a3d5841117
* test(#3714): failing-first coverage for the dropped Codex worktree model override Pins the argv contract for the orchestrator-worktree process dispatch: an explicit model_overrides pin must reach the child as --model, while an unpinned, empty, inherit, or profile-only configuration must emit no flag at all. Five of the eight matrix rows are CONTROLS that pass before the fix. They carry the weight here because this is an over-emission bug waiting to happen: resolve-model returns 'sonnet' for the unpinned, empty and profile-only cases, so a fix that threads its return value into argv would satisfy the positive row and emit --model sonnet to Codex on every unpinned install -- the documented 400 that ADR-2313 exists to prevent. The controls are what separate the correct fix from the obvious one. * fix(#3714): deliver an explicitly pinned model to the Codex worktree executor resolveOrchestratorExec had no model input at all -- the descriptor carried only command/args/cwdFlag/promptFlag -- so a resolved override had no way to reach the spawned process even in principle. The baked gsd-executor.toml could not compensate because this path spawns a process rather than dispatching a named agent. Three parts, and the third is the load-bearing one. The descriptor gains modelFlag (codex: --model), keeping the per-host knowledge as descriptor data exactly as cwdFlag and promptFlag already are, so the scheduler grows no per-host branch. No other runtime declares it. The seam appends [modelFlag, model] and stays MECHANICAL: it does not know the inherit sentinel, does not know which models Codex rejects, and reads no config. Its sibling codex-agent-toml states that rule outright -- callers decide what to strip. Argv order is baseArgs, model, cwd, prompt so the prompt remains the final positional token. Omitting the model is byte-identical to before. A model starting with '-' now fails closed as unsafe_leading_dash_model, the same hazard the prompt and cwd guards already reject and which was silently accepted before. The policy lives at the caller and passes ONLY an explicit, non-sentinel per-agent pin. Passing null as the runtime resolver is what keeps profile and tier derived models out of argv, which is what Codex's session-only model posture requires: the model resolver returns 'sonnet' for the unpinned, empty and profile-only cases, and emitting that revives the documented 400 from #2310/#2311 that ADR-2313 removed. So the gate is the presence of an explicit pin, never that a value came back. * fix(#3714): enforce the real-Codex value policy the sibling surface already applies Review found one root cause behind a BLOCKER, two MAJORs, two MINORs and an argv-injection finding: the dispatch path gated on the PRESENCE of an explicit pin but never applied the VALUE policy that generateCodexAgentToml already applies to the same config key. Textbook generative divergence -- and the parity row I wrote tested resolver parity, not this policy, so it could never have caught it. BLOCKER: a global ~/.gsd/defaults.json model_overrides.gsd-executor of 'sonnet', 'opus' or 'claude-sonnet-4-5' reached codex exec --model verbatim. That is the documented 400 from #2310/#2311, arriving through the explicit-pin door rather than the tier door. The issue asks for an explicit REAL-CODEX pin; real-Codex was unenforced. Now dropped with a warning via the isAnthropicFlavoredModel predicate #3241 single-sourced for exactly this reason. Also: values are trimmed, so a whitespace-only pin is blank rather than --model " "; 'inherit' is matched case- and whitespace-insensitively, so 'Inherit' and ' inherit ' no longer reach the wire; and a value outside a model-id charset is dropped with a warning. That last one closes the injection surface -- .planning/config.json travels with a clone, and values like 'gpt-5 -c approval_policy=never' or a command-substitution value previously reached argv verbatim, where the spawner is an agent writing bash. Every rejection DROPS AND WARNS rather than failing closed. An unusable exec is not degraded, it is fatal: the dispatch step halts the wave after the worktree already exists, so a config typo would have aborted execute-phase. The stale comment claiming it degrades to sequential is corrected. Separately, the seam's own empty-model handling contradicted the committed contract and failed four tests on the remote runner. An absent, null or empty model is not an error -- it means use the host default, the same degradation cwdFlag:null already expresses. Unlike a prompt, where empty is a hang rather than a degraded run, so that one stays fail-closed. Non-string values still fail closed. Tests: the CLI rows were not HOME-hermetic and read the developer's real ~/.gsd/defaults.json, which is precisely the file the BLOCKER is about; HOME and USERPROFILE are now sandboxed per call. Adds the global-pin regression, the injection shapes, the case-variant inherit rows, and a real cross-surface divergence guard. * fix(#3714): close the flag-shaped pin, the case-variant alias, and the warning sink Round two of review found three more defects, two of which both engines reached independently, and all three were mine. The charset allowlist put the dash INSIDE the character class, so a value made only of allowed characters passed the pin policy silently and then tripped the seam's leading-dash guard, producing exec:null. That is the wave-fatal path the whole drop-and-warn design exists to avoid, reachable from a committed config file: -c, --config, -p and --dangerously-skip-permissions all reproduced it. It also regressed hosts with no model flag at all, where a dash pin turned a previously working kimi-code dispatch into exec:null. The first character is now anchored, so a flag-shaped value is dropped and warned like every other rejection, and the comment that claimed this path was unreachable is corrected. isAnthropicFlavoredModel folded case on its substring arm but not on its alias-set arm, so SONNET, Sonnet, OPUS and HAIKU all reached Codex argv while lowercase sonnet was correctly dropped -- the same 400 the drop exists to prevent. The predicate is the one #3241 single-sourced so these surfaces cannot diverge, so folding case there fixes the install-side .toml surface too. The warning wrote the rejected value RAW to stderr. Every value that fails the charset test contains by definition the characters the charset excludes, so it was a guaranteed-reachable raw-to-terminal sink: an OSC sequence in a committed config reached the operator's terminal byte for byte, and truncation could sever an escape before its reset. The value is now sanitized before truncation. Also from review: the allowlist rejected Vertex version pins like text-bison@002, a false positive on a real model id; the policy ran host-neutrally so hosts with no model flag printed a misleading drop warning on every dispatch; the invalid_model branch had no test at all; and the changeset disclosed only that a pin is delivered, not that an unusable one is now dropped with a warning. * fix(#3714): single-source the model-id charset, bound the pin, keep the flag diagnosis Round three found no blocking findings on either engine. These are the three correctness items left in code I added. The charset existed TWICE -- once to accept a pin, once to render a rejected one in the warning -- and the two copies had already drifted inside a single commit: '@' was added to the accept class and not the render class, so a Vertex-shaped value rejected for some other reason rendered as text-bison?002. Both are now derived from one definition, with a parity test asserting every character the matcher accepts survives the sanitizer unchanged, so they cannot drift again. A pin reached argv unbounded. CLAUDE.md documents the hazard: execFileSync aborts on Windows above 32,767 characters of argv. A model id has no reason to be long, so a pin over 200 characters is dropped and warned rather than truncated -- a truncated model id is a different model id. Boundary rows at 199, 200 and 201. The first character is now required to be alphanumeric, so '@evil' and '/c' no longer reach argv. Security rates both inert on codex today, so this is hardening rather than a live defect; it is here because it is one character of regex and resolveOrchestratorExec documents itself as a general descriptor-to-argv seam that other hosts may adopt. Tightening the anchor made the leading-dash branch unreachable and, with it, regressed the diagnosis: '-c' began reporting 'unsafe characters' instead of 'looks like a flag/option'. The dash check now runs before the charset test, which both restores the actionable message for the most likely user typo and keeps the branch live. A test pins the distinction between the three rejection messages so the branch cannot silently die again. * test(#3714): make the charset parity guard actually guard, and remove a false-green trap Review proved by mutation that my parity test could not do what its own comment claimed. It bound the expected character set to a local that was assigned and discarded, and the shared definition was not exported, so widening that definition left the test green. A comment overstating what a test guards is worse than no comment, because the next reader trusts it. The shared body is now exported and asserted equal, and I watched the assertion fail against a widened definition before keeping it. The sanitizer regex was module-scope, carried the g flag and was exported. Production only uses it with replace, which resets lastIndex, so there was no live bug -- but test() on a g-flagged regex alternates between calls, so any future test reaching for it would false-green. The g-flagged copy is now internal to the one call site that needs it and the exported companion carries no flags, which removes the footgun rather than documenting it. Also notes at the shared definition that it is interpolated into both a positive and a negated character class, so only plain characters and ranges are safe to add. No runtime behavior changes: the accept set, the anchor, the length cap, the sanitizer output, the rejection ordering and all three message texts are byte-identical, re-verified through the real CLI. * chore(#3714): backfill changeset pr number * chore(#3714): re-trigger CI after the GitHub Actions outage The workflow runs for this branch were created during the Actions major outage on 2026-08-26 and never got scheduled. They are wedged: GitHub reports them queued, refuses to cancel them, and refuses to rerun them because it believes the workflow is already running. The Tests run is also pinned to a superseded sha, so no test run exists for the current head at all. Actions is operational again and the repo-wide queue has drained, so a fresh push is what creates schedulable runs. This commit is empty on purpose: nothing about the change is being altered, and the verified content is byte-identical to 7860c6ccc. --------- Co-authored-by: sim <sim@local>
163 lines
4.1 KiB
JSON
163 lines
4.1 KiB
JSON
{
|
|
"id": "codex",
|
|
"role": "runtime",
|
|
"version": "1.11.0",
|
|
"title": "OpenAI Codex CLI",
|
|
"description": "OpenAI Codex CLI — shell-var command style; per-agent sandbox tiers; config.toml + hooks.json hook surface; tier-1 support.",
|
|
"tier": "core",
|
|
"requires": [],
|
|
"engines": {
|
|
"gsd": ">=1.6.0"
|
|
},
|
|
"runtime": {
|
|
"configHome": {
|
|
"kind": "dot-home",
|
|
"name": ".codex",
|
|
"env": [
|
|
"CODEX_HOME"
|
|
]
|
|
},
|
|
"localConfigDir": ".codex",
|
|
"configFormat": "toml",
|
|
"artifactLayout": {
|
|
"global": [
|
|
{
|
|
"kind": "skills",
|
|
"destSubpath": "skills",
|
|
"prefix": "gsd-",
|
|
"nesting": "flat",
|
|
"recursive": false,
|
|
"converter": "convertClaudeCommandToCodexSkill",
|
|
"home": ".agents"
|
|
},
|
|
{
|
|
"kind": "agents",
|
|
"destSubpath": "agents",
|
|
"prefix": "gsd-",
|
|
"nesting": "flat",
|
|
"recursive": false,
|
|
"converter": "convertClaudeAgentToCodexAgent"
|
|
}
|
|
],
|
|
"local": [
|
|
{
|
|
"kind": "skills",
|
|
"destSubpath": "skills",
|
|
"prefix": "gsd-",
|
|
"nesting": "flat",
|
|
"recursive": false,
|
|
"converter": "convertClaudeCommandToCodexSkill"
|
|
},
|
|
{
|
|
"kind": "agents",
|
|
"destSubpath": "agents",
|
|
"prefix": "gsd-",
|
|
"nesting": "flat",
|
|
"recursive": false,
|
|
"converter": "convertClaudeAgentToCodexAgent"
|
|
}
|
|
]
|
|
},
|
|
"triggerPrecedence": [
|
|
"skills",
|
|
"commands"
|
|
],
|
|
"commandStyle": "shell-var",
|
|
"hooksSurface": "codex-hooks-json",
|
|
"hookEvents": "claude",
|
|
"sandboxTier": "codex-agent-sandbox",
|
|
"supportTier": 1,
|
|
"installSurface": "codex-toml",
|
|
"writesSharedSettings": false,
|
|
"permissionWriter": null,
|
|
"extendedHookEvents": [
|
|
"SubagentStop",
|
|
"Stop",
|
|
"PreCompact"
|
|
],
|
|
"hostIntegration": {
|
|
"embeddingMode": "declarative",
|
|
"commandSurface": "slash-file",
|
|
"dispatch": {
|
|
"namedDispatch": true,
|
|
"nested": true,
|
|
"maxDepth": 1,
|
|
"background": true,
|
|
"subagentToolkit": "full",
|
|
"backgroundDispatch": true,
|
|
"isolation": "orchestrator-worktree"
|
|
},
|
|
"modelMode": "passive",
|
|
"hookBus": "host",
|
|
"stateIO": "filesystem",
|
|
"transport": "mcp",
|
|
"runtime": "node",
|
|
"effortSurface": "argv"
|
|
},
|
|
"orchestratorExec": {
|
|
"command": "codex",
|
|
"args": [
|
|
"exec"
|
|
],
|
|
"cwdFlag": "--cd",
|
|
"promptFlag": null,
|
|
"modelFlag": "--model"
|
|
},
|
|
"hostBehaviors": {
|
|
"reapplyCommand": "$gsd-update --reapply",
|
|
"tomlConfigInstall": true,
|
|
"cleanupSkillSidecars": true,
|
|
"agentTomlFiles": true,
|
|
"frontmatterDialect": "codex"
|
|
}
|
|
},
|
|
"reviewer": {
|
|
"slug": "codex",
|
|
"flags": [
|
|
"--codex"
|
|
],
|
|
"transport": "spawn",
|
|
"probe": {
|
|
"kind": "command-exists",
|
|
"binary": "codex"
|
|
},
|
|
"invoke": {
|
|
"binary": "codex",
|
|
"args": [
|
|
"exec",
|
|
"--ephemeral",
|
|
"{{model}}",
|
|
"{{effort}}",
|
|
"--skip-git-repo-check",
|
|
"{{output}}",
|
|
"-"
|
|
],
|
|
"promptChannel": "stdin",
|
|
"outputChannel": "file-arg",
|
|
"outputArg": "-o",
|
|
"modelArg": "--model",
|
|
"effortChannel": "argv"
|
|
},
|
|
"timeoutFloorMs": 1200000,
|
|
"emptyOutput": "stub-with-stderr",
|
|
"reviewsSection": "Codex",
|
|
"evidenceClass": "source-grounded",
|
|
"requiresBinaries": [],
|
|
"promptBudgetKey": "review.max_prompt_tokens_per_reviewer.codex",
|
|
"modelConfigKey": "review.models.codex",
|
|
"handler": null
|
|
},
|
|
"config": {
|
|
"review.models.codex": {
|
|
"type": "string",
|
|
"default": "",
|
|
"description": "Model passed to the Codex reviewer lane."
|
|
},
|
|
"review.max_prompt_tokens_per_reviewer.codex": {
|
|
"type": "number",
|
|
"default": -1,
|
|
"description": "Prompt-token budget for the Codex reviewer lane. Unset is -1, a sentinel: 0 is a legitimate value meaning \"do not trim this lane\", so it cannot double as \"not configured\"."
|
|
}
|
|
}
|
|
}
|