+}
+function cleanupCurrentMadmaxReuseRunRoot(env, runsRoot) {
+    const runRoot = env.OMX_ROOT;
+    if (!runRoot || !env.OMXBOX_ACTIVE)
+        return;
+    const normalizedRunsRoot = runsRoot.endsWith("/") ? runsRoot : `${runsRoot}/`;
+    if (runRoot !== runsRoot && !runRoot.startsWith(normalizedRunsRoot))
+        return;
+    rmSync(runRoot, { recursive: true, force: true });
+}
+function writeMadmaxDetachedActiveRecord(recordPath, record) {
+    mkdirSync(dirname(recordPath), { recursive: true });
+    writeFileSync(recordPath, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+}
+class MadmaxDetachedReuseError extends Error {
+    failClosed = true;
+}
+class MadmaxDetachedGuardError extends Error {
+    failClosed = true;
+}
 export function createMadmaxIsolatedRoot(sourceCwd, argv, env = process.env) {
-    const runsRoot = env.OMX_RUNS_DIR || join(homedir(), ".omx-runs");
+    const runsRoot = resolveMadmaxRunsRoot(env);
     mkdirSync(runsRoot, { recursive: true });
     const stamp = new Date().toISOString().replace(/[-:TZ.]/g, "").slice(0, 14);
     const suffix = Math.random().toString(16).slice(2, 6);
     const runDir = join(runsRoot, sanitizeRunIdSegment(`run-${stamp}-${suffix}`));
     mkdirSync(runDir, { recursive: false });
+    const detachedLaunchContext = buildMadmaxDetachedLaunchContextKey(sourceCwd, argv);
     const metadata = {
         launcher: "omx --madmax",
         created_at: new Date().toISOString(),
         cwd: runDir,
         source_cwd: sourceCwd,
         argv,
+        detached_launch_context: detachedLaunchContext,
     };
     writeFileSync(join(runDir, ".omxbox-run.json"), `${JSON.stringify(metadata, null, 2)}\n`);
     writeFileSync(join(runsRoot, "registry.jsonl"), `${JSON.stringify(metadata)}\n`, { flag: "a" });
+    env[OMX_MADMAX_DETACHED_CONTEXT_ENV] = detachedLaunchContext;
     return runDir;
 }
 function activateMadmaxIsolationIfNeeded(command, launchArgs, cwd, env = process.env) {
@@ -843,6 +1039,7 @@ export async function main(args) {
         "autoresearch",
         "autoresearch-goal",
         "explore",
+        "api",
         "sparkshell",
         "team",
         "ralph",
@@ -947,6 +1144,9 @@ export async function main(args) {
             case "explore":
                 await exploreCommand(args.slice(1));
                 break;
+            case "api":
+                await apiCommand(args.slice(1));
+                break;
             case "exec":
                 if (launchArgs[0] === "inject") {
                     await execInjectCommand(launchArgs);
@@ -1021,6 +1221,11 @@ export async function main(args) {
             case "reasoning":
                 await reasoningCommand(args.slice(1));
                 break;
+            case "codex-native-hook": {
+                const { runCodexNativeHookCli } = await import("../scripts/codex-native-hook.js");
+                await runCodexNativeHookCli();
+                break;
+            }
             case "help":
             case "--help":
             case "-h":
@@ -1220,7 +1425,7 @@ export async function launchWithHud(args) {
         // ── Phase 3: postLaunch ─────────────────────────────────────────────
         if (!postLaunchHandledExternally) {
             await postLaunch(cwd, sessionId, codexHomeOverride, enableNotifyFallbackAuthority, projectLocalCodexHomeForCleanup);
-            await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup).catch(logCliOperationFailure);
+            await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup).catch(logCliOperationFailure);
         }
     }
 }
@@ -1312,7 +1517,7 @@ export async function execWithOverlay(args) {
     }
     finally {
         await postLaunch(cwd, sessionId, codexHomeOverride, true, projectLocalCodexHomeForCleanup);
-        await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup).catch(logCliOperationFailure);
+        await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup).catch(logCliOperationFailure);
     }
 }
 export function normalizeCodexLaunchArgs(args) {
@@ -1833,10 +2038,16 @@ function withTmuxExtendedKeysLeaseLock(cwd, socketPath, run) {
     }
     throw new Error(`timed out waiting for tmux extended-keys lease lock: ${lockPath}`);
 }
-function buildDetachedSessionLeaderCommand(cwd, sessionName, codexCmd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup) {
+function buildDetachedSessionLeaderCommand(cwd, sessionName, codexCmd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, parentEnvFilePath) {
     const detachedPostLaunchHelper = sessionId
         ? `${buildDetachedSessionPostLaunchHelperCommand(cwd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup)} >/dev/null 2>&1 || true;`
         : "";
+    const parentEnvSource = parentEnvFilePath && parentEnvFilePath.trim()
+        ? `if [ -r ${quoteShellArg(parentEnvFilePath)} ]; then . ${quoteShellArg(parentEnvFilePath)}; rm -f ${quoteShellArg(parentEnvFilePath)}; fi;`
+        : "";
+    const parentEnvCleanup = parentEnvFilePath && parentEnvFilePath.trim()
+        ? `rm -f ${quoteShellArg(parentEnvFilePath)} 2>/dev/null || true;`
+        : "";
     const wrapped = [
         buildTmuxExtendedKeysAcquireShellSnippet(cwd),
         'exec 3<&0;',
@@ -1850,6 +2061,7 @@ function buildDetachedSessionLeaderCommand(cwd, sessionName, codexCmd, sessionId
         "fi;",
         'exec 3<&- 2>/dev/null || true;',
         buildTmuxExtendedKeysReleaseShellSnippet(cwd),
+        parentEnvCleanup,
         detachedPostLaunchHelper,
         'if [ "$status" -eq 0 ]; then',
         `tmux kill-session -t "${escapeShellDoubleQuotedValue(sessionName)}" >/dev/null 2>&1 || true;`,
@@ -1857,6 +2069,7 @@ function buildDetachedSessionLeaderCommand(cwd, sessionName, codexCmd, sessionId
         "exit $status;",
         "};",
         "trap omx_detached_session_cleanup 0 INT TERM HUP;",
+        parentEnvSource,
         "omx_codex_started_at=$(date +%s 2>/dev/null || printf 0);",
         `${codexCmd} <&3 &`,
         "omx_codex_pid=$!;",
@@ -1997,6 +2210,34 @@ function buildTmuxExtendedKeysAcquireShellSnippet(cwd) {
 function buildTmuxExtendedKeysReleaseShellSnippet(cwd) {
     return `if [ -n "\${OMX_TMUX_EXTENDED_KEYS_LEASE:-}" ]; then ${buildTmuxExtendedKeysHelperCommand(cwd, "release")} "\${OMX_TMUX_EXTENDED_KEYS_LEASE}" >/dev/null 2>&1 || true; fi;`;
 }
+const SHELL_ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function serializeDetachedSessionParentEnv(env) {
+    const lines = [];
+    for (const key of Object.keys(env).sort()) {
+        if (!SHELL_ENV_NAME_PATTERN.test(key))
+            continue;
+        const value = env[key];
+        if (typeof value !== "string")
+            continue;
+        if (value.includes("\0"))
+            continue;
+        lines.push(`export ${key}=${quoteShellArg(value)}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function detachedSessionParentEnvFilePath(cwd, sessionId) {
+    const safeSessionId = sessionId.replace(/[^A-Za-z0-9_.-]/g, "_");
+    return join(omxRoot(cwd), "runtime", "tmux-env", `${safeSessionId}.env`);
+}
+export function writeDetachedSessionParentEnvFile(cwd, sessionId, env) {
+    const filePath = detachedSessionParentEnvFilePath(cwd, sessionId);
+    mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+    writeFileSync(filePath, serializeDetachedSessionParentEnv(env), {
+        encoding: "utf-8",
+        mode: 0o600,
+    });
+    return filePath;
+}
 export function withTmuxExtendedKeys(cwd, run, execFileSyncImpl = (file, tmuxArgs) => execFileSync(file, tmuxArgs, {
     encoding: "utf-8",
     ...(process.platform === "win32" ? { windowsHide: true } : {}),
@@ -2010,10 +2251,10 @@ export function withTmuxExtendedKeys(cwd, run, execFileSyncImpl = (file, tmuxArg
             releaseTmuxExtendedKeysLease(cwd, leaseHandle, execFileSyncImpl);
     }
 }
-export function buildDetachedSessionBootstrapSteps(sessionName, cwd, codexCmd, hudCmd, workerLaunchArgs, codexHomeOverride, notifyTempContractRaw, nativeWindows = false, sessionId, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, omxRootOverride, env = process.env, sqliteHomeOverride) {
+export function buildDetachedSessionBootstrapSteps(sessionName, cwd, codexCmd, hudCmd, workerLaunchArgs, codexHomeOverride, notifyTempContractRaw, nativeWindows = false, sessionId, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, omxRootOverride, env = process.env, sqliteHomeOverride, parentEnvFilePath) {
     const detachedLeaderCmd = nativeWindows
         ? "powershell.exe"
-        : buildDetachedSessionLeaderCommand(cwd, sessionName, codexCmd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup);
+        : buildDetachedSessionLeaderCommand(cwd, sessionName, codexCmd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, parentEnvFilePath);
     const newSessionArgs = [
         "new-session",
         "-d",
@@ -2249,6 +2490,26 @@ async function readPostLaunchModeStateFile(path, dependencies = {}) {
 function cleanPostLaunchString(value) {
     return typeof value === "string" ? value.trim() : "";
 }
+function isAutopilotReviewPendingPostLaunchState(state) {
+    if (!state || state.active !== true)
+        return false;
+    const mode = cleanPostLaunchString(state.mode).toLowerCase();
+    if (mode && mode !== "autopilot")
+        return false;
+    const phase = cleanPostLaunchString(state.current_phase ?? state.currentPhase)
+        .toLowerCase()
+        .replace(/_/g, "-");
+    if (phase === "code-review" || phase === "review" || phase === "reviewing" || phase === "review-pending") {
+        return true;
+    }
+    const nestedState = state.state && typeof state.state === "object"
+        ? state.state
+        : {};
+    return state.review_pending === true
+        || state.reviewPending === true
+        || nestedState.review_pending === true
+        || nestedState.reviewPending === true;
+}
 function postLaunchUniqueStrings(values) {
     return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
 }
@@ -2336,8 +2597,16 @@ export async function cleanupPostLaunchModeStateFiles(cwd, sessionId, dependenci
     const rootSkillActiveStateBeforeCleanup = sessionId
         ? await readSkillActiveState(getSkillActiveStatePathsForStateDir(rootStateDir).rootPath)
         : null;
+    let preserveSkillActiveForReviewPendingAutopilot = false;
     for (const stateDir of scopedDirs) {
         const files = await readdir(stateDir).catch(() => []);
+        const autopilotPath = join(stateDir, "autopilot-state.json");
+        const autopilotPrecheck = files.includes("autopilot-state.json")
+            ? await readPostLaunchModeStateFile(autopilotPath, dependencies)
+            : null;
+        const preserveReviewPendingAutopilot = autopilotPrecheck?.kind === "ok"
+            && isAutopilotReviewPendingPostLaunchState(autopilotPrecheck.state);
+        preserveSkillActiveForReviewPendingAutopilot ||= preserveReviewPendingAutopilot;
         for (const file of files) {
             if (!file.endsWith("-state.json") || file === "session.json")
                 continue;
@@ -2395,6 +2664,10 @@ export async function cleanupPostLaunchModeStateFiles(cwd, sessionId, dependenci
                 }
                 continue;
             }
+            if (preserveReviewPendingAutopilot
+                && (mode === "autopilot" || mode === SKILL_ACTIVE_STATE_MODE)) {
+                continue;
+            }
             try {
                 const completedAt = now().toISOString();
                 if (mode === SKILL_ACTIVE_STATE_MODE) {
@@ -2433,7 +2706,9 @@ export async function cleanupPostLaunchModeStateFiles(cwd, sessionId, dependenci
     }
     if (sessionId) {
         try {
-            await scrubPostLaunchRootSkillActiveForSession(rootStateDir, sessionId, now().toISOString(), writeFile, rootSkillActiveStateBeforeCleanup);
+            if (!preserveSkillActiveForReviewPendingAutopilot) {
+                await scrubPostLaunchRootSkillActiveForSession(rootStateDir, sessionId, now().toISOString(), writeFile, rootSkillActiveStateBeforeCleanup);
+            }
         }
         catch (err) {
             writeWarn(`[omx] postLaunch: failed to reconcile root skill-active state: ${err instanceof Error ? err.message : err}`);
@@ -2610,6 +2885,9 @@ function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverride, s
         let hudPaneId = null;
         try {
             hudPaneId = createHudWatchPane(cwd, hudCmd);
+            if (hudPaneId && currentPaneId) {
+                registerHudResizeHook(hudPaneId, currentPaneId, HUD_TMUX_HEIGHT_LINES);
+            }
         }
         catch (err) {
             logCliOperationFailure(err);
@@ -2670,96 +2948,166 @@ function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverride, s
             ? buildWindowsPromptCommand("codex", launchArgs)
             : null;
         const sessionName = buildDetachedTmuxSessionName(cwd, sessionId);
-        void writeSessionStart(cwd, sessionId, { tmuxSessionName: sessionName }).catch((err) => {
-            logCliOperationFailure(err);
-            // Non-fatal: managed tmux recovery can still use compatibility fallback.
-        });
-        let createdDetachedSession = false;
-        let registeredHookTarget = null;
-        let registeredHookName = null;
-        let registeredClientAttachedHookName = null;
-        try {
-            const bootstrapSteps = buildDetachedSessionBootstrapSteps(sessionName, cwd, codexCmd, hudCmd, workerLaunchArgs, codexHomeOverride, notifyTempContractRaw, nativeWindows, sessionId, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, omxRootOverride, process.env, sqliteHomeOverride);
-            for (const step of bootstrapSteps) {
-                const output = execTmuxFileSync(step.args, {
-                    stdio: "pipe",
-                    encoding: "utf-8",
-                });
-                if (step.name === "new-session") {
-                    createdDetachedSession = true;
-                    parsePaneIdFromTmuxOutput(output || "");
+        const launchDetachedSession = () => {
+            const contextKey = process.env[OMX_MADMAX_DETACHED_CONTEXT_ENV]?.trim();
+            const runsRoot = resolveMadmaxRunsRoot(process.env);
+            const activeRecordPath = contextKey
+                ? madmaxDetachedActiveRecordPath(runsRoot, contextKey)
+                : null;
+            const activeRecord = activeRecordPath
+                ? readMadmaxDetachedActiveRecord(activeRecordPath)
+                : null;
+            if (activeRecord &&
+                activeRecord.context_key === contextKey &&
+                detachedTmuxSessionExists(activeRecord.tmux_session_name)) {
+                cleanupCurrentMadmaxReuseRunRoot(process.env, runsRoot);
+                process.stderr.write(`[omx] madmax detached launch already active for this context; attaching ${activeRecord.tmux_session_name} instead of starting a duplicate.\n`);
+                try {
+                    execTmuxFileSync(["attach-session", "-t", activeRecord.tmux_session_name], {
+                        stdio: "inherit",
+                    });
                 }
-                if (step.name === "split-and-capture-hud-pane") {
-                    const hudPaneId = parsePaneIdFromTmuxOutput(output || "");
-                    const hookWindowIndex = hudPaneId
-                        ? detectDetachedSessionWindowIndex(sessionName)
-                        : null;
-                    const hookTarget = hudPaneId && hookWindowIndex
-                        ? buildResizeHookTarget(sessionName, hookWindowIndex)
-                        : null;
-                    const hookName = hudPaneId && hookWindowIndex
-                        ? buildResizeHookName("launch", sessionName, hookWindowIndex, hudPaneId)
-                        : null;
-                    const clientAttachedHookName = hudPaneId && hookWindowIndex
-                        ? buildClientAttachedReconcileHookName("launch", sessionName, hookWindowIndex, hudPaneId)
-                        : null;
-                    const finalizeSteps = buildDetachedSessionFinalizeSteps(sessionName, hudPaneId, hookWindowIndex, process.env.OMX_MOUSE !== "0", nativeWindows);
-                    if (nativeWindows && detachedWindowsCodexCmd) {
-                        scheduleDetachedWindowsCodexLaunch(sessionName, detachedWindowsCodexCmd);
+                catch (err) {
+                    logCliOperationFailure(err);
+                    throw new MadmaxDetachedReuseError(`refusing duplicate madmax detached launch: existing session ${activeRecord.tmux_session_name} is active but attach failed`);
+                }
+                return { postLaunchHandledExternally: true };
+            }
+            if (activeRecordPath && activeRecord) {
+                rmSync(activeRecordPath, { force: true });
+            }
+            void writeSessionStart(cwd, sessionId, { tmuxSessionName: sessionName }).catch((err) => {
+                logCliOperationFailure(err);
+                // Non-fatal: managed tmux recovery can still use compatibility fallback.
+            });
+            let createdDetachedSession = false;
+            let registeredHookTarget = null;
+            let registeredHookName = null;
+            let registeredClientAttachedHookName = null;
+            let detachedParentEnvFilePath;
+            try {
+                // This path is the user-shell interactive launch: OMX creates a tmux
+                // session and immediately attaches the user's terminal to it. If a tmux
+                // server already exists, `new-session -e` only forwards explicit values,
+                // so provider-specific parent-shell keys would disappear. Source a
+                // private env file inside the leader shell instead of putting every
+                // parent env value on the tmux command line or in logs.
+                if (!nativeWindows) {
+                    detachedParentEnvFilePath = writeDetachedSessionParentEnvFile(cwd, sessionId, codexEnvWithNotify);
+                }
+                const bootstrapSteps = buildDetachedSessionBootstrapSteps(sessionName, cwd, codexCmd, hudCmd, workerLaunchArgs, codexHomeOverride, notifyTempContractRaw, nativeWindows, sessionId, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, omxRootOverride, process.env, sqliteHomeOverride, detachedParentEnvFilePath);
+                for (const step of bootstrapSteps) {
+                    const output = execTmuxFileSync(step.args, {
+                        stdio: "pipe",
+                        encoding: "utf-8",
+                    });
+                    if (step.name === "new-session") {
+                        createdDetachedSession = true;
+                        if (activeRecordPath && contextKey) {
+                            writeMadmaxDetachedActiveRecord(activeRecordPath, {
+                                version: 1,
+                                context_key: contextKey,
+                                created_at: new Date().toISOString(),
+                                source_cwd: process.env.OMX_SOURCE_CWD || cwd,
+                                argv: args,
+                                run_dir: process.env.OMX_ROOT || cwd,
+                                tmux_session_name: sessionName,
+                            });
+                        }
+                        parsePaneIdFromTmuxOutput(output || "");
                     }
-                    for (const finalizeStep of finalizeSteps) {
-                        if (finalizeStep.name === "sanitize-copy-mode-style") {
+                    if (step.name === "split-and-capture-hud-pane") {
+                        const hudPaneId = parsePaneIdFromTmuxOutput(output || "");
+                        const hookWindowIndex = hudPaneId
+                            ? detectDetachedSessionWindowIndex(sessionName)
+                            : null;
+                        const hookTarget = hudPaneId && hookWindowIndex
+                            ? buildResizeHookTarget(sessionName, hookWindowIndex)
+                            : null;
+                        const hookName = hudPaneId && hookWindowIndex
+                            ? buildResizeHookName("launch", sessionName, hookWindowIndex, hudPaneId)
+                            : null;
+                        const clientAttachedHookName = hudPaneId && hookWindowIndex
+                            ? buildClientAttachedReconcileHookName("launch", sessionName, hookWindowIndex, hudPaneId)
+                            : null;
+                        const finalizeSteps = buildDetachedSessionFinalizeSteps(sessionName, hudPaneId, hookWindowIndex, process.env.OMX_MOUSE !== "0", nativeWindows);
+                        if (nativeWindows && detachedWindowsCodexCmd) {
+                            scheduleDetachedWindowsCodexLaunch(sessionName, detachedWindowsCodexCmd);
+                        }
+                        for (const finalizeStep of finalizeSteps) {
+                            if (finalizeStep.name === "sanitize-copy-mode-style") {
+                                try {
+                                    mitigateCopyModeUnderlineArtifacts(sessionName);
+                                }
+                                catch (err) {
+                                    logCliOperationFailure(err);
+                                }
+                                continue;
+                            }
+                            const stdio = finalizeStep.name === "attach-session" ? "inherit" : "ignore";
                             try {
-                                mitigateCopyModeUnderlineArtifacts(sessionName);
+                                const startedAtMs = Date.now();
+                                execTmuxFileSync(finalizeStep.args, { stdio });
+                                if (finalizeStep.name === "attach-session") {
+                                    assertDetachedAttachDidNotNoop(sessionName, Date.now() - startedAtMs, process.env);
+                                }
                             }
                             catch (err) {
                                 logCliOperationFailure(err);
+                                if (finalizeStep.name === "attach-session")
+                                    throw new Error("failed to attach detached tmux session");
+                                continue;
                             }
-                            continue;
-                        }
-                        const stdio = finalizeStep.name === "attach-session" ? "inherit" : "ignore";
-                        try {
-                            const startedAtMs = Date.now();
-                            execTmuxFileSync(finalizeStep.args, { stdio });
-                            if (finalizeStep.name === "attach-session") {
-                                assertDetachedAttachDidNotNoop(sessionName, Date.now() - startedAtMs, process.env);
+                            if (finalizeStep.name === "register-resize-hook" &&
+                                hookTarget &&
+                                hookName) {
+                                registeredHookTarget = hookTarget;
+                                registeredHookName = hookName;
+                            }
+                            if (finalizeStep.name === "register-client-attached-reconcile" &&
+                                clientAttachedHookName) {
+                                registeredClientAttachedHookName = clientAttachedHookName;
                             }
                         }
-                        catch (err) {
-                            logCliOperationFailure(err);
-                            if (finalizeStep.name === "attach-session")
-                                throw new Error("failed to attach detached tmux session");
-                            continue;
-                        }
-                        if (finalizeStep.name === "register-resize-hook" &&
-                            hookTarget &&
-                            hookName) {
-                            registeredHookTarget = hookTarget;
-                            registeredHookName = hookName;
+                    }
+                }
+                return { postLaunchHandledExternally: !nativeWindows };
+            }
+            catch (err) {
+                if (detachedParentEnvFilePath) {
+                    rmSync(detachedParentEnvFilePath, { force: true });
+                }
+                if (activeRecordPath) {
+                    rmSync(activeRecordPath, { force: true });
+                }
+                if (createdDetachedSession) {
+                    const rollbackSteps = buildDetachedSessionRollbackSteps(sessionName, registeredHookTarget, registeredHookName, registeredClientAttachedHookName);
+                    for (const rollbackStep of rollbackSteps) {
+                        try {
+                            execTmuxFileSync(rollbackStep.args, { stdio: "ignore" });
                         }
-                        if (finalizeStep.name === "register-client-attached-reconcile" &&
-                            clientAttachedHookName) {
-                            registeredClientAttachedHookName = clientAttachedHookName;
+                        catch (rollbackErr) {
+                            logCliOperationFailure(rollbackErr);
+                            // best-effort rollback only
                         }
                     }
                 }
+                throw err;
+            }
+        };
+        const contextKey = process.env[OMX_MADMAX_DETACHED_CONTEXT_ENV]?.trim();
+        const runsRoot = resolveMadmaxRunsRoot(process.env);
+        try {
+            if (isMadmaxDetachedGuardEnabled(process.env) && contextKey) {
+                return withMadmaxDetachedContextLock(runsRoot, contextKey, launchDetachedSession);
             }
-            return { postLaunchHandledExternally: !nativeWindows };
+            return launchDetachedSession();
         }
         catch (err) {
-            logCliOperationFailure(err);
-            if (createdDetachedSession) {
-                const rollbackSteps = buildDetachedSessionRollbackSteps(sessionName, registeredHookTarget, registeredHookName, registeredClientAttachedHookName);
-                for (const rollbackStep of rollbackSteps) {
-                    try {
-                        execTmuxFileSync(rollbackStep.args, { stdio: "ignore" });
-                    }
-                    catch (err) {
-                        logCliOperationFailure(err);
-                        // best-effort rollback only
-                    }
-                }
+            if (err instanceof MadmaxDetachedReuseError || err instanceof MadmaxDetachedGuardError) {
+                throw err;
             }
+            logCliOperationFailure(err);
             // tmux not available or failed, just run codex directly
             runCodexBlocking(cwd, launchArgs, codexEnvWithNotify);
             return { postLaunchHandledExternally: false };
@@ -3016,7 +3364,7 @@ async function postLaunch(cwd, sessionId, codexHomeOverride, enableNotifyFallbac
 }
 export async function runDetachedSessionPostLaunch(cwd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup) {
     await postLaunch(cwd, sessionId, codexHomeOverride, false, projectLocalCodexHomeForCleanup);
-    await cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup).catch(logCliOperationFailure);
+    await cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup).catch(logCliOperationFailure);
 }
 async function emitNativeHookEvent(cwd, event, opts = {}) {
     const payload = buildHookEvent(event, {
@@ -3117,6 +3465,22 @@ function parseWatcherPidFile(content) {
         return Number.isFinite(pid) && pid > 0 ? pid : null;
     }
 }
+const DEFAULT_NOTIFY_FALLBACK_REAP_GRACE_MS = 5000;
+function resolveNotifyFallbackReapGraceMs(env = process.env) {
+    const parsed = Number.parseInt(env.OMX_NOTIFY_FALLBACK_REAP_GRACE_MS || "", 10);
+    if (Number.isFinite(parsed) && parsed >= 0)
+        return parsed;
+    return DEFAULT_NOTIFY_FALLBACK_REAP_GRACE_MS;
+}
+function isWatcherRecordWithinReapGrace(record, nowMs = Date.now(), graceMs = resolveNotifyFallbackReapGraceMs()) {
+    if (graceMs <= 0 || !record.startedAt)
+        return false;
+    const startedMs = Date.parse(record.startedAt);
+    if (!Number.isFinite(startedMs))
+        return false;
+    const ageMs = nowMs - startedMs;
+    return ageMs >= 0 && ageMs < graceMs;
+}
 function parseWatcherPidRecord(content) {
     const trimmed = content.trim();
     if (!trimmed)
@@ -3159,7 +3523,7 @@ function isLikelyOmxWatcherProcess(pid, execFileSyncFn = execFileSync, platform
 export async function reapStaleNotifyFallbackWatcher(pidPath, deps = {}) {
     const exists = deps.exists ?? existsSync;
     if (!exists(pidPath))
-        return;
+        return "missing";
     const { readFile } = await import("fs/promises");
     const readFileImpl = deps.readFile ?? readFile;
     const tryKillPidImpl = deps.tryKillPid ?? tryKillPid;
@@ -3168,9 +3532,15 @@ export async function reapStaleNotifyFallbackWatcher(pidPath, deps = {}) {
     const isWatcherProcessImpl = deps.isWatcherProcess ?? isLikelyOmxWatcherProcess;
     try {
         const record = parseWatcherPidRecord(await readFileImpl(pidPath, "utf-8"));
-        if (record && isWatcherProcessImpl(record.pid)) {
-            tryKillPidImpl(record.pid, "SIGTERM");
+        if (!record)
+            return "invalid";
+        if (!isWatcherProcessImpl(record.pid))
+            return "identity_mismatch";
+        if (isWatcherRecordWithinReapGrace(record, deps.nowMs?.() ?? Date.now(), deps.reapGraceMs ?? resolveNotifyFallbackReapGraceMs())) {
+            return "recent_active";
         }
+        tryKillPidImpl(record.pid, "SIGTERM");
+        return "reaped";
     }
     catch (error) {
         if (!hasErrnoCodeImpl(error, "ESRCH")) {
@@ -3179,6 +3549,7 @@ export async function reapStaleNotifyFallbackWatcher(pidPath, deps = {}) {
                 error: error instanceof Error ? error.message : String(error),
             });
         }
+        return "failed";
     }
 }
 function tryKillPid(pid, signal = "SIGTERM") {
@@ -3196,7 +3567,9 @@ function tryKillPid(pid, signal = "SIGTERM") {
 async function startNotifyFallbackWatcher(cwd, options = {}) {
     const { mkdir, writeFile } = await import("fs/promises");
     const pidPath = notifyFallbackPidPath(cwd);
-    await reapStaleNotifyFallbackWatcher(pidPath);
+    const reapResult = await reapStaleNotifyFallbackWatcher(pidPath);
+    if (reapResult === "recent_active")
+        return;
     if (!shouldEnableNotifyFallbackWatcher(process.env, process.platform))
         return;
     const pkgRoot = getPackageRoot();