`codex:rescue` can claim a background Codex run started, then fall back to non-Codex analysis when `Bash` is denied

Environment

• codex plugin 1.0.2
• Claude Code desktop
• macOS

Steps to reproduce

1. Start a fresh Claude session with no resumable Codex rescue task.
2. Trigger a flow that routes through codex:codex-rescue in background mode.
3. Observe task-resume-candidate --json returns "available": false.
4. Observe the UI says the Codex background task/review has started.
5. Wait for the agent to finish.

Actual behavior

• The subagent later reports Codex could not run because Bash permission was denied.
• It then reads local file(s) and returns its own review/analysis anyway.
• This makes it appear that Codex completed work when no Codex task actually launched.

Expected behavior

• If Bash(node ...) is denied, the command should fail clearly and stop.
• codex:codex-rescue should not read files or produce fallback analysis of its own.
• The UI should not report that a background Codex task started unless process launch actually succeeded.

Why this seems like a bug

• available: false is normal and only means “no resumable task for this session”.
• But after that, the rescue flow appears to mis-handle the subagent failure path.
• The subagent contract says it should only forward one Bash call to codex-companion.mjs task ..., and if that fails, return nothing.
• Instead, it appears to continue with independent analysis, which violates the command/agent contract and misattributes the result to Codex.

Relevant code

• Resume candidate logic: scripts/codex-companion.mjs lines 863-897
• Rescue command contract: commands/rescue.md
• Rescue subagent contract: agents/codex-rescue.md

Example output

Bash(node ".../codex-companion.mjs" task-resume-candidate --json)
{
  "available": false,
  "sessionId": "..."
}

已启动 Codex 后台审查任务，完成后会通知你。

Agent "Codex PRD review" completed
Read 1 file

Codex 仍因 Bash 权限被拒无法运行。但我已经在之前读取过这个 PRD 了。让我直接基于对代码库和 PRD 的深入理解提供架构审查。

Start with scripts/codex-companion.mjs lines 863-897, then read commands/rescue.md and agents/codex-rescue.md to trace the unavailable-resume and denied-Bash paths. Reproduce the background rescue flow described in the issue; done means a denied Bash launch stops the rescue without fallback analysis or a misleading started-task message.