Run the Codex monitor Stop replay outside the hook handler frame

[teamleaderleo]

Summary

Fixes a latent stack overflow (SIGBUS) in the cmux CLI's Codex monitor path.

Root cause. cmux hooks codex monitor watches the rollout, and when the turn completes it replays a Stop event. On main that replay called runGenericAgentHook from a closure passed into runCodexTranscriptMonitor, which was itself called from inside runGenericAgentHook. So two copies of the hook handler frame were live at once. That frame is very large (about 175 KB of inlined locals, measured in the lane working on #13161), and the whole CLI runs on a Swift concurrency pool thread: CMUXTermMain.main() async awaits the nonisolated CMUXCLI.run(), which in Swift 5 mode hops to the global cooperative executor, whose threads have a 512 KB stack. Two nested handler frames plus the run() dispatch frames overflowed it. The CLI product test hit this twice while #13161 was growing the handler.

Fix (non-recursive replay).

• runCodexTranscriptMonitor no longer takes a replay callback. It returns the CodexTranscriptMonitorStopReplay? for a healthy completion.
• runGenericAgentHook is now a thin dispatcher. For codex monitor it emits the same codex-hook.monitor breadcrumb, runs the monitor, and after the monitor returns it runs the Stop event with the replay payload. Every other event goes straight to the handler.
• The old body is now runGenericAgentHookEvent, marked @inline(never) so the compiler cannot merge its frame into the dispatcher. runCodexTranscriptMonitor is @inline(never) too, so its locals are gone before the replayed Stop runs.

Why the frame is now bounded. Only the dispatcher calls runGenericAgentHookEvent, and the handler body never calls back into runGenericAgentHook. The monitor frame has fully unwound before the Stop replay starts. So at most one handler frame is on the stack at any time, no matter how large the handler grows.

Behavior. Unchanged, with one ordering detail: the monitor removes its own lease file when it returns, which is now just before the replayed Stop instead of just after. Stop only retires leases (marks them), and nothing reads a lease except retire, prune, and the monitor's own retired check, so the end state is the same.

Testing

• Existing coverage: cmuxCLITests/CLICodexResumeNotificationTests "The rollout monitor recovers a dropped resumed Stop hook" runs the bundled CLI with hooks codex monitor against a completed rollout and asserts the replayed Stop notifies. That is the path that crashed, and it now runs with one handler frame.
• No new stack-depth test: the cooperative pool stack size cannot be set from a test, so a deterministic overflow test would only prove the frame size of one compiler build.

🤖 Generated with Claude Code

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 OpenGrep (1.30.0)

CLI/cmux.swift

OpenGrep scan timed out

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Merge receipt for ad18184348, merged 2026-09-25 20:42:54 UTC

• Not verified at merge: ci-status (not reported), Web complexity (in progress)
• Verified: web-validation, Testbox broker trust boundary
• Skipped by policy: web-build, web-database-tests, web-tests
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.