From 7ae4b056a0ca478e584fa282c45b528134cc80c9 Mon Sep 17 00:00:00 2001
From: JJ Liebig <jonathan.liebig@gmail.com>
Date: Tue, 11 Aug 2026 02:24:02 +0200
Subject: fix: wait for agent prompt readiness (#2537)

* fix: wait for agent prompt readiness

refs #2410

* fix: return pane updates after tab bar command

refs #2410

---------

Co-authored-by: Can Celik <ogulcancelik@gmail.com>
---
 src/detect/manifest/tests.rs    | 34 ++++++++++++++++++++++++++++++++++
 src/detect/manifests/codex.toml | 17 ++++++++++++++---
 2 files changed, 48 insertions(+), 3 deletions(-)

(limited to 'src/detect')

diff --git a/src/detect/manifest/tests.rs b/src/detect/manifest/tests.rs
index 11c92f49..265dfa69 100644
--- a/src/detect/manifest/tests.rs
+++ b/src/detect/manifest/tests.rs
@@ -733,6 +733,40 @@ fn codex_osc_title_plain_is_idle() {
     assert!(result.visible_idle);
 }
 
+#[test]
+fn codex_trust_directory_requires_live_top_region() {
+    let screen = "> You are in C:\\Users\\user\\project\n\n\
+        Do you trust the contents of this\n\
+        directory? Working with untrusted\n\
+        contents comes with higher risk of\n\
+        prompt injection. Trusting the\n\
+        directory allows project-local config,\n\
+        hooks, and exec policies to load.\n\n\
+        › 1. Yes, continue\n\
+          2. No, quit\n\n\
+        Press enter to continue\n";
+    let result = osc_explain(Agent::Codex, screen, "project", "");
+
+    assert_eq!(result.state, AgentState::Blocked);
+    assert_eq!(
+        result.matched_rule.as_ref().map(|rule| rule.id.as_str()),
+        Some("trust_directory")
+    );
+    assert!(result.visible_blocker);
+
+    let transcript = "› > You are in C:\\Users\\user\\project\n\n\
+        Do you trust the contents of this\n\
+        directory? Working with untrusted contents comes with higher risk.\n";
+    let result = osc_explain(Agent::Codex, transcript, "project", "");
+
+    assert_eq!(result.state, AgentState::Idle);
+    assert_ne!(
+        result.matched_rule.as_ref().map(|rule| rule.id.as_str()),
+        Some("trust_directory")
+    );
+    assert!(!result.visible_blocker);
+}
+
 #[test]
 fn codex_background_terminal_screen_does_not_override_osc_idle() {
     // Background terminal tasks can be long-lived helpers such as dev servers.
diff --git a/src/detect/manifests/codex.toml b/src/detect/manifests/codex.toml
index a4a4ca9f..9169e108 100644
--- a/src/detect/manifests/codex.toml
+++ b/src/detect/manifests/codex.toml
@@ -1,7 +1,7 @@
 id = "codex"
-version = "2026.07.18.1"
-min_engine_version = 2
-updated_at = "2026-07-18T00:00:00Z"
+version = "2026.08.09.1"
+min_engine_version = 3
+updated_at = "2026-08-09T00:00:00Z"
 
 [[rules]]
 id = "osc_title_blocked"
@@ -31,6 +31,17 @@ any = [
   { contains = ["esc/← to edit prev"] },
 ]
 
+[[rules]]
+id = "trust_directory"
+state = "blocked"
+priority = 950
+region = "top_non_empty_lines(20)"
+visible_blocker = true
+all = [
+  { regex = ['\A> You are in [^\r\n]+(?:\r?\n|$)'] },
+  { regex = ['(?s)Do\s+you\s+trust\s+the\s+contents\s+of\s+this\s+directory\?'] },
+]
+
 [[rules]]
 id = "live_strong_blocker"
 state = "blocked"
-- 
cgit v1.2.3