@bill10/agent-007 0.12.1001 → 0.12.2001

package/VERSION

@@ -1 +1 @@
-0.12.1.1
+0.12.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bill10/agent-007",
-  "version": "0.12.1001",
+  "version": "0.12.2001",
   "description": "From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.",
   "license": "MIT",
   "repository": {

package/server/agent-mcp.js

@@ -91,6 +91,10 @@ export function writeMcpConfig(sessionId, agentToken) {
 // server/permission-hook.js with this session's MCP config. Claude Code only;
 // Codex takes its hook differently and is not wired yet (docs/BILLION.md).
 const PERMISSION_HOOK = fileURLToPath(new URL('./permission-hook.js', import.meta.url));
+// The two board tools the job prompt tells a worker on Billion's card to use:
+// finishing its card, and asking Billion. Asking permission for those would
+// only send Billion (or the owner) a request to approve its own instructions.
+export const WORKER_BOARD_TOOLS = ['finish_job', 'send_message'];
 const shellQuote = (s) => `"${String(s).replace(/(["\\$`])/g, '\\$1')}"`;
 // Forward slashes on Windows, which node takes as well: a backslash means
 // something different to each shell a hook might run under (doubled by the
@@ -99,10 +103,7 @@ export const hookPath = (p, platform = process.platform) => (platform === 'win32
 export function withApprovalHook(file, args, configPath) {
   if (!configPath || agentName(file) !== 'claude' || args.includes('--settings')) return args;
   const settings = {
-    // The two board tools the job prompt tells the worker to use: finishing
-    // its card, and asking Billion. Asking permission for those would only
-    // send Billion a request to approve its own instructions.
-    permissions: { allow: ['finish_job', 'send_message'].map(tool => `mcp__${MCP_SERVER_NAME}__${tool}`) },
+    permissions: { allow: WORKER_BOARD_TOOLS.map(tool => `mcp__${MCP_SERVER_NAME}__${tool}`) },
     hooks: {
       PermissionRequest: [{
         matcher: '*',
@@ -113,6 +114,18 @@ export function withApprovalHook(file, args, configPath) {
   return ['--settings', JSON.stringify(settings), ...args];
 }
 
+// The Codex side of the same pre-allow: per-run -c overrides, one separate argv
+// element each, so ~/.codex/config.toml is never touched. Only these tools;
+// everything else on the server keeps Codex's default (ask). Must come after
+// withMcpConfig's server table on the command line, which replaces the table.
+export function withCodexWorkerTools(file, args, configPath) {
+  if (!configPath || agentName(file) !== 'codex') return args;
+  return [
+    ...WORKER_BOARD_TOOLS.flatMap(tool => ['-c', `mcp_servers.${MCP_SERVER_NAME}.tools.${tool}.approval_mode="approve"`]),
+    ...args,
+  ];
+}
+
 export function removeMcpConfig(sessionId) {
   try {
     rmSync(mcpConfigPath(sessionId), { force: true });

package/server/models.js

@@ -1,16 +1,16 @@
 // Which models a card may name, per CLI, discovered on this machine so nobody
-// keeps a list. Nothing here goes to the network: Claude Code's aliases are
-// fixed words its --model resolves to the newest model itself, and Codex
-// already caches the account's model list on disk.
+// keeps a list. Claude Code's aliases are fixed words its --model resolves to
+// the newest model itself; Codex is asked for its catalog.
 //
 // A CLI that is not on the PATH the board spawns with offers nothing — a card
 // could not run there anyway — and so does anything that fails to read. An
 // empty list leaves only the CLI's own default on offer.
 
+import { execFile } from 'child_process';
 import { readFileSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
-import { commandExists } from './command-path.js';
+import { commandExists, resolveExecutable } from './command-path.js';
 import { isSafeModelName } from '../lib/jobs.js';
 
 // `claude --model` takes these as "the latest model of that family"
@@ -21,30 +21,51 @@ export const CLAUDE_ALIASES = ['fable', 'opus', 'sonnet', 'haiku'];
 
 const codexHome = (env) => env.CODEX_HOME || join(homedir(), '.codex');
 
-// Codex (0.156) keeps the models its account can use in
-// $CODEX_HOME/models_cache.json: { fetched_at, client_version, models: [{ slug,
-// visibility, priority, ... }] }. Only `visibility: "list"` entries are kept:
-// that is Codex's own filter for its /model picker, and it is what hides the
-// internal ones (codex-auto-review, the reviewer's model; gpt-reserve) that
-// are not for a coding session. Picker order is `priority`, lowest first. A
-// slug must also pass isSafeModelName, since it ends up on a command line.
-// The CLI has no plain list-models subcommand (its app-server's model/list is
-// a JSON-RPC session, not a one-shot), so this reads the cache its picker is
-// built from — read-only; nothing here ever writes under CODEX_HOME.
-export function parseCodexModels(text) {
+// Codex's catalog, from `codex debug models` (0.157: "Render the raw model
+// catalog as JSON") or, failing that, the cache its picker is built from,
+// $CODEX_HOME/models_cache.json. Both are { models: [{ slug, visibility,
+// priority, ... }] }. Only `visibility: "list"` entries are kept: that is
+// Codex's own filter for its /model picker, and it is what hides the internal
+// ones (codex-auto-review, the reviewer's model; gpt-reserve) that are not for
+// a coding session. Picker order is `priority`, lowest first. A slug must also
+// pass isSafeModelName, since it ends up on a command line. Null when the text
+// is not a catalog. Read-only; nothing here ever writes under CODEX_HOME.
+function listedCodexModels(text) {
   let models;
-  try { models = JSON.parse(text)?.models; } catch { return []; }
-  if (!Array.isArray(models)) return [];
+  try { models = JSON.parse(text)?.models; } catch { return null; }
+  if (!Array.isArray(models)) return null;
   return models
     .filter(m => m && m.visibility === 'list' && isSafeModelName(m.slug))
     .sort((a, b) => (Number(a.priority) || 0) - (Number(b.priority) || 0))
     .map(m => m.slug);
 }
 
-export function discoverModels({ env = process.env, exists = (f) => commandExists(f, env), read = (p) => readFileSync(p, 'utf8') } = {}) {
+export const parseCodexModels = (text) => listedCodexModels(text) ?? [];
+
+// The same codex, found the same way, the board launches workers with. No
+// shell. On Windows the npm install is codex.cmd, which execFile will not run
+// without one, so there this fails and the cache is read instead.
+export function runCodexModels(env) {
+  return new Promise((resolve, reject) => {
+    execFile(resolveExecutable('codex', env) ?? 'codex', ['debug', 'models'],
+      { env, timeout: 10_000, maxBuffer: 32 * 1024 * 1024, windowsHide: true },
+      (err, stdout) => (err ? reject(err) : resolve(stdout)));
+  });
+}
+
+export async function discoverModels({
+  env = process.env, exists = (f) => commandExists(f, env), read = (p) => readFileSync(p, 'utf8'),
+  run = runCodexModels, log = console.log,
+} = {}) {
   let codex = [];
   if (exists('codex')) {
-    try { codex = parseCodexModels(read(join(codexHome(env), 'models_cache.json'))); } catch { /* no cache yet */ }
+    let source = '`codex debug models`';
+    codex = await run(env).then(listedCodexModels, () => null);
+    if (!codex) {
+      source = 'models_cache.json';
+      try { codex = parseCodexModels(read(join(codexHome(env), 'models_cache.json'))); } catch { codex = []; source = 'nowhere (no models_cache.json either)'; }
+    }
+    log(`  Models: Codex's from ${source}`);
   }
   return { claude: exists('claude') ? [...CLAUDE_ALIASES] : [], codex };
 }
@@ -55,19 +76,22 @@ const STALE_MS = 10 * 60 * 1000;
 let cached = { claude: [], codex: [] };
 let cachedAt = 0;
 
-export function refreshModels(opts) {
-  cached = discoverModels(opts);
+// cachedAt is stamped before the await so a second ask while Codex is still
+// answering does not start another run. It never rejects: callers fire and
+// forget, and a failed look keeps the last answer.
+export async function refreshModels(opts) {
   cachedAt = Date.now();
+  try { cached = await discoverModels(opts); } catch (err) { console.error('  Models: discovery failed:', err); }
   return cached;
 }
 
 export function availableModels() { return cached; }
 
 // Whether a refresh changed anything, so the caller only repaints boards when it did.
-export function refreshIfStale(now = Date.now()) {
+export async function refreshIfStale(now = Date.now()) {
   if (now - cachedAt < STALE_MS) return false;
   const before = JSON.stringify(cached);
-  return JSON.stringify(refreshModels()) !== before;
+  return JSON.stringify(await refreshModels()) !== before;
 }
 
 export function startModelRefresh() {

package/server/pty.js

@@ -10,7 +10,7 @@ export { trackSyncFrames } from '../lib/helpers.js';
 import { resolveExecutable, isUsableCwd, commandExists, missingCommandMessage } from './command-path.js';
 import { RING_BUFFER_MAX } from './state.js';
 import { mintAgentToken, authEnabled } from './auth.js';
-import { writeMcpConfig, removeMcpConfig, withMcpConfig, takesMcpConfig, withApprovalHook } from './agent-mcp.js';
+import { writeMcpConfig, removeMcpConfig, withMcpConfig, takesMcpConfig, withApprovalHook, withCodexWorkerTools } from './agent-mcp.js';
 import { broadcastJobs, requestDispatch } from './jobs.js';
 import { flushMessages, dropMessages } from './messages.js';
 import { sessionAgentFromCommand, permissionFlagsFromCommand } from '../lib/jobs.js';
@@ -244,7 +244,11 @@ export function createSessionFromConfig({ sessionId, name, color, command, repoP
   // use it — a plain `bash` tab does not need one.
   const mcpConfigPath = takesMcpConfig(file) ? writeMcpConfig(sessionId, agentToken) : null;
   const codexTrust = autoTrust && sessionAgentFromCommand(command) === 'codex';
-  const mcpArgs = withMcpConfig(file, codexTrust ? [...codexTrustArgs(worktreePath), ...args] : args, mcpConfigPath);
+  const ownArgs = codexTrust ? [...codexTrustArgs(worktreePath), ...args] : args;
+  // Codex has no hook yet, but its worker on Billion's card still gets the
+  // same board tools pre-allowed. Inside withMcpConfig, whose server table
+  // override would otherwise replace them.
+  const mcpArgs = withMcpConfig(file, approvalsToBillion ? withCodexWorkerTools(file, ownArgs, mcpConfigPath) : ownArgs, mcpConfigPath);
   // A worker on one of Billion's cards asks Billion before it asks a person
   // (server/approvals.js) — where the CLI can be hooked, which today is
   // Claude Code only. Recorded as whether the hook actually went in.

package/server/ws.js

@@ -635,7 +635,7 @@ export function setupWebSocket(wss, { createSession, killSession, startBillion }
         // The card form opening: look again if the list is over 10 minutes
         // old, so a CLI installed since shows up without a restart.
         case 'models-refresh': {
-          if (refreshIfStale()) broadcastJobs(broadcast);
+          refreshIfStale().then(changed => { if (changed) broadcastJobs(broadcast); }).catch(err => console.error('models-refresh:', err));
           break;
         }
         case 'job-pause': {