[Juliusolsson05]

Problem

During MCP / client-tool agentic runs the Agent Code feed appears to "clear" every couple of turns and stops growing — runtime.entries stays frozen at the bootstrap snapshot while the proxy semantic stream keeps producing turns. Traced in Juliusolsson05/agent-code#159.

Root cause is here, not in the renderer: the committed-transcript channel goes permanently silent after bootstrap.

1. CodexHeadless.start() pins tailFile() to a single rollout JSONL. When Codex writes the resumed conversation into a different (reconstructed / forked) rollout file, the tailer keeps reading the dead one — so no live rollout-entry events ever land.
2. For client-executed tools (MCP), the proxy adapter held activeFlowId until the socket's response-end. Codex issues the follow-up /v1/responses (carrying function_call_output) before that end is observed — and on long-lived transports it may never arrive — so the legitimate follow-up flow was demoted to secondary and never published.

Fix

CodexResponsesAdapter — release the flow slot on response.completed. New 'completed' attribution state: the upstream semantic terminal releases activeFlowId so the next model turn can claim the active slot. A 'completed' flow drops late chunks instead of growing its buffer / refreshing lastEventAt, so it is reaped rather than leaked.

CodexHeadless — correct rollout tail ownership.

• Resume: a single sessions-dir watcher detects a forked rollout and switches the committed tail to it; freshness is decided by an mtime guard so a fork created before/during/after attach is all evaluated.
• A candidate must match both the cwd (compared canonically — symlink/case/..-normalised) and share copied-history item ids with the resumed file. cwd alone is unsafe — orchestration branches spawn sibling Codex agents in the same directory. Lineage is matched by opaque item id value (msg_/fc_/rs_/call_/turn ids), which survives re-serialisation.
• A same-cwd candidate with no shared lineage is rejected with a diagnostic; an empty-lineage resume fails closed rather than switching on cwd alone.
• Fresh start: tailNewRolloutFile emits a diagnostic when additional new rollout files appear during startup, surfacing wrong-session-attach ambiguity.

Verification

• npm run build (tsc) passes clean.
• Not yet exercised against a live Codex resume/fork. Recommended smoke matrix: append-resume (no fork), immediate fork during startup, same-cwd sibling agent in the watch window, MCP follow-up turn promotion after response.completed.

Resolves

Root cause of Juliusolsson05/agent-code#159 (paired with the submodule-pointer PR Juliusolsson05/agent-code#160).

Follow-up issues (bookkeeping — not blocking)

• Add test coverage for the resume rollout-fork detector #10 — test coverage for the resume rollout-fork detector
• Use a distinct diagnostic event for non-error rollout notices #11 — distinct diagnostic event for non-error rollout notices (the switch / rejection / ambiguity notices currently use rollout-error)
• Stronger rollout identity for resume (explicit lineage id, not cwd+content heuristics) #12 — stronger rollout identity: explicit lineage id instead of cwd + content heuristics

🤖 Generated with Claude Code

[Juliusolsson05]

Thanks — review addressed in 07e197b.

Blocking

• Priming-scan race — fixed. watchResumeForkRollout no longer primes an existing set then watches for "new" files (which recorded a fork created mid-scan as pre-existing and skipped it forever). It's now a single ignoreInitial:false watcher; freshness is decided solely by the isResumeForkCandidate mtime guard, so a fork created at any point — before, during, or after attach — is evaluated.
• Raw cwd equality — fixed. New normalizeCwd canonicalises both sides via realpathSync.native (resolves macOS symlinks like /var→/private/var and case) with a resolve fallback. payload.cwd is also now type-guarded.

Should Fix

• Empty-lineage cwd-only fallback — removed. If the resumed file has no fingerprintable history we now fail closed (no switch) with a diagnostic, instead of latching on cwd alone. The #159 failure had 53 bootstrap entries → non-empty lineage → unaffected; an empty resumed session has no accumulated conversation to lose.
• 256 KiB candidate read — widened to 4 MiB so large copied bootstrap entries (AGENTS.md / environment_context) can't push shared item ids out of range. Reads only happen on fresh-file events inside the bounded window.
• Completed-flow buffer/lastEventAt leak — fixed. A 'completed' flow now drops late chunks entirely (early return in the response-chunk handler) rather than appending to flow.buffer and refreshing lastEventAt. lastEventAt is frozen at completion, so the watchdog reaps the flow if response-end never arrives.
• switchTo open-before-close overlap — documented inline: the overlap is intentional (closing first would drop in-between entries) and safe because a fork starts with copied history and downstream ingest dedupes by deterministic per-entry uuid.

Nits

• Unit coverage: the fork detector is the most testable part, but the repo convention is no new test files in feature/fix PRs — flagged as a follow-up. A live smoke matrix (append-resume, immediate-fork-during-startup, same-cwd sibling in the window, MCP follow-up promotion) is noted on the PR.
• 'rollout-error' for a successful tail switch: left as-is for now — a dedicated diagnostic event would need a new CodexHeadlessEvents member wired through the parent's IPC, out of scope for this PR. Tracked as follow-up.

[Juliusolsson05]

Follow-up work from review tracked as bookkeeping issues (not blocking this PR):

• Add test coverage for the resume rollout-fork detector #10 — test coverage for the resume rollout-fork detector
• Use a distinct diagnostic event for non-error rollout notices #11 — distinct diagnostic event for non-error rollout notices
• Stronger rollout identity for resume (explicit lineage id, not cwd+content heuristics) #12 — stronger rollout identity (explicit lineage id vs cwd+content heuristics)