chore: agent-bundle e57c0ac9 + MATCH2 leftover tighten

.changeset/match2-private-stdio-tighten.md

@@ -0,0 +1,5 @@
+---
+"grok-bot-cli": patch
+---
+
+Tighten Desktop private-stdio detection so probe-shell cmdlines that only mention ChatGPT.app + app-server + codex-app-tools no longer false-positive; keep the Resources/codex path match.

package.json

@@ -54,12 +54,12 @@
     "LICENSE"
   ],
   "devDependencies": {
-    "@agent-bundle/runtime": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@8e55ab832d",
+    "@agent-bundle/runtime": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@810",
     "@changesets/cli": "3.0.3",
     "@rstest/core": "0.11.12",
     "@types/node": "^24.0.0",
     "@types/react": "^19.2.18",
-    "agent-bundle": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@8e55ab832d",
+    "agent-bundle": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@810",
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "typescript": "7.0.2",

src/core/codex-bridge.js

@@ -722,10 +722,10 @@ export function detectDesktopPrivateAppServer({ platform = process.platform, lis
   const lines = Array.isArray(listProcesses) ? listProcesses : String(listProcesses ?? "").split(/\r?\n/);
   for (const line of lines) {
     if (!/app-server/.test(line)) continue;
-    // Desktop's bundled binary, Mac or Windows-style separators with optional .exe.
+    // Desktop's bundled binary only (Mac/Windows separators, optional .exe).
+    // Do NOT match probe shells whose cmdline merely mentions ChatGPT.app +
+    // app-server + codex-app-tools — that false-positives MATCH2 / Scout noise.
     if (/ChatGPT\.app[\\/].*Resources[\\/]codex(\.exe)?(["'\s]|$)/.test(line)) return "private-stdio";
-    // Same app-server line owned by ChatGPT.app carrying the app-tools override.
-    if (/ChatGPT\.app/.test(line) && /(codex_app|mcp_servers\.codex_app|codex-app-tools)/.test(line)) return "private-stdio";
   }
   return "unknown";
 }

test/codex-bridge.test.js

@@ -1154,6 +1154,17 @@ test("detectDesktopPrivateAppServer stays unknown on Windows", () => {
   assert.equal(detectDesktopPrivateAppServer({ platform: "win32", listProcesses: DESKTOP_MAC_PS }), "unknown");
 });
 
+
+test("detectDesktopPrivateAppServer ignores probe-shell cmdline noise (MATCH2 false-positive)", () => {
+  // Scout observed: a shell whose argv text mentions ChatGPT.app + app-server +
+  // codex-app-tools without being Desktop's Resources/codex binary.
+  const probe = [
+    "1234 ?? 0:00.01 /bin/zsh -c echo ChatGPT.app app-server codex-app-tools mcp_servers.codex_app",
+    "1235 ?? 0:00.01 node /tmp/probe.js --from ChatGPT.app --flag app-server --tools codex-app-tools",
+  ].join("\n");
+  assert.equal(detectDesktopPrivateAppServer({ platform: "darwin", listProcesses: probe }), "unknown");
+});
+
 test("codexStatus reports private-stdio with a managed-daemon message when the socket is absent", async () => {
   const home = mkdtempSync(join(tmpdir(), "gbot-codex-desktop-"));
   const status = await codexStatus({ ...process.env, CODEX_HOME: home, PATH: "/nonexistent" }, { listProcesses: DESKTOP_MAC_PS });