sprag-cli 3.63.0 → 3.64.0

package/src/codex-delegation-diagnostics.js

@@ -0,0 +1,42 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'smol-toml';
+import { codexUserDir, codexModelName } from './agent.js';
+import { codexDelegationStatus } from './codex-ledger.js';
+
+/** Local introspection only. A CLI feature flag cannot prove a model received a tool. */
+export function codexDelegationDiagnostics({ home = codexUserDir(), model = codexModelName({ home }), sessionId, dir,
+  exec = execFileSync } = {}) {
+  const result = { model, version: null, flags: {}, configuredDisabled: false,
+    catalogAgentVersion: null, activity: codexDelegationStatus({ dir, sessionId }),
+    tools: 'unverified in the active session', warnings: [], errors: [] };
+  try {
+    const cfg = parse(readFileSync(join(home, 'config.toml'), 'utf8'));
+    const profile = cfg.profiles?.[cfg.profile];
+    result.configuredDisabled = (profile?.agents?.enabled ?? cfg.agents?.enabled) === false ||
+      (profile?.features?.multi_agent ?? cfg.features?.multi_agent) === false;
+  } catch (e) { if (e.code !== 'ENOENT') result.errors.push('Cannot parse user config.'); }
+  const run = (args) => exec('codex', args, { encoding: 'utf8', timeout: 5000, maxBuffer: 20 * 1024 * 1024,
+    env: { ...process.env, CODEX_HOME: home }, stdio: ['ignore', 'pipe', 'pipe'] });
+  try { result.version = run(['--version']).trim().slice(0, 100); } catch { result.errors.push('Codex version unavailable.'); }
+  try {
+    for (const line of run(['features', 'list']).split('\n')) {
+      const m = /^(multi_agent(?:_v2(?:_dynamic_tools)?)?)\s+.+?\s+(true|false)\s*$/.exec(line);
+      if (m) result.flags[m[1]] = m[2] === 'true';
+    }
+  } catch { result.errors.push('Codex feature list unavailable.'); }
+  try {
+    const data = JSON.parse(run(['debug', 'models', '--bundled']));
+    const models = Array.isArray(data) ? data : data.models;
+    const found = models?.find((m) => m.slug === model);
+    if (['v1', 'v2'].includes(found?.multi_agent_version)) result.catalogAgentVersion = found.multi_agent_version;
+  } catch { result.errors.push('Bundled model catalog unavailable.'); }
+  if (result.configuredDisabled || result.flags.multi_agent === false) result.warnings.push('Agent tools are disabled in the inspected configuration.');
+  if (result.catalogAgentVersion === 'v2' && result.flags.multi_agent_v2 === false) {
+    result.warnings.push('The bundled model catalog names v2 while the v2 feature is off. This is a compatibility clue, not proof of the cause; no setting was changed.');
+  }
+  if (result.activity.offers && !result.activity.bound && !result.activity.settled) result.warnings.push('Sprag emitted offers but no child execution is connected.');
+  result.warnings.push('Confirm spawn_agent and wait_agent in the running session. If absent, continue on the main agent and report the limitation; do not launch another CLI as a substitute.');
+  return result;
+}

package/src/codex-delegation.js

@@ -244,6 +244,23 @@ const SHARED_TIER_GUIDANCE = 'Choose T2 only for a simple bounded lookup or comm
 const WAIT_TEXT = 'Wait for it to finish (call wait_agent with timeout_ms of at least 120000, and again if it times out) and do not do the delegated task yourself while it runs; then verify its result and report unfinished work. Do not spawn another CLI process. '
   + 'If sub-agent tools or the target model are unavailable, keep the task on the main agent and state that delegation was unavailable.';
 
+/** Called explicitly by the parent after design, never by prompt classification. */
+export function codexImplementationHint({ model, provider, sessionId, cfg = loadConfig(), dir = userDataDir(),
+  home = codexUserDir(), record = recordCodexDelegation } = {}) {
+  if (!safeId(model) || !safeId(provider) || !safeId(sessionId)) throw new Error('Implementation delegation requires --from, --provider and --session for the active parent.');
+  if (!codexDelegateEnabled(cfg) || cfg.codex?.sharedRules?.enabled === false) return 'Implementation delegation is off. Keep the implementation on the main agent.';
+  const target = codexTierTargets({ cfg, dir, home, model, provider }).find((t) => t.tier === 'T1');
+  if (!target) return 'T1 is unresolved for this parent/provider. Keep the implementation on the main agent; do not fall back to T2.';
+  const id = newRouteId();
+  record({ id, parentSessionId: sessionId, via: 'prompt', source: 'implementation', tier: 'T1',
+    from: model, to: target.model, provider, effort: target.effort ?? null }, { dir });
+  return `[Sprag implementation delegation] The user-approved implementation-split policy keeps design and specification on the main agent. `
+    + `Delegate only the implementation of that completed design to model ${target.model}${target.effort ? `, reasoning_effort ${target.effort}` : ''}, with fork_turns "none". `
+    + 'Never delegate design judgement or irreversible actions. Give one child a self-contained specification, owned files, constraints, test commands, completion criteria and the reason for this model choice. '
+    + 'Cap: 8000 output tokens. Stop and report partial work before exceeding it. Do not recursively delegate. '
+    + WAIT_TEXT + `\nEnd the child task message with this route line only:\n<!-- sprag:codex:route id=${id} -->`;
+}
+
 function sharedTargetText(rule) {
   return `${rule.tier}: model ${rule.model}${rule.effort ? `, reasoning_effort ${rule.effort}` : ''}. ${sharedRuleBounds(rule)}`.trim();
 }

package/src/codex-doc2md-ledger.js

@@ -5,43 +5,88 @@ import { codexUserDir } from './agent.js';
 import { userDataDir } from './paths.js';
 import { writeViaTmp } from './state-file.js';
 import { readResetMarks, isBeforeReset } from './saved-reset.cjs';
+import { codexPriceBook, readCodexPrices } from './codex-cache-policy.js';
 
 const hash = (value) => createHash('sha256').update(value).digest('hex');
 const ledgerDir = ({ home = codexUserDir(), dir = userDataDir() } = {}) => join(dir, 'codex-doc2md', hash(resolve(home)));
 const finite = (n) => Number.isSafeInteger(n) && n >= 0;
 
+/** Office XML versus the prepared Markdown, not native attachment billing. */
+export function estimateCodexDocument(source, meta, { model, provider, home, dir, now = Date.now(), prices } = {}) {
+  const unknown = (reason) => ({ usd: null, reason });
+  if (meta.clipped || meta.truncated) return unknown('incomplete-text');
+  if (!['.pptx', '.docx', '.xlsx'].includes(extname(source).toLowerCase()) || !finite(meta.markupBytes) || meta.markupBytes === 0) {
+    return unknown('no-comparable-baseline');
+  }
+  if (!finite(meta.markdownBytes)) return unknown('missing-markdown-size');
+  if (typeof model !== 'string' || !model || typeof provider !== 'string' || !provider) return unknown('unknown-model-provider');
+  const book = codexPriceBook(provider, prices === undefined ? readCodexPrices({ home, dir, now }) : prices, { home });
+  const rate = book?.prices?.[model]?.input;
+  if (!Number.isFinite(rate) || rate < 0) return unknown('unpriced-model');
+  const baseline = Math.ceil(meta.markupBytes / 4), tokens = Math.ceil(meta.markdownBytes / 4);
+  return { usd: (baseline - tokens) * rate, baseline, tokens, savedTokens: baseline - tokens,
+    method: 'office-xml-vs-markdown-bytes/4', model, provider, inputRate: rate,
+    priceSource: book.source, priceCheckedAt: book.checkedAt };
+}
+
 // One file per source avoids lost updates when parallel hooks prepare documents.
-export function recordCodexDocument(source, result, opts) {
+export function recordCodexDocument(source, result, opts = {}) {
   if (!result?.ok) return;
   try {
     const dir = ledgerDir(opts);
     const file = join(dir, `${hash(realpathSync(source))}.json`);
     const meta = result.meta || {};
-    const event = { version: 1, ext: extname(source).slice(1).toLowerCase(),
+    const now = opts.now ?? Date.now();
+    const st = statSync(source);
+    const fingerprint = hash(JSON.stringify([st.size, st.mtimeMs, meta.markupBytes, meta.markdownBytes, !!(meta.clipped || meta.truncated)]));
+    let previous;
+    try { previous = JSON.parse(readFileSync(file, 'utf8')); } catch { /* First use. */ }
+    const same = previous?.version === 2 && previous.fingerprint === fingerprint;
+    const since = readResetMarks(opts.dir ?? userDataDir())['codex-docs'];
+    const estimate = estimateCodexDocument(source, meta, opts);
+    // Reusing a cache without session identity must not erase a priced snapshot.
+    const saving = same && !isBeforeReset(previous.at, since) && Number.isFinite(previous.saving?.usd) ? previous.saving : estimate;
+    const event = { version: 2, ext: extname(source).slice(1).toLowerCase(),
+      fingerprint, at: same && !isBeforeReset(previous.at, since) ? previous.at : now, saving,
       sourceBytes: finite(meta.size) ? meta.size : null,
       markdownBytes: finite(meta.markdownBytes) ? meta.markdownBytes : null,
       clipped: !!(meta.clipped || meta.truncated) };
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const tmp = `${file}.${randomUUID()}.tmp`;
     writeViaTmp(tmp, file, JSON.stringify(event) + '\n', { mode: 0o600 });
+    return saving;
   } catch { /* Accounting must not prevent document conversion. */ }
 }
 
-// Records carry no timestamp field, so the reset mark is compared with the
-// file's mtime. A source converted again rewrites its record and counts as new.
-export function codexDocumentTotals(opts) {
+// Legacy records use mtime; new records retain their first priced observation.
+export function codexDocumentTotals(opts = {}) {
   const since = readResetMarks(opts?.dir ?? userDataDir())['codex-docs'];
-  const total = { docs: 0, byExt: [], scope: 'codex-total', since };
+  const now = opts.now ?? Date.now();
+  const savings = { week: 0, month: 0, total: 0, priced: 0, unpriced: 0, savedTokens: 0, reasons: {} };
+  const total = { docs: 0, byExt: [], scope: 'codex-total', since, savings };
   const byExt = new Map();
   try {
     const dir = ledgerDir(opts);
     for (const file of readdirSync(dir).filter((name) => /^[a-f0-9]{64}\.json$/.test(name))) {
       try {
-        if (since !== null && isBeforeReset(statSync(join(dir, file)).mtimeMs, since)) continue;
         const event = JSON.parse(readFileSync(join(dir, file), 'utf8'));
-        if (event?.version !== 1 || !['pdf', 'pptx', 'xlsx', 'xls', 'docx', 'fig'].includes(event.ext)) continue;
+        if (![1, 2].includes(event?.version) || !['pdf', 'pptx', 'xlsx', 'xls', 'docx', 'fig'].includes(event.ext)) continue;
+        const at = event.version === 2 ? event.at : statSync(join(dir, file)).mtimeMs;
+        if (isBeforeReset(at, since)) continue;
         total.docs++;
         byExt.set(event.ext, (byExt.get(event.ext) || 0) + 1);
+        const s = event.saving;
+        if (event.version === 2 && s?.method === 'office-xml-vs-markdown-bytes/4' && Number.isFinite(s.usd)) {
+          savings.priced++;
+          savings.total += s.usd;
+          savings.savedTokens += Number.isFinite(s.savedTokens) ? s.savedTokens : 0;
+          if (at <= now && now - at < 7 * 86400000) savings.week += s.usd;
+          if (at <= now && now - at < 30 * 86400000) savings.month += s.usd;
+        } else {
+          savings.unpriced++;
+          const reason = event.version === 1 ? 'legacy-record' : s?.reason || 'unknown';
+          savings.reasons[reason] = (savings.reasons[reason] || 0) + 1;
+        }
       } catch { /* Ignore only the damaged record. */ }
     }
   } catch { /* No Codex document history yet. */ }

package/src/codex-doc2md.js

@@ -1,14 +1,31 @@
 import { createRequire } from 'node:module';
-import { realpathSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
+import { realpathSync, readFileSync, writeFileSync, renameSync, rmSync, openSync, readSync, closeSync } from 'node:fs';
 import { basename, dirname, resolve } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { recordCodexDocument } from './codex-doc2md-ledger.js';
+import { readCodexSnapshot } from './codex-parser.js';
 
 const require = createRequire(import.meta.url);
 const doc2md = require('./doc2md.cjs');
 const lint = require('./korean-lint.cjs');
 const shellTools = new Set(['Bash', 'exec_command', 'shell_command', 'shell']);
 
+/** Hook identity, never the user's default model or another project's session. */
+export function codexDocumentContext(payload = {}) {
+  const snapshot = readCodexSnapshot(payload.transcript_path);
+  let provider, id, fd;
+  try {
+    fd = openSync(payload.transcript_path, 'r');
+    const buf = Buffer.alloc(65536);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    const first = JSON.parse(buf.subarray(0, n).toString('utf8').split('\n')[0]);
+    if (first.type === 'session_meta') { provider = first.payload?.model_provider; id = first.payload?.id || first.payload?.session_id; }
+  } catch { /* Payload identity may still be complete. */ }
+  finally { if (fd !== undefined) closeSync(fd); }
+  if (id && payload.session_id && id !== payload.session_id) return {};
+  return { model: payload.model || snapshot?.model, provider: payload.model_provider || provider || snapshot?.provider };
+}
+
 function canonicalPath(file) {
   const missing = [];
   for (let current = file; ; current = dirname(current)) {
@@ -47,8 +64,8 @@ export function convertCodexDocument(source, { convert = doc2md.convert, ...opts
       tmp = null;
     }
     const { savedUsd, baselineTokens, ...meta } = result.meta || {};
-    const prepared = { ...result, cacheFile, meta };
-    recordCodexDocument(source, prepared, opts);
+    const prepared = { ...result, cacheFile, meta: { ...meta, markdownBytes: Buffer.byteLength(text, 'utf8') } };
+    prepared.meta.codexSaving = recordCodexDocument(source, prepared, opts);
     return prepared;
   } catch {
     return { ok: false, reason: 'cache-unavailable' };
@@ -87,7 +104,7 @@ export function codexDocumentTool(payload, { convert = convertCodexDocument, gua
     if (match) file = match[1] || match[2] || match[3];
   }
   if (typeof file !== 'string' || !doc2md.isTargetPath(file)) return null;
-  const result = convert(resolve(cwd, file));
+  const result = convert(resolve(cwd, file), codexDocumentContext(payload));
   if (!result.ok) return { hookSpecificOutput: { hookEventName: 'PreToolUse',
     ...(result.reason === 'unsafe-archive' ? { permissionDecision: 'deny', permissionDecisionReason: '[doc2md] Unsafe archive; do not extract it.' }
       : { additionalContext: `[doc2md] Conversion failed (${result.reason}). Do not claim this document was converted. ${codexDocumentNote()}` }) } };

package/src/codex-doctor.js

@@ -15,13 +15,18 @@ export const CODEX_CAPABILITIES = [
   { feature: 'history', support: 'supported', command: 'sprag history --agent codex', note: 'Codex-only records of context (80%/95%) and 5h/weekly rate-limit (90%) warnings, plus handoffs. Cache and TTL chips are not recorded; last shows the latest event.' },
   { feature: 'handoff', support: 'supported', command: 'sprag handoff --agent codex', note: 'Git state and recorded Codex session usage; never reads Claude caps.' },
   { feature: 'korean', support: 'supported', command: 'sprag korean status --agent codex', note: 'Session guidance and recognized write-target lint; shared preference.' },
+  { feature: 'reply-language', support: 'supported', command: 'sprag korean reply on --agent codex', note: 'Trusted Stop hook checks the current Korean prompt and final reply; continuation, opt-out and explicit English requests are excluded.' },
   { feature: 'cohesion', support: 'supported', command: 'sprag cohesion status --agent codex', note: 'Shared English guidance preference.' },
   { feature: 'doc2md', support: 'supported', command: 'sprag doc2md status --agent codex', note: 'Shared converter, prompt paths, supported file reads, and recognized document/cache write guards; not arbitrary shell extraction.' },
+  { feature: 'doc2md-saved', support: 'partial', command: 'sprag doc2md savings --agent codex', note: 'Office XML versus Markdown bytes/4 at the recorded Codex input price. Estimate only; incomplete or unsupported baselines and missing prices stay unknown.' },
+  { feature: 'delegation-diagnostics', support: 'supported', command: 'sprag delegate doctor --agent codex', note: 'Local feature/catalog and matched-child evidence. Never claims that an enabled preference proves native tools are available.' },
   { feature: 'delegate', support: 'supported', command: 'sprag delegate on --agent codex', note: 'Native routing and shared delegation policies; tier models resolve from priced models already run in Codex, or from explicit mappings. Explicit models/custom roles preserved; bounds are guidance, not enforced limits.' },
   { feature: 'routing-saved', support: 'partial', command: 'sprag route-scan savings --agent codex', note: 'Sprag-routed child usage with matching LiteLLM prices; counterfactual estimate, not billed savings. Unpriced runs stay unknown.' },
   { feature: 'cache-timer', support: 'partial', command: 'sprag cache status --refresh --agent codex', note: 'Documented minimum retention after recorded cache usage; LiteLLM deployments resolved through model/info. Unknown routes show age; exact expiry is not reported.' },
   { feature: 'mode', support: 'partial', command: 'sprag mode --agent codex', note: 'Labels, color, and timer apply to panel/statusline; Claude TTL buckets do not.' },
   { feature: 'upgrade', support: 'manual', command: 'sprag upgrade --print --agent codex', note: 'Skip the Claude npm postinstall; reinstall Codex hooks after upgrade.' },
+  { feature: 'update-notice', support: 'supported', command: 'sprag update-check --agent codex', note: 'Live panel refreshes in the background; one-shot statusline reads cached state; interactive SessionStart offers upgrades with consent.' },
+  { feature: 'implementation-delegation', support: 'supported', command: 'sprag delegate implementation --agent codex --from MODEL --provider PROVIDER --session ID', note: 'Main agent designs and verifies; implementation uses resolved T1 only. Requires native subagent tools and records only matched child runs.' },
   { feature: 'route-scan', support: 'supported', command: 'sprag route-scan --agent codex', note: 'Recurring simple turns grouped by project, provider, and parent model; explicit approval before routing.' },
   { feature: 'seed', support: 'supported', command: 'sprag seed --agent codex', note: 'Shared delegation policies plus agent-compatible ratchet presets. Explicit scope; tier models resolve automatically or by mapping. No Claude installation needed.' },
   { feature: 'transcript ratchet', support: 'supported', command: 'sprag --statusline --agent codex', note: 'Recent repeated tool failures become ratchet? candidates; no automatic rule registration.' },
@@ -37,6 +42,8 @@ export async function codexDoctor({ root = process.cwd(), sessionId, days = 7 }
     const cfg = config.present ? parse(readFileSync(file, 'utf8')) : {};
     // Only expose an allowlist. Provider auth and arbitrary config may hold secrets.
     config.hooksDisabled = cfg.features?.hooks === false || (cfg.features?.hooks === undefined && cfg.features?.codex_hooks === false);
+    config.agentsDisabled = cfg.agents?.enabled === false || cfg.features?.multi_agent === false;
+    config.agentsMaxThreads = cfg.agents?.max_concurrent_threads_per_session ?? cfg.agents?.max_threads ?? null;
     config.statusLine = Array.isArray(cfg.tui?.status_line) ? cfg.tui.status_line.filter((item) => typeof item === 'string') : null;
     config.autoCompactTokenLimit = Number.isFinite(cfg.model_auto_compact_token_limit) ? cfg.model_auto_compact_token_limit : null;
     config.note = 'User config only; active profile, project, managed policy, and runtime overrides may differ.';
@@ -49,5 +56,6 @@ export async function codexDoctor({ root = process.cwd(), sessionId, days = 7 }
     lastActivity: data.session.lastActivity, usageUpdates: data.session.requestCount } : null;
   return { agent: 'codex', home, root, config, hooks, harness: data.harness, rules: data.rules,
     preferences: { korean: data.korean, lint: data.lint, cohesion: data.cohesion, doc2md: data.doc2md, brief: data.brief, delegate: data.delegate },
-    session, panel: panelHealth(root, { sessionId }), capabilities: CODEX_CAPABILITIES };
+    session, delegation: { ...data.delegation, tools: 'unknown; only the running agent can confirm spawn_agent and wait_agent availability' },
+    documents: data.documents, routingSaved: data.routingSaved, panel: panelHealth(root, { sessionId }), capabilities: CODEX_CAPABILITIES };
 }

package/src/codex-harness.js

@@ -5,6 +5,7 @@ import { codexUserDir } from './agent.js';
 import { loadConfig } from './config.js';
 import { koreanStyleEnabled, koreanStyleInjection } from './korean-style.js';
 import { codexToolEvents, codexLegacyToolEvent, readCodexTailLines, forkedCopyFilter } from './codex-parser.js';
+import { implementationDelegationRule } from './implementation-delegation.js';
 
 export const CODEX_BEGIN = '<!-- sprag:codex:harness:begin -->';
 export const CODEX_END = '<!-- sprag:codex:harness:end -->';
@@ -39,7 +40,7 @@ function harnessFiles(root, scope) {
 }
 
 export function codexHarnessBlock() {
-  return `${CODEX_BEGIN}\n## Sprag Harness\n\n${sections.map(([name, text], i) => `### ${i + 1}. ${name}\n${text}`).join('\n\n')}\n\nRead the global and project Codex ratchet files before working when present. Run \`sprag harness list --agent codex --global\` and \`sprag harness list --agent codex --project\` to retrieve them. These are instructions, not Claude-style @ imports.\nUse \`sprag doc2md <file> --agent codex\` before reading PDF, Office, or Figma documents. Delegate only through available Codex tools and configured roles; do not assume Claude model names or Task/Agent arguments. A [Sprag model routing] note on a request means the user has asked for that request to be delegated: spawn the sub-agent it describes (its model, reasoning_effort, fork_turns "none", and a self-contained message ending with the route line it gives), wait for it to finish instead of doing the same task yourself, then verify the result before replying.\n${CODEX_END}\n`;
+  return `${CODEX_BEGIN}\n## Sprag Harness\n\n${sections.map(([name, text], i) => `### ${i + 1}. ${name}\n${text}`).join('\n\n')}\n\nRead the global and project Codex ratchet files before working when present. Run \`sprag harness list --agent codex --global\` and \`sprag harness list --agent codex --project\` to retrieve them. These are instructions, not Claude-style @ imports.\nUse \`sprag doc2md <file> --agent codex\` before reading PDF, Office, or Figma documents. Delegate only through available Codex tools and configured roles; do not assume Claude model names or Task/Agent arguments. A [Sprag model routing] note on a request means the user has asked for that request to be delegated: spawn the sub-agent it describes (its model, reasoning_effort, fork_turns "none", and a self-contained message ending with the route line it gives), wait for it to finish instead of doing the same task yourself, then verify the result before replying.\n\n${implementationDelegationRule('codex')}\nAfter fixing the design, resolve T1 with \`sprag delegate implementation --agent codex --from <active-parent-model> --provider <active-provider> --session <parent-session-id>\`. This implementation-split policy is the user's delegation request, including selection of the returned model. Do not infer the active model from the default config. Send the returned route line only at the end of the child message, use fork_turns "none", and wait with wait_agent (timeout_ms at least 120000, repeating if needed). If tools are unavailable, do not run the resolver or launch another CLI; work on the main agent and disclose it.\n${CODEX_END}\n`;
 }
 
 /** The [start, end) span of a marker block, null when absent; malformed markers throw. */

package/src/codex-hooks.js

@@ -10,13 +10,14 @@ import { codexHarnessPaths, syncCodexKoreanBlock } from './codex-harness.js';
 import { writeViaTmp } from './state-file.js';
 import { findProjectRoot } from './harness.js';
 import { runCodexBrief } from './codex-brief.js';
-import { codexDocumentTool, codexDocumentNote, convertCodexDocument } from './codex-doc2md.js';
+import { codexDocumentTool, codexDocumentNote, convertCodexDocument, codexDocumentContext } from './codex-doc2md.js';
 import { codexDelegationTool, codexRouteHint, codexDelegateEnabled } from './codex-delegation.js';
 import { bindCodexSubagent, closeStaleCodexRoutes, unsettledCodexRoutes } from './codex-ledger.js';
 import { seedOfferBlock } from './seed-rules.js';
 import { readCodexRouteScan, openCodexCandidates, shouldRescanCodex } from './codex-route-scan.js';
 import { userDataDir } from './paths.js';
 import { debug } from './debug.js';
+import { updateOffer } from './update-notice.js';
 
 const require = createRequire(import.meta.url);
 const lint = require('./korean-lint.cjs');
@@ -162,8 +163,14 @@ export function lintCodexTool(payload, { scope = 'all' } = {}) {
   return messages.length ? messages.join('\n\n') : null;
 }
 
-export async function codexHookOutput(event, payload, { cfg = loadConfig(), refreshLedger = defaultLedgerRefresh } = {}) {
+export async function codexHookOutput(event, payload, { cfg = loadConfig(), refreshLedger = defaultLedgerRefresh, version } = {}) {
   if (!payload || typeof payload !== 'object') return null;
+  if (event === 'stop') {
+    if (payload.stop_hook_active || !koreanStyleEnabled(cfg) || cfg?.koreanReplyCheck === false) return null;
+    const { checkCodexReplyLanguage } = await import('./codex-reply-language.js');
+    if (!checkCodexReplyLanguage(payload)) return null;
+    return { decision: 'block', reason: '사용자는 한국어로 질문했는데 마지막 답변이 영어로 작성됐습니다. 같은 내용을 한국어로 다시 답하십시오. 코드, 명령어, 오류 원문, 커밋 메시지는 그대로 유지하십시오.' };
+  }
   if (event === 'session-start' || event === 'subagent-start') {
     if (event === 'subagent-start' && !codexDelegateEnabled(cfg)) return null;
     if (event === 'subagent-start') {
@@ -203,6 +210,7 @@ export async function codexHookOutput(event, payload, { cfg = loadConfig(), refr
     if (process.env.CTS_NO_DOC2MD !== '1' && cfg?.codex?.doc2md !== false) parts.push({ priority: 4, spill: true, text: codexDocumentNote() });
     // Offers ask the user a question; a `codex exec` run has no one to answer it.
     if (event === 'session-start' && payload.source !== 'compact' && !isCodexExecSession(payload.transcript_path)) {
+      if (version) parts.push({ priority: 5, text: updateOffer(version, { agent: 'codex', lang: userLanguage() }) });
       try { parts.push({ priority: 5, text: await routeNotice(root) }); } catch (e) { debug('codex:route-notice', e); }
       try { parts.push({ priority: 6, text: seedOfferBlock({ root, agent: 'codex' }) }); } catch (e) { debug('codex:seed-offer', e); }
     }
@@ -228,7 +236,8 @@ export async function codexHookOutput(event, payload, { cfg = loadConfig(), refr
       catch (e) { debug('codex:brief', e); }
     }
     if (process.env.CTS_NO_DOC2MD !== '1' && cfg?.codex?.doc2md !== false) {
-      parts.push(doc2md.contextForPrompt(payload, { lang: userLanguage(), agent: 'codex', convert: convertCodexDocument }));
+      const identity = codexDocumentContext(payload);
+      parts.push(doc2md.contextForPrompt(payload, { lang: userLanguage(), agent: 'codex', convert: (source) => convertCodexDocument(source, identity) }));
     }
     return context('UserPromptSubmit', parts.filter(Boolean).join('\n\n'));
   }

package/src/codex-installer.js

@@ -9,6 +9,7 @@ export const CODEX_HANDLERS = {
   PreToolUse: { matcher: '^(Bash|Read|read_file|Edit|Write|Agent|spawn_agent|mcp__filesystem__read_(?:text_)?file|(?:functions\\.|tools\\.)?(?:exec_command|shell_command|shell|apply_patch|spawn_agent))$', command: 'sprag codex-hook --agent codex --event pre-tool', timeout: 600 },
   PostToolUse: { matcher: '^(Bash|apply_patch|Edit|Write|(?:functions\\.|tools\\.)?(?:exec_command|shell_command|shell|apply_patch))$', command: 'sprag codex-hook --agent codex --event post-tool', timeout: 15 },
   SubagentStart: { command: 'sprag codex-hook --agent codex --event subagent-start', timeout: 15 },
+  Stop: { command: 'sprag codex-hook --agent codex --event stop', timeout: 15 },
 };
 const ownCommands = new Set(Object.values(CODEX_HANDLERS).map((h) => h.command));
 const PANEL_COMMAND = 'sprag codex-hook --agent codex --event panel-start';

package/src/codex-ledger.js

@@ -177,6 +177,29 @@ export function loadCodexLedger({ dir = userDataDir() } = {}) {
   return { version: 1, events: {} };
 }
 
+/** Offers are not executions. Count tier alternatives as one offer per prompt. */
+export function codexDelegationStatus({ dir = userDataDir(), sessionId, now = Date.now() } = {}) {
+  const routes = readCodexDelegations({ dir }).filter((r) => now - r.at < PENDING_TTL_MS && r.at <= now &&
+    (!sessionId || r.parentSessionId === sessionId));
+  const bound = new Set(readCodexBindings({ dir }).map((b) => b.id));
+  const events = loadCodexLedger({ dir }).events;
+  const closed = closedCodexRouteIds({ dir });
+  const offers = new Map();
+  for (const r of routes) {
+    const key = r.offerId || r.id;
+    if (!offers.has(key)) offers.set(key, []);
+    offers.get(key).push(r);
+  }
+  const result = { offers: offers.size, bound: 0, settled: 0, pending: 0, unclaimed: 0 };
+  for (const group of offers.values()) {
+    if (group.some((r) => events[r.id]?.complete || events[r.id]?.aborted)) result.settled++;
+    else if (group.some((r) => bound.has(r.id) || events[r.id])) result.bound++;
+    else if (group.every((r) => closed.has(r.id) || now - r.at >= BIND_TTL_MS)) result.unclaimed++;
+    else result.pending++;
+  }
+  return result;
+}
+
 function saveLedger(data, dir) {
   mkdirSync(dir, { recursive: true });
   const file = ledgerFile(dir), tmp = `${file}.${randomUUID()}.tmp`;
@@ -242,7 +265,7 @@ export async function refreshCodexLedger({ dir = userDataDir(), home, now = Date
     if (route.provider && route.provider !== run.provider) continue;
     // A shared policy names its model only through the caller's choice, so
     // credit it only for a child of that parent that ran the mapped model.
-    if (route.source === 'shared' && (run.model !== route.to || !route.parentSessionId ||
+    if (['shared', 'implementation'].includes(route.source) && (run.model !== route.to || !route.parentSessionId ||
         run.parentThreadId !== route.parentSessionId)) continue;
     if (Number.isFinite(run.startedAt) && run.startedAt < route.at - 5000) continue;
     // A closed route ended with its hinted turn. Only a child that started
@@ -265,6 +288,7 @@ export async function refreshCodexLedger({ dir = userDataDir(), home, now = Date
     const event = { ts: run.endedAt ?? route.at, parentSessionId: route.parentSessionId || run.parentThreadId || null,
       childSessionId: run.sessionId, source: route.source, category: route.category ?? null, scope: route.scope ?? null,
       ...(route.source === 'shared' ? { tier: route.tier, sharedSignature: route.sharedSignature } : {}),
+      ...(route.source === 'implementation' ? { tier: route.tier } : {}),
       from: route.from, to, provider,
       ...(route.targetRoot !== undefined ? { targetRoot: route.targetRoot } : {}),
       ...(route.ruleCreatedAt !== undefined ? { ruleCreatedAt: route.ruleCreatedAt } : {}), tokens: run.tokens, calls: run.calls, toolErrors: run.toolErrors, usd, rates: usd === null ? null : rates,

package/src/codex-panel.js

@@ -17,15 +17,16 @@ import { formatResetIn } from './format-time.js';
 import { codexDocumentTotals } from './codex-doc2md-ledger.js';
 import { codexHookStatus } from './codex-installer.js';
 import { koreanStyleEnabled } from './korean-style.js';
-import { codexRoutingSavedTotals, loadCodexLedger } from './codex-ledger.js';
+import { codexRoutingSavedTotals, loadCodexLedger, codexDelegationStatus } from './codex-ledger.js';
 import { loadCodexModelRules, codexDelegateEnabled } from './codex-delegation.js';
-import { codexRulesInReview } from './codex-rule-health.js';
+import { codexRulesInReview, codexSharedRuleHealth } from './codex-rule-health.js';
 import { readCodexRouteScan, openCodexCandidates } from './codex-route-scan.js';
 import { codexBudgetProvider } from './codex-budget.js';
+import { readUpdateChip } from './update-notice.js';
 
 export const CODEX_SEGMENT_ORDER = [
-  'cap-warn', 'usage', 'ctx', 'ttl', 'model', 'effort',
-  'hit', 'saved', 'doc2md', 'harness', 'korean', 'version',
+  'cap-warn', 'update', 'usage', 'ctx', 'ttl', 'model', 'effort',
+  'hit', 'saved', 'doc2md', 'routing', 'harness', 'korean', 'version',
 ];
 
 // Only cache full-session parses. A moving time cutoff would make an unchanged
@@ -34,7 +35,8 @@ export const CODEX_SEGMENT_ORDER = [
 const RATCHET_SIBLING_MS = 30 * 60000;
 
 export function createPanelReader({ root = process.cwd(), home, sessionId: pinnedId, sessionFile, days = 7, readBudget = () => null,
-  readCachePolicy = (session) => readCodexCachePolicy(session, { home }), hasFlag = () => false } = {}) {
+  readCachePolicy = (session) => readCodexCachePolicy(session, { home }), hasFlag = () => false,
+  version, refreshUpdate = false } = {}) {
   if (pinnedId && sessionFile) throw new Error('Choose --session or --session-file, not both.');
   const cache = new Map();
   const ratchetCache = new Map();
@@ -121,11 +123,15 @@ export function createPanelReader({ root = process.cwd(), home, sessionId: pinne
       const modelRules = loadCodexModelRules();
       if (modelRules.length) ruleReview = codexRulesInReview({ root: project, rules: modelRules, events: Object.values(loadCodexLedger().events) }).map((r) => r.index);
     } catch { /* Unreadable rules or ledger show no chip. */ }
+    let sharedRuleReview = [];
+    try { sharedRuleReview = codexSharedRuleHealth({ root: project }).filter((r) => r.health.status === 'review'); }
+    catch { /* Shared policy health must not hide the rest of the panel. */ }
     let routingSaved = null;
     try { routingSaved = { ...codexRoutingSavedTotals(), pricesAvailable: isDirectOpenAI(selected?.provider, home ? { home } : {}) || !!readCodexPrices({ provider: codexBudgetProvider(home ? { home } : {}), ...(home ? { home } : {}) }) }; }
     catch { /* Unreadable ledger reads as n/a. */ }
     return { session: selected, matches, root, sessionId, selection, bindingPending: !!sessionFile && !sessionId, days, harness, rules,
-      ratchet: ratchetFor(selected, recent.filter((file) => file !== selected?.filePath)), route, ruleReview, routingSaved,
+      ratchet: ratchetFor(selected, recent.filter((file) => file !== selected?.filePath)), route, ruleReview, sharedRuleReview, routingSaved,
+      delegation: codexDelegationStatus({ sessionId: sessionId || selected?.sessionId }),
       labelMode: resolveLabelMode({ cfg: statuslineDefaults(), hasFlag }).mode,
       color: statuslineDefaults().color,
       timer: !hasFlag('--no-timer') && (hasFlag('--timer') || statuslineDefaults().timer),
@@ -140,6 +146,7 @@ export function createPanelReader({ root = process.cwd(), home, sessionId: pinne
       brief: cfg?.codex?.brief !== false,
       delegate: codexDelegateEnabled(cfg),
       doc2md: cfg?.codex?.doc2md !== false && process.env.CTS_NO_DOC2MD !== '1',
+      update: version ? readUpdateChip(version, { refresh: refreshUpdate }) : null,
       updatedAt: new Date() };
   };
 }
@@ -276,16 +283,27 @@ function panelGroups(data, { now, version = '', full = false, mode = full ? 'tex
     chip(`Reasoning ${short(s.reasoningOutputTokens)} (in output)`),
   ] : []);
   const docs = data.documents;
-  register('doc2md', 'documents', docs?.scope === 'codex-total' && docs.docs > 0 ? [
-    chip(`${icon('doc')}Doc2md ${number(docs.docs)} docs (Codex total)`, 32),
+  const docSavings = docs?.scope === 'codex-total' ? docs.savings : null;
+  register('doc2md', 'savings', [
+    chip(`Doc2md saved ${docSavings?.priced ? `${signedMoney(docSavings.total)} est. (XML vs MD)`
+      : `n/a (${docs?.docs ? `${docs.docs} unpriced docs` : 'no documents'})`}`, docSavings?.priced ? (docSavings.total < 0 ? 33 : 32) : 90),
+    ...(docSavings?.priced && docSavings.unpriced ? [chip(`${docSavings.unpriced} docs unpriced`)] : []),
+    ...(docs?.scope === 'codex-total' && docs.docs > 0 ? [chip(`${icon('doc')}Doc2md ${number(docs.docs)} docs (Codex total)`, 32),
     ...(docs.byExt || []).map((row) => chip(`${terminalText(row.ext)} ${number(row.docs)}x`)),
-  ] : []);
+    ] : []),
+  ]);
+  const delegation = data.delegation;
+  register('routing', 'savings', [routingChip(data.routingSaved, chip),
+    delegation?.offers ? chip(`Delegation ${delegation.settled} completed / ${delegation.bound} bound / ${delegation.pending} pending / ${delegation.unclaimed} unclaimed (session)`,
+      delegation.unclaimed && !delegation.settled && !delegation.bound ? 33 : 90) : null,
+  ]);
   register('harness', 'preferences', [
     chip(`${icon('harness')}Harness ${h?.error ? 'ERROR' : h ? `${h.configured}/${h.total}` : 'n/a'}`, h?.configured === 5 ? 32 : 33),
     chip(`Ratchet ${data.rules?.global ?? '?'}/${data.rules?.project ?? '?'}`),
     // A repeated failure outranks a delegation candidate, as in the Claude statusline.
     data.ratchet?.length ? chip(`ratchet? #${data.ratchet[0].id} x${data.ratchet[0].count}`, 33) : null,
     data.ruleReview?.length ? chip(`rule-health #${data.ruleReview[0]}${data.ruleReview.length > 1 ? ` +${data.ruleReview.length - 1}` : ''}`, 33) : null,
+    data.sharedRuleReview?.length ? chip(`rule-health shared ${terminalText(data.sharedRuleReview[0].rule.tier)} ${terminalText(data.sharedRuleReview[0].rule.category)}${data.sharedRuleReview.length > 1 ? ` +${data.sharedRuleReview.length - 1}` : ''}`, 33) : null,
     data.route?.length ? chip(`route? R${data.route[0].id} ${terminalText(data.route[0].category)}${data.route.length > 1 ? ` +${data.route.length - 1}` : ''}`, 33) : null,
   ]);
   register('korean', 'preferences', [
@@ -294,8 +312,11 @@ function panelGroups(data, { now, version = '', full = false, mode = full ? 'tex
     chip(`${icon('doc')}Doc2md ${data.doc2md ? 'on' : 'off'} (prefs)`),
     ...(data.hooks ? [chip(`Hooks ${data.hooks.filter((hook) => hook.registered).length}/${data.hooks.length} registered`)] : []),
     ...(data.brief !== undefined ? [chip(`Brief ${data.brief ? 'on' : 'off'}`)] : []),
-    ...(data.delegate !== undefined ? [chip(`Delegate ${data.delegate ? 'on' : 'off'} (model routing)`)] : []),
-    routingChip(data.routingSaved, chip),
+    ...(data.delegate !== undefined ? [chip(`Delegate ${data.delegate ? 'on' : 'off'} (preference; tools unverified)`)] : []),
+  ]);
+  register('update', 'priority', [
+    data.update?.available && !data.update.dismissed
+      ? chip(`${icon('upgrade')}v${terminalText(version)} -> ${terminalText(data.update.latest)}`, 33) : null,
   ]);
   register('version', 'preferences', [
     chip(`SPRAG${version ? ` v${terminalText(version)}` : ''} / ${s ? age(s.lastActivity, now) : 'waiting'}`,
@@ -453,7 +474,7 @@ export async function runCodexPanel({ read, interval = 2000, once = false, color
       try { lastData = await read(); }
       catch (e) { lastData = { ...lastData, error: e.message }; }
       if (stopped) break;
-      if (compact && !once) fitRows(formatCodexPanel(lastData, { columns: (output.columns || 100) - 1, rows: 10000, color: false, compact: true }).split('\n').length);
+      if (compact && !once) fitRows(formatCodexPanel(lastData, { columns: (output.columns || 100) - 1, rows: 10000, color: false, compact: true, version }).split('\n').length);
       draw();
       if (once) break;
       await wait();

package/src/codex-reply-language.js

@@ -0,0 +1,43 @@
+import { createRequire } from 'node:module';
+import { forkedCopyFilter, codexToolEvents } from './codex-parser.js';
+
+const { checkReplyLanguage } = createRequire(import.meta.url)('./reply-language.cjs');
+
+/** Ignore copied history and commentary; only the current turn's final reply counts. */
+export function lastCodexTurn(lines, { turnId, sessionId } = {}) {
+  const copied = forkedCopyFilter();
+  let prompt = null, reply = '', currentTurn = null;
+  for (const line of lines) {
+    let e;
+    try { e = JSON.parse(line); } catch { continue; }
+    if (copied(e)) continue;
+    const p = e?.payload;
+    if (!p) continue;
+    if (e.type === 'session_meta' && sessionId && (p.id || p.session_id) !== sessionId) return null;
+    if (e.type === 'event_msg' && p.type === 'task_started') {
+      currentTurn = p.turn_id;
+      prompt = null;
+      reply = '';
+    }
+    for (const ev of codexToolEvents(e)) {
+      if (ev.kind !== 'user' || (sessionId && ev.threadId && ev.threadId !== sessionId)) continue;
+      currentTurn = ev.turnId || currentTurn;
+      prompt = ev.text;
+      reply = '';
+    }
+    if (e.type === 'response_item' && p.type === 'message' && p.role === 'assistant' && p.phase === 'final_answer') {
+      reply = (Array.isArray(p.content) ? p.content : []).filter((b) => b?.type === 'output_text' && typeof b.text === 'string').map((b) => b.text).join('\n');
+    }
+    if (e.type === 'event_msg' && p.type === 'task_complete' && (!p.turn_id || p.turn_id === currentTurn) &&
+        typeof p.last_agent_message === 'string') reply = p.last_agent_message;
+  }
+  if (prompt === null || (turnId && currentTurn !== turnId)) return null;
+  return { prompt, reply };
+}
+
+export function checkCodexReplyLanguage(payload) {
+  return checkReplyLanguage(payload.transcript_path, {
+    parseTurn: (lines) => lastCodexTurn(lines, { turnId: payload.turn_id, sessionId: payload.session_id }),
+    reply: payload.last_assistant_message,
+  });
+}

package/src/codex-rule-health.js

@@ -2,6 +2,7 @@ import { resolve } from 'node:path';
 import { loadCodexLedger } from './codex-ledger.js';
 import { isFailedRun } from './route-scan.js';
 import { wilsonLowerBound, HEALTH_ERR_RATE, HEALTH_MIN_SAMPLE_DELEGATED } from './model-rules.js';
+import { loadSharedModelRules, sharedModelRulesForProject, realProjectRoot } from './shared-model-rules.js';
 
 /**
  * Measured outcome of one Codex rule, judged as Claude's rule health judges
@@ -18,12 +19,34 @@ export function codexRuleHealth(rule, { events = Object.values(loadCodexLedger()
     (rule.scope !== 'project' || (typeof e.targetRoot === 'string' && e.targetRoot === rule.targetRoot)) &&
     // A rule deleted and added again starts a fresh record.
     (!Number.isFinite(since) || (Number.isFinite(e.ts) && e.ts >= since)));
+  return healthOf(runs.filter((e) => e.source !== 'shared'));
+}
+
+function healthOf(runs) {
   const errs = runs.filter((e) => e.aborted || isFailedRun({ toolErrors: e.toolErrors, calls: e.calls })).length;
   const saved = runs.filter((e) => Number.isFinite(e.usd)).reduce((sum, e) => sum + e.usd, 0);
   const review = runs.length >= HEALTH_MIN_SAMPLE_DELEGATED && wilsonLowerBound(errs, runs.length) > HEALTH_ERR_RATE;
   return { runs: runs.length, errs, rate: runs.length ? errs / runs.length : 0, saved, status: review ? 'review' : 'active' };
 }
 
+/** Shared policies keep Codex outcomes separate, including each provider/model pair. */
+export function codexSharedRuleHealth({ root = process.cwd(), dir, events = Object.values(loadCodexLedger({ dir }).events) } = {}) {
+  const policies = sharedModelRulesForProject(loadSharedModelRules({ dir }), root);
+  return policies.flatMap((rule) => {
+    const groups = new Map();
+    for (const e of events) {
+      if (e?.source !== 'shared' || !(e.complete || e.aborted) || e.sharedSignature !== rule.sharedSignature ||
+          e.category !== rule.category || e.tier !== rule.tier || e.scope !== rule.scope ||
+          (rule.scope === 'project' && (typeof e.targetRoot !== 'string' || realProjectRoot(e.targetRoot) !== rule.targetRoot))) continue;
+      const key = JSON.stringify([e.provider, e.from, e.to]);
+      if (!groups.has(key)) groups.set(key, []);
+      groups.get(key).push(e);
+    }
+    return [...groups.values()].map((runs) => ({ rule, provider: runs[0].provider, from: runs[0].from,
+      model: runs[0].to, health: healthOf(runs) }));
+  });
+}
+
 /**
  * Rules in review that apply to the project at `root`: global rules, and
  * project rules whose targetRoot is `root`; a null `root` lists every rule. `index` is the 1-based number the