unsnooze 1.18.0 → 1.19.1

package/src/fish.js

@@ -0,0 +1,22 @@
+// Where the fish shell looks for its config.
+//
+// A leaf module (node builtins only) on purpose — the same reason
+// powershell.js exists: install.js already imports doctor.js, and doctor.js
+// needs this to answer "are the wrappers installed?" for fish users.
+// Declaring it in install.js would close that loop (see
+// test/module-graph.test.js for what that breaks).
+//
+// fish reads its config from <config-home>/fish/config.fish, where
+// <config-home> honors XDG_CONFIG_HOME (absolute paths only — the XDG spec
+// says a relative value must be ignored, and fish follows that).
+
+import { homedir } from 'node:os';
+import { join, isAbsolute } from 'node:path';
+
+export function fishConfigPath({ env = process.env, home = homedir() } = {}) {
+  // Test/CI override, matching UNSNOOZE_QWEN_DIR and the autostart dir vars.
+  if (env.UNSNOOZE_FISH_CONFIG) return env.UNSNOOZE_FISH_CONFIG;
+  const xdg = env.XDG_CONFIG_HOME;
+  if (xdg && isAbsolute(xdg)) return join(xdg, 'fish', 'config.fish');
+  return join(home, '.config', 'fish', 'config.fish');
+}

package/src/install.js

@@ -5,14 +5,17 @@
 //     atomic write)
 //   - ~/.zshrc + ~/.bashrc: one fence-marked block with a wrapper function per
 //     enabled agent (claude/codex/grok), routed through `unsnooze _run`
+//   - ~/.config/fish/config.fish: the same block in fish syntax (fish shares
+//     no syntax with POSIX rc files — a bash function there is a parse error)
 //   - ~/.grok/hooks/unsnooze.json when the grok agent is enabled
-// --settings <path> / --zshrc <path> override targets (used by tests).
+// --settings <path> / --zshrc <path> / --fishrc <path> override targets (used
+// by tests).
 
 import { readFileSync, writeFileSync, renameSync, existsSync, copyFileSync, rmSync, mkdirSync, unlinkSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { homedir, userInfo } from 'node:os';
 import { join, dirname, delimiter } from 'node:path';
-import { CLAUDE_SETTINGS, STATE_DIR } from './config.js';
+import { CLAUDE_SETTINGS, STATE_DIR, WINDOWS_TASK_NAME } from './config.js';
 import { getConfig, configFileExists } from './settings.js';
 import { xmlEscape } from './notify.js';
 import { installGrokHooks, uninstallGrokHooks } from './agents/grok.js';
@@ -21,6 +24,7 @@ import { findCsgProcesses, findCsgAutostarts } from './doctor.js';
 import { UNSNOOZE_BIN, stopResumer } from './spawn.js';
 import { uninstallStatuslineShim } from './usage.js';
 import { powershellProfilePath } from './powershell.js';
+import { fishConfigPath } from './fish.js';
 
 const FENCE_OPEN = '# >>> unsnooze >>>';
 const FENCE_CLOSE = '# <<< unsnooze <<<';
@@ -33,13 +37,17 @@ const LEGACY_FENCES = [
 const OLD_FENCE_OPEN = LEGACY_FENCES[0].open;
 
 function parseArgs(rest) {
-  const opts = { yes: false, settings: CLAUDE_SETTINGS, zshrc: join(homedir(), '.zshrc'), purge: false, daemon: false };
+  const opts = {
+    yes: false, settings: CLAUDE_SETTINGS, zshrc: join(homedir(), '.zshrc'),
+    fishrc: fishConfigPath(), purge: false, daemon: false,
+  };
   for (let i = 0; i < rest.length; i++) {
     if (rest[i] === '--yes' || rest[i] === '-y') opts.yes = true;
     else if (rest[i] === '--purge') opts.purge = true;
     else if (rest[i] === '--daemon') opts.daemon = true;
     else if (rest[i] === '--settings') opts.settings = rest[++i];
     else if (rest[i] === '--zshrc') opts.zshrc = rest[++i];
+    else if (rest[i] === '--fishrc') opts.fishrc = rest[++i];
   }
   return opts;
 }
@@ -204,6 +212,38 @@ export function installZshrcBlock(content, agents = ['claude']) {
   return { content: result, oldRemoved };
 }
 
+// The fish twin of wrapperBlock(). Fish shares no syntax with the POSIX block:
+// `name() { … }` is a parse error there, `$?` is `$status`, and `"${X}"` is
+// `"${X}"` verbatim text — so the wrapper gets its own body. Same semantics as
+// the zsh/bash wrapper: a recursion guard (UNSNOOZE_ACTIVE), the load-bearing
+// missing-file fallback to the real CLI, and `_run <id>` routing.
+//
+// Redefining a function replaces any earlier one, which covers fish "aliases"
+// (they are functions too) — no `unalias` analogue is needed. Fish comments
+// are `#`, so the same fence markers work and stripFencedBlock() removes it
+// unchanged.
+export function fishWrapperBlock(agents = ['claude'], bin = UNSNOOZE_BIN) {
+  const fns = agents.flatMap(id => wrapperNamesFor(id).map(name => `function ${name} --description 'unsnooze-wrapped ${name}'
+  if test "$UNSNOOZE_ACTIVE" = "1"; or not test -f '${bin}'
+    command ${name} $argv
+    return $status
+  end
+  node '${bin}' _run ${id} $argv
+end`)).join('\n');
+  return `${FENCE_OPEN}
+# unsnooze wrappers: route every interactive launch of the CLIs below through
+# unsnooze so limit stops are recorded and auto-resumed.
+${fns}
+${FENCE_CLOSE}`;
+}
+
+// installZshrcBlock's fish twin. Same fence, same replace-don't-append
+// behaviour, so re-running setup never stacks a second copy of the wrappers.
+export function installFishBlock(content, agents = ['claude'], bin = UNSNOOZE_BIN) {
+  const { content: cleaned } = stripFencedBlock(content, FENCE_OPEN, FENCE_CLOSE);
+  return cleaned.replace(/\n+$/, '\n') + '\n' + fishWrapperBlock(agents, bin) + '\n';
+}
+
 // --- daemon autostart ---
 // GUI sessions (VS Code extension, desktop apps) never pass through the shell
 // wrappers, so their limit stops are only caught while `unsnooze daemon` is
@@ -213,7 +253,7 @@ export function installZshrcBlock(content, agents = ['claude']) {
 export const DAEMON_LABEL = 'com.unsnooze.daemon';
 // Task Scheduler has no reverse-DNS convention and shows this name to the user
 // in taskschd.msc, so it is a plain word rather than the launchd label.
-export const WINDOWS_TASK_NAME = 'unsnooze';
+export { WINDOWS_TASK_NAME };
 
 // Is this process running under the supervisor we install, rather than from
 // somebody's shell? It decides whether exiting is safe: a supervised daemon
@@ -555,6 +595,22 @@ function rcTargets(opts, explicit) {
   return existing.length > 0 ? existing : [opts.zshrc];
 }
 
+// The fish config is a separate target from the POSIX rc loop: fish syntax
+// shares nothing with bash, so it gets its own block, and fish reads only
+// <config-home>/fish/config.fish. Touch it when the file already exists (the
+// same any-rc rule as zsh/bash), or when fish is the login shell — a fish
+// user may not have created config.fish yet, and a wrapper that would never
+// load is the same silent-miss as a profile written to a guessed path. Empty
+// list = no evidence of fish on this machine; leave it alone.
+function fishTargets(opts, explicit) {
+  if (explicit) return [opts.fishrc];
+  const cfg = fishConfigPath();
+  if (existsSync(cfg)) return [cfg];
+  const loginShell = process.env.SHELL || userInfo().shell;
+  if (typeof loginShell === 'string' && /(^|\/|\\)fish$/.test(loginShell)) return [cfg];
+  return [];
+}
+
 export function cmdInstall(rest, { agents = enabledAgents() } = {}) {
   const opts = parseArgs(rest);
   const explicitRc = rest.includes('--zshrc');
@@ -623,6 +679,21 @@ export function cmdInstall(rest, { agents = enabledAgents() } = {}) {
     }
   }
 
+  // 3c. Fish config. The POSIX loop above is a parse error in fish, and the
+  //     PowerShell profile never loads there — fish needs its own block or a
+  //     fish user's `claude` never routes through unsnooze at all.
+  for (const cfg of fishTargets(opts, rest.includes('--fishrc'))) {
+    try {
+      mkdirSync(dirname(cfg), { recursive: true });
+      const before = existsSync(cfg) ? readFileSync(cfg, 'utf-8') : '';
+      if (existsSync(cfg)) backupOnce(cfg);
+      atomicWrite(cfg, installFishBlock(before, agents, UNSNOOZE_BIN));
+      console.log(`unsnooze: fish wrappers (${agents.join(', ')}) installed in ${cfg}`);
+    } catch (err) {
+      console.log(`unsnooze: could not write the fish config (${err.message})`);
+    }
+  }
+
   // 4. Daemon autostart (GUI-session watching), opt-in via --daemon / wizard.
   if (opts.daemon) {
     const target = installDaemonAutostart();
@@ -698,6 +769,17 @@ export function cmdUninstall(rest) {
     console.log(`unsnooze: could not clean the PowerShell profile (${err.message})`);
   }
 
+  // The fish config is a wrapper site too, same reason as the PowerShell
+  // profile above: a stale block would keep shadowing the real CLI.
+  for (const cfg of fishTargets(opts, rest.includes('--fishrc'))) {
+    if (!existsSync(cfg)) continue;
+    const { content, found } = stripFencedBlock(readFileSync(cfg, 'utf-8'), FENCE_OPEN, FENCE_CLOSE);
+    if (found) {
+      atomicWrite(cfg, content);
+      console.log(`unsnooze: fish wrappers removed from ${cfg}`);
+    }
+  }
+
   const autostart = uninstallDaemonAutostart();
   if (autostart) console.log(`unsnooze: daemon autostart removed (${autostart})`);
 

package/src/launcher.js

@@ -2,7 +2,7 @@
 //   - outside a multiplexer: re-exec through its launchWrapped operation
 //   - inside one: spawn a detached per-pane monitor, then run the CLI,
 //     propagating its exit code
-//   - -p/--print: pure pass-through, no monitor (nothing interactive to scrape)
+//   - -p/--print, -h/--help, -v/-V/--version: pure pass-through, no monitor (nothing interactive to scrape)
 
 import { spawn, spawnSync } from 'node:child_process';
 import { getMultiplexer } from './multiplexer.js';
@@ -16,8 +16,12 @@ import { AgentDispatchedError, SessionCreateError, attachHint } from './multiple
 
 const log = makeLogger('launcher');
 
-function isPrintMode(args) {
-  return args.includes('-p') || args.includes('--print');
+export function isPassthrough(args = []) {
+  return args.some(a =>
+    a === '-p' || a === '--print'
+    || a === '-h' || a === '--help'
+    || a === '-v' || a === '-V' || a === '--version'
+  );
 }
 
 export function resolvePaneOwner(muxName, env = process.env) {
@@ -34,7 +38,14 @@ export function resolvePaneOwner(muxName, env = process.env) {
 
 function runUnwatched(agent, args, reason) {
   if (reason) process.stderr.write(`unsnooze: ${reason}\n`);
+  return runPassthrough(agent, args);
+}
+
+// spawnSync reports a binary it could not start as r.error with no status;
+// `r.status ?? 1` alone turned `spawn codex ENOENT` into a silent exit 1.
+function runPassthrough(agent, args) {
   const r = spawnSync(agent.bin, args, { stdio: 'inherit', env: { ...process.env, UNSNOOZE_ACTIVE: '1' } });
+  if (r.error) return launchFailed(agent, r.error);
   return r.status ?? 1;
 }
 
@@ -44,9 +55,13 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
   // Recursion / nested-launch guard: inside an unsnooze-managed session, a
   // plain `claude`/`codex`/`unsnooze` call goes straight through. Same for an
   // agent the user disabled in settings — run it, don't watch it.
-  if (process.env.UNSNOOZE_ACTIVE === '1' || isPrintMode(args) || !getConfig(`agents.${agent.id}`)) {
-    const r = spawnSync(agent.bin, args, { stdio: 'inherit', env: { ...process.env, UNSNOOZE_ACTIVE: '1' } });
-    return r.status ?? 1;
+  //
+  // Non-interactive / informational invocations (-p/--print, -h/--help, -v/--version)
+  // also bypass multiplexer wrapping and monitoring — running a new tmux session
+  // or spawning a watcher for `claude --help` flashes the screen and slows down
+  // simple queries.
+  if (process.env.UNSNOOZE_ACTIVE === '1' || isPassthrough(args) || !getConfig(`agents.${agent.id}`)) {
+    return runPassthrough(agent, args);
   }
 
   // Flags the user wants on every session they start (claude's --autocompact
@@ -157,10 +172,17 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
     UNSNOOZE_PANE: pane || '', UNSNOOZE_PANE_OWNER: paneOwner || '',
     UNSNOOZE_LEASE_ID: leaseId,
   };
-  const child = spawn(agent.bin, args, {
-    stdio: 'inherit',
-    env: childEnv,
-  });
+  // The bin can be a path we resolved ourselves (a Windows .cmd shim, say).
+  // Node ≥ 20.12 refuses to spawn .bat/.cmd without a shell, and depending on
+  // the version that is a synchronous throw rather than an 'error' event —
+  // either way it has to come out as the same "failed to launch" line, with
+  // the reason, never as a crash with no exit code for the resumer to read.
+  let child;
+  try {
+    child = spawn(agent.bin, args, { stdio: 'inherit', env: childEnv });
+  } catch (err) {
+    return launchFailed(agent, err);
+  }
   const lease = pane && child.pid ? {
     leaseId, mux: mux.name, paneOwner, pane, agent: agent.id,
     pid: child.pid, pidBirth: processBirthFn(child.pid),
@@ -177,8 +199,19 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
     child.on('exit', code => { cleanup(); resolve(code ?? 1); });
     child.on('error', err => {
       cleanup();
-      process.stderr.write(`unsnooze: failed to launch ${agent.bin}: ${err.message}\n`);
-      resolve(127);
+      resolve(launchFailed(agent, err));
     });
   });
 }
+
+// One place for the message, because the resumer reads it back out of the
+// headless log when a revival dies (#25). 127 like a shell's "command not
+// found"; the hint names the one misconfiguration that produces EINVAL here.
+function launchFailed(agent, err) {
+  process.stderr.write(`unsnooze: failed to launch ${agent.bin}: ${err.message}\n`);
+  if (/\.(cmd|bat)$/i.test(String(agent.bin))) {
+    process.stderr.write(`unsnooze: ${agent.bin} is a .cmd/.bat shim, which cannot be launched directly — `
+      + `point UNSNOOZE_${agent.id.toUpperCase()}_BIN at the .exe\n`);
+  }
+  return 127;
+}

package/src/multiplexers/headless.js

@@ -18,7 +18,10 @@
 //     session sweep skips headless rather than claiming to own anything.
 
 import { spawn } from 'node:child_process';
-import { mkdirSync, openSync } from 'node:fs';
+import {
+  mkdirSync, openSync, closeSync, readSync, statSync, readFileSync, writeFileSync,
+  renameSync, unlinkSync, readdirSync,
+} from 'node:fs';
 import { join } from 'node:path';
 
 import { HEADLESS_LOG_DIR } from '../config.js';
@@ -27,6 +30,12 @@ export const SUBMIT_DELAY_MS = 0;   // nothing is ever typed
 
 const PID_PREFIX = 'pid:';
 
+// How long a recorded exit stays on disk. A revival is verified ~20s after
+// launch and retried within the hour; a day covers a daemon that was asleep.
+const EXIT_TTL_MS = 24 * 3_600_000;
+// Enough of the child's own output to say why it died, never the whole log.
+const EXIT_OUTPUT_BYTES = 4096;
+
 export function parsePidAddress(pane) {
   if (typeof pane !== 'string' || !pane.startsWith(PID_PREFIX)) return null;
   const pid = Number.parseInt(pane.slice(PID_PREFIX.length), 10);
@@ -60,6 +69,64 @@ export function createHeadless({
   env = process.env,
   platform = process.platform,
 } = {}) {
+  const exitsDir = join(logDir, 'exits');
+  const exitPath = pid => join(exitsDir, `${pid}.json`);
+
+  function writeExit(pid, record) {
+    try {
+      mkdirSync(exitsDir, { recursive: true, mode: 0o700 });
+      const tmp = join(exitsDir, `.${pid}.${process.pid}.tmp`);
+      writeFileSync(tmp, JSON.stringify(record), { mode: 0o600 });
+      renameSync(tmp, exitPath(pid));
+    } catch { /* evidence only — a revival must never fail on bookkeeping */ }
+  }
+
+  function readExit(pid) {
+    try {
+      const parsed = JSON.parse(readFileSync(exitPath(pid), 'utf-8'));
+      return parsed && typeof parsed === 'object' && parsed.pid === pid ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+
+  function pruneExits(now = Date.now()) {
+    let names;
+    try { names = readdirSync(exitsDir); } catch { return; }
+    for (const name of names) {
+      if (!name.endsWith('.json')) continue;
+      const path = join(exitsDir, name);
+      try {
+        if (now - statSync(path).mtimeMs > EXIT_TTL_MS) unlinkSync(path);
+      } catch { /* raced or gone */ }
+    }
+  }
+
+  // The last lines the child wrote to the shared log, read between the offsets
+  // recorded at its launch and at its exit. The upper bound matters: the
+  // resumer staggers revivals 8s apart and verifies 20s later, so a revival
+  // that died at once is read back after the next one has written its own
+  // lines into the same log. (One running alongside it can still interleave.)
+  function childOutput(exit) {
+    if (!exit.log || !Number.isFinite(exit.from)) return null;
+    let fd;
+    try {
+      const { size } = statSync(exit.log);
+      const end = Number.isFinite(exit.to) ? Math.min(exit.to, size) : size;
+      const start = Math.max(exit.from, end - EXIT_OUTPUT_BYTES);
+      if (end <= start) return null;
+      fd = openSync(exit.log, 'r');
+      const buf = Buffer.alloc(end - start);
+      const n = readSync(fd, buf, 0, buf.length, start);
+      const lines = buf.toString('utf-8', 0, n).split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+      return lines.length ? lines.slice(-3).join(' | ') : null;
+    } catch {
+      return null;
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+    }
+  }
+
   const backend = {
     name: 'headless',
     SUBMIT_DELAY_MS,
@@ -95,24 +162,105 @@ export function createHeadless({
 
     // A revive is just a detached child. Its output goes to a per-session log
     // because there is no scrollback to read it out of later.
+    //
+    // The child's exit is recorded next to that log (exits/<pid>.json). With no
+    // pane to capture, an empty capture proves nothing — verifyOne used to read
+    // it as a cleared banner and mark a launcher that had died with `spawn
+    // codex ENOENT` as resumed (#25). The exit record, plus the slice of the
+    // log the child wrote, is what paneOutcome() answers with instead.
     async newWindow(sessionName, cwd, launchSpec) {
       // 0700/0600: this log is the entire stdout+stderr of an unattended
       // agent run — the most revealing thing under the state dir.
       mkdirSync(logDir, { recursive: true, mode: 0o700 });
       const logPath = join(logDir, `${sessionName}.log`);
       const fd = openSync(logPath, 'a', 0o600);
-      const child = spawner(launchSpec.file, launchSpec.args || [], {
-        cwd,
-        detached: true,
-        stdio: ['ignore', fd, fd],
-        env: { ...env, ...launchSpec.env },
-        windowsHide: true,
-      });
+      // The log is shared by every revival into this session name, so remember
+      // where this child's output starts.
+      let from = 0;
+      try { from = statSync(logPath).size; } catch { /* just created */ }
+      // The child gets this process's environment — the one backend that
+      // passes it through. A resumer spawned by the StopFailure hook runs in
+      // claude's, which carries UNSNOOZE_ACTIVE=1: the launcher's "nested
+      // call, pass straight through" marker. A revival is a fresh top-level
+      // launch; with the marker it dropped launchExtraArgs and, on a spawn
+      // failure, exited 1 without saying why.
+      const childEnv = { ...env, ...launchSpec.env };
+      delete childEnv.UNSNOOZE_ACTIVE;
+      let child;
+      try {
+        child = spawner(launchSpec.file, launchSpec.args || [], {
+          cwd,
+          detached: true,
+          stdio: ['ignore', fd, fd],
+          env: childEnv,
+          windowsHide: true,
+        });
+      } finally {
+        // The child has its own copy; the daemon's would otherwise stay open
+        // for the life of the process, one descriptor per revival.
+        try { closeSync(fd); } catch { /* already closed */ }
+      }
+      const pid = child?.pid;
+      const startedAt = Date.now();
+      let spawnError = null;
+      // Listen before anything below can throw. A spawn that fails — the
+      // session's cwd was a worktree that has since been deleted, say — says
+      // so with an 'error' event after spawn() has returned, and an 'error'
+      // nobody listens for is an uncaught exception: the daemon dies with it.
+      if (typeof child?.on === 'function') {
+        const record = (code, signal, error) => {
+          if (!pid) return;
+          // Where this child's output ends in the shared log (childOutput).
+          let to = null;
+          try { to = statSync(logPath).size; } catch { /* gone */ }
+          writeExit(pid, {
+            pid, code, signal: signal ?? null, error: error ?? null,
+            startedAt, at: Date.now(), log: logPath, from, to,
+          });
+        };
+        child.on('exit', (code, signal) => record(code, signal, null));
+        child.on('error', err => {
+          spawnError = err;
+          record(null, null, err?.message || String(err));
+        });
+      }
       if (typeof child?.unref === 'function') child.unref();
-      if (!child?.pid) {
-        throw new Error(`unsnooze: headless launch of ${launchSpec.file} produced no pid`);
+      if (!pid) {
+        // The reason arrives on the next tick; wait for it so the record's
+        // lastError says why, not just that there was no pid.
+        await new Promise(resolve => setImmediate(resolve));
+        throw new Error(`unsnooze: headless launch of ${launchSpec.file} produced no pid`
+          + (spawnError ? ` (${spawnError.message})` : ''));
       }
-      return { pane: `${PID_PREFIX}${child.pid}`, paneOwner: null, session: sessionName };
+      // A recycled pid must not inherit an old exit. Best-effort, like the
+      // pruning: an exit record is evidence, never something a launch needs.
+      // (No event can have fired yet — nothing above has yielded since spawn.)
+      try { unlinkSync(exitPath(pid)); } catch { /* none */ }
+      pruneExits();
+      return { pane: `${PID_PREFIX}${pid}`, paneOwner: null, session: sessionName };
+    },
+
+    // What became of a revival: { exited: false } while it runs, and once it is
+    // gone { exited: true, code, signal, output } from the recorded exit, where
+    // output is the tail of what the child itself wrote. null when the process
+    // is gone and nothing was recorded (a resumer that was not the parent) —
+    // the caller then knows exactly as much as it did before.
+    async paneOutcome(pane) {
+      const pid = parsePidAddress(pane);
+      if (pid === null) return null;
+      // The record first: newWindow clears any old one for this pid at spawn,
+      // so a record here is our child's exit — even if the pid has since been
+      // handed to another process (Windows recycles them quickly), which a
+      // liveness check alone would read as our revival still running.
+      const exit = readExit(pid);
+      if (!exit) return alive(pid) ? { exited: false } : null;
+      return {
+        exited: true,
+        code: exit.code ?? null,
+        signal: exit.signal ?? null,
+        error: exit.error ?? null,
+        output: childOutput(exit),
+      };
     },
 
     // Nothing to wrap into: the user's own terminal is the session. Returning

package/src/resumer.js

@@ -9,7 +9,7 @@ import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { getMultiplexer, backendCanType } from './multiplexer.js';
 import {
-  RESUMER_LOCK, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS, ensureStateDir,
+  RESUMER_LOCK, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS, HEADLESS_SETTLE_MS, ensureStateDir,
   BUSY_DEFER_MS, MAX_BUSY_DEFERS, MAX_RESUME_ATTEMPTS, READY_TIMEOUT_MS,
   CAPTURE_LINES, PANE_SCAN_LINES, RESUME_SESSION_NAME,
   RESET_MARGIN_MS, FALLBACK_RESET_MS, PROBE_INTERVAL_MS, PROBE_MAX_MS,
@@ -123,6 +123,15 @@ export function resolveRecordMux(rec) {
   return getMultiplexer(rec.mux, { owner: rec.paneOwner });
 }
 
+// The user's resumeExtraArgs, placed where the adapter's command parses them:
+// appended, unless the adapter names an index (codex's `exec resume` takes
+// its options after `exec`, not after the prompt).
+function withResumeExtraArgs(resume, agentId) {
+  const extra = resolveResumeExtraArgs(agentId);
+  const at = Number.isInteger(resume.extraArgsAt) ? resume.extraArgsAt : resume.args.length;
+  return [...resume.args.slice(0, at), ...extra, ...resume.args.slice(at)];
+}
+
 const stopEpisodeAt = rec => rec?.bannerAt ?? rec?.detectedAt;
 
 // Newer non-error parent-context Claude usage proves that a user/provider retry
@@ -366,13 +375,16 @@ function rescheduleProbe(rec, now = Date.now()) {
     // never by waiting it out. Typing a wake into it would hit the same wall,
     // so make the stall a visible terminal state instead of a futile resume.
     if (rec.limitType === 'model') {
+      // The agent's own remedy: `unsnooze status` shows this line, and
+      // Claude's slash commands mean nothing to a Codex workspace wall.
+      const remedy = modelRemedy(getAgent(rec.agent));
       setStatus(key, 'failed', {
-        lastError: 'model limit still active — switch models (/model) or add credits',
+        lastError: `model limit still active — ${remedy}`,
         probeCount: probeCount + 1,
       }, { expect: ['stopped'] });
       log(`${key}: model limit still active at probe ceiling — needs a human`);
       notify('unsnooze: model limit needs you ⚠️',
-        `${rec.cwd}: still limited after probing — ${modelRemedy(getAgent(rec.agent))}`,
+        `${rec.cwd}: still limited after probing — ${remedy}`,
         { context: ctxOf(rec), priority: 4 });
       return 'held';
     }
@@ -585,10 +597,12 @@ export async function planFor(rec, {
     return { ...base, action: 'superseded', target: { key: superseded.key } };
   }
   const target = await reviveTarget(mux, rec);
-  const resume = agent.resumeArgs(rec.sessionId, message);
+  // The same argv reopen() builds: on a backend with no pane the prompt rides
+  // in argv, and for codex the command itself changes (`exec resume`).
+  const resume = agent.resumeArgs(rec.sessionId, message, { canType: backendCanType(mux) });
   return {
     ...base, action: 'reopen', target: { session: target }, message,
-    argv: [agent.id, ...resume.args, ...resolveResumeExtraArgs(agent.id)],
+    argv: [agent.id, ...withResumeExtraArgs(resume, agent.id)],
     messageViaPane: !!resume.messageViaPane,
   };
 }
@@ -758,7 +772,7 @@ async function reopen(rec, { mux, resolveMux, agent, resumeMessage, selfCmd, onD
   const leaseId = createLeaseId();
   const target = await reviveTarget(mux, rec);
   const launchSpec = {
-    file: selfCmd[0], args: [...selfCmd.slice(1), '_run', agent.id, ...resume.args, ...resolveResumeExtraArgs(agent.id)],
+    file: selfCmd[0], args: [...selfCmd.slice(1), '_run', agent.id, ...withResumeExtraArgs(resume, agent.id)],
     env: reopenEnv(rec, leaseId, target),
   };
   // reviveTarget can await a multiplexer query. Recheck after it and claim the
@@ -936,6 +950,44 @@ export async function verifyOne(key, { resolveMux = resolveRecordMux } = {}) {
     log(`${key}: limit still active, rescheduled to ${new Date(at).toISOString()} (${source})`);
     return;
   }
+  // A pane-less backend answers every capture with '', so "no banner" is not
+  // evidence there. Headless records what became of the launcher it spawned;
+  // a child that already died non-zero (`spawn codex ENOENT`, the Codex TUI's
+  // "stdin is not a terminal") resumed nothing, and marking it resumed would
+  // drop a retryable stop from the ledger and announce a wake that never
+  // happened (#25). Exit 0 is fine — `claude --resume … "prompt"` runs to
+  // completion and exits before the verify delay — and so is running on
+  // past HEADLESS_SETTLE_MS. A revival that is still young stays in flight:
+  // the loop verifies every resuming record each tick, and once it counts as
+  // resumed nothing reads its exit again (the sweep drops the record when
+  // the pid goes), so a death at 25s would have been announced as a wake.
+  if (typeof mux.paneOutcome === 'function') {
+    let outcome = null;
+    try { outcome = await mux.paneOutcome(rec.pane); } catch { outcome = null; }
+    if (outcome && outcome.exited === false
+        && Date.now() - (rec.lastAttemptAt || 0) < HEADLESS_SETTLE_MS) {
+      return 'pending';
+    }
+    if (outcome?.exited && outcome.code !== 0) {
+      const attempts = (rec.attempts || 0) + 1;
+      const how = outcome.code != null ? `exit ${outcome.code}`
+        : outcome.signal ? `killed by ${outcome.signal}` : 'failed to start';
+      const why = outcome.output || outcome.error || '';
+      const lastError = `revive died before it could resume (${how}${why ? `: ${why}` : ''})`;
+      const applied = transitionStopEpisode(rec, 'stopped', {
+        attempts,
+        // Same backoff (and same manual exemption) as every other retry.
+        resetAt: rec.manual ? Date.now() : Date.now() + retryBackoffMs(attempts),
+        lastError, verifyRetries: 0, resumeEpisodeAt: null,
+      }, { expect: ['resuming'] });
+      if (!applied) {
+        releaseSupersededResume(key);
+        return 'stale';
+      }
+      log(`${key}: ${lastError}`);
+      return 'retry';
+    }
+  }
   if (!transitionStopEpisode(rec, 'resumed', {
     lastError: null, verifyRetries: 0, resumeEpisodeAt: null,
     bannerCleared: true,
@@ -1108,8 +1160,14 @@ export async function runResumer({
       // Anything over the attempts cap is dead — mark failed so we can exit.
       for (const s of dueForDispatch()) {
         if ((s.attempts || 0) >= MAX_RESUME_ATTEMPTS) {
+          // Keep the last attempt's reason: this is the state `unsnooze status`
+          // shows after the "gave up" notification, and "exceeded" alone does
+          // not say that every revival died with `spawn codex ENOENT` (#25).
           const applied = transitionStopEpisode(s, 'failed', {
-            lastError: 'max resume attempts exceeded', verifyRetries: 0,
+            lastError: s.lastError
+              ? `max resume attempts exceeded — last: ${s.lastError}`
+              : 'max resume attempts exceeded',
+            verifyRetries: 0,
             resumeEpisodeAt: null,
           }, { expect: ['stopped'] });
           if (!applied) continue;

package/src/time-parser.js

@@ -278,7 +278,12 @@ export function resetAtMs(parsed, {
       }
       return t;   // unreachable in practice — 9 steps cover a week + DST repeat
     }
-    if (t <= anchor) {
+    // A clock time names a whole minute. Codex prints the reset as %-I:%M and
+    // drops the seconds, so a dated banner written at 7:36:15 that says "try
+    // again at 7:36 AM" means a reset later in that same minute — not 7:36
+    // tomorrow, a day late. Only a minute that had fully passed rolls.
+    const past = bannerAt != null ? t + 60_000 <= anchor : t <= anchor;
+    if (past) {
       // Dated banner, or ambiguous (need both am/pm candidates as real
       // next-occurrences): roll to the next day. Undated non-ambiguous
       // past clock times stay past so the outer guard returns due-now