[abruption]

Summary

Implements the approved first slice of #324: local, user-owned route presets, not saved recipients or a team identity directory. Supports ordinary local/SSH Claude Code and Codex list/send on Mac/Linux. The branch incorporates current main 87e46e8dc63880acf6cb6db3666d5f438dc2d06f, including the separately merged #327 dependency fix. The diff contains no Control dependency changes and does not copy the still-open #325 feature.

session-peer preset add work-mac --host user@work-mac --agent codex --codex-home /Users/user/.codex
session-peer preset show work-mac --json
session-peer list --preset work-mac
session-peer send --preset work-mac --to 'codex:<full-thread-uuid>' --message "Review the patch" --dry-run
session-peer send --preset work-mac --preset-revision 'dp1:<HASH>' --to 'codex:<full-thread-uuid>' --message "Review the patch"

• Adds preset add/list/show/replace/remove, list/send --preset and send --preset-revision.
• Saves only a route, agent, one SSH host when needed, and an explicit absolute Codex home for Codex. Never saves recipient names, PID/UUID/generation, bodies, credentials, executables, SSH options, permissions or receipt capabilities. --to remains required and uses existing native validation.
• Actual sends require a matching content revision; replace/remove use expected-revision checks. The hash detects config changes, not human approval, person identity, DNS/SSH configuration continuity, owner generation, native storage identity or ACK. Same values restore the same hash. A later mutation does not cancel an already expanded invocation.
• Rejects unsupported/conflicting combinations and repeated new options before input/advisory/native work. Presets cannot silently override explicit route arguments, Reply-To URIs, paired devices, Antigravity, wake/inactive flags or experimental handoff.
• Management reads do not initialize storage, contact targets, launch native tools or refresh update notices. Existing ordinary list/send output, native JSON/wire and exits remain; text route/revision context is sender-only stderr. No additional probes or automatic resend/fallback are introduced.
• Updates all four CLI-reference locales, their manifest and the generated standalone.

Refs #324. The broader saved-recipient binding, paired-device, grouping and other address-book acceptance items remain open. This is not a complete implementation of the entire issue.

Storage boundary

• Strict versioned JSON, duplicate/unknown fields refused, 64 KiB and 128-entry limits; only explicitly selected presets cause config reads. No current-working-directory config search or silent fallback.
• Owner/mode/no-follow/regular-file/hardlink checks, held directory/file descriptors, bounded writer lock and atomic replacement. Conservative ACL checks include ancestors; Windows and unverifiable storage are refused without changing ordinary Windows functionality.
• macOS ownership-ignoring mounts are explicitly refused using the held FD and the documented 64-bit filesystem ABI. A mode of 0600/0700 alone is not considered proof of ownership enforcement. No mount or global permission settings are modified.
• Post-replacement durability failure is distinguished from pre-commit failure; management interruption can leave a visible update and requires inspecting current configuration. Cleanup preserves the primary exception but still reports normal cleanup errors.
• These are conservative configuration checks, not an effective-ACL interpreter, atomic owner/storage attestation, defense against root/the same account, recipient deduplication or a new authorization protocol. Some otherwise usable ACL/symlink/shared-directory layouts are intentionally refused.

Validation

Candidate 6510c93aa39e613adf2eeb4a35b0e9c0a1ebca7e: preset code, tests, docs and generated artifact are byte-identical to reviewed c54a70b413c198d2b481479222dc53aa8648dac8; the integration commit adds only current main's already-merged Control lockfile.

• macOS arm64, Python 3.13.7 with relay/MCP test extras, dev mode and ResourceWarning as error: 1385 tests OK, 21 skipped.
• New preset storage/CLI/flow suite: 66 tests OK, 2 skipped locally on Python 3.9.6 and 3.13.7. Both Linux-only native ACL fixtures subsequently passed without skips in the current-head Ubuntu Python 3.9 CI job.
• Actual dedicated-temp macOS ACL allow/deny checks and owner-enforced versus ownership-ignored filesystem FD checks, without changing real user config or mount settings. Other native sends/SSH execution are mocked. No agent/model delivery experiment is claimed.
• Four-language docs, generator --check, isolated wheel/sdist build, exact distribution-content tests (4) and git diff --check pass. No global dependency installation.
• Independent read-only CLI reviews were performed before PR creation; confirmed issues were corrected and regression-tested. Successful tests and static reviews are not whole-platform or live delivery acceptance.

Current-head verification: CI run 39753494952 succeeded; all 28 PR checks pass. Automatic code and security reviews completed without findings on 6510c93aa39e613adf2eeb4a35b0e9c0a1ebca7e. This is a review handoff, not merge or release authorization.

Integration and approval gates

• chore(control): update Vite and Vitest security patches #327 is now merged and incorporated from current main. Existing dependency auditing remains enabled and must pass on this PR; no bypass is included.
• feat(cli): explain ordinary dry-run delivery limits #325's separate --explain feature is not copied here; these examples use the normal dry run. Combined-tree integration must be checked after normal approval/merge of the sibling PRs.
• No merge, version bump, tag, release, package publication, global installation or operational deployment is included.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T09:14:43.393999Z	6510c93	PR opened
🔒 Security Review	✅ Completed 2026-10-22T09:15:35.753553Z	6510c93	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.