Resolve Codex through mise which instead of running the lazy launcher

[surim0n]

Summary

omarchy-agent-usage-codex resolved codex with shutil.which, which finds ~/.local/bin/codex first — the lazy launcher written by omarchy-mise-install, whose first step is mise use -g. On a machine without Codex installed, the Agents widget's read-only refresh probe started a full install; when the app-server handshake timed out, the orphaned mise kept installing.

• Scan PATH for a real codex binary, skipping lazy launchers (a regular file that invokes mise use/mise x, and anything under mise's shims directory
• Fall back to , which only prints a binary that is already installed — it can never trigger an install
• A symlink at the launcher path is treated as the user's own binary and probed directly, without invoking
• If nothing real resolves, the record reports as before

Fixes #12939

Test plan

• New tests in : a launcher-only PATH never executes the launcher and reports Codex unavailable; a result is probed; a user symlink at is probed without invoking mise
• Verified all three scenarios against stub / binaries with a sanitized PATH

Generated with Devin
EOF
)

[llstrk]

Automated AI review

Community review: Independent automated community review, unaffiliated with the Omarchy team, intended to help prepare PRs for their review.

Verified: on a machine where Codex was never installed, the usage collector no longer runs the ~/.local/bin/codex launcher. It skips the launcher, mise which codex finds nothing, and the record reports "Codex unavailable". A Codex from an npm global install is also no longer shadowed by the launcher. One gap remains: mise's own shims are not caught by the new check, and in some mise states a shim still reaches an installing path.

Setup (reviewed head vs base)	Base	Head
Launcher only, Codex never installed	runs launcher (mise use -g)	skips launcher, reports unavailable
npm global Codex plus launcher	launcher shadows npm Codex	probes npm Codex
Codex from pacman (/usr/bin/codex)	probed	probed (unchanged)
User binary or symlink at ~/.local/bin/codex	probed	probed (unchanged)
mise-installed Codex, shim first on session PATH	shim executed	shim executed (unchanged)

mise shims bypass the lazy-launcher check

On Linux, mise creates each shim as a symlink to the mise binary (src/shims.rs add_shim, v2026.9.9). is_lazy_launcher() returns False for every symlink before it reaches the shims-directory comparison (bin/omarchy-agent-usage-codex#L98). So the "anything under mise's shims directory" rule never applies to a real shim, and the collector executes shims/codex whenever it exists. In a sandboxed run with a synthetic shim symlinked to a stub mise, the head collector executed the shim in both the Omarchy session PATH order and the collector's own appended order.

Executing a shim is not always read-only. Traced from mise 2026.9.9 source (not run against a real mise):

collector -> shims/codex (symlink, not treated as lazy)
  -> mise shim dispatch, no active Codex version in config
       -> not_found_system_fallback (default true) searches PATH
            -> ~/.local/bin/codex (Omarchy launcher)
                 -> mise use -g codex   (install + global config write)
  -> or: a configured Codex version is missing
       -> not_found_auto_install (default true) may install it

Impact: in the default flow (Codex installed through the launcher and active in the global config) the shim runs the installed Codex, the same as base. The install path is reached when mise has a Codex install or shim but no active Codex version in config (for example after mise install codex without mise use, or after the global entry is removed), or when a configured version is missing. In the session PATH order base behaves the same way, so this is not a regression, but the PR's stated guarantee that shims are skipped does not hold.

Suggested change: detect shims before the symlink exemption, for example by treating a candidate whose os.path.realpath() equals the realpath of the resolved mise binary as lazy, and let mise which codex return the installed binary instead. Optional approaches: move the directory check above islink and derive the shims directory from MISE_DATA_DIR/XDG_DATA_HOME, or set MISE_NOT_FOUND_SYSTEM_FALLBACK=false and MISE_NOT_FOUND_AUTO_INSTALL=false when spawning a shim. A test with shims/codex as a symlink to the mise stub would cover this; the current symlink case points at the Codex stub and passes on base too (confirmed by running it against the base collector).

Test isolation: the new cases use SAFE_PATH="$(dirname "$(command -v jq)"):/usr/bin:/bin". find_codex_binary() scans PATH in order, and Arch's openai-codex package installs /usr/bin/codex, so on such a host all three new cases pick the real Codex and start codex ... app-server with the scratch HOME. A synthetic tripwire codex placed in a SAFE_PATH directory was invoked three times and all three cases failed. A private bin directory holding only the needed tools (or skipping when PATH=$SAFE_PATH command -v codex succeeds) would keep the test hermetic.

Optional: mise which can resolve a configured latest version over the network when some tool has no installed version. Setting MISE_OFFLINE=1 for that call would keep the refresh probe offline.

---

Review information

Test scope: Source review of the reviewed head d34d2c9 against base 28ceaae, including bin/omarchy-mise-install, Omarchy session PATH setup and mise 2026.9.9 source (the version Arch ships). The existing and new test files and the new cases against the base collector ran in a network-isolated sandbox with stub mise and codex binaries; no real mise, npm or Codex was executed and no desktop session was used. The shim fallback and auto-install paths are traced from source only.

AI process: Opus 5.5 Medium coordination and synthesis, independent Opus 5.5 Xhigh and GPT 6 Sol Xhigh technical assessments with targeted follow-up questions, Opus 5.5 Medium editorial check.

Opt out: To stop receiving these reviews, reply to this comment saying so.

[surim0n]

Addressed in af251f2:

• Shim detection now runs before the symlink exemption. A shim is recognised either by living in the mise shims dir (derived from MISE_DATA_DIR/XDG_DATA_HOME) or by resolving via realpath to the mise binary itself. A symlink elsewhere is still treated as the user's own binary.
• mise which is called with MISE_OFFLINE=1 so the probe cannot resolve a configured latest over the network.
• The new tests use a private tools dir instead of /usr/bin:/bin, so a packaged /usr/bin/codex on the host can no longer leak into the probe. Added a case with shims/codex symlinked to the mise stub.

[llstrk]

Automated AI review

Community review: Independent automated community review, unaffiliated with the Omarchy team, intended to help prepare PRs for their review.

Follow-up on the earlier review and the author's reply, checked at af251f2.

Verified: all three earlier points are resolved. The new commit adds one narrow regression, described below: when mise itself is a symlink, a mise-installed Codex is reported as unavailable.

Earlier point	Outcome at af251f2
mise shims bypass the lazy-launcher check	Resolved. A shim symlinked to a stub mise is no longer executed. The installed Codex from mise which codex is probed instead, in both the session PATH order and the collector's appended order.
Test isolation (SAFE_PATH included /usr/bin:/bin)	Resolved. With a tripwire codex in the sandbox directory that the test's command -v resolves python3, jq and rg to, the new test file passed 25/25 and never invoked it. The previous test file invoked it and failed its first new case.
Optional: MISE_OFFLINE=1 for mise which	Resolved. Set only for the mise which call; the Codex process does not inherit it.

The two shim checks cover different cases. The directory check alone catches a shim under a custom MISE_DATA_DIR that points at a different mise. The realpath check alone catches a shim in the collector's appended ~/.local/share/mise/shims when XDG_DATA_HOME points elsewhere, and a custom MISE_SHIMS_DIR. The other rows of the earlier table are unchanged.

A symlinked mise is classified as a lazy launcher

find_codex_binary() calls mise which only when not is_lazy_launcher(mise). When the mise found on PATH is itself a symlink (for example Homebrew on Linux, a Nix profile, or a hand-made ~/.local/bin/mise link), the new realpath branch compares that path with find_command("mise"), which is the same path, so it returns True (bin/omarchy-agent-usage-codex#L111-L118). mise which codex is then never called.

Symlinked mise, Codex installed through mise	Base	d34d2c9	af251f2
Launcher at ~/.local/bin/codex, no shim	launcher run (mise use -g)	installed Codex probed	"Codex unavailable", no mise call
Shim first on the session PATH	shim executed	shim executed	"Codex unavailable", no mise call

Impact: on these setups the widget shows "Codex unavailable" instead of the limits. Nothing is executed or installed, so this fails safe. Omarchy installs mise-bin, whose AUR PKGBUILD installs a regular /usr/bin/mise, so default installs are not affected.

Suggested change: skip the realpath comparison when the candidate is the mise binary itself:

if os.path.islink(path):
  mise = find_command("mise")
  if mise and os.path.abspath(path) != os.path.abspath(mise):
    ...  # existing realpath comparison
  return False

With this change, both rows above probe the installed Codex (with MISE_OFFLINE=1 on the which call), and the PR's test file still passes 25/25. A test case with bin/mise as a symlink to a stub that prints a Codex path fails at af251f2 and passes with the change.

Optional test improvement: the private tools dir holds only python3 and rg, but the Codex stub the tests probe calls jq. In the "mise-resolved binary" and "user-owned symlink" cases the stub cannot answer initialize, so the collector waits out its 8 s timeout (timed at 8.08 s for the resolved-binary case) and records "Codex limits unavailable". Both cases still pass, because they check only the args file and the mise call log, not the probe's result. Adding jq (for tool in python3 rg jq) brought the file from 18.2 s to 2.27 s, still 25/25.

Test interaction with #13106 (test-only): that open PR adds a no-credentials guard that returns before the app-server starts unless CODEX_ACCESS_TOKEN, a non-file credential store or CODEX_HOME/auth.json exists. This PR's "mise-resolved binary" and "user-owned symlink" test cases create none of these but require codex-args. In a sandbox merge of the two PRs (the collector merges cleanly; the test files conflict only at the end, where both append), the "mise-resolved binary" case fails with "Codex limits unavailable". Adding an auth.json to the CODEX_HOME of those two cases, as #13106 does for the existing fixtures, makes all 29 checks pass.

---

Review information

Test scope: Source review of af251f2 against the previously reviewed d34d2c9 and base 28ceaae, with mise 2026.9.9 (Arch extra) and 2026.9.14 (AUR mise-bin) source. The collector at all three commits, variants of it with one or both shim checks removed, and the current test file against each of them ran in a network-isolated sandbox with synthetic homes and stub mise and codex binaries. The combined test file was also run on a local merge with #13106. No real mise, npm or Codex was executed. Real shim dispatch and MISE_OFFLINE handling are traced from mise source only.

AI process: Opus 5.5 Medium coordination and synthesis, Opus 5.5 Xhigh technical review and final fact check, GPT 6 Sol Xhigh search for related issues, Opus 5.5 Medium editorial check.

Opt out: To stop receiving these reviews, reply to this comment saying so.

[dhh]

Thank you! Brought in with your authorship in #14049.