feat(prompt-input): issue the input profile for recorded Codex 0.157.1

[Juliusolsson05]

Fixes #63. Refs agent-code#234 (Codex 0.157.1 acceptance), #65, #66, #68.

The problem

prepareCodex01491PromptInputProfile issued a profile only for exactly 0.149.1. At 0.157.1, the version Agent Code runs, it returned unsupported-cli. PromptInputEvidence then produced nothing, and fresh-rollout ownership depended on the proxy identity path alone.

Change

• Profile. A table of exact recorded versions (0.149.1, 0.157.1), never a range. Unrecorded versions still get unsupported-cli. The export name keeps 01491 for API stability; the comment says why.
• Evidence for 0.157.1, each item recorded the same way as the 0.149.1 evidence:
  • codex-01571-recorded.json: the full corpus (16 cases, plus the 2 popup-Enter cases on 0.157.1), inline, comparable row for row with 0.149.1.
  • codex-01571-fullscreen-recorded.json: the same corpus in fullscreen, 0.157's default and how Agent Code launches Codex.
  • codex-01571-config-read-recorded.json: the config/read projection. Its effectiveInputProjection is identical to 0.149.1's; the older fixture's extra layerShapeEvidence has no 0.157.1 counterpart.
  • codex-01571-config-source.json: the per-tag audit of the config precedence code. All nine claims re-verified at rust-v0.157.1 coordinates.
• Tests. SubmittedPromptInput.recorded.test.ts now runs the same contract once per corpus. Only provenance is per-version.

What 0.157.1 changed, from the recordings

Provider semantics. Every issued-profile case agrees with 0.149.1. The only difference is outside the profile: a Vim-default composer now opens in Insert (vim-normal-default submits iabc), and the profile forces Vim off anyway.

Four real surfaces the 0.149.1 composer classifier misread, each now pinned by a recorded frame:

1. The trust dialog's hint row (enter continue · esc quit|back) has the idle-footer shape, so the dialog read as a composer drafting "1. Trust and continue". It is now a bottom-row structural modal check, byte-identical to fix(trust): detect the Codex 0.156+ Folder access dialog and send its keystrokes #67's.
2. The skill/mention popup now paints ABOVE the composer, with the hint enter insert · esc close (skill_popup.rs). The old footer string no longer exists. Read as an idle composer, Enter (which inserts a completion) would have produced evidence for a prompt Codex never sent. It is now completion-popup.
3. Fullscreen paints a two-row footer: the status line, then ? for shortcuts or tab to queue message. Only those exact rows are accepted, and any other footer.rs variant stays unknown, which declines.
4. Every popup paints above the composer (review a and b): slash command, file, unified mention and skill. The slash and file popups have no hint row. With one open, the pane read as a composer holding the draft, and Enter, which selects the popup item, yielded evidence for a prompt Codex never sent.
   • The fix is fail-closed on the draft: a leading / or an @/$ token (what opens these popups upstream) never yields evidence. The unified-mention hint is also recognised.
   • Two new recorded cases, slash-popup-enter-selects-command and file-popup-enter-inserts-mention, show Codex submitted nothing.
   • Upstream's slash_popup_footer_wide snapshot (/m over /memories, reviewer b's reproduction) is a unit test.

Recorder changes, all gated to 0.156+ and explained inline:

• --no-daemon. Otherwise the isolated CODEX_HOME's daemon socket exceeds SUN_LEN and Codex does not start (bug(screen): Codex 0.157 background-server startup and its "Cannot use the background server" screen are undetected #66).
• A seen model migration (gpt-5.6-sol → gpt-6-sol).
• Skill YAML frontmatter.
• The trust case answers 1, asserts the dialog is still up, then sends Enter. This live-verifies bug(trust): Codex 0.156 reworded the trust dialog to "Trust this folder?"; every trust detector misses it #65's keystrokes in an isolated home.
• Thread-title side requests (thread_title.rs) are answered unheld and unrecorded.
• The request carrying the prompt is matched, not the newest one, because 0.157 re-sends a held request.
• Frames are windowed on the last painted row.
• The resize "after redraw" frame is taken when the rows actually change. Fullscreen repaints on a timer after a quiet gap.
• The popup wait uses the popup's own hint.

Verification

• Fail-first. Against origin/main both 0.157.1 suites fail at profile issuance. With only the classifier reverted, 6 recorded tests fail.
• Tests. Recorded suites 144 passing. 2 skips are the popup cases in the 0.149.1 suite, which has no such recordings. tsc --noEmit clean.
• Mutation. Removing the draft rule fails the recorded slash-popup cases in both corpora and the upstream-snapshot test.
• Privacy. Every committed projection was scanned for account, path and credential strings; none found. Workspace paths are <private-path>.

Not verified / residuals

• bug(input): Codex 0.157.1 intermittently drops a '?' from a single-line prompt written at once (sendPrompt path) #68. 0.157.1 intermittently drops a ? from a single-chunk typed draft (about 1 in 5 runs), which is the sendPrompt single-line path. When it happens the recorder fails loudly, and the committed corpus is from intact runs. The catalog says so. The drop itself is bug(input): Codex 0.157.1 intermittently drops a '?' from a single-line prompt written at once (sendPrompt path) #68.
• Other footer variants (agent hints, the collaboration-mode indicator, the cycle hint) are unrecorded and decline as unknown.
• Safe misses by design. A prompt starting with / or mentioning $HOME / a@b gets no prompt evidence, and ownership falls back to the proxy path.
• Merge order with fix(trust): detect the Codex 0.156+ Folder access dialog and send its keystrokes #67. Both change Codex01491ComposerSurface.ts with a byte-identical trust-hint hunk, so either merge order resolves cleanly or trivially.

Plan: docs/plans/2026-09-27-prompt-input-profile-0157.md.

🤖 Generated with Claude Code

[Juliusolsson05]

Disposition for review c (head a425c84)

• F1 (HIGH), fixed in 5480cc0: draftMayOpenPopup now matches any boundary-preceded @/$, including a bare sigil. Tests cover @, look at @, $, use $ and /. A comment in the surface explains why the draft rule, not the hint rows, is the primary guard: a popup can be open with zero rendered rows.
• F2 (LOW), fixed in a425c84: a new frame has a painted enter insert · esc close hint over a sigil-free draft. Deleting the hint-row layer now fails.
• F3 (LOW), fixed in a425c84:
  • RECORDED_PROMPT_INPUT_VERSIONS is pinned to exactly {0.149.1, 0.157.1}, and each version's corpus must exist.
  • The recorded suite asserts profile.upstreamTag.
  • An unrecorded second footer row must classify unknown.
  • All three mutations (widening the table, corrupting a tag, widening FULLSCREEN_SHORTCUTS_HINT) are now killed.
• F4: a pre-existing RolloutOwnership flake, tracked in bug(testing): RolloutOwnership.recorded 'modern-0149-large-bootstrap-first' exceeds 5 s under load #60. No change here.

[Juliusolsson05]

Disposition (W1). Three reviews (codex a, codex b, pi c), then a verification pass by the same three at the final head a425c84: all three are MERGE-READY.

Finding	Source	Disposition
0.157 popups painted above the composer were read as a submittable composer, so Enter gave false prompt evidence	a critical, b critical	Fixed (aac7510). No evidence from a draft a popup may own, plus 2 recorded popup-Enter cases and the upstream slash_popup_footer_wide snapshot.
A bare @/$ sigil (empty query) escaped the draft rule	c F1 HIGH	Fixed (5480cc0).
The hint-row layer, version table, upstreamTag and second fullscreen footer row were unpinned	c F2/F3 LOW	Fixed (a425c84). All four mutations are killed.
RolloutOwnership flake	c F4	Pre-existing, #60.

merge-gate.sh --dry: GATE PASS (0 behind main, checks green, reviews OK). READY for the manager's batch.