Fix worktree-bound Codex app-server startup

Sources/RepoPrompt/Features/AgentMode/Runtime/Codex/CodexRuntimeWorkspacePaths.swift

@@ -0,0 +1,54 @@
+import Foundation
+
+/// Launch/execution directory pair for one Codex controller.
+///
+/// A worktree-bound session launches the Codex app-server from the workspace's logical root so
+/// process startup behaves exactly like an unbound session, while thread and turn execution still
+/// target the bound worktree. Unbound sessions use the same directory for both roles.
+struct CodexRuntimeWorkspacePaths: Equatable {
+    /// Directory the Codex app-server process launches from.
+    let processLaunchDirectory: String?
+    /// Directory Codex thread/turn execution and the primary sandbox writable root target.
+    let executionDirectory: String?
+
+    private init(processLaunchDirectory: String?, executionDirectory: String?) {
+        self.processLaunchDirectory = processLaunchDirectory
+        self.executionDirectory = executionDirectory
+    }
+
+    /// Both roles share one directory — the shape of every session without a primary
+    /// worktree binding.
+    static func uniform(_ path: String?) -> CodexRuntimeWorkspacePaths {
+        CodexRuntimeWorkspacePaths(processLaunchDirectory: path, executionDirectory: path)
+    }
+
+    /// A validated worktree binding keeps process launch anchored to its logical workspace while
+    /// routing thread and turn execution through the worktree.
+    static func worktreeBound(
+        logicalRootPath: String,
+        validatedWorktreeRootPath: String
+    ) -> CodexRuntimeWorkspacePaths {
+        CodexRuntimeWorkspacePaths(
+            processLaunchDirectory: logicalRootPath,
+            executionDirectory: validatedWorktreeRootPath
+        )
+    }
+}
+
+/// Validation failures for the Codex launch-directory projection.
+///
+/// Thrown before provider startup so a broken selected logical root is as actionable as an
+/// unavailable worktree (`AgentWorktreeRuntimeWorkspaceError`).
+enum CodexRuntimeWorkspacePathsError: LocalizedError, Equatable {
+    case emptyLogicalRoot
+    case launchDirectoryUnavailable(path: String)
+
+    var errorDescription: String? {
+        switch self {
+        case .emptyLogicalRoot:
+            "Agent session is bound to a worktree whose workspace root path is empty. Rebind the session to a worktree of a loaded workspace root, or unbind the session before starting the agent."
+        case let .launchDirectoryUnavailable(path):
+            "Agent session is bound to a worktree for workspace root '\(path)', but that root directory is unavailable. Restore the workspace root, bind the session to another worktree, or unbind the session before starting the agent."
+        }
+    }
+}

Sources/RepoPrompt/Features/AgentMode/Services/AgentWorktreeRuntimeWorkspaceResolver.swift

@@ -26,32 +26,61 @@ enum AgentWorktreeRuntimeWorkspaceResolver {
         guard let binding else {
             return primaryWorkspacePath
         }
-        let worktreePath = standardizedWorkspacePath(binding.worktreeRootPath)
-        guard let worktreePath else {
-            throw AgentWorktreeRuntimeWorkspaceError(binding: binding)
+        return try validatedWorktreeRootPath(for: binding)
+    }
+
+    /// Codex-specific projection of the same primary-binding selection used by
+    /// `effectiveWorkspacePath`: the app-server process launches from the binding's logical root
+    /// while thread/turn execution targets the bound worktree. The logical root is validated
+    /// eagerly so a launch-directory failure surfaces before provider startup instead of as an
+    /// opaque process-spawn error.
+    static func codexRuntimeWorkspacePaths(
+        bindings: [AgentSessionWorktreeBinding],
+        fallbackWorkspacePath: String?
+    ) throws -> CodexRuntimeWorkspacePaths {
+        let primaryWorkspacePath = standardizedWorkspacePath(fallbackWorkspacePath)
+        let binding = primaryExecutionBinding(
+            in: bindings,
+            fallbackWorkspacePath: fallbackWorkspacePath
+        )
+
+        guard let binding else {
+            return .uniform(primaryWorkspacePath)
         }
-        var isDirectory: ObjCBool = false
-        guard FileManager.default.fileExists(atPath: worktreePath, isDirectory: &isDirectory),
-              isDirectory.boolValue
-        else {
-            throw AgentWorktreeRuntimeWorkspaceError(binding: binding)
+        let executionDirectory = try validatedWorktreeRootPath(for: binding)
+        guard let processLaunchDirectory = standardizedWorkspacePath(binding.logicalRootPath) else {
+            throw CodexRuntimeWorkspacePathsError.emptyLogicalRoot
         }
-        return worktreePath
+        guard directoryExists(atPath: processLaunchDirectory) else {
+            throw CodexRuntimeWorkspacePathsError.launchDirectoryUnavailable(path: processLaunchDirectory)
+        }
+        return .worktreeBound(
+            logicalRootPath: processLaunchDirectory,
+            validatedWorktreeRootPath: executionDirectory
+        )
     }
 
     static func validateBindingsAvailable(_ bindings: [AgentSessionWorktreeBinding]) throws {
         for binding in bindings {
-            let worktreePath = standardizedWorkspacePath(binding.worktreeRootPath)
-            guard let worktreePath else {
-                throw AgentWorktreeRuntimeWorkspaceError(binding: binding)
-            }
-            var isDirectory: ObjCBool = false
-            guard FileManager.default.fileExists(atPath: worktreePath, isDirectory: &isDirectory),
-                  isDirectory.boolValue
-            else {
-                throw AgentWorktreeRuntimeWorkspaceError(binding: binding)
-            }
+            _ = try validatedWorktreeRootPath(for: binding)
+        }
+    }
+
+    private static func validatedWorktreeRootPath(
+        for binding: AgentSessionWorktreeBinding
+    ) throws -> String {
+        guard let worktreePath = standardizedWorkspacePath(binding.worktreeRootPath),
+              directoryExists(atPath: worktreePath)
+        else {
+            throw AgentWorktreeRuntimeWorkspaceError(binding: binding)
         }
+        return worktreePath
+    }
+
+    private static func directoryExists(atPath path: String) -> Bool {
+        var isDirectory: ObjCBool = false
+        return FileManager.default.fileExists(atPath: path, isDirectory: &isDirectory)
+            && isDirectory.boolValue
     }
 
     static func standardizedWorkspacePath(_ path: String?) -> String? {

Sources/RepoPrompt/Features/AgentMode/ViewModels/AgentModeViewModel+TabSession.swift

@@ -496,9 +496,10 @@ extension AgentModeViewModel {
         /// The task label kind the current Codex controller was created with.
         /// Used to detect when role-specific native tool overrides require controller recycling.
         var codexControllerTaskLabelKind: AgentModelCatalog.TaskLabelKind?
-        /// The effective workspace path the current Codex controller was created with.
-        /// Used to recycle the provider when a session worktree binding changes cwd.
-        var codexControllerWorkspacePath: String?
+        /// The launch/execution directory pair the current Codex controller was created with.
+        /// Controller replacement key: the provider is recycled when either directory changes,
+        /// e.g. when a session worktree binding moves the execution cwd.
+        var codexControllerWorkspacePaths: CodexRuntimeWorkspacePaths?
         struct CodexControllerFeatureState: Equatable {
             var computerUseEnabled: Bool
             var goalSupportEnabled: Bool

Sources/RepoPrompt/Features/AgentMode/ViewModels/AgentModeViewModel.swift

@@ -42,7 +42,7 @@ final class AgentModeViewModel: ObservableObject {
         _ runID: UUID,
         _ tabID: UUID,
         _ windowID: Int,
-        _ workspacePath: String?,
+        _ workspacePaths: CodexRuntimeWorkspacePaths,
         _ permissionProfile: AgentPermissionProfile,
         _ taskLabelKind: AgentModelCatalog.TaskLabelKind?
     ) -> any CodexSessionControlling
@@ -1413,20 +1413,16 @@ final class AgentModeViewModel: ObservableObject {
         let codexWorkspacePathProvider = { [weak workspaceManager] in
             workspaceManager?.activeWorkspace?.repoPaths.first
         }
-        let sessionWorkspacePathProvider: (TabSession) throws -> String? = { session in
-            try Self.effectiveWorkspacePath(
-                for: session,
-                fallbackWorkspacePath: codexWorkspacePathProvider()
-            )
-        }
+        let (sessionWorkspacePathProvider, codexRuntimeWorkspacePathsProvider) =
+            Self.makeSessionWorkspaceProviders(fallbackWorkspacePath: codexWorkspacePathProvider)
         workspacePathProvider = codexWorkspacePathProvider
         attachmentWorkspaceDirectoryProvider = { [weak workspaceManager] in
             guard let workspaceManager, workspaceManager.activeWorkspace != nil else {
                 return nil
             }
             return FileManager.default.temporaryDirectory
         }
-        let codexControllerFactory: CodexAgentModeCoordinator.CodexControllerFactory = { runID, tabID, windowID, workspacePath, permissionProfile, _, computerUseEnabled in
+        let codexControllerFactory: CodexAgentModeCoordinator.CodexControllerFactory = { runID, tabID, windowID, workspacePaths, permissionProfile, _, computerUseEnabled in
             let client = CodexAppServerClient()
             let options = CodexNativeSessionController.Options.agentModeDefault(
                 approvalPolicyProvider: { permissionProfile.codexApprovalPolicy },
@@ -1443,7 +1439,7 @@ final class AgentModeViewModel: ObservableObject {
                 runID: runID,
                 tabID: tabID,
                 windowID: windowID,
-                workspacePath: workspacePath,
+                workspacePaths: workspacePaths,
                 options: options,
                 clientShutdownBehavior: .stopOnShutdown,
                 expectedMCPClientName: AgentProviderKind.codexExec.mcpClientNameHint
@@ -1491,7 +1487,7 @@ final class AgentModeViewModel: ObservableObject {
         usesProductionAgentDefaultsAndModelPolling = true
         codexCoordinator = CodexAgentModeCoordinator(
             windowID: windowID,
-            workspacePathProvider: sessionWorkspacePathProvider,
+            runtimeWorkspacePathsProvider: codexRuntimeWorkspacePathsProvider,
             codexControllerFactory: codexControllerFactory,
             connectionPolicyInstaller: connectionPolicyInstaller,
             shouldManageCodexTooling: true,
@@ -1640,16 +1636,12 @@ final class AgentModeViewModel: ObservableObject {
                 return FileManager.default.temporaryDirectory
             }
             let codexWorkspacePathProvider = { testWorkspacePath }
-            let sessionWorkspacePathProvider: (TabSession) throws -> String? = { session in
-                try Self.effectiveWorkspacePath(
-                    for: session,
-                    fallbackWorkspacePath: codexWorkspacePathProvider()
-                )
-            }
+            let (sessionWorkspacePathProvider, codexRuntimeWorkspacePathsProvider) =
+                Self.makeSessionWorkspaceProviders(fallbackWorkspacePath: codexWorkspacePathProvider)
             workspacePathProvider = codexWorkspacePathProvider
             let codexControllerFactory: CodexAgentModeCoordinator.CodexControllerFactory = codexControllerFactoryWithComputerUse
-                ?? { runID, tabID, windowID, workspacePath, permissionProfile, taskLabelKind, _ in
-                    codexControllerFactory(runID, tabID, windowID, workspacePath, permissionProfile, taskLabelKind)
+                ?? { runID, tabID, windowID, workspacePaths, permissionProfile, taskLabelKind, _ in
+                    codexControllerFactory(runID, tabID, windowID, workspacePaths, permissionProfile, taskLabelKind)
                 }
             self.headlessProviderFactory = headlessProviderFactory
             self.acpProviderFactory = acpProviderFactory
@@ -1674,7 +1666,7 @@ final class AgentModeViewModel: ObservableObject {
             }
             codexCoordinator = CodexAgentModeCoordinator(
                 windowID: testWindowID,
-                workspacePathProvider: sessionWorkspacePathProvider,
+                runtimeWorkspacePathsProvider: codexRuntimeWorkspacePathsProvider,
                 codexControllerFactory: codexControllerFactory,
                 connectionPolicyInstaller: connectionPolicyInstaller,
                 shouldManageCodexTooling: shouldManageCodexTooling,
@@ -1843,6 +1835,13 @@ final class AgentModeViewModel: ObservableObject {
         )
     }
 
+    func codexRuntimeWorkspacePaths(for session: TabSession) throws -> CodexRuntimeWorkspacePaths {
+        try Self.codexRuntimeWorkspacePaths(
+            for: session,
+            fallbackWorkspacePath: workspacePathProvider()
+        )
+    }
+
     func primaryExecutionBinding(for session: TabSession) -> AgentSessionWorktreeBinding? {
         Self.primaryExecutionBinding(in: session.worktreeBindings, fallbackWorkspacePath: workspacePathProvider())
     }
@@ -1878,6 +1877,41 @@ final class AgentModeViewModel: ObservableObject {
         )
     }
 
+    /// One projection contract for both initializers: session-scoped scalar
+    /// workspace path and Codex launch/execution path pair, derived from the
+    /// same fallback workspace provider.
+    private static func makeSessionWorkspaceProviders(
+        fallbackWorkspacePath: @escaping () -> String?
+    ) -> (
+        sessionWorkspacePath: (TabSession) throws -> String?,
+        codexRuntimeWorkspacePaths: (TabSession) throws -> CodexRuntimeWorkspacePaths
+    ) {
+        (
+            sessionWorkspacePath: { session in
+                try Self.effectiveWorkspacePath(
+                    for: session,
+                    fallbackWorkspacePath: fallbackWorkspacePath()
+                )
+            },
+            codexRuntimeWorkspacePaths: { session in
+                try Self.codexRuntimeWorkspacePaths(
+                    for: session,
+                    fallbackWorkspacePath: fallbackWorkspacePath()
+                )
+            }
+        )
+    }
+
+    private static func codexRuntimeWorkspacePaths(
+        for session: TabSession,
+        fallbackWorkspacePath: String?
+    ) throws -> CodexRuntimeWorkspacePaths {
+        try AgentWorktreeRuntimeWorkspaceResolver.codexRuntimeWorkspacePaths(
+            bindings: session.worktreeBindings,
+            fallbackWorkspacePath: fallbackWorkspacePath
+        )
+    }
+
     private static func standardizedWorkspacePath(_ path: String?) -> String? {
         AgentWorktreeRuntimeWorkspaceResolver.standardizedWorkspacePath(path)
     }

Sources/RepoPrompt/Features/Diagnostics/AgentMode/Stress/AgentChatStressHarness.swift

@@ -1425,7 +1425,7 @@
                 runID: UUID(),
                 tabID: UUID(),
                 windowID: windowID,
-                workspacePath: configuration.workspaceRootPaths.first
+                workspacePaths: .uniform(configuration.workspaceRootPaths.first)
             )
             let recorder = PersistedCodexFixtureEventRecorder()
             let eventTask = Task {