feat(codex): session dedup across roots, canonical real-home resume, and sqlite index heal

build-plugins/plain-node-entry-guard.ts

@@ -18,7 +18,8 @@ const PLAIN_NODE_ENTRY_NAMES = [
   'daemon-entry',
   'parcel-watcher-process-entry',
   'computer-sidecar',
-  'agent-hooks/managed-agent-hook-controls'
+  'agent-hooks/managed-agent-hook-controls',
+  'codex/codex-app-server-grant-entry'
 ] as const
 
 const ELECTRON_REQUIRE_RE = /require\(\s*["']electron["']\s*\)/

config/tsconfig.cli.json

@@ -11,17 +11,30 @@
     "../src/main/antigravity/hook-service.ts",
     "../src/main/claude/hook-settings.ts",
     "../src/main/claude/hook-service.ts",
+    "../src/main/codex/codex-app-server-capability-cache.ts",
+    "../src/main/codex/codex-app-server-client.ts",
+    "../src/main/codex/codex-app-server-grant-bridge.ts",
+    "../src/main/codex/codex-app-server-grant-envelope.ts",
+    "../src/main/codex/codex-app-server-session.ts",
     "../src/main/codex/codex-config-mirror.ts",
     "../src/main/codex/codex-config-path-reference-rewrite.ts",
     "../src/main/codex/codex-home-paths.ts",
     "../src/main/codex/codex-hook-identity.ts",
+    "../src/main/codex/codex-hook-trust-grant.ts",
+    "../src/main/codex/codex-managed-trust-reconciliation.ts",
+    "../src/main/codex/codex-process-exit-deadline.ts",
+    "../src/main/codex/codex-trust-config-rollback.ts",
+    "../src/main/codex/codex-trust-grant-host.ts",
+    "../src/main/codex/codex-trust-grant-ledger.ts",
     "../src/main/codex/codex-wsl-hook-install-plan.ts",
     "../src/main/codex/config-settings-promotion.ts",
     "../src/main/codex/config-toml-line-scan.ts",
     "../src/main/codex/config-toml-trust.ts",
     "../src/main/codex/hook-service.ts",
     "../src/main/codex/hook-trust-promotion.ts",
     "../src/main/codex-accounts/fs-utils.ts",
+    "../src/main/codex-accounts/wsl-codex-command.ts",
+    "../src/main/codex-cli/command.ts",
     "../src/main/command-code/command-code-managed-script.ts",
     "../src/main/command-code/hook-service.ts",
     "../src/main/copilot/hook-service.ts",

electron.vite.config.ts

@@ -185,6 +185,12 @@ export default defineConfig({
           // Why: forked with ELECTRON_RUN_AS_NODE so @parcel/watcher faults
           // can't take down the main process (issue #7547).
           'parcel-watcher-process-entry': resolve('src/main/ipc/parcel-watcher-process-entry.ts'),
+          // Why: run under ELECTRON_RUN_AS_NODE while the caller blocks on
+          // spawnSync — codex app-server trust grants need a live event loop
+          // but must finish before a Codex pane launch proceeds.
+          'codex/codex-app-server-grant-entry': resolve(
+            'src/main/codex/codex-app-server-grant-entry.ts'
+          ),
           // Why: electron-vite cleans out/main in dev. The dev CLI imports
           // this path for `orca agent hooks ...`, so it must survive rebuilds.
           'agent-hooks/managed-agent-hook-controls': resolve(

mobile/src/session/ai-vault-resume-launch.test.ts

@@ -144,6 +144,36 @@ describe('buildMobileAiVaultResumeLaunch', () => {
       agentArgs: '--model opus',
       agentEnv: { ANTHROPIC_BASE_URL: 'http://localhost:3000' }
     })
+    // Only bare real-home Codex resumes request env deletion.
+    expect(launch.envToDelete).toBeUndefined()
+  })
+
+  it('deletes inherited Codex homes when resuming a real-home session like desktop', () => {
+    // Regression: a user agentDefaultEnv CODEX_HOME (or a stale daemon-
+    // inherited home) must not reroute a bare real-home resume typed into the
+    // created pane; desktop already strips the pair at pane spawn.
+    const launch = buildMobileAiVaultResumeLaunch({
+      session: session({ agent: 'codex', sessionId: 'codex-1', codexHome: null }),
+      hostPlatform: 'darwin',
+      settings: {
+        agentDefaultEnv: { codex: { CODEX_HOME: '/Users/ada/.codex-pinned' } }
+      }
+    })
+    expect(launch.command).not.toContain('CODEX_HOME=')
+    expect(launch.envToDelete).toEqual(['CODEX_HOME', 'ORCA_CODEX_HOME'])
+  })
+
+  it('keeps managed-home Codex resumes free of env deletion', () => {
+    const launch = buildMobileAiVaultResumeLaunch({
+      session: session({
+        agent: 'codex',
+        sessionId: 'codex-1',
+        codexHome: '/Users/ada/.orca/codex-runtime-home/home'
+      }),
+      hostPlatform: 'darwin'
+    })
+    expect(launch.command).toContain("CODEX_HOME='/Users/ada/.orca/codex-runtime-home/home'")
+    expect(launch.envToDelete).toBeUndefined()
   })
 })
 
@@ -161,6 +191,7 @@ describe('resumeAiVaultSessionInTerminal', () => {
       resumeAiVaultSessionInTerminal({ sendRequest }, 'worktree-1', {
         command: 'claude --resume abc',
         env: { ANTHROPIC_BASE_URL: 'http://localhost:3000' },
+        envToDelete: ['CODEX_HOME', 'ORCA_CODEX_HOME'],
         launchConfig: {
           agentCommand: 'claude',
           agentArgs: '',
@@ -176,6 +207,7 @@ describe('resumeAiVaultSessionInTerminal', () => {
       {
         worktree: 'id:worktree-1',
         env: { ANTHROPIC_BASE_URL: 'http://localhost:3000' },
+        envToDelete: ['CODEX_HOME', 'ORCA_CODEX_HOME'],
         launchConfig: {
           agentCommand: 'claude',
           agentArgs: '',

mobile/src/session/ai-vault-resume-launch.ts

@@ -1,7 +1,8 @@
 import type { AiVaultSession } from '../../../src/shared/ai-vault-types'
 import {
   buildAiVaultResumeCommand,
-  buildAiVaultResumeShellCommand
+  buildAiVaultResumeShellCommand,
+  realHomeCodexResumeEnvDeletion
 } from '../../../src/shared/ai-vault-types'
 import { isResumableTuiAgent } from '../../../src/shared/agent-session-resume'
 import type { SleepingAgentLaunchConfig } from '../../../src/shared/agent-session-resume'
@@ -71,6 +72,7 @@ export type MobileAiVaultResumeSettings = {
 export type MobileAiVaultResumeLaunch = {
   command: string
   env?: Record<string, string>
+  envToDelete?: string[]
   launchConfig?: SleepingAgentLaunchConfig
   launchAgent?: TuiAgent
 }
@@ -111,6 +113,9 @@ export function buildMobileAiVaultResumeLaunch(args: {
           shell
         }),
         ...(startupPlan.env ? { env: startupPlan.env } : {}),
+        // Why: the resume command is typed into the created pane, so the bare
+        // real-home override must strip Codex homes at pane spawn like desktop.
+        ...realHomeCodexResumeEnvDeletion(args.session),
         launchConfig: startupPlan.launchConfig,
         launchAgent: startupPlan.agent
       }
@@ -122,7 +127,8 @@ export function buildMobileAiVaultResumeLaunch(args: {
       hostPlatform: args.hostPlatform,
       hostTerminalWindowsShell: args.hostTerminalWindowsShell,
       commandOverride
-    })
+    }),
+    ...realHomeCodexResumeEnvDeletion(args.session)
   }
 }
 
@@ -155,6 +161,7 @@ export async function resumeAiVaultSessionInTerminal(
     {
       worktree: `id:${worktreeId}`,
       ...(launch.env ? { env: launch.env } : {}),
+      ...(launch.envToDelete ? { envToDelete: launch.envToDelete } : {}),
       ...(launch.launchConfig ? { launchConfig: launch.launchConfig } : {}),
       ...(launch.launchAgent ? { launchAgent: launch.launchAgent } : {}),
       ...(launch.clientMutationId ? { clientMutationId: launch.clientMutationId } : {})

src/main/agent-hooks/installer-utils.ts

@@ -2,6 +2,7 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  statSync,
   writeFileSync,
   chmodSync,
   copyFileSync,
@@ -353,7 +354,11 @@ function writeScriptWithAclRetry(scriptPath: string, content: string): void {
   }
 }
 
-export function writeHooksJson(configPath: string, config: HooksConfig): void {
+export function writeHooksJson(
+  configPath: string,
+  config: HooksConfig,
+  options?: { preserveMode?: boolean }
+): void {
   const dir = dirname(configPath)
   mkdirSync(dir, { recursive: true })
 
@@ -368,6 +373,8 @@ export function writeHooksJson(configPath: string, config: HooksConfig): void {
   // UUID suffix makes the tmp path unique per call.
   const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
   const serialized = `${JSON.stringify(config, null, 2)}\n`
+  const existingMode =
+    options?.preserveMode === true && existsSync(configPath) ? statSync(configPath).mode : undefined
 
   // Why: skip the write (and therefore the .bak rotation) when the on-disk
   // content is already identical. Without this, every install() rewrites the
@@ -386,7 +393,7 @@ export function writeHooksJson(configPath: string, config: HooksConfig): void {
   }
 
   try {
-    writeFileSync(tmpPath, serialized, 'utf-8')
+    writeFileSync(tmpPath, serialized, { encoding: 'utf-8', mode: existingMode })
     // Why: single rolling backup — one file, no accumulation in ~/.claude.
     // Protects against a merge-logic bug producing bad JSON; the original is
     // always recoverable from <configPath>.bak until the next write.