@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/backends/codex-core.js

@@ -1,10 +1,11 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isPlausibleOpenAiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
+import { INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isMessageEvent, isPlausibleOpenAiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
 import { getContextDir } from "../../config.js";
 import { cleanupSessionWorkdir, createSessionWorkdir } from "../workdir.js";
-import { BackendDecisiveFailure, BackendQuotaError, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
+import { resolveUserSkillsRoot } from "../user-skills-root.js";
+import { BackendDecisiveFailure, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
 import { IdleWatchdog } from "./idle-watchdog.js";
 import { DELEGATED_PROXY_DEFAULTS } from "../../services/delegated-proxy-config.js";
 import { buildDelegatedToolPrompt, emptyCost, flattenToolResultContent, tryParseToolResult, withDurationMs, } from "../../services/delegated-tool-runtime.js";
@@ -12,10 +13,13 @@ import { materializeMcpForSession } from "../../services/mcp/session-materialize
 import { parseMcpToolName } from "../../services/mcp/risk.js";
 import { logMcpToolCall } from "../../services/mcp/tool-audit.js";
 import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
+import { noteNativeSkillToolIfPresent, probeCliNativeSkillSubcommand, } from "./native-skill-discovery-probe.js";
 import { createOutputCapturePath, CliPathCache, parseJsonLine, readFileIfExists, removeFileIfExists, runLineCommand, } from "./cli-utils.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
+import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, } from "./cli-quota-guards.js";
+import { auditStreamObservation, extractCodexShellCall, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
-import { estimateTextInputTokens, findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
+import { findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
 import { PriceFetcher } from "./price-fetcher.js";
 import { buildExecutionPrompt, buildSummaryPrompt } from "./prompt-utils.js";
 import { createLogger } from "../../logging.js";
@@ -26,6 +30,23 @@ const EMPTY_USAGE = {
     cacheCreationInputTokens: 0,
     cacheReadInputTokens: 0,
 };
+/**
+ * Per-event stream-idle threshold for reactive `runTurn` execution
+ * (DMs, routines, scheduled tasks). Distinct from the delegated-path
+ * `DELEGATED_PROXY_DEFAULTS.idleTimeoutMsByBackend.codex` (60s) because
+ * reactive turns can include longer silences during legitimate work —
+ * extended thinking, MCP cold-starts, server-side tools (`web_search`,
+ * file reads). The threshold catches a fully hung CLI subprocess (zero
+ * stream events) well before `executeTimeoutMinutes` (default 30 min)
+ * fires; healthy turns rarely go 5 min silent end-to-end.
+ *
+ * The delegated path already had this guard (see the `runDelegatedTool`
+ * wiring lower in this file); the reactive path needs it explicitly
+ * because a single hung subprocess can pin a session for the full
+ * executeTimeoutMinutes wall-clock, blocking morning-routine / hourly-check
+ * dispatch downstream.
+ */
+const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
 // Probe prompt is derived from `INTEGRATION_DESCRIPTORS.backendConnectors.codex`
 // so adding a new delegated integration (Slack, GitHub, …) requires only the
 // registry update. The line-based filter below (`l.startsWith("mcp__")`) is
@@ -87,6 +108,10 @@ export class CodexCore {
     backendId = "codex";
     // Lazily re-resolved with a 60 s TTL — see ClaudeCodeCore for rationale (§9.4).
     cliPathCache;
+    /** Legacy shared read token injected into the Codex subprocess env. */
+    readToken;
+    /** Scoped token manager preferred over the legacy shared read token. */
+    readTokenManager;
     get cliPath() {
         return this.cliPathCache.get();
     }
@@ -95,6 +120,20 @@ export class CodexCore {
         this.priceFetcher = priceFetcher;
         this.cliPathCache = new CliPathCache("codex");
     }
+    /** Set the per-daemon-boot read token for subprocess-local daemon API auth. */
+    setReadToken(token) {
+        this.readToken = token;
+    }
+    setReadTokenManager(manager) {
+        this.readTokenManager = manager;
+    }
+    /** Resolve the env-injected read token: per-scope token if a manager is wired,
+     *  otherwise the legacy shared token. Returns `undefined` when neither is set
+     *  (production wires both at startup via index.ts; tests typically wire neither).
+     */
+    issueReadToken(scope) {
+        return this.readTokenManager?.issue(scope) ?? this.readToken;
+    }
     mcpContext;
     setMcpContext(context) {
         this.mcpContext = context;
@@ -157,6 +196,11 @@ export class CodexCore {
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.event.correlationId,
             webSearchEnabled: params.webSearchEnabled ?? false,
+            ...(isMessageEvent(params.event) ? { messageText: params.event.content } : {}),
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         }, streamCallbacks);
     }
     async executeResume(params, streamCallbacks) {
@@ -173,6 +217,9 @@ export class CodexCore {
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.eventCorrelationId,
             webSearchEnabled: params.webSearchEnabled ?? false,
+            // Resume turns carry the user's reply text in `params.message`;
+            // forward it as the predicate's messageText signal.
+            messageText: params.message,
         }, streamCallbacks);
     }
     async summarize(conversationText) {
@@ -316,12 +363,16 @@ export class CodexCore {
             prompt,
         ];
         const lines = [];
+        const daemonReadToken = this.issueReadToken(sessionDir);
         try {
             const result = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "codex" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "codex",
+                }),
                 timeoutMs: 60_000,
                 onStdoutLine: (line) => {
                     const event = parseJsonLine(line);
@@ -345,9 +396,21 @@ export class CodexCore {
                 .filter((l) => l.startsWith("mcp__"));
             const deduped = Array.from(new Set(tools));
             logger.info({ toolCount: deduped.length }, "Live probe collected tool manifest via codex exec");
+            // docs/design/appendices/skills-unification.md Phase 1 item 13 — forward-compat
+            // signals. Two probes run side by side:
+            //   - Name-pattern scan over `deduped` (mcp__-filtered). Cheap
+            //     defence-in-depth; will not fire on a non-MCP native surface
+            //     but is harmless when present.
+            //   - `codex --help` scan for a top-level `skill`/`skills`
+            //     subcommand. This is the ground-truth detector — Codex's
+            //     hypothetical future form (`codex skill <command>`) trips
+            //     here regardless of how its tool inventory is shaped.
+            noteNativeSkillToolIfPresent("codex", deduped);
+            void probeCliNativeSkillSubcommand(this.cliPath, "codex");
             return deduped;
         }
         finally {
+            this.readTokenManager?.revoke(sessionDir);
             removeFileIfExists(outputPath);
             cleanupSessionWorkdir(sessionDir);
         }
@@ -366,20 +429,69 @@ export class CodexCore {
             logger.warn({ reason: auth.reason }, "Codex auth check failed");
             throw new BackendDecisiveFailure(this.backendId, "auth", new Error(auth.reason));
         }
+        // checkAuth() returns {ok:false} when cliPath is null, so reaching here
+        // proves it is a resolved absolute path. Pin it to a local const — TS
+        // cannot narrow `this.cliPath` (a getter) through the await above, and
+        // we avoid a non-null assertion. Used as the spawn `command` below.
+        const cliPath = this.cliPath;
         this.assertPromptWithinMaxBudget(params.prompt, params.maxBudgetUsd, params.modelId);
         const startMs = Date.now();
-        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, `${this.config.dataDir}/skills`, {
+        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, resolveUserSkillsRoot(this.config), {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
+            contextDir: getContextDir(this.config),
+            // docs/design/appendices/skills-unification.md Phase 4 — feed the conditional
+            // manifest predicates. `db` is the same handle threaded through
+            // `setMcpContext`; `messageText` is the inbound DM text (resume
+            // turns send the user's reply, fresh executes send the original
+            // event content). Both fields are optional — a `summarize` /
+            // probe path without either still resolves to the conservative
+            // include branch.
+            ...(this.mcpContext?.db ? { db: this.mcpContext.db } : {}),
+            ...(typeof params.messageText === "string" ? { messageText: params.messageText } : {}),
             ...(params.wikiWorkspaceName ? { wikiWorkspaceName: params.wikiWorkspaceName } : {}),
+            // AGENT_DEFINITIONS_DESIGN.md §4.2 — see ClaudeCodeCore. No-op for
+            // non-Agent executes.
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         });
         const ownsSessionDir = !params.sessionDir;
         const outputPath = createOutputCapturePath(sessionDir, "codex-last-message");
+        const daemonReadToken = this.issueReadToken(sessionDir);
         const mcp = await this.materializeMcp(sessionDir, params.processKey);
         logger.info({ eventType: params.eventType, model: params.modelId, promptLen: params.prompt.length, mcpServers: mcp.servers.map((s) => s.id) }, "Codex execute started");
+        // Stream text deltas live as they arrive — mirrors ClaudeCodeCore so
+        // owner-facing surfaces (dashboard chat, owner DM) get the same
+        // incremental-output UX regardless of which backend serves the turn.
+        // The post-completion `assertWithinMaxBudget` still enforces the budget
+        // cap; an exceeded turn surfaces as `BackendQuotaError` AFTER text has
+        // streamed, exactly as Claude behaves. The earlier "defer until budget
+        // check" guard buffered the entire turn — which made interactive flows
+        // like `setup.initial` look frozen for minutes when the model finally
+        // returned a single multi-block response in one chunk.
         let streamed = false;
-        const deferStreamingUntilBudgetCheck = params.maxBudgetUsd !== undefined;
+        // Reactive idle watchdog. Declared outside the outer try so the
+        // outer finally below can always call stop() — even if a setup line
+        // between here and runLineCommand throws. Mirrors the delegated-path
+        // wiring in `runDelegatedTool`: each
+        // arrived stream event resets the timer, and when the gap exceeds
+        // REACTIVE_IDLE_TIMEOUT_MS the aborter fires — runLineCommand reaps
+        // the subprocess via its existing kill-tree path. Distinct from
+        // `runResult.timedOut` so the post-await classifier surfaces idle
+        // hangs with a distinct message.
+        let idleTimedOut = false;
+        const idleAborter = new AbortController();
+        const idleWatchdog = new IdleWatchdog({
+            idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS,
+            onTimeout: (idleMs) => {
+                idleTimedOut = true;
+                logger.warn({ idleMs, idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS, eventType: params.eventType }, "codex reactive idle watchdog tripped — aborting");
+                idleAborter.abort(new Error(`codex reactive stream idle for ${idleMs}ms (limit ${REACTIVE_IDLE_TIMEOUT_MS}ms)`));
+            },
+        });
         try {
             let sessionId = params.resumeSessionId ?? null;
             let actualModelId = params.modelId;
@@ -394,12 +506,35 @@ export class CodexCore {
             // the run. Collecting up front — rather than scanning per-line — keeps
             // each occurrence logged exactly once across multi-line payloads.
             const apiOutputBuffer = [];
+            // Per-turn set of item IDs whose `item.started` / `item.completed`
+            // declared a reasoning type. Used to filter follow-on `item.updated`
+            // deltas, which usually omit the type and carry only `id + delta`
+            // — `shouldDropAsReasoning` consults this on every event.
+            const reasoningItemIds = new Set();
+            // Per-turn flag tripped whenever any event is dropped by the
+            // reasoning gate. The `--output-last-message` file written by
+            // codex CLI is NOT covered by the stream-level filter — when
+            // reasoning was observed but the stream produced no final
+            // assistant text, the file may itself contain a reasoning
+            // summary (codex CLI's GPT-5 behavior under tool-only turns
+            // and certain Responses-API relay shapes). Consulting this
+            // flag below makes the file-fallback path refuse such content
+            // instead of writing it verbatim to the chat bubble / DB.
+            let observedReasoning = false;
+            idleWatchdog.start();
             const runResult = await runLineCommand({
-                command: "codex",
+                // Resolved absolute CLI path, not a bare name — on Windows with
+                // shell:false, spawn does no PATHEXT resolution, so a bare "codex"
+                // would never match an npm `codex.cmd` or native `codex.exe`. The
+                // checkAuth() pre-flight above guarantees cliPath is non-null
+                // (checkAuth returns {ok:false} when it is, and the gate throws).
+                // Matches the delegated/probe sibling call sites.
+                command: cliPath,
                 args: this.buildArgs(params, outputPath),
                 cwd: sessionDir,
                 env: {
                     ...buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                        ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
                         sessionBackend: "codex",
                         sessionId: params.sessionDbId,
                         eventCorrelationId: params.eventCorrelationId,
@@ -408,7 +543,9 @@ export class CodexCore {
                     ...(params.turnToken ? { PA_TURN_TOKEN: params.turnToken } : {}),
                 },
                 timeoutMs: this.config.executeTimeoutMinutes * 60 * 1000,
+                abortSignal: idleAborter.signal,
                 onStdoutLine: (line) => {
+                    idleWatchdog.beat();
                     const event = parseJsonLine(line);
                     if (!event?.type) {
                         return;
@@ -439,7 +576,45 @@ export class CodexCore {
                         }
                         return;
                     }
+                    // Reasoning filter — must run BEFORE every text-bearing path
+                    // below (`extractCodexText`, `collectCodexItemText`, the tool
+                    // / shell-call audits). Two steps:
+                    //
+                    //  1. Record reasoning item IDs from any event that declares
+                    //     the item type (`item.started` and `item.completed` are
+                    //     the canonical carriers; `item.updated` typically omits
+                    //     it — that's why ID tracking is necessary, not optional).
+                    //  2. Drop the event entirely when it is reasoning by any
+                    //     signal: outer event type, declared item type, OR an
+                    //     `item.updated` delta whose `item.id` was previously
+                    //     recorded as reasoning.
+                    //
+                    // The two-step ordering matters: a single `item.completed`
+                    // with `{id, type: "reasoning", text: "..."}` must first
+                    // register the ID (so any straggling deltas for the same ID
+                    // are still filtered) and THEN be dropped.
+                    rememberReasoningItem(event, reasoningItemIds);
+                    if (shouldDropAsReasoning(event, reasoningItemIds)) {
+                        observedReasoning = true;
+                        return;
+                    }
                     collectCodexItemText(event, apiOutputBuffer);
+                    // EXECUTION-MODE-DESIGN.md §6.3 — stream-side absolute-block
+                    // observability. Codex has no PreToolUse hook, so we classify
+                    // each shell-call item the moment it surfaces and write a
+                    // `blocked_absolute` audit row with `result='partial'` on a hit.
+                    // The actual rejection (if any) happens in the workspace-write
+                    // sandbox out-of-band; the row tells operators the agent
+                    // *attempted* an absolute-block-listed pattern.
+                    const codexShellCall = extractCodexShellCall(event.item);
+                    if (codexShellCall) {
+                        auditStreamObservation(codexShellCall, {
+                            db: this.mcpContext?.db,
+                            backend: this.backendId,
+                            mode: this.config.codexExecutionPermissionMode,
+                            sessionId: params.sessionDbId,
+                        });
+                    }
                     // B-003 Phase 4.4 — persist MCP tool call to `mcp_tool_calls`.
                     const mcpCall = extractMcpToolCall(event);
                     if (mcpCall) {
@@ -468,12 +643,11 @@ export class CodexCore {
                         return;
                     }
                     outputChunks.push(delta);
-                    if (!deferStreamingUntilBudgetCheck) {
-                        streamCallbacks?.onText?.(delta);
-                        streamed = true;
-                    }
+                    streamCallbacks?.onText?.(delta);
+                    streamed = true;
                 },
                 onStderrLine: (line) => {
+                    idleWatchdog.beat();
                     apiOutputBuffer.push(line);
                     if (isLikelyCodexFailure(line)) {
                         lastError = line.trim();
@@ -488,15 +662,61 @@ export class CodexCore {
                     eventType: params.eventType,
                 });
             }
+            // Order matters: idle-trip is checked before wall-clock timeout so
+            // the post-await classifier surfaces the precise reason. The
+            // idle-aborter trips runResult.timedOut=false (an external abort
+            // is reported via non-zero exit per cli-utils.ts contract), but
+            // we still throw a `timeout` failure here because that matches
+            // the dispatcher's retry semantics.
+            if (idleTimedOut) {
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`));
+                logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Codex execute idle-timed-out");
+                throw err;
+            }
             if (runResult.timedOut) {
                 const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Codex execute timed out");
                 throw err;
             }
             const capturedOutput = readFileIfExists(outputPath);
-            const outputSource = capturedOutput && capturedOutput.trim().length > 0
-                ? capturedOutput
-                : outputChunks.join("");
+            // File-vs-stream precedence — minimal change from the original.
+            //
+            // Original semantics (preserved): the `--output-last-message`
+            // file is the authoritative final assistant text; the stream
+            // chunks are the fallback. Codex CLI writes the file at turn
+            // close after assembling the full agent_message, so it is more
+            // resilient than chunk replay against mid-stream truncation or
+            // transport hiccups.
+            //
+            // Safety amendment (new): when reasoning items appeared on the
+            // wire during the turn, the file is untrustworthy. Codex's
+            // GPT-5 path can write a reasoning summary to the same file
+            // when no agent_message item was produced, and the
+            // stream-level `shouldDropAsReasoning` gate cannot see that
+            // path. Suppress the file in that case and fall back to the
+            // (already filtered) stream chunks — which means an empty
+            // bubble for reasoning-only turns, but never reasoning
+            // narration surfacing as the assistant message.
+            const streamJoined = outputChunks.join("");
+            let outputSource;
+            if (capturedOutput !== null
+                && capturedOutput.trim().length > 0
+                && !observedReasoning) {
+                outputSource = capturedOutput;
+            }
+            else {
+                if (observedReasoning
+                    && capturedOutput !== null
+                    && capturedOutput.trim().length > 0) {
+                    logger.warn({
+                        eventType: params.eventType,
+                        sessionId,
+                        fileBytes: capturedOutput.trim().length,
+                        streamBytes: streamJoined.trim().length,
+                    }, "Codex --output-last-message suppressed: reasoning was observed during the turn; the file may carry a reasoning summary instead of an agent_message. Falling back to filtered stream chunks.");
+                }
+                outputSource = streamJoined;
+            }
             const output = outputSource.trim();
             const combinedFailure = lastError
                 ?? firstFailureLine(runResult.stderrLines)
@@ -513,7 +733,12 @@ export class CodexCore {
                 usage,
                 fallbackModel: findRegisteredModel(this.backendId, actualModelId),
             });
-            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId);
+            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId, {
+                usage,
+                costSource,
+                numTurns: numTurns || 1,
+                durationMs: Date.now() - startMs,
+            });
             if (output && !streamed) {
                 streamCallbacks?.onText?.(output);
             }
@@ -548,9 +773,17 @@ export class CodexCore {
             };
         }
         finally {
+            // Stop the reactive idle watchdog first — idempotent if start()
+            // was never reached, but always safe.
+            idleWatchdog.stop();
             removeFileIfExists(outputPath);
             streamCallbacks?.onEnd?.();
             if (ownsSessionDir) {
+                // Mirror ClaudeCodeCore: only revoke when we own the temp dir.
+                // Caller-owned (persistent) dirs survive across turns and reuse the
+                // same scope, so revoking here would invalidate a token still in use
+                // by a subsequent resume on the same session.
+                this.readTokenManager?.revoke(sessionDir);
                 cleanupSessionWorkdir(sessionDir);
             }
         }
@@ -563,8 +796,7 @@ export class CodexCore {
         // agent to reach the daemon API at http://localhost:${apiPort}/... under
         // the workspace-write sandbox. Without it, Seatbelt/sandbox-exec blocks
         // ALL network egress and `curl http://localhost:8321/api/health` fails
-        // with a connection-refused sandbox denial (verified 2026-04-11, Codex
-        // v0.118.0).
+        // with a connection-refused sandbox denial.
         //
         // HOWEVER: this flag is a binary on/off switch in Codex's sandbox model.
         // There is no host-scoped allowlist. Once enabled, the agent can reach
@@ -634,8 +866,8 @@ export class CodexCore {
         // (per-integration)` block in AGENTS.md (rendered by
         // `skills-compiler.buildSameBackendDenyBlock`). Cross-backend
         // delegation provides hard enforcement at the
-        // `/api/integrations/:key/invoke` chokepoint, so users requiring
-        // strict deny should pick a non-Codex DM backend.
+        // `/api/integrations/:key/exec` task-mode chokepoint, so users
+        // requiring strict deny should pick a non-Codex DM backend.
         //
         const sandboxArgs = allowMode
             ? ["--dangerously-bypass-approvals-and-sandbox"]
@@ -707,47 +939,38 @@ export class CodexCore {
             return anyFromRegistry;
         throw new Error(`pickSummaryModel: no models registered for backend ${this.backendId}`);
     }
+    // Failure classification + budget enforcement share a skeleton with the
+    // Gemini CLI core; the logic lives in `cli-quota-guards.ts` (single source
+    // of truth) and each backend passes its own regexes / label. See that
+    // module for the full ordering rationale.
     classifyFailure(message) {
-        if (isMaxBudgetMessage(message)) {
-            return new BackendQuotaError(this.backendId, "max_budget_usd", null, message);
-        }
-        if (/rate limit|usage limit|quota/i.test(message)) {
-            return new BackendQuotaError(this.backendId, "rate_limited", null, message);
-        }
-        if (/unauthorized|forbidden|api key|login/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "auth", new Error(message));
-        }
-        if (/timed out|timeout/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "timeout", new Error(message));
-        }
-        return new BackendDecisiveFailure(this.backendId, "other_non_retryable", new Error(message));
+        return classifyCliFailure({
+            backendId: this.backendId,
+            message,
+            // OpenAI surfaces quota exhaustion as "rate limit" / "usage limit" / "quota".
+            rateLimitPattern: /rate limit|usage limit|quota/i,
+            authPattern: /unauthorized|forbidden|api key|login/i,
+        });
     }
-    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId) {
-        if (maxBudgetUsd === undefined || costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Codex estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
+    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, spend) {
+        assertCostWithinMaxBudget({
+            backendId: this.backendId,
+            label: "Codex",
+            costUsd,
+            maxBudgetUsd,
+            modelId,
+            spend,
+        });
     }
     assertPromptWithinMaxBudget(prompt, maxBudgetUsd, modelId) {
-        if (maxBudgetUsd === undefined) {
-            return;
-        }
-        const estimatedUsage = {
-            inputTokens: estimateTextInputTokens(prompt),
-            outputTokens: 0,
-            cacheCreationInputTokens: 0,
-            cacheReadInputTokens: 0,
-        };
-        const { costUsd } = this.priceFetcher.estimateUsageCost({
+        assertPromptCostWithinMaxBudget({
             backendId: this.backendId,
+            label: "Codex",
+            prompt,
+            maxBudgetUsd,
             modelId,
-            usage: estimatedUsage,
-            fallbackModel: findRegisteredModel(this.backendId, modelId),
+            priceFetcher: this.priceFetcher,
         });
-        if (costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Codex estimated prompt cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
     }
     /**
      * Delegated proxy invocation — Codex CLI path.
@@ -830,6 +1053,16 @@ export class CodexCore {
         let lastError = null;
         let sawTurnCompleted = false;
         const stderrBuffer = [];
+        // Reasoning-gate state — same shape as the main executeTurn path.
+        // The delegated proxy expects exactly one tool result; if codex
+        // emitted reasoning summaries during the turn AND structured
+        // pairing yielded nothing, the `--output-last-message` fallback
+        // below would otherwise hand the reasoning text to
+        // `tryParseToolResult` and surface it as a fake "tool result"
+        // string. Tracking reasoning observation lets that fallback
+        // refuse such content.
+        const reasoningItemIds = new Set();
+        let observedReasoning = false;
         // Local aborter bridged from the caller's signal so we can also
         // trigger an early abort on wrong-tool detection. See gemini-cli-core
         // for the full rationale: this caps wrong_tool failures at ~5s
@@ -864,13 +1097,17 @@ export class CodexCore {
                 proxyAborter.abort(new DelegatedProxyTimeoutError(`codex stream idle for ${idleMs}ms (limit ${idleTimeoutMs}ms)`));
             },
         });
+        const daemonReadToken = this.issueReadToken(sessionDir);
         try {
             idleWatchdog.start();
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "codex" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "codex",
+                }),
                 // Wall-clock is enforced by the invoker via abortSignal — we still
                 // pass a generous local timeout as a safety net (callers can
                 // disable it by setting their own abortSignal).
@@ -902,6 +1139,14 @@ export class CodexCore {
                         }
                         return;
                     }
+                    // Reasoning gate — must run before tool-call matching so a
+                    // reasoning item never accidentally feeds into the pairing
+                    // logic and never poisons the file fallback below.
+                    rememberReasoningItem(event, reasoningItemIds);
+                    if (shouldDropAsReasoning(event, reasoningItemIds)) {
+                        observedReasoning = true;
+                        return;
+                    }
                     // Match MCP tool calls by item.name / item.tool. We accept the
                     // first item that resolves to the requested tool name; any
                     // earlier item resolving to a different MCP tool flips the
@@ -980,9 +1225,18 @@ export class CodexCore {
                 // tool output (less reliable than structured matching, but a
                 // graceful degradation when pairing semantics drift across
                 // Codex versions).
-                const lastMessage = readFileIfExists(outputPath);
-                if (lastMessage && lastMessage.trim().length > 0) {
-                    capturedResultRaw = lastMessage.trim();
+                //
+                // Reasoning gate — when reasoning was observed during the turn
+                // the file may itself contain a reasoning summary (codex 0.121+
+                // GPT-5 behavior). Surfacing it as a fake "tool result" would
+                // poison the downstream `tryParseToolResult` walker. Skip the
+                // fallback in that case and let the caller classify the run
+                // as no-result.
+                if (!observedReasoning) {
+                    const lastMessage = readFileIfExists(outputPath);
+                    if (lastMessage && lastMessage.trim().length > 0) {
+                        capturedResultRaw = lastMessage.trim();
+                    }
                 }
             }
             const cost = withDurationMs({
@@ -1107,6 +1361,10 @@ export class CodexCore {
         finally {
             idleWatchdog.stop();
             removeFileIfExists(outputPath);
+            // Invoker owns sessionDir lifecycle, but the readToken scope is keyed
+            // on the same path — revoke here so a leaked token cannot outlive the
+            // delegated proxy run.
+            this.readTokenManager?.revoke(sessionDir);
             if (abortSignal && !abortSignal.aborted) {
                 abortSignal.removeEventListener("abort", callerAbortListener);
             }
@@ -1225,12 +1483,24 @@ export class CodexCore {
         let lastError = null;
         let sawTurnCompleted = false;
         const stderrBuffer = [];
+        // Reasoning-gate state — mirrors executeTurn / runDelegatedTool.
+        // Delegated tasks pull `rawAssistantText` from the file written by
+        // `--output-last-message`; if reasoning was observed and that file
+        // is the only text source, the dispatcher's structured-output
+        // validator would receive reasoning narration in place of the
+        // expected JSON envelope, leaking GPT-5's internal deliberation
+        // into delegated-task traces and surfacing as a parse_error
+        // wrapped around reasoning content.
+        const reasoningItemIds = new Set();
+        let observedReasoning = false;
+        const daemonReadToken = this.issueReadToken(sessionDir);
         try {
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
                 env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
                     sessionBackend: "codex",
                 }),
                 // Wall-clock is enforced by the caller's abortSignal (the route
@@ -1265,6 +1535,15 @@ export class CodexCore {
                         }
                         return;
                     }
+                    // Reasoning gate — must precede tool-call matching and the
+                    // pairing logic so reasoning items are excluded from both,
+                    // and so `observedReasoning` is set in time to suppress the
+                    // file fallback after the run completes.
+                    rememberReasoningItem(event, reasoningItemIds);
+                    if (shouldDropAsReasoning(event, reasoningItemIds)) {
+                        observedReasoning = true;
+                        return;
+                    }
                     const item = event.item;
                     if (!item || typeof item !== "object")
                         return;
@@ -1433,7 +1712,18 @@ export class CodexCore {
                     writeClassToolFired,
                 };
             }
-            const lastMessage = readFileIfExists(outputPath);
+            // Reasoning gate on the file fallback. The delegated task path
+            // has no stream-side text accumulator (unlike executeTurn's
+            // `outputChunks`), so the file IS the only text source. When
+            // reasoning was observed during the run, codex CLI may have
+            // written a reasoning summary to `--output-last-message` —
+            // returning that as `rawAssistantText` would feed reasoning
+            // narration into the dispatcher's structured-output validator.
+            // Treat it as no-output instead and let the standard
+            // parse_error path surface a clean failure.
+            const lastMessage = observedReasoning
+                ? null
+                : readFileIfExists(outputPath);
             const finalText = lastMessage?.trim() ?? "";
             if (finalText.length === 0) {
                 const failure = lastError ?? firstFailureLine(stderrBuffer);
@@ -1452,7 +1742,9 @@ export class CodexCore {
                     ok: false,
                     errorClass: "parse_error",
                     message: failure
-                        ?? `codex emitted no final assistant message (sawTurnCompleted=${sawTurnCompleted})`,
+                        ?? (observedReasoning
+                            ? `codex emitted only reasoning summaries; no final assistant message (sawTurnCompleted=${sawTurnCompleted})`
+                            : `codex emitted no final assistant message (sawTurnCompleted=${sawTurnCompleted})`),
                     cost,
                     trace,
                     writeClassToolFired,
@@ -1490,6 +1782,9 @@ export class CodexCore {
         }
         finally {
             removeFileIfExists(outputPath);
+            // See runDelegatedTool — invoker owns the dir, but the readToken scope
+            // matches the dir path and must not outlive the run.
+            this.readTokenManager?.revoke(sessionDir);
             if (abortSignal) {
                 abortSignal.removeEventListener("abort", callerListener);
             }
@@ -1570,9 +1865,6 @@ function collectItemOutput(bag) {
     }
     return null;
 }
-function isMaxBudgetMessage(message) {
-    return /max(?:imum)? budget|max_budget_usd|budget limit|per-turn budget/i.test(message);
-}
 /**
  * Codex argv byte budget. macOS `ARG_MAX` is ~1 MB and the kernel counts
  * env vars too, so we cap our contribution at 120 KB to leave plenty of
@@ -1630,6 +1922,122 @@ function extractCodexUsage(event) {
 function nonCachedInputTokens(totalInputTokens, cacheReadInputTokens, cacheCreationInputTokens = 0) {
     return Math.max(totalInputTokens - cacheReadInputTokens - cacheCreationInputTokens, 0);
 }
+/**
+ * Codex reasoning detection — schema-defensive across naming variants.
+ *
+ * Reasoning summaries (GPT-5 family, codex 0.121+) surface in three
+ * shapes we must drop before they reach `outputChunks` or
+ * `streamCallbacks.onText`:
+ *
+ *  1. Outer event-level reasoning types from older codex builds —
+ *     `agent_reasoning`, `agent_reasoning_delta`, …
+ *  2. `item.completed` (or `item.started`) carrying the item type
+ *     directly. The field name varies across codex versions: `type`,
+ *     `item_type`, `kind` — all three are accepted defensively, same
+ *     pattern as `extractCodexShellCall`'s multi-shape probe.
+ *  3. `item.updated` deltas. The item type is usually only declared on
+ *     `item.started` / `item.completed`; the streaming updates carry
+ *     only `id` + `delta`. The caller must remember which item IDs are
+ *     reasoning (`rememberReasoningItem`) and check IDs on every
+ *     event (`shouldDropAsReasoning`).
+ *
+ * Keeping (2) and (3) separate from the shell-call audit guarantees
+ * a reasoning event never reaches `extractMcpToolCall` /
+ * `extractCodexShellCall` either — those helpers don't false-match on
+ * reasoning shapes today, but the early return makes the contract
+ * explicit.
+ */
+// Item types carried inside `event.item.type` / `item.item_type` /
+// `item.kind` for events that wrap a reasoning summary.
+//
+// **Verified shapes** (covered by existing tests, observed in the
+// wild): `reasoning` (codex 0.121+), `agent_reasoning` (older builds).
+//
+// **Defensive entries** (not yet confirmed from codex-rs source —
+// additions are safe because the names are reasoning-specific enough
+// that a false positive is implausible): `reasoning_summary` —
+// plausible naming if
+// codex-rs ever differentiates the summary item from the in-progress
+// reasoning stream. Drop this entry if a future codex release
+// repurposes the name for something else.
+const CODEX_REASONING_ITEM_TYPES = new Set([
+    "reasoning",
+    "agent_reasoning",
+    "reasoning_summary",
+]);
+// Outer-level `event.type` values that ALWAYS carry reasoning content
+// (typically in `event.delta` / `event.text`, with no `event.item`
+// wrapper, so item-id tracking does not catch them).
+//
+// **Verified shapes**: `agent_reasoning`, `agent_reasoning_delta`,
+// `agent_reasoning_section_break` — emitted by older codex builds and
+// covered by the existing reasoning-filter regression tests.
+//
+// **Defensive entries** (NOT confirmed against codex-rs source,
+// included because the bug surface is real and the false-positive risk
+// is near-zero given how reasoning-specific the names are): the
+// `response.reasoning_summary_*` family follows
+// OpenAI's Responses API streaming schema, which codex CLI is known
+// to relay verbatim in some configurations (GPT-5 / o-series models
+// against certain backends). The bare `reasoning_*` short forms hedge
+// against codex pre-release variants. If any of these conflict with a
+// future non-reasoning event type, remove only the conflicting entry
+// — the verified set above is the load-bearing minimum.
+const CODEX_REASONING_OUTER_EVENT_TYPES = new Set([
+    "agent_reasoning",
+    "agent_reasoning_delta",
+    "agent_reasoning_section_break",
+    "response.reasoning_summary_text.delta",
+    "response.reasoning_summary_text.done",
+    "response.reasoning_summary_part.added",
+    "response.reasoning_summary_part.done",
+    "response.reasoning.delta",
+    "response.reasoning.done",
+    "reasoning_delta",
+    "reasoning_section_break",
+]);
+function readCodexItemId(event) {
+    const item = event.item;
+    if (!item || typeof item !== "object")
+        return null;
+    const id = item.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
+function readCodexItemTypeName(event) {
+    const item = event.item;
+    if (!item || typeof item !== "object")
+        return null;
+    const bag = item;
+    for (const key of ["type", "item_type", "kind"]) {
+        const value = bag[key];
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return null;
+}
+function rememberReasoningItem(event, reasoningItemIds) {
+    const id = readCodexItemId(event);
+    if (!id)
+        return;
+    const typeName = readCodexItemTypeName(event);
+    if (typeName && CODEX_REASONING_ITEM_TYPES.has(typeName)) {
+        reasoningItemIds.add(id);
+    }
+}
+function shouldDropAsReasoning(event, reasoningItemIds) {
+    if (event.type && CODEX_REASONING_OUTER_EVENT_TYPES.has(event.type)) {
+        return true;
+    }
+    const typeName = readCodexItemTypeName(event);
+    if (typeName && CODEX_REASONING_ITEM_TYPES.has(typeName)) {
+        return true;
+    }
+    const id = readCodexItemId(event);
+    if (id && reasoningItemIds.has(id)) {
+        return true;
+    }
+    return false;
+}
 function extractCodexText(event) {
     if (typeof event.output_text === "string") {
         return event.output_text;
@@ -1726,4 +2134,3 @@ function firstFailureLine(lines) {
 function readNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
-//# sourceMappingURL=codex-core.js.map