codex: seats in one project unintentionally share one app-server

[fujibee]

Summary

A Codex seat on herdr can resolve its own pane as a different seat's pane. where.sh and fix.sh then act on the wrong pane. Pokes and placement records can land on another agent.

Cause (measured)

codex-monitor.sh starts one app-server per project and reuses it for every later Codex seat in that project (port file run/codex-app-server.<sha1>.port). Under codex --remote, an agent's shell commands run inside the app-server process, not in the TUI client (already noted in _app-server.sh). The app-server inherited HERDR_PANE_ID / HERDR_SOCKET_PATH from the pane that launched it first.

The herdr driver's terminal_detect trusts the inherited HERDR_PANE_ID. So every Codex seat that attached to a reused app-server reports the first seat's pane as its own.

Observed on one herdr session with three Codex seats in the same project:

process	listens / connects	inherited HERDR_PANE_ID
app-server	listens 127.0.0.1:52700	w1:p3 (seat A's pane)
seat A TUI	--remote ws://127.0.0.1:52700	w1:p3
seat B TUI	--remote ws://127.0.0.1:52700	w1:pD
seat C TUI	--remote ws://127.0.0.1:52700	w1:pE

In seat B, peek of seat B showed seat B's own conversation, while where.sh returned w1:p3 (seat A). fix.sh run from seat B's tool calls returned undetermined reason=not_found.

It is not specific to running several herdr sessions. The same reuse across two herdr sessions would also carry the wrong socket, not only the wrong pane.

The earlier measurement that justified trusting HERDR_PANE_ID (every process carrying it sat in its own pane) did not include a Codex seat attached to another seat's app-server.

Impact

• where / self-naming / placement records for later Codex seats name another seat's pane.
• Actions derived from that location (poke, arrange, fix) target another agent. In the observed run, a stop command was poked into the other seat.

Direction (to decide)

• Fail closed now: when the caller runs inside a shared Codex app-server, do not trust the inherited HERDR_PANE_ID. Report the pane as unresolved instead of naming another seat's pane.
• Root fix: give each Codex seat its own app-server, or carry the TUI's pane into the execution context. Per-project reuse is what makes the inherited environment wrong.

[fujibee]

Reframed

The wrong-pane self-location above is one symptom. The underlying problem is that Codex seats in the same project share a single app-server, and nothing ever decided that they should.

What has to be shared: a seat's TUI and its agmsg bridge must be on the same app-server, otherwise turns the bridge starts never appear in that TUI.

What was never decided: codex-monitor.sh records the server per project (run/codex-app-server.<project-hash>.{pid,port,version}) and reuses a live one. So a second Codex seat in the same project attaches to the first seat's server whenever the reuse conditions happen to hold. Whether seats share is decided by launch timing and state, not by design.

Symptoms:

• A tool shell inherits the first seat's terminal environment (HERDR_PANE_ID, HERDR_SOCKET_PATH, TMUX, TMUX_PANE). Self-location, self-naming, placement records, fix and spawn then target another seat's pane. This is the original report.
• The server outlives the seat that started it (reparented to pid 1) and is reused, with no clear owner for shutdown.
• One server holds every attached seat's thread state. Observed resident size reached 550 MB.
• A stalled or crashed server affects every Codex seat in the project.

Measured on codex 0.146: per-thread -c shell_environment_policy overrides do not reach a remote server's tool environment, for new or resumed threads. Configuring the client cannot fix this.

Direction

One set per seat: each Codex TUI gets its own app-server, and its bridge attaches to that server. Records keyed by project (server pid/port/version/log, bridge request, dispatcher lock, lease identity, the off-switch cleanup in delivery.sh) become keyed by seat. Servers that are already running and shared are left untouched until their seats exit. New launches never reuse a server started by another seat.

#1261 (detect the shared server and fail closed) is closed in favour of this.