Add managed completion hooks for Copilot, Droid, and Qoder

[onevcat]

Extends the S3a managed-hook foundation (#721, #723) to the remaining tier-A runtimes, so a
Profile launch of Copilot, Droid, or Qoder reports native lifecycle events into the existing
signal bus. Slice 064-S3b; S3 wave 1 completes with S3c.

What each runtime needed

All three emit Claude-shaped payloads, so they share one decoder plus a per-runtime event
table. Their injection is asymmetric in ways that were measured rather than assumed:

	Injection	Repeated flag	Prowl writes to disk
Copilot 1.0.80	--plugin-dir (static plugin now in the bundle)	additive — no merge needed	no
Droid 0.203.0	--settings (path only)	last wins	yes, owner-only 0600
Qoder 1.1.29	--settings (inline JSON)	first wins	no

Copilot's plugin ships as Resources/agent-hooks/copilot/ and resolves the CLI through
$COPILOT_PLUGIN_ROOT, so the directory stays read-only inside a signed bundle. Droid's merged
settings can contain user secrets (customModels[].apiKey), so they go to an owner-only file
reusing S3a's lock/retirement/orphan-sweep. Qoder inserts its merged object before the user's,
because inserting after would leave Prowl's hooks dead and inserting unmerged would disable the
user's settings; --setting-sources degrades instead of injecting.

PermissionRequest is not "needs input"

The tempting uniform mapping is wrong. Copilot and Qoder both fire PermissionRequest while the
permission service auto-approves a tool and nobody is waiting — measured with
--allow-all-tools and --permission-mode accept_edits respectively, in headless runs where no
human could answer. Mapping it would report "waiting for input" on ordinary tool calls, so all
three derive needs-input from Notification alone.

The same matrix re-checked Claude 2.1.243 across six non-interactive scenarios, including an
auto-allowed Bash call that actually executed: it stays silent, so the shipped S3a mapping is
correct as-is.

Bug found while verifying

Hook validation compared the launch directory with the hook's reported cwd using
standardizedFileURL, which does not resolve symlinks. Copilot echoes the shell's logical
/tmp/... path while Droid reports process.cwd(), already resolved to /private/tmp/... —
the same directory, silently rejected. Now compared by resolved path, with a debug log naming
the first failing precondition (a rejected hook is otherwise indistinguishable from one that
never fired).

Droid: two processes, one launch

Droid's hook ran and the CLI provably transmitted a valid frame, yet no channel appeared. The
cause was in code every runtime shares. Droid ≥ 0.202 is two processes: the interactive TUI, and
a droid exec --input-format stream-jsonrpc engine it forks once the folder is trusted — and
every hook is a child of the engine. The process probe lists the newer engine first and both
score equally, so the detector identified the TUI at the first scan and the engine a few seconds
later. The evidence epoch keyed its process generation on that identified pid, read the flip as
a replaced process, dropped the managed registration, and rejected every later hook at a
guard whose diagnostic had never surfaced (the app's print output is block-buffered under
redirection).

The fix separates two concepts that single-process runtimes had let coincide: the identified
process is still what state and sessions are read from, while the launch process — the
topmost job ancestor of the identified one, now recorded in IdentifiedAgentProcess and
PaneAgentState — is what hook ancestry and replacements are judged against. Hooks descend from
both, so an engine child taking over identification, or restarting, is no longer a relaunch.
ForegroundProcess gains the parent pid the probe already fetches (no extra syscall), and the
detection diagnostic prints identified=<agent>:<pid> launch=<pid>. Two regression tests at the
manager level fail on the old generation subject.

Codex 0.149.1: keep the config-read pipe open

Re-verifying against the latest releases turned every Codex Profile launch into
managed_hook_degraded. Codex 0.149.1's app-server now exits as soon as stdin reaches EOF and
drops any request it has not answered yet; the notifier preflight closed the pipe right after
writing, so config/read was never answered (0.149.0 tolerated this). The pipe now stays open
until the response arrives. A stub that exits on EOF like 0.149.1 covers it, and the live
contract test was re-attested against the real binary.

Static-review hardening

A static review of the branch found four contract gaps the tests missed (the stubs encoded the
same assumptions). Each is now pinned by a test and fixed:

• Runtime working directory was not registered. Copilot -C, Droid --cwd, and Qoder
  -w/--cwd change directory before their hooks run, so a --cwd launch had every event
  rejected on the cwd guard. A shared scanner resolves the effective directory per runtime
  (last-wins for Copilot/Droid, first-wins for Qoder; =/joined forms; degrade on malformed),
  while a relative --settings path still resolves against the launch directory.
• Droid could override env-var settings. A FACTORY_RUNTIME_SETTINGS_PATH set through the
  Profile environment is now merged as the base rather than dropped by the injected flag (flag
  still wins; unreadable degrades). The shell-rc / globally exported case needs a shell probe and
  is a noted follow-up; the plan doc's "unused" claim was corrected.
• A stale detector session could roll back a hook-announced one. After SessionStart(S1) →
  SessionStart(S2), a lagging detector reporting S1 revoked the verified S2 channel. An announced
  rotation now retires the superseded session for every runtime, so a read of it is ignored while
  a genuinely new session still distrusts the channel until the hook re-announces.
• A transient process sample could revoke the launch generation. If one proc_listpids
  dropped the launcher while keeping the engine child, the launch root flipped and read as a
  replacement, permanently revoking the registration and private file. The launch process is now
  kept while it is still a live ancestor of the identified process.

Also: Droid --settings is treated as path-only (a {-value is a missing path, not inline JSON);
the Droid merge is capped at the private-file limit so an oversize merge degrades cleanly; and the
symlink cwd-comparison test dropped during the session-takeover change was restored. make check,
make test (zero failures), and make build-app pass; Droid re-verified verified_live live on
the hardened build.

Static-review round 2

A second review pass found two remaining P1s; both are pinned by tests and fixed:

• Shell-rc FACTORY_RUNTIME_SETTINGS_PATH was still overridable. Round 1 read the variable
  only from a Profile environment override, so a value exported in the user's shell rc stayed
  invisible and the injected --settings dropped it. DroidSettingsEnvironmentProbe now resolves
  it from the login shell (rc sourced), reusing the Codex shell probe. Precedence is Profile
  override > shell-resolved; the probe is skipped when a --settings flag or override already
  answers the question, and a probe that cannot run degrades rather than override. Adds a
  login-shell spawn per Droid launch with no flag/override, consistent with Codex.
• A resumed session could not re-verify. Retiring the superseded session on rotation (round
  1's stale-detector fix) made Claude's /resume — which re-announces an old session id with a
  fresh SessionStart — get rejected by the retired-session guard, killing every event of the
  resumed session. An announcing runtime's SessionStart now reactivates a retired id (un-retire,
  retire the current one, rotate); Codex, with no SessionStart, stays strict. Covered by a
  S1 → S2 → S1 regression test.

Both P1s red→green-verified; make check, make test (zero failures), make build-app pass, and
Droid re-verified verified_live live (its shell probe runs, finds the variable unset, and the
hooks-only merge still verifies).

Static-review round 3

• Delayed event for a detector-superseded session. Round 1 retired a session only when the
  hook rotated it; when the detector moved to an exact new session S2 while the hook's last was
  S1, S1 stayed live, so a delayed Stop(S1) re-verified the channel and rolled record.sessionID
  back. A detector-driven session change now retires the superseded session for every runtime
  (announcing runtimes keep managed.sessionID so a non-SessionStart event for the new session is
  rejected until its SessionStart; Codex clears it). Regression test: S1 → detector S2 → delayed
  Stop(S1) must be rejected.
• CI flake — Codex config-read timeout. CodexConfigReadProcessTests spawns a Python
  app-server fake that could be starved past its 2 s deadline under the full parallel suite. The
  suite is now .serialized and the fake-response deadlines raised to 15 s (production keeps its
  1 s deadline against the real, fast app-server). Ran the suite 5× in a row clean; full make test green.
• Droid path normalization (P2). A path-only --settings source and the
  FACTORY_RUNTIME_SETTINGS_PATH value are trimmed, tilde-expanded, and treated as unset when
  blank, matching Droid 0.203, so a Profile override and the shell probe resolve to the same file.
  The probe is now exercised through a real /bin/sh script (set / unset / blank), not only an
  injected resolver.

Verification

make check (35 script tests), make test (2567 tests, zero failures), make build-cli,
make test-cli-integration (97 tests), make build-app.

Live, in an isolated Debug instance with its own home, socket, and copied credentials:

• PASS — Copilot injects --plugin-dir ahead of --interactive, reaches verified_live
  with source=hook_copilot, and records turn-ended; the read-only bundled plugin loads; a
  hook without a token fails open (runtime unaffected, exit 0).
• PASS — Droid injects --settings with a correct 0600 merged file, binds the TUI as the
  launch generation at the first scan, accepts SessionStart from the engine child forked seven
  seconds later, and records turn-ended from Stop with source=hook_droid, verified_live,
  and last_binding=current.
• PASS — Qoder injects its inline --settings carrier and reaches verified_live with
  source=hook_qodercli, recording turn-ended. This required correcting a research error:
  Qoder's flag hooks are trust-gated (Security: Blocked execution of hook (system) in untrusted folder), so exact coverage begins once the user trusts the worktree — which they
  must do anyway before the agent can work there. The earlier probe had run in an
  already-trusted directory, which hid the gate.

Profile surface creation is not broken for any runtime: main launched the same Qoder
Profile three times in a row and this branch launched seven consecutive Profile surfaces. The
intermittent CREATE_FAILED seen while testing affects every runtime in a long-lived isolated
Debug instance, is unrelated to S3b, and matches the flaky
deferredProfileAppliesFontSizeAdjustmentAfterSurfaceCreation test that also fails on main.

Latest-version re-verification (2026-08-25), same isolated sweep for each Profile in turn:
Claude Code 2.1.245, Codex 0.149.1, Copilot 1.0.80, Droid 0.203.0, and Qoder 1.1.29 each reach
verified_live with their hook_<runtime> source and record turn-ended. Codex passed only
after the pipe fix above.

All three runtimes are complete. The investigation, the fix, and the live-verification technique
(CFFIXED_USER_HOME alone for isolation, script(1) for a line-buffered app log) are recorded in
docs-ai/064-agent-completion-signals/009-s3b-action.md.