@aitne/daemon 0.1.7 → 0.1.8

package/dist/core/backends/codex-core.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isPlausibleOpenAiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
+import { INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isMessageEvent, isPlausibleOpenAiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
 import { getContextDir } from "../../config.js";
 import { cleanupSessionWorkdir, createSessionWorkdir } from "../workdir.js";
 import { BackendDecisiveFailure, BackendQuotaError, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
@@ -12,8 +12,11 @@ import { materializeMcpForSession } from "../../services/mcp/session-materialize
 import { parseMcpToolName } from "../../services/mcp/risk.js";
 import { logMcpToolCall } from "../../services/mcp/tool-audit.js";
 import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
+import { noteNativeSkillToolIfPresent, probeCliNativeSkillSubcommand, } from "./native-skill-discovery-probe.js";
 import { createOutputCapturePath, CliPathCache, parseJsonLine, readFileIfExists, removeFileIfExists, runLineCommand, } from "./cli-utils.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
+import { extractGenericQuotaResetHint } from "./quota-reset-hints.js";
+import { auditStreamObservation, extractCodexShellCall, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
 import { estimateTextInputTokens, findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
 import { PriceFetcher } from "./price-fetcher.js";
@@ -26,6 +29,23 @@ const EMPTY_USAGE = {
     cacheCreationInputTokens: 0,
     cacheReadInputTokens: 0,
 };
+/**
+ * Per-event stream-idle threshold for reactive `runTurn` execution
+ * (DMs, routines, scheduled tasks). Distinct from the delegated-path
+ * `DELEGATED_PROXY_DEFAULTS.idleTimeoutMsByBackend.codex` (60s) because
+ * reactive turns can include longer silences during legitimate work —
+ * extended thinking, MCP cold-starts, server-side tools (`web_search`,
+ * file reads). The threshold catches a fully hung CLI subprocess (zero
+ * stream events) well before `executeTimeoutMinutes` (default 30 min)
+ * fires; healthy turns rarely go 5 min silent end-to-end.
+ *
+ * Audit 2026-05-17: the delegated path already had this guard (see the
+ * `runDelegatedTool` wiring lower in this file); the reactive path was
+ * unprotected and a single hung subprocess could pin a session for the
+ * full 30-min wall-clock, blocking morning-routine / hourly-check
+ * dispatch downstream.
+ */
+const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
 // Probe prompt is derived from `INTEGRATION_DESCRIPTORS.backendConnectors.codex`
 // so adding a new delegated integration (Slack, GitHub, …) requires only the
 // registry update. The line-based filter below (`l.startsWith("mcp__")`) is
@@ -87,6 +107,10 @@ export class CodexCore {
     backendId = "codex";
     // Lazily re-resolved with a 60 s TTL — see ClaudeCodeCore for rationale (§9.4).
     cliPathCache;
+    /** Legacy shared read token injected into the Codex subprocess env. */
+    readToken;
+    /** Scoped token manager preferred over the legacy shared read token. */
+    readTokenManager;
     get cliPath() {
         return this.cliPathCache.get();
     }
@@ -95,6 +119,20 @@ export class CodexCore {
         this.priceFetcher = priceFetcher;
         this.cliPathCache = new CliPathCache("codex");
     }
+    /** Set the per-daemon-boot read token for subprocess-local daemon API auth. */
+    setReadToken(token) {
+        this.readToken = token;
+    }
+    setReadTokenManager(manager) {
+        this.readTokenManager = manager;
+    }
+    /** Resolve the env-injected read token: per-scope token if a manager is wired,
+     *  otherwise the legacy shared token. Returns `undefined` when neither is set
+     *  (production wires both at startup via index.ts; tests typically wire neither).
+     */
+    issueReadToken(scope) {
+        return this.readTokenManager?.issue(scope) ?? this.readToken;
+    }
     mcpContext;
     setMcpContext(context) {
         this.mcpContext = context;
@@ -157,6 +195,7 @@ export class CodexCore {
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.event.correlationId,
             webSearchEnabled: params.webSearchEnabled ?? false,
+            ...(isMessageEvent(params.event) ? { messageText: params.event.content } : {}),
         }, streamCallbacks);
     }
     async executeResume(params, streamCallbacks) {
@@ -173,6 +212,9 @@ export class CodexCore {
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.eventCorrelationId,
             webSearchEnabled: params.webSearchEnabled ?? false,
+            // Resume turns carry the user's reply text in `params.message`;
+            // forward it as the predicate's messageText signal.
+            messageText: params.message,
         }, streamCallbacks);
     }
     async summarize(conversationText) {
@@ -316,12 +358,16 @@ export class CodexCore {
             prompt,
         ];
         const lines = [];
+        const daemonReadToken = this.issueReadToken(sessionDir);
         try {
             const result = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "codex" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "codex",
+                }),
                 timeoutMs: 60_000,
                 onStdoutLine: (line) => {
                     const event = parseJsonLine(line);
@@ -345,9 +391,21 @@ export class CodexCore {
                 .filter((l) => l.startsWith("mcp__"));
             const deduped = Array.from(new Set(tools));
             logger.info({ toolCount: deduped.length }, "Live probe collected tool manifest via codex exec");
+            // docs/design/appendices/skills-unification.md Phase 1 item 13 — forward-compat
+            // signals. Two probes run side by side:
+            //   - Name-pattern scan over `deduped` (mcp__-filtered). Cheap
+            //     defence-in-depth; will not fire on a non-MCP native surface
+            //     but is harmless when present.
+            //   - `codex --help` scan for a top-level `skill`/`skills`
+            //     subcommand. This is the ground-truth detector — Codex's
+            //     hypothetical future form (`codex skill <command>`) trips
+            //     here regardless of how its tool inventory is shaped.
+            noteNativeSkillToolIfPresent("codex", deduped);
+            void probeCliNativeSkillSubcommand(this.cliPath, "codex");
             return deduped;
         }
         finally {
+            this.readTokenManager?.revoke(sessionDir);
             removeFileIfExists(outputPath);
             cleanupSessionWorkdir(sessionDir);
         }
@@ -372,14 +430,52 @@ export class CodexCore {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
+            contextDir: getContextDir(this.config),
+            // docs/design/appendices/skills-unification.md Phase 4 — feed the conditional
+            // manifest predicates. `db` is the same handle threaded through
+            // `setMcpContext`; `messageText` is the inbound DM text (resume
+            // turns send the user's reply, fresh executes send the original
+            // event content). Both fields are optional — a `summarize` /
+            // probe path without either still resolves to the conservative
+            // include branch.
+            ...(this.mcpContext?.db ? { db: this.mcpContext.db } : {}),
+            ...(typeof params.messageText === "string" ? { messageText: params.messageText } : {}),
             ...(params.wikiWorkspaceName ? { wikiWorkspaceName: params.wikiWorkspaceName } : {}),
         });
         const ownsSessionDir = !params.sessionDir;
         const outputPath = createOutputCapturePath(sessionDir, "codex-last-message");
+        const daemonReadToken = this.issueReadToken(sessionDir);
         const mcp = await this.materializeMcp(sessionDir, params.processKey);
         logger.info({ eventType: params.eventType, model: params.modelId, promptLen: params.prompt.length, mcpServers: mcp.servers.map((s) => s.id) }, "Codex execute started");
+        // Stream text deltas live as they arrive — mirrors ClaudeCodeCore so
+        // owner-facing surfaces (dashboard chat, owner DM) get the same
+        // incremental-output UX regardless of which backend serves the turn.
+        // The post-completion `assertWithinMaxBudget` still enforces the budget
+        // cap; an exceeded turn surfaces as `BackendQuotaError` AFTER text has
+        // streamed, exactly as Claude behaves. The earlier "defer until budget
+        // check" guard buffered the entire turn — which made interactive flows
+        // like `setup.initial` look frozen for minutes when the model finally
+        // returned a single multi-block response in one chunk.
         let streamed = false;
-        const deferStreamingUntilBudgetCheck = params.maxBudgetUsd !== undefined;
+        // Reactive idle watchdog (audit 2026-05-17 C1). Declared outside the
+        // outer try so the outer finally below can always call stop() — even
+        // if a setup line between here and runLineCommand throws. Mirrors the
+        // delegated-path wiring in `runDelegatedTool` (~line 1350): each
+        // arrived stream event resets the timer, and when the gap exceeds
+        // REACTIVE_IDLE_TIMEOUT_MS the aborter fires — runLineCommand reaps
+        // the subprocess via its existing kill-tree path. Distinct from
+        // `runResult.timedOut` so the post-await classifier surfaces idle
+        // hangs with a distinct message.
+        let idleTimedOut = false;
+        const idleAborter = new AbortController();
+        const idleWatchdog = new IdleWatchdog({
+            idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS,
+            onTimeout: (idleMs) => {
+                idleTimedOut = true;
+                logger.warn({ idleMs, idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS, eventType: params.eventType }, "codex reactive idle watchdog tripped — aborting");
+                idleAborter.abort(new Error(`codex reactive stream idle for ${idleMs}ms (limit ${REACTIVE_IDLE_TIMEOUT_MS}ms)`));
+            },
+        });
         try {
             let sessionId = params.resumeSessionId ?? null;
             let actualModelId = params.modelId;
@@ -394,12 +490,29 @@ export class CodexCore {
             // the run. Collecting up front — rather than scanning per-line — keeps
             // each occurrence logged exactly once across multi-line payloads.
             const apiOutputBuffer = [];
+            // Per-turn set of item IDs whose `item.started` / `item.completed`
+            // declared a reasoning type. Used to filter follow-on `item.updated`
+            // deltas, which usually omit the type and carry only `id + delta`
+            // — `shouldDropAsReasoning` consults this on every event.
+            const reasoningItemIds = new Set();
+            // Per-turn flag tripped whenever any event is dropped by the
+            // reasoning gate. The `--output-last-message` file written by
+            // codex CLI is NOT covered by the stream-level filter — when
+            // reasoning was observed but the stream produced no final
+            // assistant text, the file may itself contain a reasoning
+            // summary (codex CLI's GPT-5 behavior under tool-only turns
+            // and certain Responses-API relay shapes). Consulting this
+            // flag below makes the file-fallback path refuse such content
+            // instead of writing it verbatim to the chat bubble / DB.
+            let observedReasoning = false;
+            idleWatchdog.start();
             const runResult = await runLineCommand({
                 command: "codex",
                 args: this.buildArgs(params, outputPath),
                 cwd: sessionDir,
                 env: {
                     ...buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                        ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
                         sessionBackend: "codex",
                         sessionId: params.sessionDbId,
                         eventCorrelationId: params.eventCorrelationId,
@@ -408,7 +521,9 @@ export class CodexCore {
                     ...(params.turnToken ? { PA_TURN_TOKEN: params.turnToken } : {}),
                 },
                 timeoutMs: this.config.executeTimeoutMinutes * 60 * 1000,
+                abortSignal: idleAborter.signal,
                 onStdoutLine: (line) => {
+                    idleWatchdog.beat();
                     const event = parseJsonLine(line);
                     if (!event?.type) {
                         return;
@@ -439,7 +554,45 @@ export class CodexCore {
                         }
                         return;
                     }
+                    // Reasoning filter — must run BEFORE every text-bearing path
+                    // below (`extractCodexText`, `collectCodexItemText`, the tool
+                    // / shell-call audits). Two steps:
+                    //
+                    //  1. Record reasoning item IDs from any event that declares
+                    //     the item type (`item.started` and `item.completed` are
+                    //     the canonical carriers; `item.updated` typically omits
+                    //     it — that's why ID tracking is necessary, not optional).
+                    //  2. Drop the event entirely when it is reasoning by any
+                    //     signal: outer event type, declared item type, OR an
+                    //     `item.updated` delta whose `item.id` was previously
+                    //     recorded as reasoning.
+                    //
+                    // The two-step ordering matters: a single `item.completed`
+                    // with `{id, type: "reasoning", text: "..."}` must first
+                    // register the ID (so any straggling deltas for the same ID
+                    // are still filtered) and THEN be dropped.
+                    rememberReasoningItem(event, reasoningItemIds);
+                    if (shouldDropAsReasoning(event, reasoningItemIds)) {
+                        observedReasoning = true;
+                        return;
+                    }
                     collectCodexItemText(event, apiOutputBuffer);
+                    // EXECUTION-MODE-DESIGN.md §6.3 — stream-side absolute-block
+                    // observability. Codex has no PreToolUse hook, so we classify
+                    // each shell-call item the moment it surfaces and write a
+                    // `blocked_absolute` audit row with `result='partial'` on a hit.
+                    // The actual rejection (if any) happens in the workspace-write
+                    // sandbox out-of-band; the row tells operators the agent
+                    // *attempted* an absolute-block-listed pattern.
+                    const codexShellCall = extractCodexShellCall(event.item);
+                    if (codexShellCall) {
+                        auditStreamObservation(codexShellCall, {
+                            db: this.mcpContext?.db,
+                            backend: this.backendId,
+                            mode: this.config.codexExecutionPermissionMode,
+                            sessionId: params.sessionDbId,
+                        });
+                    }
                     // B-003 Phase 4.4 — persist MCP tool call to `mcp_tool_calls`.
                     const mcpCall = extractMcpToolCall(event);
                     if (mcpCall) {
@@ -468,12 +621,11 @@ export class CodexCore {
                         return;
                     }
                     outputChunks.push(delta);
-                    if (!deferStreamingUntilBudgetCheck) {
-                        streamCallbacks?.onText?.(delta);
-                        streamed = true;
-                    }
+                    streamCallbacks?.onText?.(delta);
+                    streamed = true;
                 },
                 onStderrLine: (line) => {
+                    idleWatchdog.beat();
                     apiOutputBuffer.push(line);
                     if (isLikelyCodexFailure(line)) {
                         lastError = line.trim();
@@ -488,15 +640,61 @@ export class CodexCore {
                     eventType: params.eventType,
                 });
             }
+            // Order matters: idle-trip is checked before wall-clock timeout so
+            // the post-await classifier surfaces the precise reason. The
+            // idle-aborter trips runResult.timedOut=false (an external abort
+            // is reported via non-zero exit per cli-utils.ts contract), but
+            // we still throw a `timeout` failure here because that matches
+            // the dispatcher's retry semantics.
+            if (idleTimedOut) {
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`));
+                logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Codex execute idle-timed-out");
+                throw err;
+            }
             if (runResult.timedOut) {
                 const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Codex execute timed out");
                 throw err;
             }
             const capturedOutput = readFileIfExists(outputPath);
-            const outputSource = capturedOutput && capturedOutput.trim().length > 0
-                ? capturedOutput
-                : outputChunks.join("");
+            // File-vs-stream precedence — minimal change from the original.
+            //
+            // Original semantics (preserved): the `--output-last-message`
+            // file is the authoritative final assistant text; the stream
+            // chunks are the fallback. Codex CLI writes the file at turn
+            // close after assembling the full agent_message, so it is more
+            // resilient than chunk replay against mid-stream truncation or
+            // transport hiccups.
+            //
+            // Safety amendment (new): when reasoning items appeared on the
+            // wire during the turn, the file is untrustworthy. Codex's
+            // GPT-5 path can write a reasoning summary to the same file
+            // when no agent_message item was produced, and the
+            // stream-level `shouldDropAsReasoning` gate cannot see that
+            // path. Suppress the file in that case and fall back to the
+            // (already filtered) stream chunks — which means an empty
+            // bubble for reasoning-only turns, but never reasoning
+            // narration surfacing as the assistant message.
+            const streamJoined = outputChunks.join("");
+            let outputSource;
+            if (capturedOutput !== null
+                && capturedOutput.trim().length > 0
+                && !observedReasoning) {
+                outputSource = capturedOutput;
+            }
+            else {
+                if (observedReasoning
+                    && capturedOutput !== null
+                    && capturedOutput.trim().length > 0) {
+                    logger.warn({
+                        eventType: params.eventType,
+                        sessionId,
+                        fileBytes: capturedOutput.trim().length,
+                        streamBytes: streamJoined.trim().length,
+                    }, "Codex --output-last-message suppressed: reasoning was observed during the turn; the file may carry a reasoning summary instead of an agent_message. Falling back to filtered stream chunks.");
+                }
+                outputSource = streamJoined;
+            }
             const output = outputSource.trim();
             const combinedFailure = lastError
                 ?? firstFailureLine(runResult.stderrLines)
@@ -513,7 +711,12 @@ export class CodexCore {
                 usage,
                 fallbackModel: findRegisteredModel(this.backendId, actualModelId),
             });
-            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId);
+            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId, {
+                usage,
+                costSource,
+                numTurns: numTurns || 1,
+                durationMs: Date.now() - startMs,
+            });
             if (output && !streamed) {
                 streamCallbacks?.onText?.(output);
             }
@@ -548,9 +751,17 @@ export class CodexCore {
             };
         }
         finally {
+            // Stop the reactive idle watchdog first — idempotent if start()
+            // was never reached, but always safe.
+            idleWatchdog.stop();
             removeFileIfExists(outputPath);
             streamCallbacks?.onEnd?.();
             if (ownsSessionDir) {
+                // Mirror ClaudeCodeCore: only revoke when we own the temp dir.
+                // Caller-owned (persistent) dirs survive across turns and reuse the
+                // same scope, so revoking here would invalidate a token still in use
+                // by a subsequent resume on the same session.
+                this.readTokenManager?.revoke(sessionDir);
                 cleanupSessionWorkdir(sessionDir);
             }
         }
@@ -634,8 +845,9 @@ export class CodexCore {
         // (per-integration)` block in AGENTS.md (rendered by
         // `skills-compiler.buildSameBackendDenyBlock`). Cross-backend
         // delegation provides hard enforcement at the
-        // `/api/integrations/:key/invoke` chokepoint, so users requiring
-        // strict deny should pick a non-Codex DM backend.
+        // `/api/integrations/:key/exec` task-mode chokepoint (the legacy
+        // `/invoke` RPC was retired 2026-05-01), so users requiring strict
+        // deny should pick a non-Codex DM backend.
         //
         const sandboxArgs = allowMode
             ? ["--dangerously-bypass-approvals-and-sandbox"]
@@ -712,7 +924,12 @@ export class CodexCore {
             return new BackendQuotaError(this.backendId, "max_budget_usd", null, message);
         }
         if (/rate limit|usage limit|quota/i.test(message)) {
-            return new BackendQuotaError(this.backendId, "rate_limited", null, message);
+            // Best-effort reset-time extraction so the dashboard can surface
+            // "quota resets at HH:MM (TZ)" instead of a bare "rate_limited" tag.
+            // OpenAI rate-limit messages typically carry "try again in Xm" or
+            // an ISO retry-after; the helper falls through to null when neither
+            // pattern matches, preserving the original behaviour.
+            return new BackendQuotaError(this.backendId, "rate_limited", extractGenericQuotaResetHint(message), message);
         }
         if (/unauthorized|forbidden|api key|login/i.test(message)) {
             return new BackendDecisiveFailure(this.backendId, "auth", new Error(message));
@@ -722,11 +939,20 @@ export class CodexCore {
         }
         return new BackendDecisiveFailure(this.backendId, "other_non_retryable", new Error(message));
     }
-    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId) {
+    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, 
+    /**
+     * Spend metadata for the just-completed turn. Codex enforces
+     * `max_budget_usd` post-hoc — by the time we reject here OpenAI has
+     * already consumed tokens — so we hand the actual usage to the
+     * BackendQuotaError so the dispatcher's error path can write a
+     * `result='failed'` agent_actions row with `cost_usd` populated.
+     * Without this the dashboard silently misses budget-rejected spend.
+     */
+    spend) {
         if (maxBudgetUsd === undefined || costUsd <= maxBudgetUsd) {
             return;
         }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Codex estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
+        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Codex estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`, spend ? { ...spend, modelId, costUsd } : null);
     }
     assertPromptWithinMaxBudget(prompt, maxBudgetUsd, modelId) {
         if (maxBudgetUsd === undefined) {
@@ -830,6 +1056,16 @@ export class CodexCore {
         let lastError = null;
         let sawTurnCompleted = false;
         const stderrBuffer = [];
+        // Reasoning-gate state — same shape as the main executeTurn path.
+        // The delegated proxy expects exactly one tool result; if codex
+        // emitted reasoning summaries during the turn AND structured
+        // pairing yielded nothing, the `--output-last-message` fallback
+        // below would otherwise hand the reasoning text to
+        // `tryParseToolResult` and surface it as a fake "tool result"
+        // string. Tracking reasoning observation lets that fallback
+        // refuse such content.
+        const reasoningItemIds = new Set();
+        let observedReasoning = false;
         // Local aborter bridged from the caller's signal so we can also
         // trigger an early abort on wrong-tool detection. See gemini-cli-core
         // for the full rationale: this caps wrong_tool failures at ~5s
@@ -864,13 +1100,17 @@ export class CodexCore {
                 proxyAborter.abort(new DelegatedProxyTimeoutError(`codex stream idle for ${idleMs}ms (limit ${idleTimeoutMs}ms)`));
             },
         });
+        const daemonReadToken = this.issueReadToken(sessionDir);
         try {
             idleWatchdog.start();
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "codex" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "codex",
+                }),
                 // Wall-clock is enforced by the invoker via abortSignal — we still
                 // pass a generous local timeout as a safety net (callers can
                 // disable it by setting their own abortSignal).
@@ -902,6 +1142,14 @@ export class CodexCore {
                         }
                         return;
                     }
+                    // Reasoning gate — must run before tool-call matching so a
+                    // reasoning item never accidentally feeds into the pairing
+                    // logic and never poisons the file fallback below.
+                    rememberReasoningItem(event, reasoningItemIds);
+                    if (shouldDropAsReasoning(event, reasoningItemIds)) {
+                        observedReasoning = true;
+                        return;
+                    }
                     // Match MCP tool calls by item.name / item.tool. We accept the
                     // first item that resolves to the requested tool name; any
                     // earlier item resolving to a different MCP tool flips the
@@ -980,9 +1228,18 @@ export class CodexCore {
                 // tool output (less reliable than structured matching, but a
                 // graceful degradation when pairing semantics drift across
                 // Codex versions).
-                const lastMessage = readFileIfExists(outputPath);
-                if (lastMessage && lastMessage.trim().length > 0) {
-                    capturedResultRaw = lastMessage.trim();
+                //
+                // Reasoning gate — when reasoning was observed during the turn
+                // the file may itself contain a reasoning summary (codex 0.121+
+                // GPT-5 behavior). Surfacing it as a fake "tool result" would
+                // poison the downstream `tryParseToolResult` walker. Skip the
+                // fallback in that case and let the caller classify the run
+                // as no-result.
+                if (!observedReasoning) {
+                    const lastMessage = readFileIfExists(outputPath);
+                    if (lastMessage && lastMessage.trim().length > 0) {
+                        capturedResultRaw = lastMessage.trim();
+                    }
                 }
             }
             const cost = withDurationMs({
@@ -1107,6 +1364,10 @@ export class CodexCore {
         finally {
             idleWatchdog.stop();
             removeFileIfExists(outputPath);
+            // Invoker owns sessionDir lifecycle, but the readToken scope is keyed
+            // on the same path — revoke here so a leaked token cannot outlive the
+            // delegated proxy run.
+            this.readTokenManager?.revoke(sessionDir);
             if (abortSignal && !abortSignal.aborted) {
                 abortSignal.removeEventListener("abort", callerAbortListener);
             }
@@ -1225,12 +1486,24 @@ export class CodexCore {
         let lastError = null;
         let sawTurnCompleted = false;
         const stderrBuffer = [];
+        // Reasoning-gate state — mirrors executeTurn / runDelegatedTool.
+        // Delegated tasks pull `rawAssistantText` from the file written by
+        // `--output-last-message`; if reasoning was observed and that file
+        // is the only text source, the dispatcher's structured-output
+        // validator would receive reasoning narration in place of the
+        // expected JSON envelope, leaking GPT-5's internal deliberation
+        // into delegated-task traces and surfacing as a parse_error
+        // wrapped around reasoning content.
+        const reasoningItemIds = new Set();
+        let observedReasoning = false;
+        const daemonReadToken = this.issueReadToken(sessionDir);
         try {
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
                 env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
                     sessionBackend: "codex",
                 }),
                 // Wall-clock is enforced by the caller's abortSignal (the route
@@ -1265,6 +1538,15 @@ export class CodexCore {
                         }
                         return;
                     }
+                    // Reasoning gate — must precede tool-call matching and the
+                    // pairing logic so reasoning items are excluded from both,
+                    // and so `observedReasoning` is set in time to suppress the
+                    // file fallback after the run completes.
+                    rememberReasoningItem(event, reasoningItemIds);
+                    if (shouldDropAsReasoning(event, reasoningItemIds)) {
+                        observedReasoning = true;
+                        return;
+                    }
                     const item = event.item;
                     if (!item || typeof item !== "object")
                         return;
@@ -1433,7 +1715,18 @@ export class CodexCore {
                     writeClassToolFired,
                 };
             }
-            const lastMessage = readFileIfExists(outputPath);
+            // Reasoning gate on the file fallback. The delegated task path
+            // has no stream-side text accumulator (unlike executeTurn's
+            // `outputChunks`), so the file IS the only text source. When
+            // reasoning was observed during the run, codex CLI may have
+            // written a reasoning summary to `--output-last-message` —
+            // returning that as `rawAssistantText` would feed reasoning
+            // narration into the dispatcher's structured-output validator.
+            // Treat it as no-output instead and let the standard
+            // parse_error path surface a clean failure.
+            const lastMessage = observedReasoning
+                ? null
+                : readFileIfExists(outputPath);
             const finalText = lastMessage?.trim() ?? "";
             if (finalText.length === 0) {
                 const failure = lastError ?? firstFailureLine(stderrBuffer);
@@ -1452,7 +1745,9 @@ export class CodexCore {
                     ok: false,
                     errorClass: "parse_error",
                     message: failure
-                        ?? `codex emitted no final assistant message (sawTurnCompleted=${sawTurnCompleted})`,
+                        ?? (observedReasoning
+                            ? `codex emitted only reasoning summaries; no final assistant message (sawTurnCompleted=${sawTurnCompleted})`
+                            : `codex emitted no final assistant message (sawTurnCompleted=${sawTurnCompleted})`),
                     cost,
                     trace,
                     writeClassToolFired,
@@ -1490,6 +1785,9 @@ export class CodexCore {
         }
         finally {
             removeFileIfExists(outputPath);
+            // See runDelegatedTool — invoker owns the dir, but the readToken scope
+            // matches the dir path and must not outlive the run.
+            this.readTokenManager?.revoke(sessionDir);
             if (abortSignal) {
                 abortSignal.removeEventListener("abort", callerListener);
             }
@@ -1630,6 +1928,122 @@ function extractCodexUsage(event) {
 function nonCachedInputTokens(totalInputTokens, cacheReadInputTokens, cacheCreationInputTokens = 0) {
     return Math.max(totalInputTokens - cacheReadInputTokens - cacheCreationInputTokens, 0);
 }
+/**
+ * Codex reasoning detection — schema-defensive across naming variants.
+ *
+ * Reasoning summaries (GPT-5 family, codex 0.121+) surface in three
+ * shapes we must drop before they reach `outputChunks` or
+ * `streamCallbacks.onText`:
+ *
+ *  1. Outer event-level reasoning types from older codex builds —
+ *     `agent_reasoning`, `agent_reasoning_delta`, …
+ *  2. `item.completed` (or `item.started`) carrying the item type
+ *     directly. The field name varies across codex versions: `type`,
+ *     `item_type`, `kind` — all three are accepted defensively, same
+ *     pattern as `extractCodexShellCall`'s multi-shape probe.
+ *  3. `item.updated` deltas. The item type is usually only declared on
+ *     `item.started` / `item.completed`; the streaming updates carry
+ *     only `id` + `delta`. The caller must remember which item IDs are
+ *     reasoning (`rememberReasoningItem`) and check IDs on every
+ *     event (`shouldDropAsReasoning`).
+ *
+ * Keeping (2) and (3) separate from the shell-call audit guarantees
+ * a reasoning event never reaches `extractMcpToolCall` /
+ * `extractCodexShellCall` either — those helpers don't false-match on
+ * reasoning shapes today, but the early return makes the contract
+ * explicit.
+ */
+// Item types carried inside `event.item.type` / `item.item_type` /
+// `item.kind` for events that wrap a reasoning summary.
+//
+// **Verified shapes** (covered by existing tests, observed in the
+// wild): `reasoning` (codex 0.121+), `agent_reasoning` (older builds).
+//
+// **Defensive entries** (added by the file-fallback hardening,
+// 2026-05-16, not yet confirmed from codex-rs source — additions are
+// safe because the names are reasoning-specific enough that a false
+// positive is implausible): `reasoning_summary` — plausible naming if
+// codex-rs ever differentiates the summary item from the in-progress
+// reasoning stream. Drop this entry if a future codex release
+// repurposes the name for something else.
+const CODEX_REASONING_ITEM_TYPES = new Set([
+    "reasoning",
+    "agent_reasoning",
+    "reasoning_summary",
+]);
+// Outer-level `event.type` values that ALWAYS carry reasoning content
+// (typically in `event.delta` / `event.text`, with no `event.item`
+// wrapper, so item-id tracking does not catch them).
+//
+// **Verified shapes**: `agent_reasoning`, `agent_reasoning_delta`,
+// `agent_reasoning_section_break` — emitted by older codex builds and
+// covered by the existing reasoning-filter regression tests.
+//
+// **Defensive entries** (added 2026-05-16 — NOT confirmed against
+// codex-rs source, included because the bug surface is real and the
+// false-positive risk is near-zero given how reasoning-specific the
+// names are): the `response.reasoning_summary_*` family follows
+// OpenAI's Responses API streaming schema, which codex CLI is known
+// to relay verbatim in some configurations (GPT-5 / o-series models
+// against certain backends). The bare `reasoning_*` short forms hedge
+// against codex pre-release variants. If any of these conflict with a
+// future non-reasoning event type, remove only the conflicting entry
+// — the verified set above is the load-bearing minimum.
+const CODEX_REASONING_OUTER_EVENT_TYPES = new Set([
+    "agent_reasoning",
+    "agent_reasoning_delta",
+    "agent_reasoning_section_break",
+    "response.reasoning_summary_text.delta",
+    "response.reasoning_summary_text.done",
+    "response.reasoning_summary_part.added",
+    "response.reasoning_summary_part.done",
+    "response.reasoning.delta",
+    "response.reasoning.done",
+    "reasoning_delta",
+    "reasoning_section_break",
+]);
+function readCodexItemId(event) {
+    const item = event.item;
+    if (!item || typeof item !== "object")
+        return null;
+    const id = item.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
+function readCodexItemTypeName(event) {
+    const item = event.item;
+    if (!item || typeof item !== "object")
+        return null;
+    const bag = item;
+    for (const key of ["type", "item_type", "kind"]) {
+        const value = bag[key];
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return null;
+}
+function rememberReasoningItem(event, reasoningItemIds) {
+    const id = readCodexItemId(event);
+    if (!id)
+        return;
+    const typeName = readCodexItemTypeName(event);
+    if (typeName && CODEX_REASONING_ITEM_TYPES.has(typeName)) {
+        reasoningItemIds.add(id);
+    }
+}
+function shouldDropAsReasoning(event, reasoningItemIds) {
+    if (event.type && CODEX_REASONING_OUTER_EVENT_TYPES.has(event.type)) {
+        return true;
+    }
+    const typeName = readCodexItemTypeName(event);
+    if (typeName && CODEX_REASONING_ITEM_TYPES.has(typeName)) {
+        return true;
+    }
+    const id = readCodexItemId(event);
+    if (id && reasoningItemIds.has(id)) {
+        return true;
+    }
+    return false;
+}
 function extractCodexText(event) {
     if (typeof event.output_text === "string") {
         return event.output_text;