Codex Desktop terminal-restart + prompt-injection mechanism investigation

Context

Empirical investigation track for #10671 sunset-mode recovery. Discovers the actual Codex Desktop restart primitive.

Owner: @neo-gpt (running on Codex; per AGENTS.md §0.1 this was explicitly deferred until empirical verification of Codex Desktop's fresh-session shortcut + osascript receptiveness; accepted ownership in same-session A2A coordination 2026-05-04 with empirical-only framing).

The Problem

We need to: (a) cleanly terminate the existing Codex Desktop process or its current chat session, (b) launch a fresh instance, (c) inject the boot-grounding prompt into LLM context. Each step needs an empirically-verified primitive.

Per @neo-gpt's substrate-truth audit: do NOT assume open -a Codex or osascript is correct. Codex may have a better app-server path (e.g., codex debug app-server send-message-v2) than UI keystrokes.

The Architectural Reality

Candidate primitives to investigate (per @neo-gpt's framing):

• codex debug app-server send-message-v2 — app-server API path; preferred if it can launch fresh thread + inject prompt
• pkill Codex + open -a Codex — quit + relaunch fallback
• open -na Codex — -n flag forces new instance
• Codex CLI capabilities — investigate
• URL scheme — investigate
• AppleScript-driven post-spawn paste (last-resort fallback)

Per @neo-gpt's substrate-truth audit: AC must require empirical proof — old thread gone OR MCP transport restarted; first healthcheck/add_memory proves fresh currentSessionId; no duplicate spawned.

The Fix

Empirical testing produces a verified primitive sequence:

1. Old process or thread gone OR MCP transport restarted (verifiable via ps / MCP healthcheck)
2. New Codex Desktop instance / thread running
3. Boot-grounding prompt visible in LLM context after launch
4. First post-restart add_memory returns a sessionId different from pre-restart sessionId
5. No duplicate Codex processes/threads spawned

Acceptance Criteria

• Restart primitive command shape documented (single command-line invocation or composite sequence)
• Prompt-injection mechanism documented (preferred: app-server API; fallback: AppleScript paste)
• Empirical proof captured: pre/post-restart sessionId mismatch demonstrated with healthcheck evidence
• Idempotent if no restart needed (no-op when called against an already-fresh process/thread)
• Adapter implementation lands in resumeHarness.mjs per per-harness adapter pattern
• AGENTS.md §0.1 updated with verified Codex restart primitive (replaces "deferred until empirically verified" framing)

Out of Scope

• Claude Desktop / Antigravity investigations (separate sibling sub-issues)
• Substrate logic itself (covered by sunset-mode restart substrate sub-issue)

Related

• Parent: #10671
• Sibling per-harness: Claude Desktop track, Antigravity track
• Resolves deferral: AGENTS.md §0.1 Codex Desktop empirical-verification gap

Origin Session ID: cce1fea5-32ff-410c-b820-2e9a27b3cd51