wezard 2.5.1 → 2.6.1

package/dist/daemon/mirror-bridge.js

@@ -1,3 +1,6 @@
+import { codexSessions, codexSessionForPane } from "../shared/codex.js";
+import { codexHookLaunchArgs, codexHookCommand } from "../shared/codex-hooks.js";
+import { fileURLToPath } from "node:url";
 // Mirror-mode bridge.
 //
 // Strategy: a running interactive `claude` exposes no local IPC. Its only
@@ -14,31 +17,33 @@
 // while a `--resume` injection is in flight; Claude Code locks aren't strict.
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { pasteTmuxBuffer } from "./tmux-buffer.js";
 import { existsSync, readdirSync, readFileSync, statSync, watch, openSync, readSync, closeSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { newStewardSpec, resumedStewardSpec } from "./steward-model.js";
 import { expandHome, sanitizeId } from "../shared/paths.js";
 import { augmentedPath } from "../shared/exec-path.js";
 import { sleep, truncateWithCount, mapLimit } from "../shared/std.js";
-import { activeBackends, backendForPath, projectDirFor, projectDirsFor, } from "../shared/cli-backends.js";
-import { isModalPane, isAskqSubmitPage, parseModalOptions, pickModalAnswer, pickAutoAllowAnswer, parseConfirmContext, looksLikePicker } from "../shared/modal-pane.js";
-import { bindCardChannel, hasMirrorAskq, runMirrorAskqFlow, hasMirrorPlan, mootMirrorPlan, runMirrorPlanFlow, hasMirrorPicker, mootMirrorPicker, runMirrorPickerFlow } from "./approval.js";
+import { activeBackends, resolveCliBackend, backendForPath, projectDirFor, projectDirsFor, } from "../shared/cli-backends.js";
+import { isModalPane, isAskqSubmitPage, parseModalOptions, pickModalAnswer, pickAutoAllowAnswer, parseConfirmContext, modalFingerprint, looksLikePicker } from "../shared/modal-pane.js";
+import { hasMirrorAskq, runMirrorAskqFlow, hasMirrorPlan, mootMirrorPlan, runMirrorPlanFlow, hasMirrorPicker, mootMirrorPicker, runMirrorPickerFlow } from "./approval.js";
 import { isAutoWindowActive } from "./session-cache.js";
 import { noticeSuffixFor } from "./notices.js";
-import { dangerOf } from "./danger.js";
+import { dispatchPickerPolicy, pickerPolicy } from "./picker-policy.js";
 import { renameWindow, runTmux, spawnTmuxClaude } from "./spawn-tmux.js";
 import { selectEffort, selectModel } from "./model-select.js";
 import { parseEffort } from "../shared/effort.js";
-import { hasRegistry, markTranscript, probeOf, sessionOnPane, sessionPanes, submittedSince, watchRegistry } from "./cc-session.js";
+import { hasRegistry, liveSessionPids, markTranscript, probeOf, sessionOnPane, submittedSince, watchRegistry } from "./cc-session.js";
 import { waitForIdle } from "./graph.js";
 import { wizardStore } from "./wizard.js";
 import { startSubagentWatch } from "./subagent-tail.js";
 import { knowsToolUse, recordTool, recordToolResult, recordMark, recordTurnStart, recordTurnQuery, recordTurnInject, recordTurnItem, recordTurnUsage, recordTurnClose, recordCloseOpenTurns, lastChannelOf, openTurnsOf, buildDetailUrl, buildChatUrl, roleUniq } from "./detail.js";
 import { errText } from "./last-response.js";
-import { labelFor, tagOfKey, baseOfKey, keyOf, stripSigil, displayName, withTagHeader, withLinkedTagHeader, chatHead, headed, tagBadge, linkTags, parseTagHeader, MAX_BODY_LINKS, isInternalKey } from "../shared/session-label.js";
+import { labelFor, tagOfKey, baseOfKey, keyOf, stripSigil, displayName, withTagHeader, withLinkedTagHeader, chatHead, headed, tagBadge, linkTags, parseTagHeader, MAX_BODY_LINKS, isInternalKey, sameBot } from "../shared/session-label.js";
 import { splitMarkdown } from "../shared/md-chunk.js";
 import { isWxFrame } from "../shared/wx-text.js";
 import { randomTip } from "./tips.js";
-import { chatBaseOf, chatNameOf, listChatNames, parsePeerRef, peerAddress, stewardTierOf } from "./chat-name.js";
+import { chatBaseOf, chatNameOf, listChatNames, parsePeerRef, peerAddress } from "./chat-name.js";
 import { stripAnsi, paneIsBusy, summarizeTail, lastAssistantText, lastReply, replyToPeer as replyToPeerIn, unwrapPasted, lastContextTokens, lastModel, cacheTouchMs, cacheTtlSec, keepaliveStamps, openKeepalivePing, lastUserTurn, talkRounds, openToolUses, renderDialog } from "./peers.js";
 import { keepalivePingSigs, isKeepalivePingText } from "../shared/keepalive.js";
 // PATH augmentation: launchd / systemd start the daemon
@@ -92,7 +97,9 @@ const readCwdFromJsonl = (path) => {
 // parse (wrong jsonl dialect). Only genuine discovery searches the union.
 const rankedJsonlsForCwd = (cwd, only, exclude) => projectDirsFor(expandHome(cwd))
     .filter(({ backend }) => !only || backend.name === only.name)
-    .flatMap(({ dir }) => {
+    .flatMap(({ backend, dir }) => {
+    if (backend.name === "codex")
+        return codexSessions(dir, expandHome(cwd)).filter((x) => !exclude?.has(x.sessionId)).map((x) => ({ ...x, mtime: statSync(x.jsonlPath).mtimeMs }));
     let names;
     try {
         names = readdirSync(dir).filter((n) => n.endsWith(".jsonl"));
@@ -133,6 +140,8 @@ const findJsonlBySid = (sid, only) => {
     return (only ? [only] : activeBackends())
         .flatMap((b) => {
         const root = expandHome(b.projectsDir);
+        if (b.name === "codex")
+            return codexSessions(root).filter((x) => x.sessionId === sid).map((x) => x.jsonlPath);
         try {
             return readdirSync(root).map((d) => join(root, d, sidFile));
         }
@@ -719,6 +728,11 @@ const renderLine = (raw, deps) => {
                 },
             });
         }
+        // Codex turn_context reports the real tier before any token usage.
+        // Forward metadata without inventing an API call or resetting context counts.
+        if (!u && (line.message?.model || line.effort)) {
+            out.push({ kind: "turn_usage", model: line.message?.model, effort: line.effort });
+        }
         // Terminal stop_reason → emit turn_end so onItem closes the live bubble.
         // `tool_use` is intentionally excluded — more turns will follow once the
         // tool result lands; finalizing now would split a single logical reply.
@@ -730,7 +744,7 @@ const renderLine = (raw, deps) => {
         // 且此后整轮的 tool/text 全部退化成散装气泡。终态消息里必然有 text 块 (含
         // tool_use 的消息 stop_reason 恒为 "tool_use"), 且实测终态消息从不拆出第二个
         // text 行 —— 所以"本行带 text 块"精确等价于"本消息的最后一行"。
-        if (isFinal && blocks.some((b) => b?.type === "text"))
+        if (isFinal && !line.awaitTurnEnd && blocks.some((b) => b?.type === "text"))
             out.push({ kind: "turn_end" });
         // 软收口 (codebuddy): 这条消息写完了, 但说不出后面还有没有 function_call。
         else if (line.softTurnEnd)
@@ -774,6 +788,23 @@ const renderLine = (raw, deps) => {
 const TAG_HEADER_BUDGET = 256 * (2 + MAX_BODY_LINKS);
 export const startMirrorTail = (deps) => {
     const { log } = deps;
+    // Codex records model/effort separately from per-response usage. Keep that
+    // context local to this tail (never share it between sessions/normalizers).
+    if (backendForPath(deps.jsonlPath).name === "codex" && deps.normalizeLine) {
+        const normalize = deps.normalizeLine;
+        let model = deps.startOffset === 0 ? "" : lastModel(deps.jsonlPath);
+        let effort;
+        deps = { ...deps, normalizeLine: (raw) => {
+                const line = normalize(raw);
+                if (line?.message?.model) {
+                    model = line.message.model;
+                    effort = line.effort;
+                }
+                return line?.message?.usage
+                    ? { ...line, effort, message: { ...line.message, model } }
+                    : line;
+            } };
+    }
     // A single logical tail follows ONE sessionId whose transcript file may move
     // between sibling project dirs — Claude Code's EnterWorktree/ExitWorktree
     // rename <sid>.jsonl into/out of <cwd>/.claude/worktrees/<name>, each cwd
@@ -827,6 +858,11 @@ export const startMirrorTail = (deps) => {
         watchedPath = path;
         try {
             watcher = watch(path, { persistent: false }, () => drain());
+            const active = watcher;
+            active.on("error", (err) => {
+                active.close();
+                log.warn({ err: err.message }, "fs.watch failed; relying on poll");
+            });
         }
         catch (e) {
             watcher = undefined;
@@ -1100,19 +1136,19 @@ const extractPaneAssistantTail = (pane) => {
 // long after the pane went back to accepting input — wedging the mirror shut
 // permanently. Bare `-p` captures only what is currently on screen.
 //
-// Trailing blank rows are trimmed first so the 15-row window lands on the
-// bottom-most *content* (a picker's footer is its last line); 15 rows spans
-// "title → options → footer" on every confirm layout we've seen.
-const MODAL_SCAN_ROWS = 15;
-// `screen` = 实际参与判定的那一屏文本, 一并返回给调用方做选项解析 —— 再 capture
-// 一次会拿到"下一瞬间"的屏幕, 与 verdict 不同源(框可能已被本地按掉), 按键就按错了。
+// Trim trailing blank rows so the bottom 15 rows locate the active picker.
+// Keep the full current screen from that same capture for operation context;
+// a second capture might already be a different invocation. -J joins terminal
+// wraps without reading scrollback or dropping long command arguments.
 const detectModalPicker = async (target) => {
-    const r = await runTmux(["capture-pane", "-t", target, "-p"]);
+    const r = await runTmux(["capture-pane", "-t", target, "-p", "-J"]);
     if (!r.ok)
         return { modal: false, screen: "" };
     const lines = r.stdout.replace(/\s+$/u, "").split("\n");
-    const screen = lines.slice(-MODAL_SCAN_ROWS).join("\n");
-    return { ...isModalPane(screen), screen };
+    const screen = lines.join("\n");
+    // Only the bottom picker may block input. Earlier completed pickers on the
+    // current screen remain useful context, but must not look like a live modal.
+    return { ...isModalPane(lines.slice(-15).join("\n")), screen };
 };
 // 按下确认框的第 index 号选项。Claude Code 的 picker 数字键即选即确认; CodeBuddy
 // 的框数字键不一定生效, 且高亮可能停在别的选项上 (实测见过默认高亮在 "Yes, and
@@ -1124,10 +1160,14 @@ const MODAL_PRESS_SETTLE_MS = 400;
 const MODAL_ARROW_SETTLE_MS = 150;
 const highlightedIndex = (screen) => parseModalOptions(screen).find((o) => o.selected)?.index;
 const pressModalIndex = async (pane, before, index) => {
+    const fingerprint = modalFingerprint(before.screen);
+    const current = await detectModalPicker(pane);
+    if (!current.modal || modalFingerprint(current.screen) !== fingerprint)
+        return current;
     await runTmux(["send-keys", "-t", pane, String(index)]);
     await sleep(MODAL_PRESS_SETTLE_MS);
     let after = await detectModalPicker(pane);
-    if (!after.modal || after.title !== before.title)
+    if (!after.modal || modalFingerprint(after.screen) !== fingerprint)
         return after;
     // 数字键没关掉框: 把高亮挪到目标项。guard 上限盖过任何确认框的选项数。
     for (let guard = 0; guard < 8; guard++) {
@@ -1137,7 +1177,7 @@ const pressModalIndex = async (pane, before, index) => {
         await runTmux(["send-keys", "-t", pane, cur < index ? "Down" : "Up"]);
         await sleep(MODAL_ARROW_SETTLE_MS);
         after = await detectModalPicker(pane);
-        if (!after.modal || after.title !== before.title)
+        if (!after.modal || modalFingerprint(after.screen) !== fingerprint)
             return after;
     }
     if (highlightedIndex(after.screen) !== index)
@@ -1246,10 +1286,39 @@ const BOX_PROMPT_RE = /^\s*[❯>]\s?/u;
 /** 底 ruler 之下只该剩 cwd/模式两行状态; 多于此说明框到的不是输入框。 */
 const BOX_FOOTER_ROWS = 6;
 const UNKNOWN_BOX = { known: false, body: "" };
-export const parseInputBox = (cap) => {
+export const parseInputBox = (cap, styledLayout = cap) => {
     const lines = cap.split("\n");
     while (lines.length && lines[lines.length - 1].trim() === "")
         lines.pop();
+    // Codex has no rulers. Anchor the composer to its bottom shortcuts footer,
+    // then use the LAST › prompt: earlier prompts belong to the transcript.
+    // Requiring a status row and a blank separator avoids treating arbitrary
+    // output containing › as editable input. Collapsed pastes remain visible
+    // as a body change even though the original text fingerprints disappear.
+    const styledLines = styledLayout.split("\n");
+    const layout = styledLines.map((line) => line.replace(/\x1b\[[0-9;:]*m/gu, "").replace(OTHER_ESC_RE, ""));
+    while (layout.length && !layout[layout.length - 1].trim())
+        layout.pop();
+    const footer = layout.length - 1;
+    // Codex hides the shortcuts row while the composer contains text.
+    const shortcuts = /\? for shortcuts\s*$/u.test(layout[footer] ?? "");
+    if (shortcuts || (layout[footer] ?? "").includes("·")) {
+        let status = shortcuts ? footer - 1 : footer;
+        while (status >= 0 && !layout[status].trim())
+            status--;
+        if (status >= 0 && footer - status <= BOX_FOOTER_ROWS && layout[status].includes("·") && status > 0 && !layout[status - 1].trim()) {
+            let prompt = status - 2;
+            // Continuation rows are indented; a › inside pasted content is not a
+            // new composer prompt.
+            while (prompt >= 0 && !/^›(?:\s|$)/u.test(layout[prompt]))
+                prompt--;
+            if (prompt >= 0 && (shortcuts || /\x1b\[[0-9;:]*48[;:]/u.test(styledLines[prompt]))) {
+                const body = dropDim(styledLines.slice(prompt, status).join("\n"))
+                    .replace(/^\s*›\s?/u, "").replace(/[\s\u200b\ufeff]+/gu, " ").trim();
+                return { known: true, body };
+            }
+        }
+    }
     const rulers = lines.reduce((acc, l, i) => (BOX_RULER_RE.test(l) ? [...acc, i] : acc), []);
     const bottom = rulers[rulers.length - 1];
     const top = rulers[rulers.length - 2];
@@ -1287,10 +1356,18 @@ export const dropDim = (styled) => {
 };
 const captureUndimmed = async (target, rows) => {
     const r = await runTmux(["capture-pane", "-t", target, "-p", "-e", "-S", `-${rows}`]);
-    return r.ok ? dropDim(r.stdout) : "";
+    // Negative -S includes scrollback plus the entire visible pane, not its
+    // last N rows. Crop before removing dim text so row boundaries survive.
+    return r.ok ? dropDim(r.stdout.replace(/\n$/u, "").split("\n").slice(-rows).join("\n")) : "";
 };
 // 24 行足够容纳展开后的多行粘贴 (折叠态只占一行)。
-const readInputBox = async (target) => parseInputBox(await captureUndimmed(target, 24));
+const readPaneInput = async (target) => {
+    const r = await runTmux(["capture-pane", "-t", target, "-p", "-e", "-S", "-24"]);
+    const raw = r.ok ? r.stdout : "";
+    const cap = dropDim(raw);
+    return { cap, box: parseInputBox(cap, raw) };
+};
+const readInputBox = async (target) => (await readPaneInput(target)).box;
 // ── 注入门控的会话证人 (cc-session) ─────────────────────────────────
 // 能从会话自己写的 json 读到的判据, 就不读 pane: 就绪看注册表的 status, 提交看
 // 注册表的 busy 翻转或 jsonl 里新落的那一行。输入框里「贴进去没有」是唯一只有
@@ -1445,8 +1522,6 @@ const withImageRefs = (text, images) => {
 // 证人不作声 (忙时排队、slash 命令、无注册表的后端) 才看框回没回到贴之前的样子。
 // 框认得出来时这条判据可信, 于是允许多补回车 (空框上的回车在 CLI 里是 no-op);
 // 每次补之前再问一遍证人, 已提交就不补。
-/** 具名粘贴 buffer 的序号 (见 loadAndPaste)。 */
-let pasteSeq = 0;
 const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS) => {
     // Warm pane: tight timings, low latency. Fresh spawn (claude --resume just
     // started, transcript still loading): extended timings — bracketed-paste
@@ -1484,29 +1559,16 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     const baseBody = alreadyTyped ? "" : preBox.body;
     /** 框里还是贴之前那样 (或彻底空了) = 我们的文本不在框里。 */
     const boxIntact = (b) => boxVerify && b.known && (b.body === "" || b.body === baseBody);
-    const loadAndPaste = async () => {
-        // stdin variant of the shared exec path — it carries the same hard timeout,
-        // which a hand-rolled spawn here did not.
-        // 每次注入用自己的具名 buffer: 不同 pane 的注入并发时, 共用 tmux 的默认 buffer 会让
-        // 一方 load 之后、paste 之前被另一方覆盖 —— 两段文本互换 pane (实测: 同一毫秒投的两份
-        // 回执, 发给 A 的进了 B)。同一 pane 的串行管不到跨 pane。
-        const buf = `wezard-${process.pid}-${++pasteSeq}`;
-        const loaded = await runTmux(["load-buffer", "-b", buf, "-"], { stdin: text });
-        if (!loaded.ok)
-            return { ok: false, reason: `tmux load-buffer failed: ${loaded.stderr.slice(-200) || loaded.code}` };
-        const pasted = await runTmux(["paste-buffer", "-b", buf, "-p", "-d", "-t", target]);
-        if (!pasted.ok)
-            return { ok: false, reason: `tmux paste-buffer failed: ${pasted.stderr.slice(-200)}` };
-        return { ok: true };
-    };
+    const loadAndPaste = () => pasteTmuxBuffer(target, text);
     // 框认得出来 → 看它变没变; 认不出来 → 退回宽窗口找 headFp (长文本会换行,
     // 头部可能在框顶, 所以窗口要宽)。
     const sawLanded = async (timeoutMs) => {
         const t0 = Date.now();
         while (Date.now() - t0 < timeoutMs) {
-            const cap = await captureUndimmed(target, 24);
-            const box = parseInputBox(cap);
-            if (boxVerify && box.known ? !boxIntact(box) : Boolean(headFp) && stripWs(cap).includes(headFp))
+            const { cap, box } = await readPaneInput(target);
+            // A redraw can hide the baseline. Once the composer reappears, its
+            // nonempty body also proves landing of a collapsed paste.
+            if (box.known ? (boxVerify ? !boxIntact(box) : box.body !== "") : Boolean(headFp) && stripWs(cap).includes(headFp))
                 return true;
             await sleep(POLL_MS);
         }
@@ -1519,6 +1581,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
         return Boolean(tailFp) && stripWs(pane).includes(tailFp);
     };
     let pasteSeen = alreadyTyped;
+    let pastedAt = Date.now();
     if (alreadyTyped) {
         log.warn({ target, headFp }, "mirror inject: 输入框里已有这段文本 (上次未提交) — 不重贴, 直接提交");
     }
@@ -1526,7 +1589,11 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
         const r = await loadAndPaste();
         if (!r.ok)
             return r;
-        pasteSeen = await sawLanded(PASTE_VERIFY_MS);
+        pastedAt = Date.now();
+        // An unknown layout cannot verify collapsed text by fingerprint. Bound
+        // that inconclusive probe by the catch-up budget instead of waiting 6s
+        // and then sleeping another 2.5s before the first Enter.
+        pasteSeen = await sawLanded(boxVerify ? PASTE_VERIFY_MS : POST_PASTE_SETTLE_FALLBACK_MS);
     }
     if (!pasteSeen) {
         const box = await readInputBox(target);
@@ -1540,7 +1607,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             log.warn({ target, headFp, boxKnown: box.known }, "mirror inject: 粘贴未验证但输入框非空 — 首次粘贴已落地, 不重贴");
             pasteSeen = true;
         }
-        else {
+        else if (boxVerify && box.known) {
             log.warn({ target, headFp, boxKnown: box.known }, "mirror inject: 输入框确认为空, 重贴一次");
             await sleep(RETRY_SETTLE_MS);
             if (submitted())
@@ -1548,8 +1615,14 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             const r = await loadAndPaste();
             if (!r.ok)
                 return r;
+            pastedAt = Date.now();
             pasteSeen = await sawLanded(PASTE_VERIFY_MS);
         }
+        else {
+            // Missing fingerprints are not proof of an empty composer: other TUIs
+            // may collapse pasted text. Never duplicate a paste on that evidence.
+            log.warn({ target, headFp }, "mirror inject: 输入框布局未知, 不重贴未确认的粘贴");
+        }
     }
     // 粘贴落定 = 框里是我们的内容, 且连续两次读到同一个样子 —— TUI 已把整段粘贴
     // (bracketed-paste end 在内) 消化完, 紧跟的回车不会被并进粘贴。实测冷启动的
@@ -1568,10 +1641,10 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     // Bracketed-paste end + TUI catch-up. 框认不出来 / 粘贴没被看见时没有条件可查,
     // 维持固定等待 (fresh respawn: claude --resume is still loading the transcript)。
     if (!alreadyTyped) {
-        if (pasteSeen && boxVerify)
+        if (pasteSeen)
             await pasteSettled(POST_PASTE_SETTLE_MS);
         else
-            await sleep(pasteSeen ? POST_PASTE_SETTLE_MS : POST_PASTE_SETTLE_FALLBACK_MS);
+            await sleep(Math.max(0, POST_PASTE_SETTLE_FALLBACK_MS - (Date.now() - pastedAt)));
     }
     const sendEnter = async () => {
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
@@ -1579,7 +1652,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     };
     const cleared = async () => {
         const box = await readInputBox(target);
-        return boxVerify && box.known ? boxIntact(box) : !(await inputBoxStillHasTail());
+        return box.known ? (boxVerify ? boxIntact(box) : box.body === "") : !(await inputBoxStillHasTail());
     };
     /** 证人先答; 它的窗口过了还不作声, 才每轮加看一眼框。 */
     const waitForSubmit = async (timeoutMs) => {
@@ -1612,8 +1685,10 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
                 return { ok: true }; // 迟到的确认 —— 补的这一下会落在空框上, 省了
             log.warn({ target, tailFp, attempt: i + 1 }, "mirror inject: 回车后输入框未清空, 再补一次");
         }
-        if (i === 0)
+        if (i === 0) {
             enterAt = Date.now();
+            log.info({ target, pasteToEnterMs: enterAt - pastedAt, pasteSeen, boxTrusted, freshSpawn }, "mirror inject: first Enter");
+        }
         const e = await sendEnter();
         if (!e.ok)
             return e;
@@ -1628,14 +1703,42 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     log.warn({ target, tailFp, freshSpawn, boxTrusted, witness: witness.status }, "mirror inject: clear not observed, trusting submit");
     return { ok: true, uncertain: true, reason: "目标会话可能正忙或未消费输入(回车后输入框未清空)" };
 };
-const injectViaSpawn = (args) => {
+const injectViaSpawn = async (args) => {
     const { text, images = [], cfg, log, sessionId, jsonlPath } = args;
-    const bin = backendForPath(jsonlPath).bin;
+    const backend = backendForPath(jsonlPath);
+    const bin = backend.bin;
+    let cwd = expandHome(cfg.wrc.cwd);
+    let codexArgs = [];
+    if (backend.name === "codex") {
+        try {
+            const fd = openSync(jsonlPath, "r");
+            let head;
+            try {
+                const buf = Buffer.alloc(256 * 1024);
+                head = buf.subarray(0, readSync(fd, buf, 0, buf.length, 0)).toString("utf8");
+            }
+            finally {
+                closeSync(fd);
+            }
+            const meta = JSON.parse(head.split("\n", 1)[0]).payload;
+            if (typeof meta?.cwd === "string")
+                cwd = meta.cwd;
+            const hookEntry = fileURLToPath(new URL("../cli/codex-hook.js", import.meta.url));
+            const { loadConfig } = await import("../shared/config.js");
+            const command = codexHookCommand(loadConfig().sourcePath, `http://127.0.0.1:${cfg.daemon.port}`, hookEntry);
+            codexArgs = await codexHookLaunchArgs(bin, cwd, command, cfg.approval.hookTimeoutSec + 10, cfg.approval.enabled);
+        }
+        catch (e) {
+            return { ok: false, reason: `Codex resume setup failed: ${e.message}` };
+        }
+    }
     // Spawn-mode (no live TTY) can't do clipboard+C-v — fall back to `@<path>`,
     // which Claude parses at submit time and inlines as image content blocks
     // without a model-decided Read tool turn.
     const finalText = withImageRefs(text, images);
-    const cliArgs = [
+    const cliArgs = backend.name === "codex" ? ["exec", "resume", "--json", ...codexArgs,
+        ...cfg.wrc.extraArgs.filter((arg) => !arg.startsWith("--disallowedTools")),
+        ...images.flatMap((path) => ["--image", path]), sessionId, text] : [
         "-p",
         finalText,
         "--resume",
@@ -1648,7 +1751,7 @@ const injectViaSpawn = (args) => {
     log.info({ sessionId, bin, len: text.length }, "mirror inject");
     return new Promise((resolve) => {
         const proc = spawn(bin, cliArgs, {
-            cwd: expandHome(cfg.wrc.cwd),
+            cwd,
             env: { ...process.env, PATH: augmentedPath(process.env.PATH) },
             stdio: ["ignore", "ignore", "pipe"],
         });
@@ -1693,6 +1796,30 @@ const INJECT_JOB_TIMEOUT_MS = 90_000;
 /** 没有绑定的 pane 静默多久才算孤儿。刚 spawn、还没 attach 的 pane (并发 fan-out 时
  *  别人的 sweep 会撞见它) 在这段时间里一直有输出, 远大于一次 spawn → attach 的耗时。 */
 const ORPHAN_GRACE_MS = 10 * 60_000;
+const psSnap = () => new Promise((resolve) => {
+    const p = spawn("ps", ["-axo", "pid=,ppid=,etimes="], { env: { ...process.env, PATH: augmentedPath(process.env.PATH) }, stdio: ["ignore", "pipe", "ignore"] });
+    let out = "";
+    p.stdout?.on("data", (c) => (out += c.toString("utf8")));
+    const done = () => {
+        const kids = new Map();
+        const etimes = new Map();
+        for (const line of out.split("\n")) {
+            const [pid, ppid, et] = line.trim().split(/\s+/).map(Number);
+            if (!pid || !ppid)
+                continue;
+            const arr = kids.get(ppid);
+            if (arr)
+                arr.push(pid);
+            else
+                kids.set(ppid, [pid]);
+            if (et !== undefined && !Number.isNaN(et))
+                etimes.set(pid, et);
+        }
+        resolve({ kids, etimes });
+    };
+    p.on("close", done);
+    p.on("error", () => resolve({ kids: new Map(), etimes: new Map() }));
+});
 /** Drop a session's queue chain. A hung job can't be cancelled (it's parked in a
  *  tmux read), but detaching the chain means the NEXT message doesn't inherit
  *  its deadlock. Pair with an injectGen bump so the zombie can't act when it
@@ -2401,11 +2528,11 @@ export const startMirror = (deps) => {
         if (!env)
             return undefined;
         const home = baseOfKey(a.target);
-        const from = env.kind === "peer" ? { kind: "peer", from: wizardStore()?.byName(stripSigil(env.from))?.target, ...(env.private ? {} : { public: true }), ...(env.receipt ? { receipt: true } : {}), ...(env.status ? { status: env.status } : {}), ...(env.turn ? { turn: env.turn } : {}) }
+        const from = env.kind === "peer" ? { kind: "peer", from: wizardStore()?.byName(stripSigil(env.from))?.target, ...(env.private ? {} : { public: true }), ...(env.receipt ? { receipt: true } : {}), ...(env.status ? { status: env.status } : {}), ...(env.turn ? { turn: env.turn } : {}), ...(env.asker ? { asker: env.asker } : {}) }
             : env.kind === "task" ? { kind: "task", taskId: env.from.replace(/^定时 /, "") }
                 : undefined;
         return {
-            channel: env.private ? "" : (env.chat && chatBaseOf(cfg, env.chat)) || home,
+            channel: env.private ? "" : env.chatKey || (env.chat && chatBaseOf(cfg, env.chat)) || home,
             speaker: env.kind === "human" ? `user:${env.from}` : undefined,
             from,
             query: t.text,
@@ -2464,8 +2591,6 @@ export const startMirror = (deps) => {
     const isPrivate = (a) => a.channel === "";
     /** 本轮回复该推去的 chatId。 */
     const replyChatId = (a) => stripPrincipalPrefix(a.channel || a.target);
-    // 审批/提问卡同样回本轮的频道; 私聊轮 ("") 的卡回 home —— 要点它的人总得在某个群里。
-    bindCardChannel((key) => byTarget.get(key)?.channel || "");
     // 详情页要按后端的名字称呼它 ("Claude 正在思考" / "CodeBuddy 正在思考") —— 后端
     // 由 transcript 落盘路径唯一确定, 所以每次开 turn 时现算, 不必额外记在 AttachState 上。
     const cliOf = (a) => a.jsonlPath ? backendForPath(a.jsonlPath).name : undefined;
@@ -2520,7 +2645,7 @@ export const startMirror = (deps) => {
         a.pendingBriefQuery = undefined;
         a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), speaker: s.speaker, at: Date.now() };
         consumeChannel(a, true, undefined);
-        recordTurnStart({ id: q.turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), cwd: a.runningCwd || undefined, userQuery: s.query.trim() || undefined, createdAt: at, ...channelFields(a) });
+        recordTurnStart({ id: q.turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: s.query.trim() || undefined, createdAt: at, ...channelFields(a) });
         if (a.briefTurnId)
             closeBriefTurn(a);
         openBriefTurn(a, q);
@@ -2585,7 +2710,7 @@ export const startMirror = (deps) => {
         const queued = !isSlash && idleVerdict(a.target) === false;
         pushSeal(a, seal);
         if (queued)
-            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), cwd: a.runningCwd || undefined, userQuery: userQuery.trim() || undefined, channel: channel ?? baseOfKey(a.target), speaker });
+            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: userQuery.trim() || undefined, channel: channel ?? baseOfKey(a.target), speaker });
         else
             activateDispatch(a, seal);
         // 新消息 = 对话边界: 立刻收掉上一 turn, 新 turn 直接激活、不排队。收口语义见
@@ -2657,7 +2782,7 @@ export const startMirror = (deps) => {
         const fresh = consumeFrom(a);
         const opened = consumeChannel(a, fromCli, fresh);
         const from = fresh ?? a.convFrom;
-        recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), cwd: a.runningCwd || undefined, userQuery: query || opened || undefined, origin: consumeOrigin(a), from, ...channelFields(a), ...(query && at ? { createdAt: at } : {}) });
+        recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: query || opened || undefined, origin: consumeOrigin(a), from, ...channelFields(a), ...(query && at ? { createdAt: at } : {}) });
         a.briefTurnId = turnId;
         a.briefBubble = undefined;
         a.briefIsSlash = false;
@@ -3164,7 +3289,7 @@ export const startMirror = (deps) => {
         if (!a.keepaliveTurnId) {
             const turnId = newTurnId();
             a.keepaliveTurnId = turnId;
-            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), userQuery: text });
+            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, userQuery: text });
         }
     };
     // A keepalive ping turn is swallowed wholesale — the reply content doesn't
@@ -3817,8 +3942,9 @@ export const startMirror = (deps) => {
                 // with the primary dialect would report a phantom drift for every
                 // session belonging to a non-primary CLI.
                 const paneDir = projectDirFor(jsonlAbs, expandHome(paneCwd));
-                if (paneDir !== dirname(jsonlAbs)) {
-                    const live = liveSessionForCwd(paneCwd, backendForPath(jsonlAbs), sidsClaimedByOthers(principal));
+                const codexPane = backendForPath(jsonlAbs).name === "codex" ? codexSessionForPane(livePane) : undefined;
+                if (codexPane ? codexPane.sessionId !== rec.sessionId : backendForPath(jsonlAbs).name !== "codex" && paneDir !== dirname(jsonlAbs)) {
+                    const live = codexPane?.cwd === expandHome(paneCwd) ? codexPane : backendForPath(jsonlAbs).name === "codex" ? undefined : liveSessionForCwd(paneCwd, backendForPath(jsonlAbs), sidsClaimedByOthers(principal));
                     if (live && live.sessionId !== rec.sessionId) {
                         log.info({ principal, from: rec.sessionId, to: live.sessionId, paneCwd }, "mirror restore: pane in worktree, re-homed to live session");
                         rec.sessionId = live.sessionId;
@@ -4131,6 +4257,8 @@ export const startMirror = (deps) => {
     // `exclusive` (the /clear flavor) refuses to claim on ambiguous evidence —
     // see claimIsAttributable.
     const startMigrationWatcher = (a, baseline, isChild, startOffset, exclusive) => {
+        if (backendForPath(a.jsonlPath).name === "codex")
+            return;
         if (a.migrationWatcher)
             a.migrationWatcher.cancel(); // re-armed (e.g. /clear twice, or respawn during a pending watch)
         const projectDir = dirname(a.jsonlPath);
@@ -4230,6 +4358,8 @@ export const startMirror = (deps) => {
     // narrows to transcripts born after the clear, which makes a short
     // fingerprint safe enough to accept.
     const armSilentForkRebind = (a, text) => {
+        if (backendForPath(a.jsonlPath).name === "codex")
+            return; // SessionStart owns exact pane identity.
         const pendingClear = a.clearRebind;
         if (pendingClear) {
             // Hand over: the fingerprint is pane-certain, the dir-scan is not.
@@ -4375,8 +4505,16 @@ export const startMirror = (deps) => {
                 const cwd = paneCwd.get(a.tmuxPane);
                 if (!cwd)
                     continue; // pane gone
+                if (backendForPath(a.jsonlPath).name === "codex") {
+                    const registered = codexSessionForPane(a.tmuxPane);
+                    if (registered && registered.cwd === expandHome(cwd) && registered.sessionId !== a.sessionId && !sidsClaimedByOthers(a.target).has(registered.sessionId)) {
+                        a.runningCwd = registered.cwd;
+                        migrateAttachment(a, registered.sessionId, registered.jsonlPath);
+                    }
+                    continue;
+                }
                 const paneDir = projectDirFor(a.jsonlPath, expandHome(cwd));
-                if (paneDir === dirname(a.jsonlPath))
+                if (backendForPath(a.jsonlPath).name === "codex" ? expandHome(cwd) === a.runningCwd : paneDir === dirname(a.jsonlPath))
                     continue; // same project dir — no drift
                 const live = liveSessionForCwd(cwd, backendForPath(a.jsonlPath), sidsClaimedByOthers(a.target));
                 if (!live || live.sessionId === a.sessionId)
@@ -4468,14 +4606,11 @@ export const startMirror = (deps) => {
             return undefined;
         }
     };
-    /** 管家该跑的那一档 (模型 + effort); 不是管家 = undefined。 */
-    const stewardSpec = (target) => {
-        const tier = stewardTierOf(cfg, target);
-        return tier ? { model: cfg.models.tiers[tier].model || undefined, effort: cfg.models.tiers[tier].effort } : undefined;
-    };
     /** 死 pane 重生 (`--resume` 同一个会话) 的模型: 绑定里记着的优先 —— set_model 换上的也记在那;
      *  没记 (老绑定 / CLI 默认) 的管家补上管家档。 */
-    const respawnSpec = (a) => a.model ? { model: a.model, effort: parseEffort(a.effort) } : stewardSpec(a.target) ?? { effort: parseEffort(a.effort) };
+    const respawnSpec = (a) => {
+        return resumedStewardSpec(cfg, a.target, backendForPath(a.jsonlPath).name, a);
+    };
     const newSession = async (target, windowName, cli, opts) => {
         const prev = byTarget.get(target);
         // Resolution precedence (all chat-scoped except the running-cwd fallback):
@@ -4497,22 +4632,16 @@ export const startMirror = (deps) => {
             (rec?.cwd?.trim()) ||
             chat.running ||
             expandedDefaultCwd;
-        // Inherit the outgoing session's CLI when the caller didn't name one: a
-        // `/new` (or a /clear upgraded to /new) on a codebuddy-bound chat must stay
-        // on codebuddy rather than silently reverting to `defaultCli`. Inheritance
-        // is chat-scoped like cwd — a FIRST `/new #tag` has no record of its own,
-        // so it falls back to the base session's binding instead of `defaultCli`
-        // (otherwise a tagged sibling silently forks onto a different CLI).
+        // Fresh panes always use the configured backend, regardless of old bindings
+        // or per-call / tier CLI values. Keep the old path only for model/effort reset.
+        const boundPath = prev?.jsonlPath ?? rec?.jsonlPath;
         const base = baseOfKey(target);
-        const baseBound = base === target ? undefined : byTarget.get(base)?.jsonlPath ?? deps.store.get(base)?.jsonlPath;
-        const boundPath = prev?.jsonlPath ?? rec?.jsonlPath ?? baseBound;
-        const effCli = cli ?? (boundPath ? backendForPath(expandHome(boundPath)).name : undefined);
+        const effCli = resolveCliBackend(cfg.wrc).name;
         // 管家 (群的默认会话) 新起的会话按管家档起 (models.steward / chatPolicy), 档压过绑定里记下的
         // effort —— `/new`、换目录、交接重开都是让改过的档位生效的那一下。点名了模型就整档让开。
         // 已在跑的管家不动 (换模型会让缓存整份重读); 死 pane 重生见 respawnSpec。
-        const steward = opts?.model?.trim() ? undefined : stewardSpec(target);
-        const effModel = opts?.model?.trim() || steward?.model || undefined;
-        const effEffort = opts?.effort ?? steward?.effort ?? parseEffort(prev?.effort ?? deps.store.get(target)?.effort);
+        const backendChanged = Boolean(boundPath && effCli && backendForPath(expandHome(boundPath)).name !== effCli);
+        const { model: effModel, effort: effEffort } = newStewardSpec(cfg, target, effCli, opts, backendChanged ? undefined : prev?.effort ?? deps.store.get(target)?.effort);
         if (prev?.tmuxPane) {
             // Best-effort kill; ignore errors (pane may already be dead).
             void runTmux(["kill-pane", "-t", prev.tmuxPane]);
@@ -4531,7 +4660,7 @@ export const startMirror = (deps) => {
             cli: effCli,
             model: effModel,
             effort: effEffort,
-            systemPrompt: opts?.systemPrompt ?? charterFor(target, { cwd: eff }),
+            systemPrompt: opts?.systemPrompt ?? charterFor(target, { cwd: eff, cli: effCli }),
         }).catch((e) => { inFlightSids.delete(freshSid); throw e; });
         if (!r.ok) {
             inFlightSids.delete(freshSid);
@@ -4695,14 +4824,14 @@ export const startMirror = (deps) => {
         rememberInject(hello);
         const boot = await inject({
             text: hello, images: [], cfg, log: lg,
-            sessionId: parent.sessionId, jsonlPath: parent.jsonlPath,
+            sessionId: parentCli === "codex" ? r.sessionId : parent.sessionId, jsonlPath: parentCli === "codex" ? r.jsonlPath : parent.jsonlPath,
             tmuxTarget: r.tmuxPane, freshSpawn: true,
         });
         if (!boot.ok) {
             await runTmux(["kill-pane", "-t", r.tmuxPane ?? ""]);
             return { ok: false, reason: `分身开场白注入失败: ${boot.reason ?? "unknown"}`, inherited: false };
         }
-        const fork = await awaitFork(projectDir, baseline, sidsClaimedByOthers(args.target), parent.jsonlPath, {
+        const fork = parentCli === "codex" ? { sessionId: r.sessionId, jsonlPath: r.jsonlPath } : await awaitFork(projectDir, baseline, sidsClaimedByOthers(args.target), parent.jsonlPath, {
             homeDir: backendForPath(parent.jsonlPath).homeDir, pane: r.tmuxPane ?? "", parentSid: parent.sessionId,
         });
         // 等不到分叉就必须收手: 此刻唯一已知的 sid 是父亲的, 认下去两个 target 会指向
@@ -4921,14 +5050,16 @@ export const startMirror = (deps) => {
     //   `daily#fix`    改名前的老写法 —— 名字取自 tag 迁移而来, 照旧认得。
     const resolvePeerTag = (self, ref) => {
         const raw = stripSigil(ref);
-        const all = allTargets();
+        // 多机器人隔离: 别的机器人名下的 wizard 在这里与「不存在」同形 —— 不说它在、不进 candidates。
+        // 单机器人时 sameBot 恒真, 这一行什么也不滤。
+        const all = allTargets().filter((k) => sameBot(self, k));
         const hit = (target) => ({ ok: true, target, foreign: baseOfKey(target) !== baseOfKey(self) });
         if (!raw)
             return hit(baseOfKey(self));
         if (/^(user|chat|group):/.test(raw)) {
             return all.includes(raw) ? hit(raw) : { ok: false, reason: `no running session '${raw}'` };
         }
-        const named = wizardStore()?.byName(raw)?.target;
+        const named = ((t) => (t && sameBot(self, t) ? t : undefined))(wizardStore()?.byName(raw)?.target);
         if (named && all.includes(named))
             return hit(named);
         if (named)
@@ -5121,7 +5252,7 @@ export const startMirror = (deps) => {
     const foreignPeers = async (self) => {
         const selfBase = baseOfKey(self);
         // 只列活着的 / 有身份的 —— 冷绑定可能有几百个, 每个探活是两次 tmux。
-        const foreign = allTargets().filter((k) => baseOfKey(k) !== selfBase && (byTarget.has(k) || !!wizardStore()?.get(k)));
+        const foreign = allTargets().filter((k) => baseOfKey(k) !== selfBase && sameBot(self, k) && (byTarget.has(k) || !!wizardStore()?.get(k)));
         return (await Promise.all(foreign.map((t) => peerInfoOf(t, self)))).sort(byRecent);
     };
     // peerInfoOf 每个 target 要两次 tmux (pane 存活 + capture tail)。跑了几个月的
@@ -5255,7 +5386,7 @@ export const startMirror = (deps) => {
         if (!a.keepaliveTurnId) {
             const turnId = newTurnId();
             a.keepaliveTurnId = turnId;
-            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), userQuery: text });
+            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, userQuery: text });
         }
     };
     let keepaliveTicking = false;
@@ -5376,10 +5507,10 @@ export const startMirror = (deps) => {
     // 触发 / 根本不触发 (与 AskUserQuestion 的「本地面板先行」同源; 实测命中: 子代理
     // 里经 ToolSearch→DeferExecuteTool 派发的 MCP 工具)。hook 链路对这类调用完全
     // 失明 —— daemon 零日志、无卡可发, pane 就地阻塞。解法与 askq/plan 同源:
-    // mirror 读屏兜底, 按三件套形状 (pickAutoAllowAnswer) 认权限确认框, 分三路:
-    //   - danger.skipAll 开 → 代按一次性裸 "Yes" (放宽静态权限的变体永不自动选中);
-    //   - 本 chat 的 ⏱自动窗口内、且内层工具不踩危险名单 → 同上代按;
-    //   - 否则 → 把框转成标准审批卡发到本 chat (runMirrorPickerFlow), 点击后代按
+    // mirror 读屏兜底, 按三件套形状 (pickAutoAllowAnswer) 认权限确认框:
+    //   - 上下文完整且现有工具策略放行 → 只代按一次性裸 Yes;
+    //   - denyRules 命中 → 拒绝; 未知参数 / askRules / 强制审批不吃窗口;
+    //   - 其它 → 把框转成标准审批卡发到本 chat (runMirrorPickerFlow), 点击后代按
     //     对应选项; 本地先按掉则 moot 作废卡。代按/发卡都发 chat 回执留痕。
     // WEZARD_PICKER_SENTINEL=0 整体关闭。
     let pickerTicking = false;
@@ -5393,6 +5524,10 @@ export const startMirror = (deps) => {
             for (const a of byTarget.values()) {
                 if (!a.tmuxPane || a.migrationWatcher)
                     continue;
+                // Codex PermissionRequest has its own independent native gate. Screen
+                // options, tool windows and skipAll never authorize its sandbox.
+                if (cliOf(a) === "codex")
+                    continue;
                 if (!(await tmuxPaneAlive(a.tmuxPane)))
                     continue;
                 const v = await detectModalPicker(a.tmuxPane);
@@ -5423,48 +5558,54 @@ export const startMirror = (deps) => {
                     continue;
                 }
                 const ctx = parseConfirmContext(v.screen);
-                const danger = dangerOf(cfg, ctx.toolName, ctx.toolInput);
-                // 自动代按的两个授权源。窗口路径要过危险名单 (窗口语义不覆盖 mustCard);
-                // skipAll 本就压过危险名单 (与 daemon 审批链一致), 不检。
-                const auto = cfg.approval.danger.skipAll
-                    ? "skipAll"
-                    : isAutoWindowActive(a.target) && !danger ? "⏱自动窗口" : undefined;
-                if (auto) {
-                    const after = await pressModalIndex(a.tmuxPane, v, pick.index);
-                    if (after.modal) {
-                        // 没按掉: 指纹换成当前屏 — pane 静止就不再重试, 免得往一个不认识的框里刷数字键。
-                        a.pickerSentinelFp = after.screen;
-                        log.warn({ target: a.target, title: after.title, pressed: pick.index }, "picker sentinel: modal still on pane after press");
-                        continue;
-                    }
-                    a.pickerSentinelFp = undefined;
-                    log.info({ target: a.target, title: v.title, via: auto, pressed: `${pick.index}. ${pick.label}` }, "picker sentinel: native permission picker auto-allowed");
-                    sendStandalone(a, `[mirror] 🔓 ${auto} 代按了 CLI 原生权限确认${v.title ? `「${v.title}」` : ""} → ${pick.index}. ${pick.label}`);
-                    continue;
+                const policy = pickerPolicy(cfg, cliOf(a), ctx, isAutoWindowActive(a.target));
+                if (policy.decision === "leave") {
+                    log.info({ target: a.target, reason: policy.reason }, "picker sentinel: independent approval left on CLI");
                 }
-                // 卡片路径: fire-and-forget — 长轮询在 flow 里, 哨兵循环不能被一张卡挂住;
-                // 防重靠 hasMirrorPicker 槽位 (含代按窗口期, 见 flow 内 finally)。
-                log.info({ target: a.target, toolName: ctx.toolName, agent: ctx.agent, danger: danger?.rule }, "picker sentinel: forwarding native picker as approval card");
-                runMirrorPickerFlow({
-                    log: log.child({ target: a.target, sessionId: a.sessionId, sub: "picker-card" }),
-                    client,
-                    cfg,
-                    sessionId: a.sessionId,
-                    chatKey: a.target,
-                    cwd: a.runningCwd,
-                    jsonlPath: a.jsonlPath,
-                    toolName: ctx.toolName,
-                    toolInput: ctx.toolInput,
-                    agent: ctx.agent,
-                    danger: danger?.rule,
-                    voteTimeoutMs: cfg.approval.longPollSec * 1000,
-                    press: (what) => pressNativePicker(a, ctx.toolName, what),
-                }).then((sent) => {
-                    // 卡没发出去 (WS 断/发送失败): 清指纹, 让下一 tick 对同屏重试发卡,
-                    // 否则这只框会被指纹永久静默。
-                    if (!sent)
+                await dispatchPickerPolicy(policy, {
+                    deny: async () => {
+                        const result = await pressNativePicker(a, modalFingerprint(v.screen), "no");
+                        log.info({ target: a.target, reason: policy.reason, result }, "picker sentinel: deny rule");
+                        sendStandalone(a, `[mirror] 🚫 ${policy.reason}，${result.ok ? "已拒绝 CLI 确认" : "确认框已变更，请回 CLI 处理"}`);
+                    },
+                    allow: async () => {
+                        const after = await pressModalIndex(a.tmuxPane, v, pick.index);
+                        if (after.modal) {
+                            // 没按掉: 指纹换成当前屏 — pane 静止就不再重试, 免得往一个不认识的框里刷数字键。
+                            a.pickerSentinelFp = after.screen;
+                            log.warn({ target: a.target, title: after.title, pressed: pick.index }, "picker sentinel: modal still on pane after press");
+                            return;
+                        }
                         a.pickerSentinelFp = undefined;
-                }).catch((e) => log.warn({ err: e.message, target: a.target }, "mirror picker flow failed"));
+                        log.info({ target: a.target, title: v.title, via: policy.reason, pressed: `${pick.index}. ${pick.label}` }, "picker sentinel: native permission picker auto-allowed");
+                        sendStandalone(a, `[mirror] 🔓 ${policy.reason} 代按了 CLI 原生权限确认${v.title ? `「${v.title}」` : ""} → ${pick.index}. ${pick.label}`);
+                    },
+                    manual: () => {
+                        // 卡片路径: fire-and-forget — 长轮询在 flow 里, 哨兵循环不能被一张卡挂住;
+                        // 防重靠 hasMirrorPicker 槽位 (含代按窗口期, 见 flow 内 finally)。
+                        log.info({ target: a.target, toolName: ctx.toolName, agent: ctx.agent, reason: policy.reason }, "picker sentinel: forwarding native picker as approval card");
+                        runMirrorPickerFlow({
+                            log: log.child({ target: a.target, sessionId: a.sessionId, sub: "picker-card" }),
+                            client,
+                            cfg,
+                            sessionId: a.sessionId,
+                            chatKey: a.target,
+                            cwd: a.runningCwd,
+                            jsonlPath: a.jsonlPath,
+                            toolName: ctx.toolName,
+                            toolInput: ctx.toolInput,
+                            agent: ctx.agent,
+                            danger: policy.forceSingle,
+                            voteTimeoutMs: cfg.approval.longPollSec * 1000,
+                            press: (what) => pressNativePicker(a, modalFingerprint(v.screen), what),
+                        }).then((sent) => {
+                            // 卡没发出去 (WS 断/发送失败): 清指纹, 让下一 tick 对同屏重试发卡,
+                            // 否则这只框会被指纹永久静默。
+                            if (!sent)
+                                a.pickerSentinelFp = undefined;
+                        }).catch((e) => log.warn({ err: e.message, target: a.target }, "mirror picker flow failed"));
+                    },
+                });
             }
         }
         catch (e) {
@@ -5478,15 +5619,19 @@ export const startMirror = (deps) => {
     // 审批卡点击后的代按回调。点击与本地按键之间隔着人的反应时间, 必须重读屏并
     // 校验仍是**同一个调用**的确认框 —— 期间本地按掉旧框又弹了新框的话, 盲按就是
     // 替用户批准了他没看过的东西。
-    const pressNativePicker = async (a, expectToolName, what) => {
+    const pressNativePicker = async (a, expectFingerprint, what) => {
         if (!a.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
             return { ok: false, reason: "pane 已不在" };
+        if (cliOf(a) === "codex")
+            return { ok: false, reason: "Codex 原生沙箱审批必须单独处理" };
         const v = await detectModalPicker(a.tmuxPane);
         if (!v.modal)
             return { ok: false, reason: "确认框已不在（可能已在本地处理）" };
-        const now = parseConfirmContext(v.screen);
-        if (expectToolName && now.toolName !== expectToolName) {
-            return { ok: false, reason: `当前确认框已是另一个调用（${now.toolName}），不代按` };
+        if (pickerPolicy(cfg, cliOf(a), parseConfirmContext(v.screen), false).decision === "leave") {
+            return { ok: false, reason: "独立原生或交互审批，请在 CLI 中处理" };
+        }
+        if (modalFingerprint(v.screen) !== expectFingerprint) {
+            return { ok: false, reason: "当前确认框的操作或参数已变更，不代按" };
         }
         if (what === "no") {
             await runTmux(["send-keys", "-t", a.tmuxPane, "Escape"]);
@@ -5523,6 +5668,8 @@ export const startMirror = (deps) => {
             const a = byTarget.get(target);
             if (!a?.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
                 return { ok: false, reason: "它没有活着的 pane —— 模型是在 pane 里切的, 先叫醒它" };
+            if (backendForPath(a.jsonlPath).name === "codex")
+                return { ok: false, reason: "Codex 运行中的模型请在终端 /model 切换；新开会话可指定 model" };
             const r = await selectModel(a.tmuxPane, wanted, log.child({ sub: "set-model", target }), scope);
             if (r.ok && r.applied) {
                 a.model = r.applied;
@@ -5536,6 +5683,8 @@ export const startMirror = (deps) => {
             const a = byTarget.get(target);
             if (!a?.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
                 return { ok: false, reason: "它没有活着的 pane —— 档位是在 pane 里切的, 先叫醒它" };
+            if (backendForPath(a.jsonlPath).name === "codex")
+                return { ok: false, reason: "Codex 运行中的推理强度请在终端 /model 切换；新开会话可指定 effort" };
             const r = await selectEffort(a.tmuxPane, effort, log.child({ sub: "set-effort", target }));
             if (r.ok && r.applied) {
                 a.effort = r.applied;
@@ -5761,7 +5910,7 @@ export const startMirror = (deps) => {
                 // Same resume-fork hazard as dispatch: snapshot before spawn, re-bind
                 // onto the forked jsonl once it appears (EOF offset — fork is seeded).
                 const resumeBaseline = listJsonls(dirname(a.jsonlPath));
-                const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn-init", sessionId: sid }), resumeSessionId: sid, windowName: displayName(target) || target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(target, { cwd: a.runningCwd }) });
+                const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn-init", sessionId: sid }), resumeSessionId: sid, windowName: displayName(target) || target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(target, { cwd: a.runningCwd, cli: backendForPath(a.jsonlPath).name }) });
                 if (!r.ok || !r.tmuxPane)
                     return { ok: false, reason: `respawn failed: ${r.reason ?? "unknown"}` };
                 a.tmuxPane = r.tmuxPane;
@@ -5892,7 +6041,7 @@ export const startMirror = (deps) => {
             // allTargets 是几百个 key, 见 target 就问 tmux 会打穿 fd (同 worldPeers 的
             // WORLD_PROBE 取舍)。
             const orphans = [];
-            const snap = await runTmux(["list-panes", "-a", "-F", "#{pane_id}\t#{window_active}:#{session_attached}\t#{session_name}\t#{window_activity}"]);
+            const snap = await runTmux(["list-panes", "-a", "-F", "#{pane_id}\t#{window_active}:#{session_attached}\t#{session_name}\t#{pane_pid}"]);
             if (snap.code !== 0)
                 return { reaped, orphans, skipped };
             const rows = snap.stdout.split("\n").filter(Boolean).map((l) => l.split("\t"));
@@ -5918,15 +6067,38 @@ export const startMirror = (deps) => {
             // 丢了 pane id (restore 认不出 → 下一条消息另起新 pane, 旧 pane 不杀) 之后留下的。
             // 没有地址能再叫到它, 却不在下面 `live` 的账上, 攒多少都触不到上限; 所以不占
             // 名额、不等超限, 见到就收。刚起的 pane 在 attach 之前也长这样 (并发 spawn),
-            // 用 window_activity 留一段宽限。只收会话 pane: 注册表认得里面住着活的 AI 会话
-            // 才算; 普通 pane (人自己开的 shell / 编辑器, 会话已退回 shell 的, 没有注册表的
-            // 后端) 一律跳过 —— 认不出就不动。
+            // 用 window_activity 留一段宽限。只收会话 pane: pane 的进程树里有注册表登记且
+            // 还活着的 CLI 进程才算 (pane_pid 是 shell, CLI 是它的子孙, 所以沿 ps 快照往下
+            // 找)。不看注册表的 `tmux` 字段 —— codebuddy 的注册表没有它, 那条路对 codebuddy
+            // 全盲。普通 pane (人自己开的 shell / ssh / 编辑器, 会话已退回 shell 的) 树里
+            // 没有注册表 pid, 一律跳过 —— 认不出就不动。
             const bound = new Set(targets.map(paneOf).filter(Boolean));
-            const hosting = new Set(activeBackends().flatMap((b) => [...sessionPanes(b.homeDir)]));
-            for (const [pane = "", , session, activity] of rows) {
-                if (session !== cfg.wrc.tmuxPrefix || bound.has(pane) || !hosting.has(pane))
+            const regPids = new Set(activeBackends().flatMap((b) => [...liveSessionPids(b.homeDir)]));
+            const ps = await psSnap();
+            // 沿进程树找注册表 pid; 找到返回那个 pid (它的 etimes 供宽限判), 找不到返回 0。
+            const hostedBy = (pid) => {
+                const seen = new Set();
+                const stack = [pid];
+                while (stack.length) {
+                    const p = stack.pop() ?? 0;
+                    if (regPids.has(p))
+                        return p;
+                    if (seen.has(p))
+                        continue;
+                    seen.add(p);
+                    for (const k of ps.kids.get(p) ?? [])
+                        stack.push(k);
+                }
+                return 0;
+            };
+            for (const [pane = "", , session, pid] of rows) {
+                if (session !== cfg.wrc.tmuxPrefix || bound.has(pane))
+                    continue;
+                const cliPid = hostedBy(Number(pid) || 0);
+                if (!cliPid)
                     continue;
-                if (now - Number(activity) * 1000 < ORPHAN_GRACE_MS)
+                // 宽限按 CLI 进程年龄, 不按 window_activity: TUI 重绘会让它永远「刚动过」。
+                if ((ps.etimes.get(cliPid) ?? Number.POSITIVE_INFINITY) * 1000 < ORPHAN_GRACE_MS)
                     continue;
                 const why = await putDown(pane);
                 if (why) {
@@ -5934,7 +6106,7 @@ export const startMirror = (deps) => {
                     continue;
                 }
                 orphans.push(pane);
-                log.info({ pane, idleHours: Math.round((now - Number(activity) * 1000) / 3.6e6) }, "mirror pane cap — orphan pane killed (no binding)");
+                log.info({ pane, cliPid, cliAgeHours: Math.round((ps.etimes.get(cliPid) ?? 0) / 3600) }, "mirror pane cap — orphan pane killed (no binding)");
             }
             const live = targets.filter((t) => watchedBy.has(paneOf(t)));
             let over = live.length - max;
@@ -6029,6 +6201,8 @@ export const startMirror = (deps) => {
         hasLivePane: (sessionId) => Boolean(bySessionId.get(sessionId)?.tmuxPane),
         answerNativeModal: async (sessionId, opts) => {
             const a = bySessionId.get(sessionId);
+            if (a && cliOf(a) === "codex")
+                return { status: "no_modal", reason: "Codex native approval is independent" };
             if (!a?.tmuxPane)
                 return { status: "no_pane", reason: "no live tmux pane for session" };
             if (!(await tmuxPaneAlive(a.tmuxPane)))
@@ -6046,6 +6220,9 @@ export const startMirror = (deps) => {
             // 没等到: 这次 CC 没弹框(会话内已授权过 / 命中盲点判断失误)。无事可做。
             if (!v.modal)
                 return { status: "no_modal" };
+            if (pickerPolicy(cfg, cliOf(a), parseConfirmContext(v.screen), false).decision === "leave") {
+                return { status: "no_modal", reason: "independent native approval left on CLI" };
+            }
             const pick = pickModalAnswer(parseModalOptions(v.screen), v.title);
             if (!pick) {
                 lg.warn({ title: v.title }, "native modal: no trustworthy one-shot option, not pressing");
@@ -6086,6 +6263,12 @@ export const startMirror = (deps) => {
             bySessionId.clear();
             byTarget.clear();
         },
+        currentAsker: (target) => {
+            const a = byTarget.get(target);
+            if (a?.convFrom)
+                return a.convFrom.asker;
+            return a?.speaker ? { who: a.speaker, chat: a.channel ?? baseOfKey(target) } : undefined;
+        },
         currentChannel: (target) => {
             const a = byTarget.get(target);
             return a?.channel ?? baseOfKey(target);
@@ -6268,7 +6451,7 @@ export const startMirror = (deps) => {
                     const resumeBaseline = !armMigration ? listJsonls(dirname(a.jsonlPath)) : undefined;
                     // Respawn in the binding's runningCwd (pendingCwd doesn't apply to a
                     // mid-turn reincarnation — only /new and /clear-with-pending swap cwd).
-                    const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn", sessionId: sid }), resumeSessionId: sid, windowName: displayName(a.target) || a.target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(a.target, { cwd: a.runningCwd }) });
+                    const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn", sessionId: sid }), resumeSessionId: sid, windowName: displayName(a.target) || a.target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(a.target, { cwd: a.runningCwd, cli: backendForPath(a.jsonlPath).name }) });
                     if (r.ok && r.tmuxPane && r.tmuxSession) {
                         a.tmuxPane = r.tmuxPane;
                         a.tmuxSession = r.tmuxSession;