@brunobracaioli/aibrain 0.4.0-beta.7 → 0.4.0-beta.9

package/README.md

@@ -58,7 +58,7 @@ notes or lock files to work around a reported storage error.
 
 The reviewed native compatibility set is Claude Code 2.1.294, 2.1.295, 2.1.296,
 2.1.299, 2.1.300, 2.1.301, 2.1.302 or 2.1.303, and Codex CLI 0.161.0,
-0.162.0, 0.162.1, 0.163.0 or 0.164.0. A newer stable Codex 0.x release may continue only
+0.162.0, 0.162.1, 0.163.0, 0.164.0 or 0.166.0 (0.165.0 was never qualified). A newer stable Codex 0.x release may continue only
 after its locally generated experimental protocol schemas and transport flags
 match the bundled adapter contract; prereleases, older releases and new majors
 remain rejected. Starting with beta14, newer stable Claude 2.1 patches can
@@ -74,6 +74,11 @@ record formats. Native launch/resume qualification is separate from a new
 model/JEV compaction qualification. A later native release that changes the
 consumed contract can still require an AI Brain compatibility update.
 
+`0.4.0-beta.9` refreshes the bundled contract to Codex 0.166.0. Its delta is
+additive: optional item timing, an image generation id, an attach-to-source fork
+flag and two error codes. See the
+[Codex 0.166 qualification record](../../docs/reference/codex-166-compatibility-2026-11-04.md).
+
 The Codex terminal bridge permits the native session picker's separate read-only
 connection while keeping the primary conversation and monitor intact. A picker
 cannot compact, start a turn, inject history or take ownership of the primary

package/dist/claude-observation.mjs

@@ -16,7 +16,7 @@ export const MAX_LOG_FILES = 3;
 const LOCK_WAIT_MS = 250;
 const LOCK_STALE_MS = 30_000;
 const ADMISSION_MS = 60 * 60 * 1000;
-export const ADAPTER_VERSION = '0.4.0-beta.7';
+export const ADAPTER_VERSION = '0.4.0-beta.9';
 const MAX_DIAGNOSTIC_COUNT = 10_000_000;
 const MAX_DIAGNOSTIC_BYTES = 128 * 1024 * 1024;
 const CHECKPOINT_BACKENDS = new Set(['native_store', 'private_file']);

package/dist/cli.mjs

@@ -40,7 +40,7 @@ import { extensionsSummary, hooksCommand, mcpCommand } from './extensions-cli.mj
 import { sessionServers } from './mcp-servers.mjs';
 import { anyFormatter } from './guardrails/format.mjs';
 
-const VERSION = '0.4.0-beta.7';
+const VERSION = '0.4.0-beta.9';
 // The command is `aisac`; `aibrain` is an alias installed from the same entry.
 const COMMAND = 'aisac';
 const ENDPOINT = 'https://mcp.ai-brain.aisac.cloud/mcp';

package/dist/codex-compatibility.mjs

@@ -26,7 +26,14 @@ const PAGINATION_CONTRACT_VALID =
       fingerprint.roots[PAGINATION_CONTRACT.response_schema]?.sha256 &&
     typeof PAGINATION_CONTRACT.graph_sha256 === 'string' &&
     PAGINATION_CONTRACT.graph_sha256.length === 64);
-const QUALIFIED_VERSIONS = new Set(['0.161.0', '0.162.0', '0.162.1', '0.163.0', '0.164.0']);
+const QUALIFIED_VERSIONS = new Set([
+  '0.161.0',
+  '0.162.0',
+  '0.162.1',
+  '0.163.0',
+  '0.164.0',
+  '0.166.0',
+]);
 const ANNOTATIONS = new Set([
   '$comment',
   'title',
@@ -475,7 +482,50 @@ export async function resolveCodexCompatibility(executable, baseEnvironment = pr
   }
 }
 
+/** @param {string} left @param {string} right */
+function compareStableVersions(left, right) {
+  const a = left.split('.').map(Number);
+  const b = right.split('.').map(Number);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = (a[index] ?? 0) - (b[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+
+/** The newest Codex release this client was qualified against. */
+export const LATEST_QUALIFIED_CODEX = /** @type {string} */ (
+  [...QUALIFIED_VERSIONS].sort(compareStableVersions).at(-1)
+);
+
+// Rejections a user fixes by installing a qualified Codex (or a newer aisac):
+// the installed release's contract or transport differs from the bundled one.
+const CONTRACT_REJECTIONS = new Set([
+  'protocol_schema_mismatch',
+  'protocol_method_missing',
+  'schema_root_missing_or_invalid',
+  'schema_set_too_large',
+  'schema_generation_failed',
+  'transport_flags_missing',
+  'protocol_probe_failed',
+]);
+
+/** @param {{reason:string, version:string|null}} decision @returns {string|null} */
+export function codexCompatibilityRemedy(decision) {
+  const detected = decision.version === null ? 'The installed Codex' : `Codex ${decision.version}`;
+  const reinstall = `npm install -g @openai/codex@${LATEST_QUALIFIED_CODEX}`;
+  if (CONTRACT_REJECTIONS.has(decision.reason))
+    return `${detected} is not qualified by this aisac (newest qualified: ${LATEST_QUALIFIED_CODEX}). Install the qualified Codex with \`${reinstall}\`, or check for an aisac release that qualifies it with \`npm install -g @aisac/cli@beta\`.`;
+  if (decision.reason === 'version_unqualified')
+    return `${detected} is older than this aisac supports. Update it with \`${reinstall}\`.`;
+  if (decision.reason === 'version_not_stable_0x')
+    return `${detected} is not a stable 0.x release. Install a qualified one with \`${reinstall}\`.`;
+  return null;
+}
+
 /** @param {{reason:string, version:string|null}} decision @returns {string} */
 export function codexCompatibilityError(decision) {
-  return `codex_protocol_incompatible:${decision.reason}:detected=${decision.version ?? 'unavailable'};run aisac doctor --json`;
+  const coded = `codex_protocol_incompatible:${decision.reason}:detected=${decision.version ?? 'unavailable'};run aisac doctor --json`;
+  const remedy = codexCompatibilityRemedy(decision);
+  return remedy === null ? coded : `${coded}\n${remedy}`;
 }

package/dist/codex-protocol-fingerprint.json

@@ -1,13 +1,13 @@
 {
   "version": 3,
-  "native": "0.164.0",
+  "native": "0.166.0",
   "consumed_pagination": {
     "method": "thread/turns/list",
     "request_schema": "v2/ThreadTurnsListParams.json",
     "response_schema": "v2/ThreadTurnsListResponse.json",
     "request_schema_sha256": "29717980579b77eb4c7cbd1118dd238fcb3e010f3ef5236d74bd4e4f6e02c005",
-    "response_schema_sha256": "f46dddf14b7b6e8e484cb998a7d0b2efa3250167b9f2c366b83b22fe494c250f",
-    "graph_sha256": "20ba733654372954440b0cbee2964230934d064b9c2c3ee3c4ed850b08f7e370",
+    "response_schema_sha256": "53d96dae44edcecee02d8dcce5645800a52a62444f288ff48376e99e506561c6",
+    "graph_sha256": "a9008170cbf190054a75f4a539db7fe271e30cf85a157ad27e2dc2192785f311",
     "ordering": "asc",
     "items_view": "full"
   },
@@ -18,7 +18,7 @@
     },
     "v2/ThreadTurnsListResponse.json": {
       "methods": null,
-      "sha256": "f46dddf14b7b6e8e484cb998a7d0b2efa3250167b9f2c366b83b22fe494c250f"
+      "sha256": "53d96dae44edcecee02d8dcce5645800a52a62444f288ff48376e99e506561c6"
     },
     "ClientRequest.json": {
       "methods": [
@@ -39,7 +39,7 @@
         "config/read",
         "account/read"
       ],
-      "sha256": "415beba5414aeb1af34954de5c3d76c0f5a1c78f30f0a51cb291c471e920b365"
+      "sha256": "950bcefcb938bdf04b84305fdcf6767b05db782a0853ef1356fe05d607b0f5b3"
     },
     "ClientNotification.json": {
       "methods": ["initialized"],
@@ -78,7 +78,7 @@
         "thread/compacted",
         "warning"
       ],
-      "sha256": "590a474f19639e9c1b57238354c89ab0ef5f9d4022561ba2ed5f286cdf254181"
+      "sha256": "7f739a3a39a248692147f1a5b2212f440d36350bf2bcca0a5393abd32c188bdf"
     },
     "JSONRPCResponse.json": {
       "methods": null,
@@ -106,7 +106,7 @@
     },
     "v2/ThreadForkResponse.json": {
       "methods": null,
-      "sha256": "b1e26ab55f9fcbe108d325491d29678040d0776953093626fbcd9608593df31c"
+      "sha256": "36af2650a2f2fddd081dd6cb92a91632d0fc12e819fb47ceadcaf238990bec1e"
     },
     "v2/ThreadInjectItemsResponse.json": {
       "methods": null,
@@ -114,15 +114,15 @@
     },
     "v2/ThreadReadResponse.json": {
       "methods": null,
-      "sha256": "2de20539e09dd7110bd5b705f519288329bacc162d1c14c0c4af33ff27085e24"
+      "sha256": "136c873857d2ba0e1aa0836d96ec8d81bfc30a9209e058226e910e0179563e6b"
     },
     "v2/ThreadResumeResponse.json": {
       "methods": null,
-      "sha256": "bf6130a2dd9494a878e406f2d13535930ebc56f1a66cc1f597528537652a6a65"
+      "sha256": "ea37ce77b7a1b2fff78191dac117013ef817cfe1f0ab04f95d1bdc847ceacbb9"
     },
     "v2/ThreadStartResponse.json": {
       "methods": null,
-      "sha256": "b1e26ab55f9fcbe108d325491d29678040d0776953093626fbcd9608593df31c"
+      "sha256": "36af2650a2f2fddd081dd6cb92a91632d0fc12e819fb47ceadcaf238990bec1e"
     }
   },
   "requiredClientFlags": ["app-server", "--listen", "stdio://"],

package/dist/extensions-catalog.mjs

@@ -167,6 +167,10 @@ export function hookIds() {
  * @property {Readonly<Record<CatalogLocale, string>>} [loginNote] Why and how this login differs.
  * @property {Readonly<Record<CatalogLocale, string>>} description
  * @property {Readonly<Record<CatalogLocale, string>>} reaches What the server can reach (FR7).
+ * @property {readonly string[]} [blockedTools] Tools that spend money, removed in both
+ *   clients whatever the user's permission mode is (FR7.2). Exact names.
+ * @property {readonly string[]} [blockedToolPrefixes] Name prefixes removed in Claude Code
+ *   only, through a glob deny rule; Codex documents exact names only (FR7.2).
  */
 
 /** Session name of a catalog server, so it never collides with the user's own. */
@@ -215,6 +219,9 @@ export const MCP_CATALOG = Object.freeze([
     source: 'https://github.com/supabase-community/supabase-mcp',
     transport: { type: 'http', url: 'https://mcp.supabase.com/mcp?read_only=true' },
     login: 'host-oauth',
+    // read_only=true should already leave these out; the vendor does not publish
+    // what it removes, so they are blocked as a second layer (FR7.2).
+    blockedTools: ['create_project', 'confirm_cost', 'create_branch'],
     description: {
       en: "Supabase's hosted server, read-only: tables, SQL, logs, advisors and docs.",
       'pt-BR':
@@ -234,15 +241,19 @@ export const MCP_CATALOG = Object.freeze([
     source: 'https://vercel.com/docs/agent-resources/vercel-mcp',
     transport: { type: 'http', url: 'https://mcp.vercel.com' },
     login: 'host-oauth',
+    // buy_domain charges the team after a quote, and its confirm flag is a model
+    // argument; a domain transfer may be charged (FR7.1, FR7.2).
+    blockedTools: ['buy_domain', 'create_or_transfer_domain'],
+    blockedToolPrefixes: ['buy_'],
     description: {
       en: "Vercel's hosted server: projects, deployments, logs, domains and environment variables.",
       'pt-BR':
         'Servidor hospedado da Vercel: projetos, deploys, logs, domínios e variáveis de ambiente.',
     },
     reaches: {
-      en: 'The teams you grant at login, with the access of your Vercel user: projects, deployments, build and runtime logs, domains and DNS, and environment variables, including decrypted values. It also has write tools (deploy, change settings, DNS records) and no read-only mode, so keep the confirmation of each call on.',
+      en: 'The teams you grant at login, with the access of your Vercel user: projects, deployments, build and runtime logs, domains and DNS, and environment variables, including decrypted values. It also has write tools (deployments, environment variables, DNS records, firewall rules, project settings) and no read-only mode, so keep the confirmation of each call on. Buying domains is blocked by AISAC.',
       'pt-BR':
-        'Os times que você liberar no login, com o acesso do seu usuário Vercel: projetos, deploys, logs de build e de execução, domínios e DNS, e variáveis de ambiente, inclusive valores decifrados. Também tem ferramentas de escrita (deploy, configurações, registros DNS) e não tem modo somente leitura, então mantenha a confirmação de cada chamada ligada.',
+        'Os times que você liberar no login, com o acesso do seu usuário Vercel: projetos, deploys, logs de build e de execução, domínios e DNS, e variáveis de ambiente, inclusive valores decifrados. Também tem ferramentas de escrita (deploys, variáveis de ambiente, registros DNS, regras de firewall, configurações de projeto) e não tem modo somente leitura, então mantenha a confirmação de cada chamada ligada. A compra de domínios é bloqueada pela AISAC.',
     },
   },
   {

package/dist/extensions-cli.mjs

@@ -273,6 +273,11 @@ export function serverInfo(entry, locale, item) {
             note: 'Hosted by the vendor: its tools can change without a client release, so keep the confirmation of each call on.',
           },
     reaches: entry.reaches[locale],
+    // Tools that spend money, removed whatever the permission mode is (FR7.2).
+    blockedTools: [...(entry.blockedTools ?? [])],
+    ...(entry.blockedToolPrefixes === undefined
+      ? {}
+      : { blockedToolPrefixes: [...entry.blockedToolPrefixes] }),
     login,
     ...(variable === undefined ? {} : { tokenVariable: variable }),
     ...(entry.loginNote === undefined ? {} : { loginNote: entry.loginNote[locale] }),
@@ -293,6 +298,16 @@ function printInfo(info) {
   const where = info.transport.type === 'local' ? info.transport.command : info.transport.url;
   console.log(`Transport: ${info.transport.type}, ${where}. ${info.transport.note}`);
   console.log(`Reaches: ${info.reaches}`);
+  if (info.blockedTools.length > 0) {
+    const prefixes = info.blockedToolPrefixes ?? [];
+    const claudeOnly =
+      prefixes.length === 0
+        ? ''
+        : ` In Claude Code, also any tool whose name starts with ${prefixes.join(', ')}.`;
+    console.log(
+      `Blocked by AISAC, because they spend money: ${info.blockedTools.join(', ')}.${claudeOnly} They stay blocked even if you allow every tool or skip permission prompts.`,
+    );
+  }
   if (info.loginNote !== undefined) console.log(`Login: ${info.loginNote}`);
   console.log(`Log in from Claude Code: ${info.login.claude}`);
   console.log(`Log in from Codex: ${info.login.codex}`);

package/dist/launch.mjs

@@ -19,7 +19,13 @@ import {
   writeLaunchMarker,
 } from './engineering-pack.mjs';
 import { prepareGuardrails } from './guardrails-plugin.mjs';
-import { CODEX_MCP_ENV, claudeMcpEntries, mcpLaunchLines, sessionServers } from './mcp-servers.mjs';
+import {
+  CODEX_MCP_ENV,
+  claudeDenyRules,
+  claudeMcpEntries,
+  mcpLaunchLines,
+  sessionServers,
+} from './mcp-servers.mjs';
 import { enabledServerIds, readPreferences } from './extensions-preferences.mjs';
 import {
   CODEX_ENGINEERING_ENV,
@@ -561,6 +567,14 @@ export async function launchClaude(config, root, args, dependencies = {}) {
   for (const rule of [...userAllow, ...requiredAllow]) {
     if (!mergedAllow.includes(rule)) mergedAllow.push(rule);
   }
+  // Catalog tools that spend money stay denied whatever the user allows or the
+  // permission mode is (spec aisac-engineering-extensions FR7.2).
+  const userDeny = Array.isArray(userPermissions.deny) ? userPermissions.deny : [];
+  /** @type {unknown[]} */
+  const mergedDeny = [];
+  for (const rule of [...userDeny, ...claudeDenyRules()]) {
+    if (!mergedDeny.includes(rule)) mergedDeny.push(rule);
+  }
   const settings = {
     ...(launchArgs.settings?.sandbox === undefined ? {} : { sandbox: launchArgs.settings.sandbox }),
     pluginConfigs: {
@@ -570,6 +584,7 @@ export async function launchClaude(config, root, args, dependencies = {}) {
     permissions: {
       ...userPermissions,
       allow: mergedAllow,
+      deny: mergedDeny,
     },
   };
   try {

package/dist/mcp-servers.mjs

@@ -8,7 +8,7 @@
  * third-party credential: logins live in the host's own store, and a token
  * variable is only named, never read here.
  */
-import { MCP_SERVER_PREFIX, mcpById } from './extensions-catalog.mjs';
+import { MCP_CATALOG, MCP_SERVER_PREFIX, mcpById } from './extensions-catalog.mjs';
 import { tomlBasicString } from './codex-engineering.mjs';
 
 /** @typedef {import('./extensions-catalog.mjs').McpEntry} McpEntry */
@@ -80,7 +80,27 @@ export function claudeMcpEntries(entries) {
 }
 
 /**
- * Session-only `-c` overrides for the owned Codex app-server.
+ * Claude Code deny rules for the tools that spend money (FR7.2). They cover every
+ * catalog server, loaded or not, so the settings file can be written before the
+ * license is confirmed; a rule for a server that is not loaded matches nothing.
+ * Claude evaluates deny rules before allow rules, in every permission mode, and a
+ * deny rule removes the tool from the model's context (measured M1, Claude 2.1.318).
+ * @param {readonly McpEntry[]} [entries]
+ * @returns {string[]}
+ */
+export function claudeDenyRules(entries = MCP_CATALOG) {
+  return entries.flatMap((entry) => {
+    const prefix = `mcp__${serverName(entry.id)}__`;
+    return [
+      ...(entry.blockedTools ?? []).map((tool) => `${prefix}${tool}`),
+      ...(entry.blockedToolPrefixes ?? []).map((start) => `${prefix}${start}*`),
+    ];
+  });
+}
+
+/**
+ * Session-only `-c` overrides for the owned Codex app-server. A server with
+ * blocked tools gets `disabled_tools` (FR7.2; measured M2, Codex 0.164.0).
  * @param {readonly McpEntry[]} entries
  * @returns {string[]}
  */
@@ -88,6 +108,11 @@ export function codexMcpConfigArgs(entries) {
   return entries.flatMap((entry) => {
     const key = `mcp_servers.${serverName(entry.id)}`;
     const { transport } = entry;
+    const blocked = entry.blockedTools ?? [];
+    const disabled =
+      blocked.length === 0
+        ? []
+        : ['-c', `${key}.disabled_tools=[${blocked.map(tomlBasicString).join(',')}]`];
     if (transport.type === 'stdio')
       return [
         '-c',
@@ -96,6 +121,7 @@ export function codexMcpConfigArgs(entries) {
         `${key}.args=[${transport.args.map(tomlBasicString).join(',')}]`,
         '-c',
         `${key}.startup_timeout_sec=${STDIO_STARTUP_TIMEOUT_SEC}`,
+        ...disabled,
       ];
     return [
       '-c',
@@ -103,6 +129,7 @@ export function codexMcpConfigArgs(entries) {
       ...(transport.bearerEnv === undefined
         ? []
         : ['-c', `${key}.bearer_token_env_var=${tomlBasicString(transport.bearerEnv)}`]),
+      ...disabled,
     ];
   });
 }

package/dist/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.7",
+  "version": "0.4.0-beta.9",
   "type": "module"
 }

package/dist/platform.mjs

@@ -86,7 +86,7 @@ export function isTestedNativeVersion(client, version) {
     return /^(?:(?:claude(?:\s+code)?)\s+)?2\.1\.(?:294|295|296|299|300|301|302|303)(?:\s+\(Claude\s+Code\))?$/iu.test(
       value,
     );
-  return /^(?:codex(?:-cli)?\s+)?0\.16(?:1\.0|2\.0|2\.1|3\.0|4\.0)$/iu.test(value);
+  return /^(?:codex(?:-cli)?\s+)?0\.16(?:1\.0|2\.0|2\.1|3\.0|4\.0|6\.0)$/iu.test(value);
 }
 
 const TESTED_NATIVE_VERSIONS = Object.freeze({
@@ -100,7 +100,7 @@ const TESTED_NATIVE_VERSIONS = Object.freeze({
     '2.1.302',
     '2.1.303',
   ]),
-  codex: Object.freeze(['0.161.0', '0.162.0', '0.162.1', '0.163.0', '0.164.0']),
+  codex: Object.freeze(['0.161.0', '0.162.0', '0.162.1', '0.163.0', '0.164.0', '0.166.0']),
 });
 
 /** @param {'claude'|'codex'} client @param {string} version */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.7",
+  "version": "0.4.0-beta.9",
   "private": false,
   "description": "AISAC client for Claude Code and Codex: AI Brain memory, context management and AISAC Engineering",
   "license": "UNLICENSED",