CMUXAgentLaunch: carry Subrouter session identity through restore

CLI/cmux.swift

@@ -36014,6 +36014,10 @@ struct CMUXCLI {
                 arguments: launchCommand?.arguments ?? [],
                 observedPermissionMode: observedPermissionMode
             )
+        case .rejected:
+            // See RestorableAgentSession: a mismatched routed Codex record is
+            // not resumed directly.
+            return nil
         }
 
         guard let argv, !argv.isEmpty else { return nil }

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentRestorePlanner.swift

@@ -2,6 +2,22 @@ import Foundation
 
 /// Builds shell-free restore and fork invocations from structured persisted records.
 public struct AgentRestorePlanner: Sendable {
+    /// The prepared argv as a restore plan, or `nil`. Prepared argv is not
+    /// independent provenance: a legacy or deferred Codex record can carry
+    /// Subrouter config (including a dead localhost data-plane URL) without
+    /// the trusted marker and launch-bound argv that rebuild `sr codex
+    /// resume`. Replaying it directly would silently change transport after
+    /// quit/reopen, so every prepared fallback for Codex fails closed on it.
+    static func preparedFallback(kind: String, preparedArguments: [String]?) -> ([String], Bool)? {
+        guard let preparedArguments else { return nil }
+        if kind == "codex",
+           SubrouterCodexResumeRouting().removingPrivateRoutingArguments(from: preparedArguments)
+               != preparedArguments {
+            return nil
+        }
+        return (preparedArguments, false)
+    }
+
     private static let claudeAuthSelectionEnvironmentKeys: Set<String> = [
         "ANTHROPIC_API_KEY",
         "ANTHROPIC_AUTH_TOKEN",
@@ -202,6 +218,8 @@ public struct AgentRestorePlanner: Sendable {
         if request.mode == .resumeAgent,
            routedClaudeResume == nil,
            let checkpointID = normalized(request.checkpointID),
+           !(kind == "codex" && subrouterCodexRoutedPrefix(request: request, checkpointID: checkpointID)
+               .map { routedArguments.starts(with: $0) } == true),
            !AgentResumeArgv().resumeRoutesThroughOwnedLauncher(
                launcher: request.launchCommand?.launcher,
                sessionId: checkpointID,
@@ -378,8 +396,8 @@ public struct AgentRestorePlanner: Sendable {
             // typed restore plan. Use it before launcher or built-in synthesis
             // when the captured argv is empty, so a rejected capture cannot be
             // replaced by a guessed command for the provider kind.
-            if (launch?.arguments.isEmpty ?? true), let preparedArguments {
-                return (preparedArguments, false)
+            if (launch?.arguments.isEmpty ?? true), preparedArguments != nil {
+                return Self.preparedFallback(kind: kind, preparedArguments: preparedArguments)
             }
             switch AgentResumeArgv().launcherResolution(
                 launcher: launch?.launcher,
@@ -392,7 +410,9 @@ public struct AgentRestorePlanner: Sendable {
                 if let arguments {
                     return (arguments, true)
                 }
-                return preparedArguments.map { ($0, false) }
+                return Self.preparedFallback(kind: kind, preparedArguments: preparedArguments)
+            case .rejected:
+                return nil
             case .passthrough:
                 if let arguments = AgentResumeArgv().builtInKind(
                     kind: kind,
@@ -403,7 +423,7 @@ public struct AgentRestorePlanner: Sendable {
                 ) {
                     return (arguments, true)
                 }
-                return preparedArguments.map { ($0, false) }
+                return Self.preparedFallback(kind: kind, preparedArguments: preparedArguments)
             }
         case .forkAgent:
             if let preparedArguments {
@@ -541,6 +561,31 @@ public struct AgentRestorePlanner: Sendable {
         }
     }
 
+    /// The `sr` prefix a routed Codex resume starts with: the bound marker's
+    /// command, the stable launcher for a config-proven capture, or, for an
+    /// older capture whose argv names Subrouter without the marker, the fixed
+    /// `sr codex resume` that `AgentResumeArgv` reroutes it to. Either way the
+    /// Subrouter child has to run through cmux's wrapper.
+    private func subrouterCodexRoutedPrefix(request: AgentRestoreRequest, checkpointID: String) -> [String]? {
+        let routing = SubrouterCodexResumeRouting()
+        let launcher = request.launchCommand?.launcher
+        let launchArguments = request.launchCommand?.arguments ?? []
+        if let prefix = routing.resumeArguments(
+            launcher: launcher,
+            sessionID: checkpointID,
+            launchArguments: launchArguments,
+            environment: request.launchCommand?.environment
+        ) {
+            return prefix
+        }
+        let normalizedLauncher = launcher?.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        guard normalizedLauncher == nil || normalizedLauncher == "codex",
+              routing.providerEvidence(in: launchArguments, launcher: "codex") == .provider("subrouter") else {
+            return nil
+        }
+        return ["sr", "codex", "resume", checkpointID]
+    }
+
     private func routeManagedWrapper(
         arguments: [String],
         request: AgentRestoreRequest,
@@ -556,12 +601,7 @@ public struct AgentRestorePlanner: Sendable {
 
         if kind == "codex",
            let checkpointID = normalized(request.checkpointID),
-           let routedPrefix = SubrouterCodexResumeRouting().resumeArguments(
-               launcher: request.launchCommand?.launcher,
-               sessionID: checkpointID,
-               launchArguments: request.launchCommand?.arguments ?? [],
-               environment: request.launchCommand?.environment
-           ),
+           let routedPrefix = subrouterCodexRoutedPrefix(request: request, checkpointID: checkpointID),
            arguments.starts(with: routedPrefix),
            let wrapperShim = normalized(environment[restoreLaunch.wrapperShimEnvironmentKey]),
            isExecutableFile(wrapperShim) {

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentResumeArgv.swift

@@ -393,6 +393,10 @@ public struct AgentResumeArgv: Sendable, Equatable {
         /// The launcher is a cmux wrapper; the associated value is its resume argv, or `nil` when the
         /// wrapper has no resumable form (e.g. one-shot `omx`/`omc`).
         case resolved([String]?)
+        /// The record claims a routed Codex launch but its executable identity
+        /// does not match the captured argv. Do not fall through to a direct
+        /// resume that could retain Subrouter provider settings.
+        case rejected
         /// The launcher is a plain agent executable; fall through to ``builtInKind(kind:sessionId:executablePath:arguments:)``.
         case passthrough
     }
@@ -412,7 +416,16 @@ public struct AgentResumeArgv: Sendable, Equatable {
         arguments: [String],
         environment: [String: String]? = nil
     ) -> LauncherResolution {
-        if let routed = SubrouterCodexResumeRouting().resumeArguments(
+        let normalizedLauncher = launcher?.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        if normalizedLauncher == "codex",
+           !capturedCodexExecutableMatches(arguments: arguments, executablePath: executablePath),
+           SubrouterCodexResumeRouting().capturedEnvironment(in: environment).isEmpty == false {
+            return .rejected
+        }
+        let capturedExecutableMatches = normalizedLauncher != "codex" ||
+            capturedCodexExecutableMatches(arguments: arguments, executablePath: executablePath)
+        if capturedExecutableMatches,
+           let routed = SubrouterCodexResumeRouting().resumeArguments(
             launcher: launcher,
             sessionID: sessionId,
             launchArguments: arguments,
@@ -466,6 +479,17 @@ public struct AgentResumeArgv: Sendable, Equatable {
         }
     }
 
+    private func capturedCodexExecutableMatches(arguments: [String], executablePath: String?) -> Bool {
+        guard let first = arguments.first else { return false }
+        let argvExecutable = URL(fileURLWithPath: first).lastPathComponent
+        // Older captures record no executable path; argv[0] is then the only
+        // identity evidence, and it has to name Codex itself.
+        guard let executablePath, !executablePath.isEmpty else {
+            return argvExecutable == "codex"
+        }
+        return argvExecutable == URL(fileURLWithPath: executablePath).lastPathComponent
+    }
+
     /// Builds the resume argv for a built-in agent kind, or `nil` if the kind is unknown or its launch
     /// arguments cannot be preserved.
     ///
@@ -502,6 +526,26 @@ public struct AgentResumeArgv: Sendable, Equatable {
                 preservePromptTags: false,
                 stripCmuxHooks: parts.executable == "codex"
             ) else { return nil }
+            // Older bindings can prove that the captured Codex invocation used
+            // Subrouter but lack the paired launch marker. Never replay the
+            // captured `model_providers.subrouter.*` argv in that case: it may
+            // contain a dead per-process localhost endpoint. Re-enter through
+            // `sr` so the provider allocates a fresh route on resume.
+            // The kind is known to be Codex, so a custom executable name
+            // (e.g. `codex-enterprise`) still counts as a Codex invocation.
+            if SubrouterCodexResumeRouting().providerEvidence(
+                in: [parts.executable] + parts.tail,
+                launcher: "codex"
+            ) == .provider("subrouter") {
+                // Same identity rule as a bound-marker capture: argv[0] has to
+                // be the captured executable, or this is not that launch.
+                guard capturedCodexExecutableMatches(arguments: arguments, executablePath: executablePath) else {
+                    return nil
+                }
+                let clean = SubrouterCodexResumeRouting().removingRoutingArguments(from: preserved)
+                return ["sr", "codex", "resume", sessionId]
+                    + codexResumeConfigOverrides(preserved: clean) + clean
+            }
             let replayExecutable = codexReplayExecutable(
                 capturedExecutable: parts.executable,
                 launchTail: parts.tail

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentSessionRecoveryPlanner.swift

@@ -113,7 +113,12 @@ public struct AgentRecoveryCandidate: Equatable, Sendable {
     }
 
     func launcherResumeArguments(isReadableFile: @escaping (String) -> Bool) -> [String]? {
-        guard let launchCommand,
+        // Codex recovery must use the structured cmux restore path. A raw
+        // launcher prefix can bypass provider routing, writer-lock checks, and
+        // restore admission, which can strand a session as "open elsewhere"
+        // or resurrect it under the wrong provider.
+        guard kind != "codex",
+              let launchCommand,
               launchCommand.externalLauncher == nil,
               !routesThroughSubrouter,
               let prefix = launchCommand.launcherPrefix,