diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4280102e..aae190a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to the claude-plugins project will be documented in this fil
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Entries are listed newest-first; each plugin section is treated as released when merged to `main`.
 
+### vibe v1.0.59
+
+#### Added
+- `codex-fleet-monitor` skill: a background event watcher for a fleet of Codex App Server threads (local and one ssh host) plus the pull requests they produce. It exits with a diff on the first change and flags IDLE, STALLED, FAILED, merge conflicts, review and comment counts, check changes and new PRs. Liveness is read from each thread's last turn and item count rather than the turn id alone, so a turn left open by a silent Codex usage limit is reported as STALLED. It needs only the vibe plugin and the `codex` CLI: `liveness.mjs` is a single self-contained file that talks to the managed App Server through `codex app-server proxy`, and `sessions.txt` lists sessions as `local|remote <label> <threadId>` (the two-column `<name>` form that reads a `<name>.json` state file with a `threadId` still works). The skill description tells agents to reach for it whenever two or more Codex or vibe sessions are running.
+- `codex-fleet-monitor` prints `codex-usage <local|remote> <band>% <state> resets=<n>` for this machine and the ssh host from `account/rateLimits/read`, where the state is `ok`, `LIMIT`, `LIMIT-SPENDING-CREDITS` (the limit is reached and turns are consuming paid credits) or `LIMIT-STOPPED`. `ratelimit.mjs` reuses the App Server client exported by `liveness.mjs` and is bounded by the same in-process timeout; both files are copied to `<REMOTE_STATE_DIR>/.fleet-monitor/` on the remote host. The skill tells agents to warn the user when the band rises fast and to stop sending turns on `LIMIT-SPENDING-CREDITS` unless the user approves paid credits.
+- Optional `REQUESTS_DIR` and `REMOTE_REQUESTS_DIR` print `requests <where> <count> <newest file>`, so the watcher wakes when a Codex session drops a delegated-work request for a Claude worker.
+- `codex-fleet-monitor`'s `watch.sh` compares each run against the previous run's `last-snapshot.txt`, so a change between a watcher exit and its re-arm (such as a session switching to paid credits) is still reported. PR check counts are reported only once settled: while `gh` lists no checks or any check is pending, the line keeps the last settled counts with a ` (running)` suffix instead of flapping on every CI run.
+
 ### code-review v3.11.0
 
 #### Changed
diff --git a/plugins/vibe/.claude-plugin/plugin.json b/plugins/vibe/.claude-plugin/plugin.json
index e2a9f517..4a5a8961 100644
--- a/plugins/vibe/.claude-plugin/plugin.json
+++ b/plugins/vibe/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "vibe",
   "description": "Vibe sessions, handoff, seed refresh, and ClosedLoop ticket workflows",
-  "version": "1.0.58",
+  "version": "1.0.59",
   "dependencies": ["closedloop-core"],
   "author": {"name": "ClosedLoop", "email": "support@closedloop.ai"}
 }
diff --git a/plugins/vibe/.codex-plugin/plugin.json b/plugins/vibe/.codex-plugin/plugin.json
index 9ad149f8..1dadebc7 100644
--- a/plugins/vibe/.codex-plugin/plugin.json
+++ b/plugins/vibe/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "vibe",
-  "version": "1.0.58",
+  "version": "1.0.59",
   "description": "Vibe sessions, handoff, seed refresh, and ClosedLoop ticket workflows",
   "author": {"name": "ClosedLoop", "email": "support@closedloop.ai"},
   "homepage": "https://github.com/closedloop-ai/claude-plugins",
diff --git a/plugins/vibe/README.md b/plugins/vibe/README.md
index a3ebaa6b..d8210217 100644
--- a/plugins/vibe/README.md
+++ b/plugins/vibe/README.md
@@ -301,6 +301,21 @@ through the queue, and mark the ticket Done. The fix worker runs the full web
 and Desktop screen walk itself, on a Mac through `pnpm vibe walk-linux`, and
 its counts and result file go into the PR's Test plan and the ticket's loop.
 
+### `codex-fleet-monitor`
+
+Background event watcher for a fleet of long-running Codex App Server threads
+(local and one ssh host) plus the pull requests they produce. One command polls
+every watched thread and PR and exits with a diff on the first change: a session
+going idle, stalling, or failing, a merge conflict, new review or comment
+counts, changed checks, or a new PR. Liveness is read from the thread's last
+turn and item count, so a turn left open by a silent Codex usage limit shows as
+`STALLED` instead of running forever. It also prints a Codex usage line for each
+machine (used-percent band, and whether a reached limit has started spending
+paid credits), check counts only once they settle, and optionally the
+delegated-work request files sessions drop for Claude workers. A change made
+between a watcher exit and its re-arm is still reported. It needs only this
+plugin and the `codex` CLI; sessions are listed by thread id.
+
 ### ClosedLoop Ticket Skills
 
 The plugin bundles the ClosedLoop ticket automation skill pack: `cl-policy`, `cl-analyze`, `cl-find-related-tickets`, `cl-split`, `cl-work-report`, `cl-sweep`, and `cl-execute`. Together they cover policy-aware ticket analysis, related-ticket discovery, safe one-level split workflows, private project work reports, sweep coordination, and end-to-end ticket execution. The imported sweep scripts use the native managed Codex App Server through bundled helpers rather than depending on a separate `app-server-orchestrator` skill. Runtime access still depends on the operator's normal ClosedLoop, GitHub, `workflow-memory`, and `closedloop-graph` MCP/API configuration.
diff --git a/plugins/vibe/skills/codex-fleet-monitor/SKILL.md b/plugins/vibe/skills/codex-fleet-monitor/SKILL.md
new file mode 100644
index 00000000..c9807ea3
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/SKILL.md
@@ -0,0 +1,82 @@
+---
+name: codex-fleet-monitor
+description: 'Use PROACTIVELY whenever you start or are already running two or more Codex or vibe sessions, or are watching PRs on their behalf, and need to be told when anything needs attention. Replaces hand-rolled polling loops: a Codex turn that hits a usage limit stays "active" and silent, so a watcher that checks only for an open turn misses it. This reads each thread''s progress and flags IDLE, STALLED, FAILED(LIMIT), new PR comments or reviews, settled check changes, merge conflicts, and new PRs. It also prints a Codex usage line per machine (used-percent band, and whether a reached limit is spending paid credits) and, when configured, the delegated-work request files sessions drop for Claude workers.'
+---
+
+# codex-fleet-monitor
+
+One background command that polls every watched Codex thread and PR, and exits with a diff the moment any line changes. You read the diff, act, then re-arm it. It costs no model tokens while waiting.
+
+## Why liveness is read from the thread, not the turn id
+
+A Codex turn that hits a usage limit stays open and simply stops producing items. Checking only "is a turn active" reports it as running forever. This monitor reads each thread's last turn (status, error, item count) and flags a turn whose item count has not grown for `STALL_SECONDS` as `STALLED`.
+
+## Requirements
+
+- Each Codex session is identified by its thread id. `scripts/liveness.mjs` is self-contained (Node built-ins only): it starts the managed App Server with `codex app-server daemon start`, connects through `codex app-server proxy`, and calls `thread/read`. `scripts/ratelimit.mjs` reuses its client to call `account/rateLimits/read`. Nothing outside the vibe plugin and the `codex` CLI is needed.
+- `codex`, `node`, `jq`, `gh` (authenticated) on this machine; `codex` and `node` on the remote host, reachable through `REMOTE_SHELL`.
+
+## Set up a work dir
+
+Pick a scratch dir (one per orchestration) and create:
+
+`config.env`
+
+```sh
+LOCAL_STATE_DIR=/path/to/local/state/files   # only for two-column sessions
+REMOTE_HOST=user@host            # omit when there are no remote sessions
+REMOTE_STATE_DIR=/path/on/remote # remote scratch dir; also holds state files for two-column sessions
+REMOTE_SHELL="zsh -lic"          # login shell so node/codex are on PATH (default)
+STALL_SECONDS=720                # no new thread items for this long means STALLED (default 12m)
+WATCH_NEW_PR_REPOS="owner/repo"  # optional: list open PRs here to spot new ones
+PR_SEARCH="head:feature/"        # optional: search filter for that list
+BOT_LOGIN_REGEX="vercel|codex|github-actions|copilot|bot"  # authors not counted as human feedback
+# MY_GH_LOGIN=me                 # your own comments are not counted; defaults to `gh api user`
+REQUESTS_DIR=/path/to/requests   # optional: local dir where sessions drop delegated-work request files
+REMOTE_REQUESTS_DIR=/path/on/remote/requests  # optional: the same on REMOTE_HOST
+```
+
+`sessions.txt`: one line per Codex session, in either form:
+
+- `local|remote <label> <threadId>`: the thread id directly.
+- `local|remote <name>`: reads `<stateDir>/<name>.json`, which must contain a `threadId` field (`LOCAL_STATE_DIR` or `REMOTE_STATE_DIR`). Use this when another tool already writes per-session state files.
+
+The label is what appears in the output lines.
+
+`prs.txt`: one line per PR to watch, `owner/repo <number>`. Add a PR when it opens, remove it when it merges.
+
+## Run
+
+```sh
+scripts/watch.sh <workDir> [intervalSeconds]
+```
+
+Start it with `run_in_background`. You are notified when it exits. Read its output, handle every line, then start it again; it only watches while running. Editing `sessions.txt` or `prs.txt` takes effect on the next re-arm. `scripts/snapshot.sh <workDir>` prints the current state once.
+
+## Reading the output
+
+| Line | Meaning | Usual action |
+|---|---|---|
+| `session <where> <name> RUN` | turn in progress and producing items | none |
+| `session ... IDLE` | turn completed; the session is waiting for you | read its last message, give it the next turn |
+| `session ... STALLED(...)` | turn open but silent | check for a usage limit or a hung command; tell the user if it needs them |
+| `session ... FAILED(LIMIT)` | turn errored on usage or rate limit | tell the user right away; a reset or second account is theirs to do |
+| `session ... FAILED(ERROR)` / `STOPPED(...)` / `READFAIL` | turn errored, was interrupted, or the thread or state file is unreadable | inspect the thread; restart or resume |
+| `session remote <host> UNREACHABLE` | ssh failed | check the host |
+| `codex-usage <local\|remote> <band>% ok resets=<n>` | Codex account usage on that machine, used percent floored to 10; `resets` is the count of available limit resets | none; if the band rises fast, warn the user with the rate |
+| `codex-usage ... LIMIT` / `LIMIT-STOPPED` | usage limit reached; `LIMIT` means ordinary usage is still allowed, `LIMIT-STOPPED` means sessions cannot run | tell the user right away; a reset or second account is theirs to do |
+| `codex-usage ... LIMIT-SPENDING-CREDITS` | limit reached and turns are now consuming paid credits | tell the user at once and stop sending turns unless they approve paid credits |
+| `codex-usage ... unreadable READFAIL` | the App Server or remote host could not be read | check `codex` on that machine |
+| `requests <local\|remote> <count> <newest file>` / `requests ... UNREADABLE` | a session dropped (or you removed) a delegated-work request file | hand the new request to a Claude worker, then steer its result back to the session that asked |
+| `open-prs <repo> <numbers>` | open PR list changed | add the new PR to `prs.txt` and start its review |
+| `pr ... <state> <head> <reviewDecision> <mergeable> comments= reviews= inline= checks=` | any field changed | new head: re-review; count up: read the feedback; `CONFLICTING`: tell the owning session to merge the base branch; checks: act on failures. Check counts change only once settled; while any check is pending the last settled counts show with ` (running)` |
+
+Surface everything that needs a human to the user immediately: limits, paid-credit spending, stalls, failures, and new human review comments.
+
+## Notes
+
+- `mergeable` keeps its last known value while GitHub reports `UNKNOWN`, so it does not flap.
+- Each run compares against `<workDir>/last-snapshot.txt` from the previous run, so a change between a watcher exit and its re-arm is still reported. Delete the file to start from a fresh base.
+- Item history lives in `<workDir>/item-history.txt`; delete it to reset stall timers. Settled check counts live in `<workDir>/checks-*.txt`.
+- On the remote host both scripts are copied to `<REMOTE_STATE_DIR>/.fleet-monitor/` on every snapshot.
+- Don't run two copies on the same work dir.
diff --git a/plugins/vibe/skills/codex-fleet-monitor/agents/openai.yaml b/plugins/vibe/skills/codex-fleet-monitor/agents/openai.yaml
new file mode 100644
index 00000000..43678c69
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Codex Fleet Monitor"
+  short_description: "Get woken when a Codex session or PR needs attention"
+  default_prompt: "Use $codex-fleet-monitor to watch my Codex sessions and their pull requests."
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh b/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh
new file mode 100755
index 00000000..e6c7a13e
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/classify.sh
@@ -0,0 +1,16 @@
+#!/bin/zsh
+# stdin: "<where> <stateName> <turnStatus> <items> <flag>". $1: item history file. $2: stall seconds.
+# A running turn whose item count has not grown for $2 seconds is STALLED (a Codex usage limit
+# leaves the turn open and silent, so "turn is open" alone is not liveness).
+H=$1; STALL=${2:-720}; touch $H; now=$(date +%s)
+while read where n st items flag; do
+  prev=$(grep "^$where:$n " $H | awk '{print $2, $3}'); pi=${prev% *}; pt=${prev#* }
+  if [ -z "$prev" ] || [ "$pi" != "$items" ]; then pt=$now; fi
+  grep -v "^$where:$n " $H > $H.tmp; echo "$where:$n $items $pt" >> $H.tmp; mv $H.tmp $H
+  if [ "$flag" != "-" ]; then s="FAILED($flag)"
+  elif [ "$st" = inProgress ] && [ $((now - pt)) -ge $STALL ]; then s="STALLED(no progress $((STALL / 60))m+)"
+  elif [ "$st" = inProgress ]; then s=RUN
+  elif [ "$st" = completed ]; then s=IDLE
+  else s="STOPPED($st)"; fi
+  echo "session $where $n $s"
+done
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.mjs
new file mode 100644
index 00000000..09108e84
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.mjs
@@ -0,0 +1,258 @@
+// Usage: node liveness.mjs <stateDir> <session>...
+// A session is "<name>" (reads <stateDir>/<name>.json, which holds a threadId) or "<label>=<threadId>".
+// Prints "<label> <lastTurnStatus> <itemCount> <flag>"; flag is LIMIT, ERROR, READFAIL or -.
+// Self-contained: speaks the Codex App Server protocol to the managed daemon through
+// `codex app-server proxy`, so a single file is all a remote host needs.
+import { createHash, randomBytes } from 'node:crypto';
+import { execFileSync, spawn } from 'node:child_process';
+import { readFileSync, realpathSync } from 'node:fs';
+import { createConnection } from 'node:net';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+const REQUEST_TIMEOUT_MS = 30_000;
+const TOTAL_TIMEOUT_MS = 120_000;
+
+export function encodeFrame(payload, opcode = 0x1) {
+  const body = Buffer.from(payload);
+  const mask = randomBytes(4);
+  let header;
+  if (body.length < 126) header = Buffer.from([0x80 | opcode, 0x80 | body.length]);
+  else if (body.length <= 0xffff) {
+    header = Buffer.alloc(4);
+    header[0] = 0x80 | opcode;
+    header[1] = 0x80 | 126;
+    header.writeUInt16BE(body.length, 2);
+  } else {
+    header = Buffer.alloc(10);
+    header[0] = 0x80 | opcode;
+    header[1] = 0x80 | 127;
+    header.writeBigUInt64BE(BigInt(body.length), 2);
+  }
+  const masked = Buffer.from(body);
+  for (let i = 0; i < masked.length; i += 1) masked[i] ^= mask[i % 4];
+  return Buffer.concat([header, mask, masked]);
+}
+
+export function decodeFrames(buffer) {
+  const frames = [];
+  let offset = 0;
+  while (buffer.length - offset >= 2) {
+    const first = buffer[offset];
+    const second = buffer[offset + 1];
+    let length = second & 0x7f;
+    let headerLength = 2;
+    if (length === 126) {
+      if (buffer.length - offset < 4) break;
+      length = buffer.readUInt16BE(offset + 2);
+      headerLength = 4;
+    } else if (length === 127) {
+      if (buffer.length - offset < 10) break;
+      length = Number(buffer.readBigUInt64BE(offset + 2));
+      headerLength = 10;
+    }
+    const maskLength = second & 0x80 ? 4 : 0;
+    if (buffer.length - offset < headerLength + maskLength + length) break;
+    const start = offset + headerLength + maskLength;
+    const payload = Buffer.from(buffer.subarray(start, start + length));
+    if (maskLength) {
+      const mask = buffer.subarray(offset + headerLength, start);
+      for (let i = 0; i < payload.length; i += 1) payload[i] ^= mask[i % 4];
+    }
+    frames.push({ fin: Boolean(first & 0x80), opcode: first & 0x0f, payload });
+    offset = start + length;
+  }
+  return { frames, remainder: buffer.subarray(offset) };
+}
+
+/** JSON-RPC over a WebSocket carried on a duplex byte stream (reader/writer). */
+export class AppServerClient {
+  constructor(reader, writer, { onClose = () => {} } = {}) {
+    this.writer = writer;
+    this.buffer = Buffer.alloc(0);
+    this.open = false;
+    this.fragments = [];
+    this.pending = new Map();
+    this.nextId = 1;
+    this.key = randomBytes(16).toString('base64');
+    this.connected = new Promise((resolve, reject) => {
+      this.onOpen = resolve;
+      this.fail = (error) => {
+        reject(error);
+        for (const p of this.pending.values()) p.reject(error);
+        this.pending.clear();
+      };
+    });
+    this.connected.catch(() => {});
+    reader.on('data', (chunk) => this.receive(chunk));
+    reader.on('error', (error) => this.fail(error));
+    reader.on('close', () => { this.fail(new Error('App Server connection closed')); onClose(); });
+    writer.on('error', (error) => this.fail(error));
+    writer.write([
+      'GET /rpc HTTP/1.1', 'Host: localhost', 'Upgrade: websocket', 'Connection: Upgrade',
+      `Sec-WebSocket-Key: ${this.key}`, 'Sec-WebSocket-Version: 13', '', '',
+    ].join('\r\n'));
+  }
+
+  receive(chunk) {
+    this.buffer = Buffer.concat([this.buffer, chunk]);
+    if (!this.open) {
+      const boundary = this.buffer.indexOf('\r\n\r\n');
+      if (boundary < 0) return;
+      const head = this.buffer.subarray(0, boundary).toString('utf8');
+      this.buffer = this.buffer.subarray(boundary + 4);
+      const accept = createHash('sha1').update(this.key + WS_GUID).digest('base64');
+      if (!/^HTTP\/1\.1 101\b/.test(head) || !head.includes(accept)) {
+        this.fail(new Error(`WebSocket upgrade rejected: ${head.split('\r\n')[0] || 'empty response'}`));
+        return;
+      }
+      this.open = true;
+      this.onOpen();
+    }
+    const { frames, remainder } = decodeFrames(this.buffer);
+    this.buffer = remainder;
+    for (const frame of frames) this.handleFrame(frame);
+  }
+
+  handleFrame({ fin, opcode, payload }) {
+    if (opcode === 0x9) this.writer.write(encodeFrame(payload, 0xa));
+    else if (opcode === 0x8) this.fail(new Error('App Server closed the connection'));
+    else if (opcode === 0x1 || opcode === 0x0) {
+      this.fragments.push(payload);
+      if (!fin) return;
+      const text = Buffer.concat(this.fragments).toString('utf8');
+      this.fragments = [];
+      this.handleMessage(text);
+    }
+  }
+
+  handleMessage(text) {
+    let message;
+    try { message = JSON.parse(text); } catch { return; }
+    if (message.id !== undefined && ('result' in message || 'error' in message)) {
+      const pending = this.pending.get(String(message.id));
+      if (!pending) return;
+      this.pending.delete(String(message.id));
+      if (message.error) pending.reject(new Error(message.error.message || 'App Server request failed'));
+      else pending.resolve(message.result);
+    } else if (message.id !== undefined && message.method) {
+      this.send({ id: message.id, error: { code: -32603, message: 'Server requests are not supported' } });
+    }
+  }
+
+  send(message) { this.writer.write(encodeFrame(JSON.stringify(message))); }
+
+  async request(method, params, timeoutMs = REQUEST_TIMEOUT_MS) {
+    await this.connected;
+    const id = `fleet-${this.nextId++}`;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`${method} timed out`));
+      }, timeoutMs);
+      this.pending.set(id, {
+        resolve: (v) => { clearTimeout(timer); resolve(v); },
+        reject: (e) => { clearTimeout(timer); reject(e); },
+      });
+      this.send({ id, method, params });
+    });
+  }
+
+  async initialize() {
+    await this.request('initialize', {
+      clientInfo: { name: 'fleet-liveness', title: 'Fleet liveness', version: '1.0.0' },
+      capabilities: { experimentalApi: true, optOutNotificationMethods: ['item/agentMessage/delta'] },
+    });
+    this.send({ method: 'initialized', params: {} });
+  }
+
+  close() {
+    try { this.writer.write(encodeFrame(Buffer.alloc(0), 0x8)); } catch {}
+    this.writer.end?.();
+  }
+}
+
+/** Connect through `codex app-server proxy --sock <socket>`, which bridges stdio to the daemon. */
+export function connectViaProxy(socket, codex = 'codex') {
+  const child = spawn(codex, ['app-server', 'proxy', '--sock', socket], { stdio: ['pipe', 'pipe', 'ignore'] });
+  child.on('error', () => {});
+  const client = new AppServerClient(child.stdout, child.stdin);
+  const close = client.close.bind(client);
+  client.close = () => { close(); child.kill(); };
+  return client;
+}
+
+/** Connect straight to a Unix socket that already speaks WebSocket. */
+export function connectDirect(socket) {
+  const stream = createConnection(socket);
+  return new AppServerClient(stream, stream);
+}
+
+export function daemonSocket() {
+  const fallback = `${homedir()}/.codex/app-server-control/app-server-control.sock`;
+  try {
+    const started = execFileSync('codex', ['app-server', 'daemon', 'start'], { encoding: 'utf8', timeout: 30_000 });
+    return JSON.parse(started).socketPath ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+export function parseSession(spec, dir) {
+  const eq = spec.indexOf('=');
+  if (eq > 0) return { label: spec.slice(0, eq), threadId: spec.slice(eq + 1) };
+  return { label: spec, threadId: JSON.parse(readFileSync(`${dir}/${spec}.json`, 'utf8')).threadId };
+}
+
+export function summarize(label, thread) {
+  const turn = (thread?.turns ?? []).at(-1);
+  const err = JSON.stringify(turn?.error ?? '').toLowerCase();
+  let flag = '-';
+  if (/usage|limit|quota|rate/.test(err)) flag = 'LIMIT';
+  else if (turn?.error) flag = 'ERROR';
+  return `${label} ${turn?.status ?? 'none'} ${(turn?.items ?? []).length} ${flag}`;
+}
+
+export async function readSessions(client, dir, specs) {
+  const lines = [];
+  for (const spec of specs) {
+    let label = spec.split('=')[0];
+    try {
+      const session = parseSession(spec, dir);
+      label = session.label;
+      const { thread } = await client.request('thread/read', { threadId: session.threadId, includeTurns: true });
+      lines.push(summarize(label, thread));
+    } catch {
+      lines.push(`${label} unreadable 0 READFAIL`);
+    }
+  }
+  return lines;
+}
+
+async function main() {
+  exitAfterTotalTimeout();
+  const [dir, ...specs] = process.argv.slice(2);
+  const client = connectViaProxy(daemonSocket());
+  try {
+    await client.initialize();
+  } catch {
+    for (const spec of specs) console.log(`${spec.split('=')[0]} unreadable 0 READFAIL`);
+    process.exit(0);
+  }
+  for (const line of await readSessions(client, dir, specs)) console.log(line);
+  client.close();
+  process.exit(0);
+}
+
+if (isEntryPoint(import.meta.url)) await main();
+
+/** Bounds the whole run from inside node; macOS has no `timeout` or `gtimeout` command. */
+export function exitAfterTotalTimeout() {
+  setTimeout(() => process.exit(1), TOTAL_TIMEOUT_MS).unref();
+}
+
+/** Compare real paths: a symlinked directory (macOS /tmp) makes argv[1] differ from the module url. */
+export function isEntryPoint(moduleUrl) {
+  return Boolean(process.argv[1]) && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(moduleUrl));
+}
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs
new file mode 100644
index 00000000..4944b993
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/liveness.test.mjs
@@ -0,0 +1,107 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import { connectDirect, decodeFrames, encodeFrame, parseSession, readSessions, summarize } from './liveness.mjs';
+
+const GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+
+function serverFrame(text, opcode = 0x1) {
+  const body = Buffer.from(text);
+  const header = body.length < 126
+    ? Buffer.from([0x80 | opcode, body.length])
+    : Buffer.from([0x80 | opcode, 126, body.length >> 8, body.length & 0xff]);
+  return Buffer.concat([header, body]);
+}
+
+/** Fake App Server: WebSocket upgrade, then JSON-RPC answers from `threads`. */
+function fakeServer(threads) {
+  const calls = [];
+  const server = createServer((socket) => {
+    let buffer = Buffer.alloc(0);
+    let upgraded = false;
+    socket.on('data', (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (!upgraded) {
+        const end = buffer.indexOf('\r\n\r\n');
+        if (end < 0) return;
+        const key = /Sec-WebSocket-Key: (.+)\r\n/.exec(buffer.subarray(0, end).toString())[1];
+        buffer = buffer.subarray(end + 4);
+        upgraded = true;
+        const accept = createHash('sha1').update(key + GUID).digest('base64');
+        socket.write(`HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: ${accept}\r\n\r\n`);
+      }
+      const { frames, remainder } = decodeFrames(buffer);
+      buffer = remainder;
+      for (const frame of frames) {
+        if (frame.opcode !== 0x1) continue;
+        const message = JSON.parse(frame.payload.toString());
+        calls.push(message);
+        if (message.id === undefined) continue;
+        if (message.method === 'initialize') socket.write(serverFrame(JSON.stringify({ id: message.id, result: {} })));
+        else if (message.method === 'thread/read') {
+          const thread = threads[message.params.threadId];
+          const reply = thread
+            ? { id: message.id, result: { thread } }
+            : { id: message.id, error: { code: -32600, message: 'no such thread' } };
+          socket.write(serverFrame(JSON.stringify(reply)));
+        }
+      }
+    });
+  });
+  return { server, calls };
+}
+
+test('frames round trip through the masked encoder', () => {
+  const payload = 'x'.repeat(300);
+  const { frames, remainder } = decodeFrames(encodeFrame(payload));
+  assert.equal(frames.length, 1);
+  assert.equal(frames[0].payload.toString(), payload);
+  assert.equal(remainder.length, 0);
+});
+
+test('summarize classifies limit, error and running turns', () => {
+  const turn = (extra) => ({ turns: [{ status: 'failed', items: [1, 2], ...extra }] });
+  assert.equal(summarize('a', turn({ error: { message: 'You hit your usage limit' } })), 'a failed 2 LIMIT');
+  assert.equal(summarize('a', turn({ error: { message: 'boom' } })), 'a failed 2 ERROR');
+  assert.equal(summarize('a', turn({})), 'a failed 2 -');
+  assert.equal(summarize('a', { turns: [] }), 'a none 0 -');
+});
+
+test('parseSession accepts label=threadId and a state file name', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'fleet-'));
+  writeFileSync(join(dir, 'w1.json'), JSON.stringify({ threadId: 'T-file' }));
+  assert.deepEqual(parseSession('lbl=T-direct', dir), { label: 'lbl', threadId: 'T-direct' });
+  assert.deepEqual(parseSession('w1', dir), { label: 'w1', threadId: 'T-file' });
+});
+
+test('reads threads over a fake server and reports READFAIL for failures', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'fleet-'));
+  writeFileSync(join(dir, 'w1.json'), JSON.stringify({ threadId: 'T1' }));
+  const { server, calls } = fakeServer({
+    T1: { turns: [{ status: 'inProgress', items: [1, 2, 3] }] },
+    T2: { turns: [{ status: 'failed', items: [1], error: { message: 'rate limit reached' } }] },
+  });
+  const sock = join(dir, 's.sock');
+  await new Promise((resolve) => server.listen(sock, resolve));
+  const client = connectDirect(sock);
+  try {
+    await client.initialize();
+    const lines = await readSessions(client, dir, ['w1', 'two=T2', 'gone=T9', 'nofile']);
+    assert.deepEqual(lines, [
+      'w1 inProgress 3 -',
+      'two failed 1 LIMIT',
+      'gone unreadable 0 READFAIL',
+      'nofile unreadable 0 READFAIL',
+    ]);
+    const read = calls.find((c) => c.method === 'thread/read');
+    assert.deepEqual(read.params, { threadId: 'T1', includeTurns: true });
+    assert.ok(calls.some((c) => c.method === 'initialized'));
+  } finally {
+    client.close();
+    server.close();
+  }
+});
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/ratelimit.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/ratelimit.mjs
new file mode 100644
index 00000000..6f451306
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/ratelimit.mjs
@@ -0,0 +1,43 @@
+// Usage: node ratelimit.mjs <label>
+// Prints "codex-usage <label> <band>% <state> resets=<n>" from account/rateLimits/read, or
+// "codex-usage <label> unreadable READFAIL". Band is the used percent floored to 10.
+// Needs liveness.mjs beside it; snapshot.sh ships both files to the remote host.
+import { connectViaProxy, daemonSocket, exitAfterTotalTimeout, isEntryPoint } from './liveness.mjs';
+
+export function usageState(response) {
+  const limits = response?.rateLimits;
+  if (!limits?.rateLimitReachedType) return 'ok';
+  if (response.ordinaryUsageAllowed) return 'LIMIT';
+  return limits.credits?.hasCredits ? 'LIMIT-SPENDING-CREDITS' : 'LIMIT-STOPPED';
+}
+
+export function usageLine(label, response) {
+  const used = response?.rateLimits?.primary?.usedPercent;
+  const band = Number.isFinite(used) ? `${Math.floor(used / 10) * 10}%` : '?%';
+  const resets = response?.rateLimitResetCredits?.availableCount ?? 0;
+  return `codex-usage ${label} ${band} ${usageState(response)} resets=${resets}`;
+}
+
+export async function readUsage(client, label) {
+  try {
+    return usageLine(label, await client.request('account/rateLimits/read', {}));
+  } catch {
+    return `codex-usage ${label} unreadable READFAIL`;
+  }
+}
+
+async function main() {
+  exitAfterTotalTimeout();
+  const label = process.argv[2] ?? 'local';
+  const client = connectViaProxy(daemonSocket());
+  try {
+    await client.initialize();
+    console.log(await readUsage(client, label));
+  } catch {
+    console.log(`codex-usage ${label} unreadable READFAIL`);
+  }
+  client.close();
+  process.exit(0);
+}
+
+if (isEntryPoint(import.meta.url)) await main();
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/ratelimit.test.mjs b/plugins/vibe/skills/codex-fleet-monitor/scripts/ratelimit.test.mjs
new file mode 100644
index 00000000..24e2d7c1
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/ratelimit.test.mjs
@@ -0,0 +1,40 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readUsage, usageLine, usageState } from './ratelimit.mjs';
+
+const reached = (extra = {}, credits = { hasCredits: false }) => ({
+  rateLimits: { primary: { usedPercent: 100 }, rateLimitReachedType: 'primary', credits },
+  ...extra,
+});
+
+test('usageState maps a reached limit by ordinary usage and paid credits', () => {
+  assert.equal(usageState({ rateLimits: { primary: { usedPercent: 40 }, rateLimitReachedType: null } }), 'ok');
+  assert.equal(usageState(reached({ ordinaryUsageAllowed: true }, { hasCredits: true })), 'LIMIT');
+  assert.equal(usageState(reached({ ordinaryUsageAllowed: false }, { hasCredits: true })), 'LIMIT-SPENDING-CREDITS');
+  assert.equal(usageState(reached({ ordinaryUsageAllowed: null }, { hasCredits: true })), 'LIMIT-SPENDING-CREDITS');
+  assert.equal(usageState(reached({ ordinaryUsageAllowed: false }, { hasCredits: false })), 'LIMIT-STOPPED');
+  assert.equal(usageState(reached({ ordinaryUsageAllowed: false }, null)), 'LIMIT-STOPPED');
+});
+
+test('usageLine floors the used percent to a band of 10 and reports resets', () => {
+  const ok = (usedPercent, extra = {}) => ({ rateLimits: { primary: { usedPercent } }, ...extra });
+  assert.equal(usageLine('local', ok(0)), 'codex-usage local 0% ok resets=0');
+  assert.equal(usageLine('local', ok(59.9)), 'codex-usage local 50% ok resets=0');
+  assert.equal(usageLine('remote', ok(60, { rateLimitResetCredits: { availableCount: 2 } })), 'codex-usage remote 60% ok resets=2');
+  assert.equal(usageLine('local', reached({ ordinaryUsageAllowed: false }, { hasCredits: true })), 'codex-usage local 100% LIMIT-SPENDING-CREDITS resets=0');
+  assert.equal(usageLine('local', { rateLimits: {} }), 'codex-usage local ?% ok resets=0');
+});
+
+test('readUsage calls account/rateLimits/read and reports READFAIL when it fails', async () => {
+  const calls = [];
+  const client = (result) => ({
+    request: async (method, params) => {
+      calls.push({ method, params });
+      if (result instanceof Error) throw result;
+      return result;
+    },
+  });
+  assert.equal(await readUsage(client({ rateLimits: { primary: { usedPercent: 73 } } }), 'local'), 'codex-usage local 70% ok resets=0');
+  assert.deepEqual(calls[0], { method: 'account/rateLimits/read', params: {} });
+  assert.equal(await readUsage(client(new Error('timed out')), 'remote'), 'codex-usage remote unreadable READFAIL');
+});
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh b/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh
new file mode 100755
index 00000000..bd25c310
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/snapshot.sh
@@ -0,0 +1,55 @@
+#!/bin/zsh
+# Usage: snapshot.sh <workDir>. One line per watched item; any changed line is an event.
+K=${0:A:h}; W=${1:?workDir}; [ -f $W/config.env ] && source $W/config.env
+: ${STALL_SECONDS:=720} ${BOT_LOGIN_REGEX:=vercel|codex|github-actions|copilot|bot} ${REMOTE_SHELL:=zsh -lic}
+: > $W/live.txt
+# Ships both scripts (ratelimit.mjs imports liveness.mjs) to REMOTE_HOST and runs one there.
+remote_node() {
+  local d=$REMOTE_STATE_DIR/.fleet-monitor
+  COPYFILE_DISABLE=1 tar -C $K -cf - liveness.mjs ratelimit.mjs 2>/dev/null | ssh -o ConnectTimeout=10 -o ServerAliveInterval=15 \
+    ${REMOTE_HOST:?set REMOTE_HOST} "mkdir -p $d && tar -C $d -xf - && $REMOTE_SHELL 'node $d/$*'" 2>/dev/null
+}
+# "requests <where> <count> <newest file>" from a newest-first listing command.
+requests() {
+  local where=$1 out; shift
+  if out=$("$@" 2>/dev/null); then printf '%s' "$out" | awk -v w=$where 'NR==1{f=$0} END{print "requests", w, NR, (NR ? f : "-")}'
+  else echo "requests $where UNREADABLE"; fi
+}
+# "<where> <name>" reads <stateDir>/<name>.json; "<where> <label> <threadId>" names the thread directly.
+L=$(awk '$1=="local"{print (NF>=3 ? $2"="$3 : $2)}' $W/sessions.txt 2>/dev/null | tr '\n' ' ')
+if [ -n "${L// }" ]; then
+  node $K/liveness.mjs ${LOCAL_STATE_DIR:?set LOCAL_STATE_DIR} ${=L} | sed 's/^/local /' >> $W/live.txt
+fi
+R=$(awk '$1=="remote"{print (NF>=3 ? $2"="$3 : $2)}' $W/sessions.txt 2>/dev/null | tr '\n' ' ')
+if [ -n "${R// }" ]; then
+  out=$(remote_node liveness.mjs $REMOTE_STATE_DIR $R)
+  if [ -n "$out" ]; then echo "$out" | sed 's/^/remote /' >> $W/live.txt
+  else echo "session remote $REMOTE_HOST UNREACHABLE"; fi
+fi
+node $K/ratelimit.mjs local 2>/dev/null
+if [ -n "${REMOTE_HOST:-}" ]; then out=$(remote_node ratelimit.mjs remote); echo "${out:-codex-usage remote unreadable READFAIL}"; fi
+if [ -n "${REQUESTS_DIR:-}" ]; then requests local ls -t $REQUESTS_DIR; fi
+if [ -n "${REMOTE_REQUESTS_DIR:-}" ]; then requests remote ssh -o ConnectTimeout=10 ${REMOTE_HOST:?set REMOTE_HOST} "ls -t $REMOTE_REQUESTS_DIR"; fi
+zsh $K/classify.sh $W/item-history.txt $STALL_SECONDS < $W/live.txt
+for r in ${=WATCH_NEW_PR_REPOS}; do
+  echo "open-prs $r $(gh pr list -R $r --state open --search "${PR_SEARCH:-}" --json number --jq '.[].number' 2>/dev/null | sort -n | tr '\n' ' ')"
+done
+[ -s $W/prs.txt ] || exit 0
+ME=${MY_GH_LOGIN:-$(gh api user --jq .login 2>/dev/null)}
+skip="(.user.login==\"$ME\" or (.user.login|test(\"$BOT_LOGIN_REGEX\";\"i\")))"
+while read r n; do
+  [ -z "$n" ] && continue
+  st=$(gh pr view $n -R $r --json state,headRefOid,reviewDecision,mergeable --jq '"\(.state) \(.headRefOid[0:8]) \(.reviewDecision) \(.mergeable)"' 2>/dev/null)
+  m=${st##* }; k=$W/merge-${r//\//_}-$n.txt
+  # GitHub reports UNKNOWN while it recomputes; keep the last known value so it does not flap.
+  if [ "$m" = UNKNOWN ] && [ -f $k ]; then m=$(cat $k); else echo $m > $k; fi
+  st="${st% *} $m"
+  c=$(gh api "repos/$r/issues/$n/comments" --jq "[.[]|select($skip|not)]|length" 2>/dev/null)
+  v=$(gh api "repos/$r/pulls/$n/reviews" --jq "[.[]|select($skip|not)]|length" 2>/dev/null)
+  i=$(gh api "repos/$r/pulls/$n/comments" --jq "[.[]|select($skip|not)]|length" 2>/dev/null)
+  ck=$(gh pr checks $n -R $r 2>/dev/null | awk -F'\t' '{print $2}' | sort | uniq -c | tr -s ' ' | tr '\n' ',')
+  # Report only settled results: while gh lists no checks or any is pending, repeat the last settled value.
+  kc=$W/checks-${r//\//_}-$n.txt
+  if [ -z "$ck" ] || [[ "$ck" == *pending* ]]; then ck="$(cat $kc 2>/dev/null) (running)"; else echo "$ck" > $kc; fi
+  echo "pr $r#$n $st comments=$c reviews=$v inline=$i checks=$ck"
+done < $W/prs.txt
diff --git a/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh b/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh
new file mode 100755
index 00000000..81d68385
--- /dev/null
+++ b/plugins/vibe/skills/codex-fleet-monitor/scripts/watch.sh
@@ -0,0 +1,13 @@
+#!/bin/zsh
+# Usage: watch.sh <workDir> [intervalSeconds]. Exits with the diff on the first change.
+K=${0:A:h}; W=${1:?workDir}; I=${2:-120}
+# Compare against the last snapshot the previous run saw, so a change between runs is still reported.
+if [ -s $W/last-snapshot.txt ]; then base=$(cat $W/last-snapshot.txt); else base=$(zsh $K/snapshot.sh $W); echo "$base" > $W/last-snapshot.txt; fi
+for _ in $(seq 1 200); do
+  sleep $I
+  now=$(zsh $K/snapshot.sh $W)
+  if [ -n "$now" ] && [ "$now" != "$base" ]; then
+    echo "$now" > $W/last-snapshot.txt; echo EVENT; diff <(echo "$base") <(echo "$now") | grep '^[<>]'; exit 0
+  fi
+done
+echo TIMEOUT; cat $W/last-snapshot.txt