oh-my-codex 0.18.0 → 0.18.2

package/dist/cli/index.js

@@ -7,6 +7,7 @@ import { basename, dirname, join, posix, win32 } from "path";
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
 import { copyFile, cp, lstat, mkdir, readFile, readdir, rm, symlink, writeFile } from "fs/promises";
 import { constants as osConstants, homedir } from "os";
+import { createHash } from "crypto";
 import { setup, SETUP_MCP_MODES, SETUP_SCOPES, } from "./setup.js";
 import { uninstall } from "./uninstall.js";
 import { version } from "./version.js";
@@ -48,11 +49,11 @@ import { readSessionState, writeSessionStart, writeSessionEnd, resetSessionMetri
 import { buildClientAttachedReconcileHookName, buildReconcileHudResizeArgs, buildRegisterClientAttachedReconcileArgs, buildRegisterResizeHookArgs, buildResizeHookName, buildResizeHookTarget, buildScheduleDelayedHudResizeArgs, buildUnregisterClientAttachedReconcileArgs, buildUnregisterResizeHookArgs, enableMouseScrolling, isMsysOrGitBash, isNativeWindows, isTmuxAvailable, mitigateCopyModeUnderlineArtifacts, } from "../team/tmux-session.js";
 import { getPackageRoot } from "../utils/package.js";
 import { codexConfigPath, omxRoot, rememberOmxLaunchContext, resolveOmxEntryPath } from "../utils/paths.js";
-import { cleanCodexModelAvailabilityNuxIfNeeded, extractSharedMcpRegistryServersFromConfig, repairConfigIfNeeded, upsertManagedCodexHookTrustState } from "../config/generator.js";
+import { cleanCodexModelAvailabilityNuxIfNeeded, extractSharedMcpRegistryServersFromConfig, repairConfigIfNeeded, syncProjectScopeTrustStateFromRuntime } from "../config/generator.js";
 import { OMX_FIRST_PARTY_MCP_SERVER_NAMES } from "../config/omx-first-party-mcp.js";
 import { HUD_TMUX_HEIGHT_LINES } from "../hud/constants.js";
 import { OMX_TMUX_HUD_OWNER_ENV } from "../hud/reconcile.js";
-import { createHudWatchPane as createSharedHudWatchPane, killTmuxPane as killSharedTmuxPane, listCurrentWindowHudPaneIds, parsePaneIdFromTmuxOutput, registerHudResizeHook, } from "../hud/tmux.js";
+import { createHudWatchPane as createSharedHudWatchPane, killTmuxPane as killSharedTmuxPane, listCurrentWindowHudPaneIds, OMX_TMUX_HUD_LEADER_PANE_ENV, parsePaneIdFromTmuxOutput, registerHudResizeHook, } from "../hud/tmux.js";
 export { parseTmuxPaneSnapshot, isHudWatchPane, findHudWatchPaneIds } from "../hud/tmux.js";
 rememberOmxLaunchContext();
 import { classifySpawnError, resolveTmuxBinaryForPlatform, spawnPlatformCommandSync, } from "../utils/platform-command.js";
@@ -478,6 +479,32 @@ async function linkOrCopyCodexHomeEntry(source, destination) {
 function isCodexSqliteArtifact(entryName) {
     return /^(?:state|logs)_\d+\.sqlite(?:-(?:shm|wal))?$/.test(entryName);
 }
+const PROJECT_LAUNCH_PERSISTED_RUNTIME_ENTRY_NAMES = new Set([
+    // Codex CLI writes browser/OTP login state here when CODEX_HOME points at
+    // the per-session mirror. Persist only the opaque file itself; never parse or
+    // log the contents.
+    "auth.json",
+]);
+// Mirroring these files into the runtime CODEX_HOME would cause Codex to load
+// them as user-scope config alongside the canonical project-scope copies under
+// <cwd>/.codex, duplicating every native hook and asking the user to re-trust
+// hooks on every launch. See GH issue #2470.
+const PROJECT_LAUNCH_RUNTIME_SKIPPED_ENTRY_NAMES = new Set(["hooks.json"]);
+function shouldPersistProjectLaunchRuntimeEntry(entryName) {
+    return PROJECT_LAUNCH_PERSISTED_RUNTIME_ENTRY_NAMES.has(entryName);
+}
+export async function persistProjectLaunchRuntimeAuthState(runtimeCodexHome, projectCodexHome) {
+    if (!runtimeCodexHome || !projectCodexHome)
+        return;
+    if (!existsSync(runtimeCodexHome))
+        return;
+    await mkdir(projectCodexHome, { recursive: true });
+    for (const entry of await readdir(runtimeCodexHome, { withFileTypes: true })) {
+        if (!shouldPersistProjectLaunchRuntimeEntry(entry.name) || !entry.isFile())
+            continue;
+        await copyFile(join(runtimeCodexHome, entry.name), join(projectCodexHome, entry.name));
+    }
+}
 /**
  * Project-scope setup keeps durable Codex config under <repo>/.codex, but the
  * Codex TUI also stores model-availability NUX counters in CODEX_HOME/config.toml.
@@ -493,22 +520,16 @@ export async function prepareRuntimeCodexHomeForProjectLaunch(cwd, sessionId, pr
     for (const entry of await readdir(projectCodexHome, { withFileTypes: true })) {
         if (isCodexSqliteArtifact(entry.name))
             continue;
+        if (PROJECT_LAUNCH_RUNTIME_SKIPPED_ENTRY_NAMES.has(entry.name))
+            continue;
         const source = join(projectCodexHome, entry.name);
         const destination = join(runtimeCodexHome, entry.name);
-        if (entry.name === "config.toml" || entry.name === "hooks.json") {
+        if (entry.name === "config.toml") {
             await copyFile(source, destination);
             continue;
         }
         await linkOrCopyCodexHomeEntry(source, destination);
     }
-    const runtimeConfigPath = join(runtimeCodexHome, "config.toml");
-    const runtimeHooksPath = join(runtimeCodexHome, "hooks.json");
-    if (existsSync(runtimeConfigPath) && existsSync(runtimeHooksPath)) {
-        const runtimeConfig = await readFile(runtimeConfigPath, "utf-8");
-        if (runtimeConfig.includes("# OMX-owned Codex hook trust state")) {
-            await writeFile(runtimeConfigPath, upsertManagedCodexHookTrustState(runtimeConfig, getPackageRoot(), runtimeHooksPath), "utf-8");
-        }
-    }
     return runtimeCodexHome;
 }
 function resolveProjectSqliteHomeForLaunch(projectCodexHome, env) {
@@ -533,9 +554,29 @@ export async function prepareCodexHomeForLaunch(cwd, sessionId, env = process.en
         projectLocalCodexHomeForCleanup,
     };
 }
-async function cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup) {
+export async function persistProjectLaunchRuntimeProjectTrustState(runtimeCodexHome, projectCodexHome) {
+    if (!runtimeCodexHome || !projectCodexHome)
+        return;
+    const runtimeConfigPath = join(runtimeCodexHome, "config.toml");
+    if (!existsSync(runtimeConfigPath))
+        return;
+    const projectConfigPath = join(projectCodexHome, "config.toml");
+    const runtimeConfig = await readFile(runtimeConfigPath, "utf-8");
+    const projectConfig = existsSync(projectConfigPath)
+        ? await readFile(projectConfigPath, "utf-8")
+        : "";
+    const projectHooksPath = join(projectCodexHome, "hooks.json");
+    const nextProjectConfig = syncProjectScopeTrustStateFromRuntime(projectConfig, runtimeConfig, projectHooksPath);
+    if (nextProjectConfig !== projectConfig) {
+        await mkdir(projectCodexHome, { recursive: true });
+        await writeFile(projectConfigPath, nextProjectConfig, "utf-8");
+    }
+}
+async function cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence) {
     if (!runtimeCodexHomeForCleanup)
         return;
+    await persistProjectLaunchRuntimeAuthState(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence);
+    await persistProjectLaunchRuntimeProjectTrustState(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence);
     await rm(runtimeCodexHomeForCleanup, { recursive: true, force: true });
 }
 function execTmuxFileSync(args, options) {
@@ -800,22 +841,262 @@ export function shouldAutoIsolateMadmaxLaunch(command, launchArgs, env = process
 function sanitizeRunIdSegment(value) {
     return value.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
+const MADMAX_DETACHED_ACTIVE_DIR = "active-detached";
+const MADMAX_DETACHED_LOCK_STALE_MS = 30_000;
+const MADMAX_DETACHED_LOCK_RETRY_MS = 50;
+const MADMAX_DETACHED_LOCK_MAX_ATTEMPTS = 100;
+const OMX_MADMAX_DETACHED_CONTEXT_ENV = "OMX_MADMAX_DETACHED_CONTEXT";
+function resolveMadmaxRunsRoot(env = process.env) {
+    return env.OMX_RUNS_DIR || join(homedir(), ".omx-runs");
+}
+function canonicalizeLaunchCwd(cwd) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim() || cwd;
+    }
+    catch {
+        return cwd;
+    }
+}
+function normalizeMadmaxDetachedLaunchArgv(argv) {
+    const passthrough = [];
+    const semanticFlags = new Set();
+    let reasoningFlag = null;
+    let afterEndOfOptions = false;
+    for (const arg of argv) {
+        if (afterEndOfOptions) {
+            passthrough.push(arg);
+            continue;
+        }
+        if (arg === "--") {
+            afterEndOfOptions = true;
+            passthrough.push(arg);
+            continue;
+        }
+        if (arg === "--tmux" || arg === "--direct") {
+            continue;
+        }
+        if (arg === MADMAX_FLAG ||
+            arg === MADMAX_SPARK_FLAG) {
+            semanticFlags.add(arg);
+            continue;
+        }
+        if (arg === HIGH_REASONING_FLAG || arg === XHIGH_REASONING_FLAG) {
+            reasoningFlag = arg;
+            continue;
+        }
+        passthrough.push(arg);
+    }
+    return [
+        ...Array.from(semanticFlags).sort(),
+        ...(reasoningFlag ? [reasoningFlag] : []),
+        ...passthrough,
+    ];
+}
+export function buildMadmaxDetachedLaunchContextKey(sourceCwd, argv, runIdentity = "") {
+    // The boxed run root is part of the lock identity for auto-isolated madmax
+    // launches. That lets independent `omx --madmax --high` sessions share the
+    // same source cwd/argv without contending on one active-detached lock, while
+    // callers that intentionally reuse the same boxed context keep one key.
+    const payload = JSON.stringify({
+        source_cwd: canonicalizeLaunchCwd(sourceCwd),
+        argv: normalizeMadmaxDetachedLaunchArgv(argv),
+        run_identity: runIdentity,
+    });
+    return createHash("sha256").update(payload).digest("hex").slice(0, 32);
+}
+function madmaxDetachedActiveRecordPath(runsRoot, contextKey) {
+    return join(runsRoot, MADMAX_DETACHED_ACTIVE_DIR, `${contextKey}.json`);
+}
+function readMadmaxDetachedActiveRecord(recordPath) {
+    if (!existsSync(recordPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(recordPath, "utf-8"));
+        if (parsed.version !== 1 ||
+            typeof parsed.context_key !== "string" ||
+            typeof parsed.source_cwd !== "string" ||
+            typeof parsed.run_dir !== "string" ||
+            typeof parsed.tmux_session_name !== "string" ||
+            !Array.isArray(parsed.argv) ||
+            !parsed.argv.every((arg) => typeof arg === "string")) {
+            return null;
+        }
+        return {
+            version: 1,
+            context_key: parsed.context_key,
+            created_at: typeof parsed.created_at === "string" ? parsed.created_at : "",
+            source_cwd: parsed.source_cwd,
+            argv: [...parsed.argv],
+            run_dir: parsed.run_dir,
+            tmux_session_name: parsed.tmux_session_name,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function detachedTmuxSessionExists(sessionName) {
+    try {
+        execTmuxFileSync(["has-session", "-t", sessionName], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function readMadmaxDetachedLockOwner(lockPath) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(lockPath, "owner.json"), "utf-8"));
+        if (parsed.version !== 1 ||
+            typeof parsed.pid !== "number" ||
+            !Number.isSafeInteger(parsed.pid) ||
+            parsed.pid <= 0 ||
+            typeof parsed.context_key !== "string" ||
+            typeof parsed.acquired_at !== "string") {
+            return null;
+        }
+        return {
+            version: 1,
+            pid: parsed.pid,
+            context_key: parsed.context_key,
+            acquired_at: parsed.acquired_at,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function readMadmaxDetachedLockPid(lockPath) {
+    const owner = readMadmaxDetachedLockOwner(lockPath);
+    if (owner)
+        return owner.pid;
+    try {
+        const holderPid = Number.parseInt(readFileSync(join(lockPath, "pid"), "utf-8").trim(), 10);
+        return Number.isSafeInteger(holderPid) && holderPid > 0 ? holderPid : null;
+    }
+    catch {
+        return null;
+    }
+}
+function inspectMadmaxDetachedContextLock(lockPath) {
+    const lockStat = statSync(lockPath, { throwIfNoEntry: false });
+    if (!lockStat) {
+        return { stale: false, diagnostic: "lock disappeared while waiting" };
+    }
+    const ageMs = Math.max(0, Date.now() - lockStat.mtimeMs);
+    const owner = readMadmaxDetachedLockOwner(lockPath);
+    const holderPid = owner?.pid ?? readMadmaxDetachedLockPid(lockPath);
+    if (holderPid) {
+        if (!isProcessAlive(holderPid)) {
+            return {
+                stale: true,
+                diagnostic: `stale holder pid ${holderPid} is not running; lock age ${Math.round(ageMs)}ms`,
+            };
+        }
+        const ownerContext = owner ? `, owner context ${owner.context_key}` : ", legacy pid-only lock";
+        const sameDirectoryGuidance = "Another madmax detached launch is active for this directory; close the existing madmax session or use --worktree for concurrent work. Multiple madmax sessions in one directory are unsafe";
+        return {
+            stale: false,
+            diagnostic: `holder pid ${holderPid} is still running${ownerContext}; lock age ${Math.round(ageMs)}ms. ${sameDirectoryGuidance}`,
+        };
+    }
+    if (ageMs > MADMAX_DETACHED_LOCK_STALE_MS) {
+        return {
+            stale: true,
+            diagnostic: `legacy lock has no readable owner pid and is older than ${MADMAX_DETACHED_LOCK_STALE_MS}ms; lock age ${Math.round(ageMs)}ms`,
+        };
+    }
+    return {
+        stale: false,
+        diagnostic: `lock has no readable owner pid yet; lock age ${Math.round(ageMs)}ms`,
+    };
+}
+export function withMadmaxDetachedContextLock(runsRoot, contextKey, run, options = {}) {
+    const lockPath = join(runsRoot, MADMAX_DETACHED_ACTIVE_DIR, `${contextKey}.lock`);
+    const maxAttempts = options.maxAttempts ?? MADMAX_DETACHED_LOCK_MAX_ATTEMPTS;
+    const retryMs = options.retryMs ?? MADMAX_DETACHED_LOCK_RETRY_MS;
+    let lastDiagnostic = "lock was busy";
+    mkdirSync(dirname(lockPath), { recursive: true });
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
+            mkdirSync(lockPath);
+            try {
+                const owner = {
+                    version: 1,
+                    pid: process.pid,
+                    context_key: contextKey,
+                    acquired_at: new Date().toISOString(),
+                };
+                writeFileSync(join(lockPath, "owner.json"), `${JSON.stringify(owner, null, 2)}\n`, { mode: 0o600 });
+                writeFileSync(join(lockPath, "pid"), String(process.pid));
+                return run();
+            }
+            finally {
+                rmSync(lockPath, { recursive: true, force: true });
+            }
+        }
+        catch (err) {
+            const code = err && typeof err === "object" && "code" in err
+                ? String(err.code)
+                : "";
+            if (code !== "EEXIST")
+                throw err;
+            const inspection = inspectMadmaxDetachedContextLock(lockPath);
+            lastDiagnostic = inspection.diagnostic;
+            if (inspection.stale) {
+                rmSync(lockPath, { recursive: true, force: true });
+                continue;
+            }
+            blockMs(retryMs);
+        }
+    }
+    throw new MadmaxDetachedGuardError(`timed out waiting for madmax detached launch context lock: ${lockPath} (${lastDiagnostic})`);
+}
+function isMadmaxDetachedGuardEnabled(env) {
+    return env.OMXBOX_ACTIVE === "1" && typeof env[OMX_MADMAX_DETACHED_CONTEXT_ENV] === "string";
+}
+function cleanupCurrentMadmaxReuseRunRoot(env, runsRoot) {
+    const runRoot = env.OMX_ROOT;
+    if (!runRoot || !env.OMXBOX_ACTIVE)
+        return;
+    const normalizedRunsRoot = runsRoot.endsWith("/") ? runsRoot : `${runsRoot}/`;
+    if (runRoot !== runsRoot && !runRoot.startsWith(normalizedRunsRoot))
+        return;
+    rmSync(runRoot, { recursive: true, force: true });
+}
+function writeMadmaxDetachedActiveRecord(recordPath, record) {
+    mkdirSync(dirname(recordPath), { recursive: true });
+    writeFileSync(recordPath, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+}
+class MadmaxDetachedReuseError extends Error {
+    failClosed = true;
+}
+class MadmaxDetachedGuardError extends Error {
+    failClosed = true;
+}
 export function createMadmaxIsolatedRoot(sourceCwd, argv, env = process.env) {
-    const runsRoot = env.OMX_RUNS_DIR || join(homedir(), ".omx-runs");
+    const runsRoot = resolveMadmaxRunsRoot(env);
     mkdirSync(runsRoot, { recursive: true });
     const stamp = new Date().toISOString().replace(/[-:TZ.]/g, "").slice(0, 14);
     const suffix = Math.random().toString(16).slice(2, 6);
     const runDir = join(runsRoot, sanitizeRunIdSegment(`run-${stamp}-${suffix}`));
     mkdirSync(runDir, { recursive: false });
+    const detachedLaunchContext = buildMadmaxDetachedLaunchContextKey(sourceCwd, argv, runDir);
     const metadata = {
         launcher: "omx --madmax",
         created_at: new Date().toISOString(),
         cwd: runDir,
         source_cwd: sourceCwd,
         argv,
+        detached_launch_context: detachedLaunchContext,
     };
     writeFileSync(join(runDir, ".omxbox-run.json"), `${JSON.stringify(metadata, null, 2)}\n`);
     writeFileSync(join(runsRoot, "registry.jsonl"), `${JSON.stringify(metadata)}\n`, { flag: "a" });
+    env[OMX_MADMAX_DETACHED_CONTEXT_ENV] = detachedLaunchContext;
     return runDir;
 }
 function activateMadmaxIsolationIfNeeded(command, launchArgs, cwd, env = process.env) {
@@ -1028,6 +1309,11 @@ export async function main(args) {
             case "reasoning":
                 await reasoningCommand(args.slice(1));
                 break;
+            case "codex-native-hook": {
+                const { runCodexNativeHookCli } = await import("../scripts/codex-native-hook.js");
+                await runCodexNativeHookCli();
+                break;
+            }
             case "help":
             case "--help":
             case "-h":
@@ -1227,7 +1513,7 @@ export async function launchWithHud(args) {
         // ── Phase 3: postLaunch ─────────────────────────────────────────────
         if (!postLaunchHandledExternally) {
             await postLaunch(cwd, sessionId, codexHomeOverride, enableNotifyFallbackAuthority, projectLocalCodexHomeForCleanup);
-            await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup).catch(logCliOperationFailure);
+            await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup).catch(logCliOperationFailure);
         }
     }
 }
@@ -1319,7 +1605,7 @@ export async function execWithOverlay(args) {
     }
     finally {
         await postLaunch(cwd, sessionId, codexHomeOverride, true, projectLocalCodexHomeForCleanup);
-        await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup).catch(logCliOperationFailure);
+        await cleanupRuntimeCodexHome(preparedCodexHome.runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup).catch(logCliOperationFailure);
     }
 }
 export function normalizeCodexLaunchArgs(args) {
@@ -2649,12 +2935,19 @@ function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverride, s
     if (!omxBin) {
         throw new Error("Unable to resolve OMX launcher path for tmux HUD bootstrap");
     }
+    const omxRootOverride = resolveOmxRootForLaunch(cwd, process.env);
+    const currentPaneId = process.env.TMUX_PANE;
+    const hudEnvArgs = [
+        `OMX_SESSION_ID=${sessionId}`,
+        `${OMX_TMUX_HUD_OWNER_ENV}=1`,
+        ...(currentPaneId ? [`${OMX_TMUX_HUD_LEADER_PANE_ENV}=${currentPaneId}`] : []),
+        ...(omxRootOverride ? [`OMX_ROOT=${omxRootOverride}`] : []),
+    ];
     const hudCmd = nativeWindows
         ? buildWindowsPromptCommand("node", [omxBin, "hud", "--watch"])
-        : buildTmuxPaneCommand("env", [`OMX_SESSION_ID=${sessionId}`, `${OMX_TMUX_HUD_OWNER_ENV}=1`, "node", omxBin, "hud", "--watch"]);
+        : buildTmuxPaneCommand("env", [...hudEnvArgs, "node", omxBin, "hud", "--watch"]);
     const inheritLeaderFlags = process.env[TEAM_INHERIT_LEADER_FLAGS_ENV] !== "0";
     const workerLaunchArgs = resolveTeamWorkerLaunchArgsEnv(process.env[TEAM_WORKER_LAUNCH_ARGS_ENV], launchArgs, inheritLeaderFlags, workerDefaultModel);
-    const omxRootOverride = resolveOmxRootForLaunch(cwd, process.env);
     const codexBaseEnv = {
         ...process.env,
         ...(codexHomeOverride ? { CODEX_HOME: codexHomeOverride } : {}),
@@ -2679,14 +2972,16 @@ function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverride, s
     }
     if (launchPolicy === "inside-tmux") {
         // Already in tmux: launch codex in current pane, HUD in bottom split
-        const currentPaneId = process.env.TMUX_PANE;
-        const staleHudPaneIds = listHudWatchPaneIdsInCurrentWindow(currentPaneId);
+        const staleHudPaneIds = listHudWatchPaneIdsInCurrentWindow(currentPaneId, { sessionId, leaderPaneId: currentPaneId });
         for (const paneId of staleHudPaneIds) {
             killTmuxPane(paneId);
         }
         let hudPaneId = null;
         try {
-            hudPaneId = createHudWatchPane(cwd, hudCmd);
+            hudPaneId = createHudWatchPane(cwd, hudCmd, {
+                heightLines: HUD_TMUX_HEIGHT_LINES,
+                targetPaneId: currentPaneId,
+            });
             if (hudPaneId && currentPaneId) {
                 registerHudResizeHook(hudPaneId, currentPaneId, HUD_TMUX_HEIGHT_LINES);
             }
@@ -2750,126 +3045,186 @@ function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverride, s
             ? buildWindowsPromptCommand("codex", launchArgs)
             : null;
         const sessionName = buildDetachedTmuxSessionName(cwd, sessionId);
-        void writeSessionStart(cwd, sessionId, { tmuxSessionName: sessionName }).catch((err) => {
-            logCliOperationFailure(err);
-            // Non-fatal: managed tmux recovery can still use compatibility fallback.
-        });
-        let createdDetachedSession = false;
-        let registeredHookTarget = null;
-        let registeredHookName = null;
-        let registeredClientAttachedHookName = null;
-        let detachedParentEnvFilePath;
-        try {
-            // This path is the user-shell interactive launch: OMX creates a tmux
-            // session and immediately attaches the user's terminal to it. If a tmux
-            // server already exists, `new-session -e` only forwards explicit values,
-            // so provider-specific parent-shell keys would disappear. Source a
-            // private env file inside the leader shell instead of putting every
-            // parent env value on the tmux command line or in logs.
-            if (!nativeWindows) {
-                detachedParentEnvFilePath = writeDetachedSessionParentEnvFile(cwd, sessionId, codexEnvWithNotify);
+        const launchDetachedSession = () => {
+            const contextKey = process.env[OMX_MADMAX_DETACHED_CONTEXT_ENV]?.trim();
+            const runsRoot = resolveMadmaxRunsRoot(process.env);
+            const activeRecordPath = contextKey
+                ? madmaxDetachedActiveRecordPath(runsRoot, contextKey)
+                : null;
+            const activeRecord = activeRecordPath
+                ? readMadmaxDetachedActiveRecord(activeRecordPath)
+                : null;
+            if (activeRecord &&
+                activeRecord.context_key === contextKey &&
+                detachedTmuxSessionExists(activeRecord.tmux_session_name)) {
+                cleanupCurrentMadmaxReuseRunRoot(process.env, runsRoot);
+                process.stderr.write(`[omx] madmax detached launch already active for this context; attaching ${activeRecord.tmux_session_name} instead of starting a duplicate.\n`);
+                try {
+                    execTmuxFileSync(["attach-session", "-t", activeRecord.tmux_session_name], {
+                        stdio: "inherit",
+                    });
+                }
+                catch (err) {
+                    logCliOperationFailure(err);
+                    throw new MadmaxDetachedReuseError(`refusing duplicate madmax detached launch: existing session ${activeRecord.tmux_session_name} is active but attach failed`);
+                }
+                return { postLaunchHandledExternally: true };
             }
-            const bootstrapSteps = buildDetachedSessionBootstrapSteps(sessionName, cwd, codexCmd, hudCmd, workerLaunchArgs, codexHomeOverride, notifyTempContractRaw, nativeWindows, sessionId, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, omxRootOverride, process.env, sqliteHomeOverride, detachedParentEnvFilePath);
-            for (const step of bootstrapSteps) {
-                const output = execTmuxFileSync(step.args, {
-                    stdio: "pipe",
-                    encoding: "utf-8",
-                });
-                if (step.name === "new-session") {
-                    createdDetachedSession = true;
-                    parsePaneIdFromTmuxOutput(output || "");
+            if (activeRecordPath && activeRecord) {
+                rmSync(activeRecordPath, { force: true });
+            }
+            void writeSessionStart(cwd, sessionId, { tmuxSessionName: sessionName }).catch((err) => {
+                logCliOperationFailure(err);
+                // Non-fatal: managed tmux recovery can still use compatibility fallback.
+            });
+            let createdDetachedSession = false;
+            let registeredHookTarget = null;
+            let registeredHookName = null;
+            let registeredClientAttachedHookName = null;
+            let detachedParentEnvFilePath;
+            try {
+                // This path is the user-shell interactive launch: OMX creates a tmux
+                // session and immediately attaches the user's terminal to it. If a tmux
+                // server already exists, `new-session -e` only forwards explicit values,
+                // so provider-specific parent-shell keys would disappear. Source a
+                // private env file inside the leader shell instead of putting every
+                // parent env value on the tmux command line or in logs.
+                if (!nativeWindows) {
+                    detachedParentEnvFilePath = writeDetachedSessionParentEnvFile(cwd, sessionId, codexEnvWithNotify);
                 }
-                if (step.name === "split-and-capture-hud-pane") {
-                    const hudPaneId = parsePaneIdFromTmuxOutput(output || "");
-                    const hookWindowIndex = hudPaneId
-                        ? detectDetachedSessionWindowIndex(sessionName)
-                        : null;
-                    const hookTarget = hudPaneId && hookWindowIndex
-                        ? buildResizeHookTarget(sessionName, hookWindowIndex)
-                        : null;
-                    const hookName = hudPaneId && hookWindowIndex
-                        ? buildResizeHookName("launch", sessionName, hookWindowIndex, hudPaneId)
-                        : null;
-                    const clientAttachedHookName = hudPaneId && hookWindowIndex
-                        ? buildClientAttachedReconcileHookName("launch", sessionName, hookWindowIndex, hudPaneId)
-                        : null;
-                    const finalizeSteps = buildDetachedSessionFinalizeSteps(sessionName, hudPaneId, hookWindowIndex, process.env.OMX_MOUSE !== "0", nativeWindows);
-                    if (nativeWindows && detachedWindowsCodexCmd) {
-                        scheduleDetachedWindowsCodexLaunch(sessionName, detachedWindowsCodexCmd);
+                const bootstrapSteps = buildDetachedSessionBootstrapSteps(sessionName, cwd, codexCmd, hudCmd, workerLaunchArgs, codexHomeOverride, notifyTempContractRaw, nativeWindows, sessionId, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup, omxRootOverride, process.env, sqliteHomeOverride, detachedParentEnvFilePath);
+                for (const step of bootstrapSteps) {
+                    const output = execTmuxFileSync(step.args, {
+                        stdio: "pipe",
+                        encoding: "utf-8",
+                    });
+                    if (step.name === "new-session") {
+                        createdDetachedSession = true;
+                        if (activeRecordPath && contextKey) {
+                            writeMadmaxDetachedActiveRecord(activeRecordPath, {
+                                version: 1,
+                                context_key: contextKey,
+                                created_at: new Date().toISOString(),
+                                source_cwd: process.env.OMX_SOURCE_CWD || cwd,
+                                argv: args,
+                                run_dir: process.env.OMX_ROOT || cwd,
+                                tmux_session_name: sessionName,
+                            });
+                        }
+                        parsePaneIdFromTmuxOutput(output || "");
                     }
-                    for (const finalizeStep of finalizeSteps) {
-                        if (finalizeStep.name === "sanitize-copy-mode-style") {
+                    if (step.name === "split-and-capture-hud-pane") {
+                        const hudPaneId = parsePaneIdFromTmuxOutput(output || "");
+                        const hookWindowIndex = hudPaneId
+                            ? detectDetachedSessionWindowIndex(sessionName)
+                            : null;
+                        const hookTarget = hudPaneId && hookWindowIndex
+                            ? buildResizeHookTarget(sessionName, hookWindowIndex)
+                            : null;
+                        const hookName = hudPaneId && hookWindowIndex
+                            ? buildResizeHookName("launch", sessionName, hookWindowIndex, hudPaneId)
+                            : null;
+                        const clientAttachedHookName = hudPaneId && hookWindowIndex
+                            ? buildClientAttachedReconcileHookName("launch", sessionName, hookWindowIndex, hudPaneId)
+                            : null;
+                        const finalizeSteps = buildDetachedSessionFinalizeSteps(sessionName, hudPaneId, hookWindowIndex, process.env.OMX_MOUSE !== "0", nativeWindows);
+                        if (nativeWindows && detachedWindowsCodexCmd) {
+                            scheduleDetachedWindowsCodexLaunch(sessionName, detachedWindowsCodexCmd);
+                        }
+                        for (const finalizeStep of finalizeSteps) {
+                            if (finalizeStep.name === "sanitize-copy-mode-style") {
+                                try {
+                                    mitigateCopyModeUnderlineArtifacts(sessionName);
+                                }
+                                catch (err) {
+                                    logCliOperationFailure(err);
+                                }
+                                continue;
+                            }
+                            const stdio = finalizeStep.name === "attach-session" ? "inherit" : "ignore";
                             try {
-                                mitigateCopyModeUnderlineArtifacts(sessionName);
+                                const startedAtMs = Date.now();
+                                execTmuxFileSync(finalizeStep.args, { stdio });
+                                if (finalizeStep.name === "attach-session") {
+                                    assertDetachedAttachDidNotNoop(sessionName, Date.now() - startedAtMs, process.env);
+                                }
                             }
                             catch (err) {
                                 logCliOperationFailure(err);
+                                if (finalizeStep.name === "attach-session")
+                                    throw new Error("failed to attach detached tmux session");
+                                continue;
                             }
-                            continue;
-                        }
-                        const stdio = finalizeStep.name === "attach-session" ? "inherit" : "ignore";
-                        try {
-                            const startedAtMs = Date.now();
-                            execTmuxFileSync(finalizeStep.args, { stdio });
-                            if (finalizeStep.name === "attach-session") {
-                                assertDetachedAttachDidNotNoop(sessionName, Date.now() - startedAtMs, process.env);
+                            if (finalizeStep.name === "register-resize-hook" &&
+                                hookTarget &&
+                                hookName) {
+                                registeredHookTarget = hookTarget;
+                                registeredHookName = hookName;
+                            }
+                            if (finalizeStep.name === "register-client-attached-reconcile" &&
+                                clientAttachedHookName) {
+                                registeredClientAttachedHookName = clientAttachedHookName;
                             }
                         }
-                        catch (err) {
-                            logCliOperationFailure(err);
-                            if (finalizeStep.name === "attach-session")
-                                throw new Error("failed to attach detached tmux session");
-                            continue;
-                        }
-                        if (finalizeStep.name === "register-resize-hook" &&
-                            hookTarget &&
-                            hookName) {
-                            registeredHookTarget = hookTarget;
-                            registeredHookName = hookName;
+                    }
+                }
+                return { postLaunchHandledExternally: !nativeWindows };
+            }
+            catch (err) {
+                if (detachedParentEnvFilePath) {
+                    rmSync(detachedParentEnvFilePath, { force: true });
+                }
+                if (activeRecordPath) {
+                    rmSync(activeRecordPath, { force: true });
+                }
+                if (createdDetachedSession) {
+                    const rollbackSteps = buildDetachedSessionRollbackSteps(sessionName, registeredHookTarget, registeredHookName, registeredClientAttachedHookName);
+                    for (const rollbackStep of rollbackSteps) {
+                        try {
+                            execTmuxFileSync(rollbackStep.args, { stdio: "ignore" });
                         }
-                        if (finalizeStep.name === "register-client-attached-reconcile" &&
-                            clientAttachedHookName) {
-                            registeredClientAttachedHookName = clientAttachedHookName;
+                        catch (rollbackErr) {
+                            logCliOperationFailure(rollbackErr);
+                            // best-effort rollback only
                         }
                     }
                 }
+                throw err;
+            }
+        };
+        const contextKey = process.env[OMX_MADMAX_DETACHED_CONTEXT_ENV]?.trim();
+        const runsRoot = resolveMadmaxRunsRoot(process.env);
+        try {
+            if (isMadmaxDetachedGuardEnabled(process.env) && contextKey) {
+                return withMadmaxDetachedContextLock(runsRoot, contextKey, launchDetachedSession);
             }
-            return { postLaunchHandledExternally: !nativeWindows };
+            return launchDetachedSession();
         }
         catch (err) {
-            logCliOperationFailure(err);
-            if (detachedParentEnvFilePath) {
-                rmSync(detachedParentEnvFilePath, { force: true });
-            }
-            if (createdDetachedSession) {
-                const rollbackSteps = buildDetachedSessionRollbackSteps(sessionName, registeredHookTarget, registeredHookName, registeredClientAttachedHookName);
-                for (const rollbackStep of rollbackSteps) {
-                    try {
-                        execTmuxFileSync(rollbackStep.args, { stdio: "ignore" });
-                    }
-                    catch (err) {
-                        logCliOperationFailure(err);
-                        // best-effort rollback only
-                    }
-                }
+            if (err instanceof MadmaxDetachedReuseError || err instanceof MadmaxDetachedGuardError) {
+                throw err;
             }
+            logCliOperationFailure(err);
             // tmux not available or failed, just run codex directly
             runCodexBlocking(cwd, launchArgs, codexEnvWithNotify);
             return { postLaunchHandledExternally: false };
         }
     }
 }
-function listHudWatchPaneIdsInCurrentWindow(currentPaneId) {
+function listHudWatchPaneIdsInCurrentWindow(currentPaneId, owner = {}) {
     try {
-        return listCurrentWindowHudPaneIds(currentPaneId);
+        return listCurrentWindowHudPaneIds(currentPaneId, undefined, owner);
     }
     catch (err) {
         logCliOperationFailure(err);
         return [];
     }
 }
-function createHudWatchPane(cwd, hudCmd) {
-    return createSharedHudWatchPane(cwd, hudCmd, { heightLines: HUD_TMUX_HEIGHT_LINES });
+function createHudWatchPane(cwd, hudCmd, options = {}) {
+    return createSharedHudWatchPane(cwd, hudCmd, {
+        heightLines: options.heightLines ?? HUD_TMUX_HEIGHT_LINES,
+        targetPaneId: options.targetPaneId,
+    });
 }
 function killTmuxPane(paneId) {
     if (!paneId.startsWith("%"))
@@ -3109,7 +3464,7 @@ async function postLaunch(cwd, sessionId, codexHomeOverride, enableNotifyFallbac
 }
 export async function runDetachedSessionPostLaunch(cwd, sessionId, codexHomeOverride, projectLocalCodexHomeForCleanup, runtimeCodexHomeForCleanup) {
     await postLaunch(cwd, sessionId, codexHomeOverride, false, projectLocalCodexHomeForCleanup);
-    await cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup).catch(logCliOperationFailure);
+    await cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup).catch(logCliOperationFailure);
 }
 async function emitNativeHookEvent(cwd, event, opts = {}) {
     const payload = buildHookEvent(event, {