azooz2003-bit · Jun 27, 2026 · Jun 23, 2026 · Jun 23, 2026 · Jun 23, 2026 · Jun 23, 2026
diff --git a/.github/swift-file-length-budget.tsv b/.github/swift-file-length-budget.tsv
@@ -1,11 +1,11 @@
 # cmux-owned Swift file length budget.
 # Format: max_lines<TAB>relative path
 # Reduce counts as files shrink. CI fails if tracked files exceed this budget.
-34629	CLI/cmux.swift
+34643	CLI/cmux.swift
 17854	Sources/AppDelegate.swift
-16499	Sources/ContentView.swift
+16476	Sources/ContentView.swift
 13913	Sources/TerminalController.swift
-12838	Sources/Workspace.swift
+12886	Sources/Workspace.swift
 12348	cmuxTests/AppDelegateShortcutRoutingTests.swift
 12237	Sources/GhosttyTerminalView.swift
 11567	Sources/Panels/BrowserPanel.swift
@@ -46,8 +46,8 @@
 2126	cmuxTests/CmuxConfigTests.swift
 2091	cmuxTests/ShortcutAndCommandPaletteTests.swift
 2078	Sources/SessionPersistence.swift
+1960	Sources/RestorableAgentSession.swift
 1952	Sources/KeyboardShortcutSettingsFileStore.swift
-1945	Sources/RestorableAgentSession.swift
 1900	cmuxTests/NotificationAndMenuBarTests.swift
 1866	Sources/Panels/BrowserWebAuthnSupport.swift
 1810	Sources/SessionIndexStore.swift
@@ -71,8 +71,8 @@
 1360	Sources/Feed/FeedButtonStyleDebugWindowController.swift
 1295	Packages/macOS/CmuxTerminalCore/Sources/CmuxTerminalCore/Config/GhosttyConfig.swift
 1295	cmuxTests/MobileHostAuthorizationTests.swift
+1287	cmuxTests/RestorableAgentSessionIndexTests.swift
 1285	cmuxUITests/SidebarHelpMenuUITests.swift
-1277	cmuxTests/RestorableAgentSessionIndexTests.swift
 1258	Sources/Feed/FeedCoordinator.swift
 1209	Packages/macOS/CmuxCommandPalette/Tests/CmuxCommandPaletteTests/CommandPaletteSearchEngineTests.swift
 1204	cmuxTests/FileExplorerStoreTests.swift
@@ -98,12 +98,12 @@
 928	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/AppSection.swift
 926	Sources/DockPanelView.swift
 920	Sources/CommandPalette/CommandPaletteSettingsToggle.swift
+914	Packages/iOS/CmuxMobileShellUI/Sources/CmuxMobileShellUI/WorkspaceDetailView.swift
 905	Sources/CmuxSSHURLRequest.swift
 899	Sources/Panels/MarkdownWebRenderer.swift
-885	cmuxTests/SidebarWorkspaceDropPlannerTests.swift
 885	Sources/Panels/TerminalPanel.swift
+885	cmuxTests/SidebarWorkspaceDropPlannerTests.swift
 877	Packages/Shared/CmuxAgentChat/Tests/CmuxAgentChatTests/ChatConversationStoreTests.swift
-877	Packages/iOS/CmuxMobileShellUI/Sources/CmuxMobileShellUI/WorkspaceDetailView.swift
 871	cmuxTests/ClaudeHookSurfaceResolutionSwiftTests.swift
 868	Sources/Panels/BrowserScreenshotSnapshotter.swift
 859	Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/Workspace/ControlCommandCoordinator+Workspace.swift
@@ -116,14 +116,15 @@
 803	Packages/iOS/CmuxMobilePairedMac/Sources/CmuxMobilePairedMac/MobilePairedMacStore.swift
 802	Sources/WorkspaceContentView.swift
 797	Sources/ClosedItemHistory.swift
+782	CLI/CMUXCLI+AgentHookDefinitions.swift
 779	cmuxUITests/BrowserOmnibarSuggestionsUITests.swift
 773	Sources/App/MenuBarExtraController.swift
 769	Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurface+Input.swift
 768	cmuxUITests/BrowserFixtureInteractionUITests.swift
 762	Packages/iOS/CmuxMobileTransport/Sources/CmuxMobileTransport/CmxNetworkByteTransport.swift
+761	Sources/Mobile/AgentChat/AgentChatSessionRegistry.swift
 760	Packages/macOS/CMUXAgentLaunch/Tests/CMUXAgentLaunchTests/AgentLaunchSanitizerTests.swift
 756	Sources/Panels/AgentSessionWebRendererCoordinator.swift
-755	CLI/CMUXCLI+AgentHookDefinitions.swift
 754	Sources/TerminalController+ControlWorkspaceContext.swift
 752	cmuxUITests/CloseWorkspaceCmdDUITests.swift
 739	cmuxTests/CLICodexHookTimeoutRegressionTests.swift
@@ -142,6 +143,7 @@
 696	cmuxTests/UpdatePillReleaseVisibilityTests.swift
 691	Sources/NotificationSoundSettings.swift
 691	cmuxTests/TaskManagerResourcesTests.swift
+690	cmuxTests/SessionIndexViewTests.swift
 683	Packages/macOS/CmuxSwiftRender/Sources/CmuxSwiftRender/SwiftViewInterpreter.swift
 683	Sources/Panels/CodexAppServerSession.swift
 681	Sources/Panels/AgentSessionProcessStore.swift
@@ -151,7 +153,6 @@
 668	cmuxTests/SettingsWindowPresenterTests.swift
 664	Sources/CmuxTopSnapshot.swift
 663	Sources/PortScanner.swift
-663	cmuxTests/SessionIndexViewTests.swift
 655	Packages/macOS/CmuxRemoteSession/Sources/CmuxRemoteSession/Session/RemoteSessionCoordinator.swift
 655	Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurface+RuntimeLifecycle.swift
 653	Packages/macOS/CmuxBrowser/Sources/CmuxBrowser/Import/Detection/BrowserInstalledBrowserDetector.swift
@@ -167,16 +168,16 @@
 620	cmuxTests/TerminalNotificationQueueTests.swift
 613	Sources/SettingsNavigation.swift
 612	cmuxUITests/FeedSidebarUITests.swift
-608	Packages/macOS/CmuxWorkspaces/Sources/CmuxWorkspaces/Coordinators/WorkspaceGroupCoordinator.swift
+607	Sources/SessionIndexModels.swift
 607	Sources/SleepyFaceView.swift
 604	Packages/macOS/CmuxCommandPalette/Tests/CmuxCommandPaletteTests/CommandPaletteNucleoFFITests.swift
 602	Packages/macOS/CmuxWorkspaces/Sources/CmuxWorkspaces/Coordinators/WorkspaceReorderCoordinator.swift
 601	Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentLaunchSanitizerPrimaryPolicies.swift
 599	Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentLaunchSanitizer.swift
 596	cmuxTests/CmuxEventBusTests.swift
-594	Sources/SessionIndexModels.swift
 594	cmuxTests/PortalTabDragRoutingTests.swift
-590	Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurface.swift
+591	Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurface.swift
+589	Packages/macOS/CmuxWorkspaces/Sources/CmuxWorkspaces/Coordinators/WorkspaceGroupCoordinator.swift
 588	cmuxTests/CommandPaletteShortcutCustomizationTests.swift
 586	Packages/macOS/CmuxRemoteSession/Sources/CmuxRemoteSession/Session/RemoteSessionCoordinator+PortScan.swift
 586	Sources/JSONCParser.swift
@@ -197,6 +198,7 @@
 552	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/BrowserSection.swift
 549	Sources/Panels/BrowserAutomation.swift
 547	Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/BackingUpPairedMacStore.swift
+546	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/AutomationSection.swift
 541	Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/Pane/ControlCommandCoordinator+Pane.swift
 539	CLI/CMUXCLI+Themes.swift
 539	CLI/CodexTeamsApprovalBridge.swift
@@ -212,7 +214,6 @@
 526	Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/Workstream/WorkstreamStore.swift
 525	Packages/macOS/CmuxSettings/Sources/CmuxSettings/SocketControl/SocketControlSettings.swift
 524	CLI/CMUXCLI+AutoNaming.swift
-523	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/AutomationSection.swift
 520	CLI/CMUXCLI+AmpExtension.swift
 520	cmuxTests/MainWindowVisibilityControllerTests.swift
 519	Packages/macOS/CmuxSwiftRender/Tests/CmuxSwiftRenderTests/Corpus/stress-two-column-cockpit-sidebar.swift

diff --git a/CLI/CMUXCLI+AgentHookDefinitions.swift b/CLI/CMUXCLI+AgentHookDefinitions.swift
@@ -377,32 +377,59 @@ extension CMUXCLI {
 
     static func hookCommandString(for def: AgentHookDef, event: AgentHookDef.HookEvent) -> String {
         let command = "cmux hooks \(def.name) \(event.cmuxSubcommand)"
+        let inline: String
         if def.name == "codex", codexHookCanRunFireAndForget(event.cmuxSubcommand) {
-            return codexFireAndForgetAgentHookShellCommand(command, for: def)
+            inline = codexFireAndForgetAgentHookShellCommand(command, for: def)
+        } else {
+            inline = agentHookShellCommand(command, for: def)
+        }
+        if def.name == "codex" {
+            return codexPersistentHookScriptCommand(inline, eventTag: event.cmuxSubcommand)
         }
-        return agentHookShellCommand(command, for: def)
+        return inline
+    }
+
+    /// Wraps a codex persistent hook command as a `#!/bin/sh` script file in the
+    /// cmux-owned hooks dir and returns its path. A bare executable path runs
+    /// correctly under any runtime, including ones (subrouters/proxies) that exec
+    /// the `command` string directly and fail an inline shell snippet with
+    /// "No such file or directory (os error 2)". Falls back to the inline command
+    /// on any write failure, so the persistent install can never regress.
+    private static func codexPersistentHookScriptCommand(_ inlineCommand: String, eventTag: String) -> String {
+        guard let dir = codexHookScriptsDirectory(),
+              let path = writeCodexHookScript(
+                  subcommand: "persistent-\(eventTag)", body: inlineCommand, in: dir
+              ) else {
+            return inlineCommand
+        }
+        return path
     }
 
     private static func codexHookCanRunFireAndForget(_ subcommand: String) -> Bool {
         subcommand == "session-start" || subcommand == "prompt-submit"
     }
 
     static func feedHookCommandString(for def: AgentHookDef, agentEvent: String) -> String {
+        let inline: String
         let noOpCommand = feedHookNoOpShellCommand(for: def, agentEvent: agentEvent)
         switch def.format {
         case .kiroAgentJSON:
-            return exitTwoPropagatingAgentHookShellCommand(
+            inline = exitTwoPropagatingAgentHookShellCommand(
                 "cmux hooks feed --source \(def.name) --event \(agentEvent)",
                 for: def,
                 noOpCommand: noOpCommand
             )
         default:
-            return agentHookShellCommand(
+            inline = agentHookShellCommand(
                 "cmux hooks feed --source \(def.name) --event \(agentEvent)",
                 for: def,
                 noOpCommand: noOpCommand
             )
         }
+        if def.name == "codex" {
+            return codexPersistentHookScriptCommand(inline, eventTag: "feed-\(agentEvent)")
+        }
+        return inline
     }
 
     private static func feedHookNoOpShellCommand(for def: AgentHookDef, agentEvent: String) -> String {

diff --git a/CLI/CMUXCLI+CodexFireAndForgetHooks.swift b/CLI/CMUXCLI+CodexFireAndForgetHooks.swift
@@ -1,4 +1,125 @@
+import Foundation
+
 extension CMUXCLI {
+    /// The per-invocation Codex hook events the wrapper injects, paired with the
+    /// cmux subcommand they call and the codex hook timeout (ms). Lifecycle
+    /// events are short; feed events (`PreToolUse`/`PermissionRequest`) are long
+    /// because the user may take time to approve. This is the single source of
+    /// truth for `cmux-codex-wrapper`'s injection, mirrored from the historic
+    /// hand-rolled `cmux_codex_add_hook` calls in the wrapper.
+    static let codexWrapperInjectionEvents: [(agentEvent: String, cmuxSubcommand: String, timeoutMs: Int)] = [
+        ("SessionStart", "session-start", 10000),
+        ("UserPromptSubmit", "prompt-submit", 10000),
+        ("Stop", "stop", 10000),
+        ("PreToolUse", "pre-tool-use", 120000),
+        ("PostToolUse", "post-tool-use", 10000),
+        ("PermissionRequest", "notification", 120000),
+    ]
+
+    /// Emit, NUL-separated to stdout, the exact codex arg list the wrapper must
+    /// splice ahead of the user's args to enable + inject cmux's fire-and-forget
+    /// hooks for one codex invocation. Returns the arg list:
+    ///   --enable\0hooks\0--dangerously-bypass-hook-trust\0
+    ///   -c\0hooks.SessionStart=[{hooks=[{type="command",command='''<ff>''',timeout=10000}]}]\0
+    ///   -c\0hooks.UserPromptSubmit=...\0 ... (one `-c` pair per event)
+    /// where `<ff>` is `codexFireAndForgetAgentHookShellCommand(...)` so each
+    /// hook returns `{}` to codex instantly and backgrounds the real cmux call.
+    /// Requires no live socket: pure string construction from the agent def.
+    func emitCodexWrapperInjectArgs() throws {
+        guard let codexDef = Self.agentDef(named: "codex") else {
+            throw CLIError(message: "Codex hook integration is unavailable.")
+        }
+        // Prefer a #!/bin/sh SCRIPT FILE as the hook command over an inline shell
+        // snippet. Some codex-compatible runtimes (subrouters, proxies) exec the
+        // `command` string directly as a program instead of via a shell, so an
+        // inline snippet fails with "No such file or directory (os error 2)". A
+        // bare executable file path runs correctly whether the runtime execs it
+        // directly or through a shell, and normal codex (which runs it via shell)
+        // is unaffected. The scripts are env-driven and identical across
+        // invocations, so they are written once into a cmux-owned dir (~/.cmux/
+        // hooks), not the user's ~/.codex. Any write failure falls back to the
+        // inline snippet so the working path can never regress.
+        let hooksDir = Self.codexHookScriptsDirectory()
+        var args: [String] = ["--enable", "hooks", "--dangerously-bypass-hook-trust"]
+        for event in Self.codexWrapperInjectionEvents {
+            let ff = Self.codexFireAndForgetAgentHookShellCommand(
+                "cmux hooks codex \(event.cmuxSubcommand)", for: codexDef
+            )
+            let command: String
+            if let scriptPath = hooksDir.flatMap({
+                Self.writeCodexHookScript(subcommand: event.cmuxSubcommand, body: ff, in: $0)
+            }), !scriptPath.contains("'''") {
+                command = scriptPath
+            } else {
+                command = ff
+            }
+            // TOML multi-line literal string ('''...''') preserves bytes verbatim
+            // and may contain single quotes, so the embedded `echo '{}'` / `sh -c
+            // '...'` survive with no escaping. TOML forbids only a literal triple
+            // single quote inside; guard against it (neither a path nor the
+            // command ever has one).
+            guard !command.contains("'''") else {
+                throw CLIError(message: "Codex hook command contains a triple single quote and cannot be TOML-encoded.")
+            }
+            let toml = "hooks.\(event.agentEvent)=[{hooks=[{type=\"command\",command='''\(command)''',timeout=\(event.timeoutMs)}]}]"
+            args.append("-c")
+            args.append(toml)
+        }
+        // NUL-TERMINATE each arg (trailing NUL after the last too) so a bash
+        // `while IFS= read -r -d '' arg` loop captures every element including
+        // the final one — a separator-only stream drops the unterminated last
+        // arg at EOF.
+        var out = Data()
+        for arg in args {
+            out.append(Data(arg.utf8))
+            out.append(0)
+        }
+        FileHandle.standardOutput.write(out)
+    }
+
+    /// The cmux-owned directory holding the generated codex hook scripts.
+    /// `~/.cmux/hooks` (NOT the user's `~/.codex`), created on demand. Returns
+    /// nil if it cannot be created, so the caller falls back to inline commands.
+    static func codexHookScriptsDirectory() -> URL? {
+        let home = FileManager.default.homeDirectoryForCurrentUser
+        let dir = home
+            .appendingPathComponent(".cmux", isDirectory: true)
+            .appendingPathComponent("hooks", isDirectory: true)
+        do {
+            try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+            return dir
+        } catch {
+            return nil
+        }
+    }
+
+    /// Writes (idempotently) a `#!/bin/sh` hook script for one event into `dir`
+    /// and returns its absolute path, or nil on any failure. The body is the
+    /// same env-driven fire-and-forget snippet used inline; as a real executable
+    /// file it runs under any runtime, including ones that exec the hook command
+    /// directly rather than through a shell. Content is identical across
+    /// invocations, so the file is only rewritten when missing or changed.
+    static func writeCodexHookScript(subcommand: String, body: String, in dir: URL) -> String? {
+        let safeName = subcommand.replacingOccurrences(
+            of: "[^A-Za-z0-9_-]", with: "-", options: .regularExpression
+        )
+        let url = dir.appendingPathComponent("cmux-codex-hook-\(safeName).sh", isDirectory: false)
+        let contents = "#!/bin/sh\n\(body)\n"
+        let fileManager = FileManager.default
+        if let existing = try? String(contentsOf: url, encoding: .utf8), existing == contents {
+            // Ensure it stays executable, then reuse.
+            try? fileManager.setAttributes([.posixPermissions: 0o755], ofItemAtPath: url.path)
+            return url.path
+        }
+        do {
+            try contents.data(using: .utf8)?.write(to: url, options: .atomic)
+            try fileManager.setAttributes([.posixPermissions: 0o755], ofItemAtPath: url.path)
+            return url.path
+        } catch {
+            return nil
+        }
+    }
+
     static func codexFireAndForgetAgentHookShellCommand(_ command: String, for def: AgentHookDef) -> String {
         let routedArguments = command.hasPrefix("cmux ") ? String(command.dropFirst("cmux ".count)) : command
         let runner = "payload=\"$1\"; shift; \"$@\" <\"$payload\" >/dev/null 2>&1 & child=\"$!\"; ( sleep 30; kill \"$child\" 2>/dev/null || true ) & watchdog=\"$!\"; wait \"$child\" 2>/dev/null || true; kill \"$watchdog\" 2>/dev/null || true; rm -f \"$payload\""