FEAT: add interactive Monitor context, approvals and replies

[merefield]

Why

Monitor should explain what a session needs, not just flag it for attention. This adds compact session context, expandable detail, and direct replies and approval decisions where the shared app-server provides a reliable target—without leaving the dashboard.

Changes

• Per-session, source-attributed context for last replies, commentary, questions and approval requests. Linked-agent requests retain their actual source thread.
• Three context levels: compact preview, expanded row replacing the token graph, and full scrollable detail. i cycles levels; Esc steps back. Explicit row selection takes priority, including sessions without context; only the selected row shows [i]. Moving selection collapses a different expanded row. With no selection, default targeting prefers the latest approval.
• Separate TURN COMPLETE state based on successful completion, independent of preview text. New turns clear it; failed/interrupted turns and ordinary idle do not imply success. A working linked agent suppresses root completion.
• Shared-server command details recover omitted command/directory fields from matching thread/turn/item events. Supported advertised choices include approve once, allow for session, persistent command-prefix rules, decline, and reject/stop. Numbered shortcuts select choices; grants require C or a second click confirming that exact choice. Broader scopes are explicitly labelled. Explicit non-command kinds (including stdin writes), network/permission/file-change requests remain read-only; omitted kind retains legacy command compatibility.
• Approval buttons sit below the text with a blank spacer when space permits. Expanded rows show buttons only if the complete request fits; otherwise they offer full detail. Confirmation slots remain stable. Justification, command, working directory and persistent rules have distinct themed sections; metadata is muted and commands retain their line breaks. Only one session exposes controls at a time.
• Successful actions show Decision sent ... / Text sent .... Request-scoped sending/results suppress contradictory instructions to reply again, without hiding a replacement request. Informational completion no longer triggers warning badges or the waiting tab pulse, and newly discovered sessions retain context on resume.
• Full-detail text editor for idle shared-server sessions (including TURN COMPLETE) and supported blocking questions. Click or Enter to focus; Enter submits; Esc leaves typing mode. Hotkeys are isolated while typing. Unicode, cursor editing, bracketed paste, offered choices, masked secret answers and multi-question replies are supported using Charm Bubbles.
• Ordinary text wraps and grows upward, then scrolls internally at the available-height cap; secret fields retain password masking. Visible global footer shortcuts (theme, refresh, quit) work in detail when not typing; Tab navigation remains available.
• Ordinary follow-ups target the displayed root CLI session using its existing configuration. Question replies target the exact requesting root/child thread and original question IDs. Replaced/unseen requests cannot inherit an editor or draft.
• One-use, connection-local capabilities; lifecycle/disconnect invalidation; fresh idle checks before follow-ups; no automatic retry of ambiguous sends. Existing approval safeguards remain intact.
• Bounded, memory-only excerpts and drafts; persisted hide/show preference only. Terminal-control stripping is not secret redaction. Submitted text enters Codex's normal session history. No extra summarisation calls or reasoning/tool-output harvesting.
• Non-executing approval demo, all fourteen locales, responsive layouts and matching click surfaces. Corrected session row-height allocation. The context toggle says HIDE DETAIL / SHOW DETAIL, with compact labels on narrow terminals.
• Five new embedded interface translations: Swedish (sv), Norwegian Bokmål (nb; no alias), Turkish (tr), Estonian (et) and Finnish (fi). Regional BCP 47 tags are supported. Set CODEXOMETER_LANG before launch and retain it in a shell profile or Windows user environment. UK English remains the default with its existing presentation and hotkeys unchanged; README and intro post list all fourteen languages and examples.
• README/intro updates, including foreground Unix-server setup, installer-managed daemon prerequisites, migration/resume steps, LIVE/LOCAL behavior, replies and safety limitations.

Validation

• go test -race ./...
• go vet ./...
• Responsive rendered click-target tests, all fourteen locales, selection/empty-context regressions, three-stage navigation and approval confirmation states.
• Catalogue completeness, formatting placeholders, unchanged hotkeys, regional language matching (including no/no-NO → Bokmål), and translated quota-window plural forms.
• Mock WebSocket tests for exact decision/question/follow-up payloads, one-use tokens, stale/replaced requests, busy-state rechecks, cancellation, disconnect and failed writes.
• Editor tests for hotkey isolation, Unicode/paste, secret masking, multiple answers, permitted choices and correct root/child targeting.
• Existing English presentation regression snapshots remain unchanged.
• Local rebuild and Windows amd64/macOS arm64 cross-builds verified.
• User manually verified a real command approval through Monitor; automated tests use mocks rather than submitting live tasks.

Limits / review notes

Interactive actions require the conversation to run through the same default Unix app-server socket and CODEX_HOME. Ordinary CLI logs do not persist approval requests and cannot accept replies; starting a daemon does not migrate existing sessions. Native Windows/custom WebSocket connections retain local fallback.

Follow-ups recheck idle state but turn/start has no atomic expected-completed-turn precondition. Avoid simultaneous submissions from Codex and Codexometer. Busy sessions are not steered from this editor. Unsupported/ambiguous requests remain REPLY IN CODEX; very small terminals hide controls. A sent response is not proof of subsequent execution, and ambiguous sends are never automatically retried.

Version remains 0.13.0. No release or tag is created by this PR.

[Copilot]

🟡 Changes recommended

A critical approval-kind validation flaw and several moderate behavioral issues must be resolved before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds interactive Monitor context, direct replies, completion states, and guarded approval controls backed by the shared app-server.

Changes:

• Adds compact, expanded, and detailed session-context views.
• Supports follow-ups, question responses, and confirmed command approvals.
• Adds lifecycle safeguards, localization, documentation, and comprehensive tests.

Review findings:

• Critical (2 votes) — internal/codex/session_context_daemon.go:76: Parse approval kind and reject non-command requests to avoid misrepresenting writeStdin approvals.
• Moderate (1 vote) — internal/codex/live_usage.go:73: Exclude Complete from needs-attention indicators and warning presentation.
• Moderate (1 vote) — internal/ui/model.go:2232: Initialize context previews for newly discovered sessions when Monitor resumes.
• Moderate (1 vote) — internal/ui/monitor_detail.go:65: Avoid showing unavailable/reply instructions alongside “Decision sent…” after token consumption.
• Nit (2 votes) — README.md:490: Correct the outdated claim that the connection is read-only except for approvals.
• Nit (1 vote) — README.md:994: Reconcile the earlier INPUT NEEDED description with TURN COMPLETE.
• Nit (2 votes) — intro-post.md:94: Clarify that supported blocking questions can be answered directly in Monitor.

File summaries

File	Description
README.md	Documents setup and interactive Monitor behavior.
main.go	Adds interactive approval demo data.
main_test.go	Tests one-use demo approvals.
intro-post.md	Updates feature and privacy documentation.
internal/ui/preferences.go	Persists context visibility preferences.
internal/ui/monitor.go	Integrates context into Monitor rendering.
internal/ui/monitor_prompt.go	Implements prompt and reply workflows.
internal/ui/monitor_prompt_test.go	Tests prompt interactions and layout.
internal/ui/monitor_editor.go	Adds text and secret-answer editors.
internal/ui/monitor_detail.go	Formats full context details.
internal/ui/monitor_detail_test.go	Tests structured detail rendering.
internal/ui/monitor_context.go	Implements context rendering and interaction.
internal/ui/monitor_context_test.go	Tests context visibility and navigation.
internal/ui/monitor_context_modes.go	Implements three context presentation levels.
internal/ui/monitor_context_modes_test.go	Tests context modes and targeting.
internal/ui/monitor_approval.go	Implements approval controls and confirmation.
internal/ui/monitor_approval_test.go	Tests approval safety and hit targets.
internal/ui/model.go	Adds Monitor interaction state and synchronization.
internal/ui/localisation_test.go	Extends localized UI coverage.
internal/i18n/locales/zh-Hans.json	Adds Simplified Chinese strings.
internal/i18n/locales/ru.json	Adds Russian strings.
internal/i18n/locales/nl.json	Adds Dutch strings.
internal/i18n/locales/ja.json	Adds Japanese strings.
internal/i18n/locales/it.json	Adds Italian strings.
internal/i18n/locales/fr.json	Adds French strings.
internal/i18n/locales/es.json	Adds Spanish strings.
internal/i18n/locales/en-GB.json	Adds English strings.
internal/i18n/locales/de.json	Adds German strings.
internal/codex/session_prompt.go	Defines prompt offers and validation.
internal/codex/session_prompt_unix.go	Sends app-server replies and follow-ups.
internal/codex/session_prompt_unix_test.go	Tests prompt protocol and invalidation.
internal/codex/session_context.go	Extracts and sanitizes session context.
internal/codex/session_context_test.go	Tests context extraction and grouping.
internal/codex/session_context_daemon.go	Tracks live context and requests.
internal/codex/session_approval.go	Defines approval client APIs.
internal/codex/session_approval_unix.go	Sends one-use approval decisions.
internal/codex/session_approval_unix_test.go	Tests approval transport and lifecycle.
internal/codex/session_approval_test.go	Tests approval validation and recovery.
internal/codex/live_usage.go	Exposes context and completion status.
internal/codex/live_usage_test.go	Updates completion-state tests.
internal/codex/daemon_status.go	Extends daemon status snapshots.
internal/codex/daemon_status_unix.go	Captures live app-server context.
internal/codex/daemon_status_unix_test.go	Tests daemon context capture.
internal/codex/approval_options.go	Parses advertised approval decisions.
internal/codex/approval_options_test.go	Tests supported approval choices.
go.sum	Records dependency checksums.
go.mod	Adds the Charm Bubbles dependency.

Review details

Suppressed comments (1)

README.md:998

• This new description conflicts with the earlier Monitor overview, which still says completed turns receive an amber INPUT NEEDED badge (README.md:839-841). Update that earlier explanation to describe TURN COMPLETE and its distinct semantics.

- **LAST REPLY** is the last completed assistant reply, not a new question. An
  observed local completed-turn prompt is labelled **TURN COMPLETE**.
  For shared-server sessions, **TURN COMPLETE** comes from an observed successful
  `turn/completed` event followed by idle status, independently of whether reply
  text is available or previews are hidden. Failed/interrupted turns and idle

• Files reviewed: 46/47 changed files
• Comments generated: 6
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.