@ccoalm/ccl-skills 0.15.4 → 0.16.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh

@@ -698,18 +698,31 @@ if [ "${1:-}" = mcp ] && [ "${2:-}" = list ]; then
   fi
   python3 - "$@" <<'PY_MCP_LIST'
 import json, os, sys, tomllib
+from pathlib import Path
 
 arguments = iter(sys.argv[1:])
 servers = {}
-inherited_names = {
-    "inherited_mcp": "unrelated",
-    "inherited_mcp_dot": "unrelated.name",
-    "inherited_mcp_space": "unrelated name",
-    "inherited_mcp_quote": 'unrelated"name',
-}
-inherited_name = inherited_names.get(os.environ.get("STUB_BEHAVIOR"))
-if inherited_name is not None:
-    servers[inherited_name] = {"command": "/bin/false", "args": [], "enabled": True}
+plugin_sourced = set()
+# Inherited servers come from the home the CLI was actually handed, never from
+# the test's own environment: whether the reviewer sees a user's server is
+# exactly the question, and a stub that injects one regardless of the home
+# could not tell a private home from the user's.
+home = Path(os.environ.get("CODEX_HOME", ""))
+home_config = home / "config.toml" if os.environ.get("CODEX_HOME") else None
+if home_config is not None and home_config.exists():
+    try:
+        home_data = tomllib.loads(home_config.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+        home_data = {}
+    for inherited_name, inherited in (home_data.get("mcp_servers") or {}).items():
+        if isinstance(inherited, dict):
+            servers[inherited_name] = dict(inherited)
+            servers[inherited_name].setdefault("enabled", True)
+# A plugin contributes its server outside `mcp_servers`, which is why an
+# override under that table cannot reach it.
+if os.environ.get("CODEX_HOME") and (home / "plugins" / "provided.json").exists():
+    servers["plugin_provided"] = {"command": "/bin/false", "args": [], "enabled": True}
+    plugin_sourced.add("plugin_provided")
 for argument in arguments:
     if argument in {"-c", "--config"}:
         # Codex splits the override path separately from its TOML value;
@@ -724,18 +737,76 @@ for argument in arguments:
         else:
             continue
         for name, settings in configured_servers.items():
+            if name in plugin_sourced:
+                # A plugin contributes its server outside `mcp_servers`, so an
+                # override under that table builds an entry with no transport
+                # and the CLI refuses to load the configuration at all.
+                sys.stderr.write(
+                    "Error: failed to load bootstrap configuration\n\n"
+                    "Caused by:\n    invalid transport\n"
+                    "    in `mcp_servers." + name + "`\n")
+                sys.exit(1)
             servers.setdefault(name, {}).update(settings)
-print(json.dumps([
+rows = [
     {"name": name, "enabled": server.get("enabled", True),
      "transport": {"type": "stdio", "command": server["command"],
                    "args": server.get("args", [])}}
     for name, server in servers.items()
-]))
+]
+if os.environ.get("STUB_MALFORMED_DISABLED_ROW"):
+    # The malformed row is disabled: a check that filters before validating
+    # would never look at it.
+    bad = {"missing": {}, "empty": {"name": ""}, "nonstring": {"name": 7}}[
+        os.environ["STUB_MALFORMED_DISABLED_ROW"]]
+    rows.append({**bad, "enabled": False,
+                 "transport": {"type": "stdio", "command": "/bin/false", "args": []}})
+if os.environ.get("STUB_DUPLICATE_PACKET_ROW") == "1":
+    # A JSON array can carry the same name twice; a dict of servers cannot.
+    rows.append({"name": "code_review_packet", "enabled": False,
+                 "transport": {"type": "stdio", "command": "/bin/false", "args": []}})
+print(json.dumps(rows))
 PY_MCP_LIST
   exit $?
 fi
 touch "$state/codex_invoked"
 printf '%s' "$0" >"$state/codex_argv0"
+printf '%s' "${CODEX_HOME:-}" >"$state/codex_home"
+if [ "${STUB_REPLACE_AUTH_LINK:-}" = 1 ] && [ -n "${CODEX_HOME:-}" ]; then
+  rm -f "$CODEX_HOME/auth.json"
+  printf '%s\n' '{"tokens":{"access":"rotated"}}' >"$CODEX_HOME/auth.json"
+fi
+python3 - "${CODEX_HOME:-}" "$state/codex_home_shape" <<'PY_HOME_SHAPE'
+import json, os, sys, tomllib
+from pathlib import Path
+
+# The wrapper deletes its run directory on exit, so the private home can only
+# be inspected from inside the run.
+home = Path(sys.argv[1]) if sys.argv[1] else None
+shape = {"home": sys.argv[1], "config_keys": [], "has_mcp_servers": None,
+         "has_plugins": None, "auth_link": None}
+if home is not None:
+    config = home / "config.toml"
+    if config.exists():
+        try:
+            data = tomllib.loads(config.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, tomllib.TOMLDecodeError):
+            data = {"__unreadable__": True}
+        shape["config_keys"] = sorted(data)
+        shape["has_mcp_servers"] = "mcp_servers" in data
+        shape["model"] = data.get("model")
+        shape["model_reasoning_effort"] = data.get("model_reasoning_effort")
+        providers = data.get("model_providers")
+        shape["provider_keys"] = sorted(providers) if isinstance(providers, dict) else None
+    else:
+        shape["has_mcp_servers"] = False
+    shape["has_plugins"] = (home / "plugins").exists()
+    auth = home / "auth.json"
+    if auth.is_symlink():
+        shape["auth_link"] = os.readlink(auth)
+    elif auth.exists():
+        shape["auth_link"] = "__regular_file__"
+Path(sys.argv[2]).write_text(json.dumps(shape), encoding="utf-8")
+PY_HOME_SHAPE
 printf '%s' "${CMUX_CODEX_HOOKS_DISABLED:-}" >"$state/codex_cmux_hooks_disabled"
 last_message=""
 has_model=no
@@ -802,6 +873,76 @@ if [ "$behavior" = "no_events" ]; then
 fi
 printf '%s\n' '{"type":"thread.started","thread_id":"test-thread"}'
 printf '%s\n' '{"type":"turn.started"}'
+# Transport failures whose only account of themselves is the event stream. The
+# CLI reports these on stdout, so a wrapper that classifies from stderr alone
+# cannot see them.
+if [ "$behavior" = "usage_limit_event" ]; then
+  printf '%s\n' '{"type":"error","message":"You'"'"'ve hit your usage limit. Visit https://example.invalid/settings/usage?A1B2C3QUERYSECRET to purchase more credits."}'
+  printf '%s\n' '{"type":"turn.failed","error":{"message":"You'"'"'ve hit your usage limit."}}'
+  exit 1
+fi
+if [ "$behavior" = "usage_limit_turn_failed" ]; then
+  printf '%s\n' '{"type":"turn.failed","error":{"message":"request rejected: rate limit exceeded for this account"}}'
+  exit 1
+fi
+if [ "$behavior" = "auth_event" ]; then
+  printf '%s\n' '{"type":"error","message":"unauthorized: the stored credential was rejected"}'
+  exit 1
+fi
+# The packet is untrusted, and the model quotes it. Quota vocabulary reaching
+# the classifier from here would let a reviewed diff choose its own reviewer.
+if [ "$behavior" = "quota_in_model_output" ]; then
+  printf '%s\n' '{"type":"item.completed","item":{"type":"agent_message","text":"the diff mentions 429 rate limit and quota handling CODEXLEAKMARKER7f3a"}}'
+  printf '%s\n' '{"type":"item.completed","item":{"type":"error","message":"429 quota rate limit CODEXLEAKMARKER7f3a"}}'
+  printf '%s\n' 'stub failed for an unrelated reason' >&2
+  exit 1
+fi
+if [ "$behavior" = "sensitive_streams" ]; then
+  # The credential-shaped values are assembled at runtime: written whole they
+  # would put a real `sk-` token shape in the repository, which the credential
+  # scanner in validate-skill.sh refuses -- correctly.
+  #
+  # They travel on the EVENT stream, because that is the stream the receipt
+  # reads. A fixture that put them on stderr would leave every redaction
+  # assertion below vacuously green.
+  python3 - "$HOME" 'livetoken00000000000000' 'urlsecretvalue' <<'PY_SENSITIVE'
+import json, sys
+# Both credential shapes are assembled here rather than written literally. A
+# `sk-` token is refused by validate-skill.sh, and a credentialed URL trips the
+# review gate's own egress tripwire on every later review of this repository --
+# both scanners behaving correctly on a fixture that only looks real.
+# The password carries a literal "@": a userinfo rule that stops at the first
+# one leaves the tail of the password in the receipt.
+# The host carries no dot: with one, the userinfo tail plus host reads as an
+# email address, and a reviewer quoting the finding puts that shape into a
+# receipt the public-sanitization gate then refuses.
+credentialed_url = "https://proxyuser:p" + "@" + "ss" + sys.argv[3] + "@" + "localhost/path"
+print(json.dumps({"type": "error", "message": (
+    "failed while reading " + sys.argv[1] + "/private/thing"
+    " sk-" + sys.argv[2] + " token=supersecretvalue"
+    " access_token=accesssecretvalue client_secret=clientsecretvalue"
+    ' {"refresh_token": "refreshsecretvalue"}'
+    " session=sessionsecretvalue cookie=cookiesecretvalue auth=authsecretvalue"
+    " code=codesecretvalue bearer=bearersecretvalue sid=sidsecretvalue"
+    " " + credentialed_url +
+    ' quoted="quotedsecretvalue more of it"'
+)}))
+PY_SENSITIVE
+  printf 'STDERRONLYMARKER5z should never reach the receipt\n' >&2
+  exit 1
+fi
+if [ "$behavior" = "silent_failure" ]; then
+  exit 1
+fi
+if [ "$behavior" = "stderr_only" ]; then
+  python3 -c 'print("startup noise line. " * 60)' >&2
+  printf 'the real failure is here STDERRTAILMARKER9x\n' >&2
+  exit 1
+fi
+if [ "$behavior" = "long_error_event" ]; then
+  python3 -c 'import json;print(json.dumps({"type":"error","message":"E"*4000}))'
+  exit 1
+fi
 case "$behavior" in
   packet_read|packet_search|packet_tampered) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
   pass|shell_disable_required|missing_shell_feature|removed_shell_feature|ignored_shell_disable|mcp_capability_missing|inherited_mcp|inherited_mcp_dot|inherited_mcp_space|inherited_mcp_quote|skills_budget_warning|skills_budget_warning_after_concern|hook_trust_warning|hook_trust_warning_started|hook_trust_warning_repeated_after_concern|unknown_error_valid_result) printf '%s\n' '{"status":"passed","concern_results":[{"concern":"correctness","conclusion":"Independently checked correctness against the frozen candidate."}],"findings":[]}' >"$last_message" ;;
@@ -1802,16 +1943,29 @@ out="$(run_codex packet_tampered)"; rc=$?
 check "Codex rejects altered packet tool bytes through wrapper and parser" \
   '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
 
-for inherited_mcp_case in inherited_mcp inherited_mcp_dot inherited_mcp_space inherited_mcp_quote; do
-  case "$inherited_mcp_case" in
-    inherited_mcp) inherited_mcp_name=unrelated ;;
-    inherited_mcp_dot) inherited_mcp_name=unrelated.name ;;
-    inherited_mcp_space) inherited_mcp_name='unrelated name' ;;
-    inherited_mcp_quote) inherited_mcp_name='unrelated"name' ;;
-  esac
+# A user's own server, however its name is spelled, must not reach the reviewer
+# and must not be touched: the wrapper neither disables it nor names it.
+inherited_index=0
+for inherited_mcp_name in 'unrelated' 'unrelated.name' 'unrelated name' 'unrelated"name'; do
+  inherited_index=$((inherited_index + 1))
+  inherited_source="$WORK/codex-inherited-$inherited_index"
+  mkdir -p "$inherited_source"
+  python3 - "$inherited_source/config.toml" "$inherited_mcp_name" <<'PY_INHERITED_SOURCE'
+import json, sys
+from pathlib import Path
+
+Path(sys.argv[1]).write_text(
+    "[mcp_servers]\n"
+    + json.dumps(sys.argv[2])
+    + ' = { command = "/bin/false", args = [] }\n',
+    encoding="utf-8",
+)
+PY_INHERITED_SOURCE
+  printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$inherited_source/auth.json"
+  chmod 0600 "$inherited_source/auth.json"
   rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
-  out="$(run_codex "$inherited_mcp_case")"; rc=$?
-  inherited_mcp_disabled="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_DISABLED'
+  out="$(run_codex pass claude "$inherited_source")"; rc=$?
+  inherited_mcp_untouched="$(python3 - "$inherited_mcp_name" "$WORK/state/codex_configs" <<'PY_MCP_UNTOUCHED'
 import sys, tomllib
 from pathlib import Path
 
@@ -1821,15 +1975,140 @@ for override in path.read_text().splitlines() if path.exists() else []:
     key, value = override.split("=", 1)
     if key.strip() == "mcp_servers":
         tables.append(tomllib.loads("servers=" + value)["servers"])
+    elif key.strip().startswith("mcp_servers."):
+        tables.append({key.strip().split(".")[1]: {}})
 print(len(tables) == 1
-      and tables[0].get(sys.argv[1], {}).get("enabled") is False
-      and "code_review_packet" in tables[0])
-PY_MCP_DISABLED
+      and sys.argv[1] not in tables[0]
+      and list(tables[0]) == ["code_review_packet"])
+PY_MCP_UNTOUCHED
 )"
-  check "Codex encodes and disables the inherited MCP key ($inherited_mcp_case)" \
-    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_disabled" = True ]'
+  check "Codex never reaches or names the user's own MCP server ($inherited_mcp_name)" \
+    '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ] && [ "$inherited_mcp_untouched" = True ]'
 done
 
+# The shape that used to dead-end the preflight: a server contributed outside
+# `mcp_servers`, which no override under that table can reach.
+plugin_source="$WORK/codex-plugin-source"
+mkdir -p "$plugin_source/plugins"
+printf '%s\n' '{"server":"plugin_provided"}' >"$plugin_source/plugins/provided.json"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$plugin_source/auth.json"
+chmod 0600 "$plugin_source/auth.json"
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+out="$(run_codex pass claude "$plugin_source")"; rc=$?
+check "Codex reviews on a host whose plugin contributes an MCP server" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/codex_invoked" ]'
+
+# A canned verdict cannot prove the repair: a CLI that accepts the configuration
+# and still refuses read_packet would pass every assertion above. This one
+# replays the real packet server's bytes through the parser on that same host.
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_packet_call"
+out="$(run_codex packet_read claude "$plugin_source")"; rc=$?
+check "Codex completes a real frozen packet read on a plugin-contributing host" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(cat "$WORK/state/codex_packet_call")" = read_packet ]'
+
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_home"
+mkdir -p "$WORK/codex-foreign-source"
+printf '%s\n' 'profile = "review"' '' '[profiles.review]' 'model = "seeded-model"' 'model_reasoning_effort = "xhigh"' \
+  '' '[model_providers."proxy.v1"]' 'name = "line one\\nline two"' '' '[mcp_servers.foreign]' 'command = "/bin/false"' 'args = []' \
+  >"$WORK/codex-foreign-source/config.toml"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$WORK/codex-foreign-source/auth.json"
+chmod 0600 "$WORK/codex-foreign-source/auth.json"
+out="$(run_codex pass claude "$WORK/codex-foreign-source")"; rc=$?
+private_home_shape="$(python3 - "$WORK/state/codex_home_shape" "$WORK/codex-foreign-source" <<'PY_PRIVATE_HOME'
+import json, os, sys
+from pathlib import Path
+
+
+def normalized(value):
+    # TMPDIR here can carry a trailing separator, so the recorded and expected
+    # paths differ as strings while naming the same file.
+    return Path(os.path.normpath(str(value))) if value else None
+
+
+path = Path(sys.argv[1])
+if not path.exists():
+    print("no-run-observed"); raise SystemExit
+shape = json.loads(path.read_text(encoding="utf-8"))
+source = normalized(sys.argv[2])
+home = normalized(shape.get("home"))
+if home is None or home == source or source in home.parents:
+    print("shares-user-home"); raise SystemExit
+if shape.get("has_mcp_servers") is not False or shape.get("has_plugins") is not False:
+    print("inherited-servers-present"); raise SystemExit
+if shape.get("model") != "seeded-model" or shape.get("model_reasoning_effort") != "xhigh":
+    print("model-preference-lost"); raise SystemExit
+if shape.get("provider_keys") != ["proxy.v1"]:
+    print("provider-key-mangled"); raise SystemExit
+if normalized(shape.get("auth_link")) != source / "auth.json":
+    print("credential-not-linked"); raise SystemExit
+print("private")
+PY_PRIVATE_HOME
+)"
+check "Codex reviews from a private home that never carried the user's MCP servers" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$private_home_shape" = private ]'
+
+# The link back to the user's credential is what keeps a rotated token in the
+# user's own file; a CLI that replaced it with a regular file would leave the
+# credential inside this run directory instead. Prove the post-run check fires.
+rm -f "$WORK/state/codex_invoked"
+# A host that names a profile it does not define must not quietly review on a
+# different model; the wrapper refuses instead of falling through.
+mkdir -p "$WORK/codex-broken-profile"
+printf '%s\n' 'profile = "missing"' 'model = "top-level-model"' >"$WORK/codex-broken-profile/config.toml"
+printf '%s\n' '{"tokens":{"access":"seeded"}}' >"$WORK/codex-broken-profile/auth.json"
+chmod 0600 "$WORK/codex-broken-profile/auth.json"
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex pass claude "$WORK/codex-broken-profile")"; rc=$?
+check "Codex refuses a selected profile it cannot resolve instead of substituting a model" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_home_preferences_unreadable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+# A malformed row that happens to be disabled must still fail the preflight;
+# filtering before validating would step over it.
+for malformed in missing empty nonstring; do
+  export STUB_MALFORMED_DISABLED_ROW="$malformed"
+  rm -f "$WORK/state/codex_invoked"
+  out="$(run_codex pass)"; rc=$?
+  unset STUB_MALFORMED_DISABLED_ROW
+  check "Codex refuses a malformed disabled MCP row ($malformed name)" \
+    '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+done
+
+# The enabled-set check alone would accept one correctly bound row beside a
+# disabled duplicate of the same name, so the uniqueness claim needs its own case.
+export STUB_DUPLICATE_PACKET_ROW=1
+rm -f "$WORK/state/codex_invoked"
+out="$(run_codex pass)"; rc=$?
+unset STUB_DUPLICATE_PACKET_ROW
+check "Codex refuses a duplicated packet-server row even when the duplicate is disabled" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_packet_tools_unavailable ] && [ ! -e "$WORK/state/codex_invoked" ]'
+
+export STUB_REPLACE_AUTH_LINK=1
+out="$(run_codex pass claude "$WORK/codex-foreign-source")"; rc=$?
+unset STUB_REPLACE_AUTH_LINK
+check "Codex refuses when the run replaced the linked credential with a file" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = codex_runtime_home_credential_moved ] && [ "$(field reason_code "$out")" = binding_mismatch ] && [ "$(field cascade_eligible "$out")" = False ]'
+
+rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_configs"
+out="$(run_codex pass)"; rc=$?
+packet_approval_mode="$(python3 - "$WORK/state/codex_configs" <<'PY_MCP_APPROVAL'
+import sys, tomllib
+from pathlib import Path
+
+path = Path(sys.argv[1])
+servers = {}
+for override in path.read_text().splitlines() if path.exists() else []:
+    key, value = override.split("=", 1)
+    if key.strip() == "mcp_servers":
+        servers = tomllib.loads("servers=" + value)["servers"]
+packet = servers.get("code_review_packet", {})
+print(packet.get("default_tools_approval_mode") == "approve"
+      and all(other.get("default_tools_approval_mode") is None
+              for name, other in servers.items() if name != "code_review_packet"))
+PY_MCP_APPROVAL
+)"
+check "Codex declares the packet server auto-approved without widening the sandbox" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$packet_approval_mode" = True ] && [ "$(cat "$WORK/state/codex_read_only")" = yes ]'
+
 rm -f "$WORK/state/codex_invoked" "$WORK/state/codex_help_invoked"
 probe_started=$SECONDS
 out="$(run_codex help_hang)"; rc=$?
@@ -1977,6 +2256,98 @@ out="$(run_codex signal_exit)"; rc=$?
 check "Codex process signals are terminal operator interrupts" \
   '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = operator_interrupt ] && [ "$(field cascade_eligible "$out")" = False ]'
 
+# The CLI reports supply and credential failures as structured events on stdout,
+# not on stderr. Classifying from stderr alone turns a cascade-eligible quota
+# into a terminal unknown failure and stops the whole reviewer lane.
+out="$(run_codex usage_limit_event)"; rc=$?
+check "Codex reads a usage limit reported only on the event stream" \
+  '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = quota ] && [ "$(field cascade_eligible "$out")" = True ]'
+
+out="$(run_codex usage_limit_turn_failed)"; rc=$?
+check "Codex reads a rate limit carried by a failed turn" \
+  '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = quota ] && [ "$(field cascade_eligible "$out")" = True ]'
+
+out="$(run_codex auth_event)"; rc=$?
+check "Codex reads a credential rejection reported only on the event stream" \
+  '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = provider_unavailable ] && [ "$(field cascade_eligible "$out")" = True ]'
+
+# Only the transport's own top-level errors classify. Model-authored content
+# arrives nested under `item`, and the packet it quotes is untrusted.
+out="$(run_codex quota_in_model_output)"; rc=$?
+check "Codex refuses to classify from packet-derived model output" \
+  '[ "$rc" = 2 ] && [ "$(field reason_code "$out")" = unknown_client_failure ] && [ "$(field cascade_eligible "$out")" = False ]'
+
+
+
+
+# The one invariant that replaces every redaction row: no input can influence
+# the receipt's text, because there is none derived from the run. The fixture
+# below carries home paths, several credential-assignment shapes, URL userinfo
+# with a separator in the password, and a stderr-only marker; none of it can
+# reach the receipt, and the check is equality with a constant rather than the
+# absence of a list of shapes.
+DIAG_CONSTANT="the transport output for this failure is in transport_run_dir"
+out="$(run_codex sensitive_streams)"; rc=$?
+diag="$(field transport_diagnostic "$out")"
+check "Codex records a receipt text no input can influence" \
+  '[ "$rc" = 2 ] && [ "$diag" = "$DIAG_CONSTANT" ]'
+
+out="$(run_codex silent_failure)"; rc=$?
+check "Codex records the same text when the transport says nothing" \
+  '[ "$rc" = 2 ] && [ "$(field transport_diagnostic "$out")" = "$DIAG_CONSTANT" ]'
+
+out="$(run_codex stderr_only)"; rc=$?
+diag="$(field transport_diagnostic "$out")"
+check "Codex does not quote stderr into the receipt" \
+  '[ "$diag" = "$DIAG_CONSTANT" ]'
+
+# The streams have to survive the failure. Deleting them with the run directory
+# is the defect this whole round started from.
+run_dir="$(field transport_run_dir "$out")"
+# The wrapper records a path under $HOME with $HOME replaced, so a committed
+# receipt carries no username. Expand it before testing the directory, or this
+# row false-REDs on any host whose TMPDIR sits under $HOME.
+case "$run_dir" in "~/"*) run_dir="$HOME/${run_dir#\~/}" ;; esac
+check "Codex preserves the run directory on a transport failure and names it" \
+  '[ -n "$run_dir" ] && [ -d "$run_dir" ] && [ -s "$run_dir/stderr.log" ] && grep -q STDERRTAILMARKER9x "$run_dir/stderr.log"'
+
+check "Codex keeps the preserved run directory private" \
+  '[ "$(dir_mode "$run_dir")" = 700 ]'
+
+# The eliding compares physical paths, so a home spelled with a trailing slash
+# -- or through a symlink -- still elides. Comparing the literal `$HOME` string
+# would put the username in a committed receipt on exactly those hosts.
+# Invoked directly rather than through run_codex: that helper pins TMPDIR, and
+# this row needs a TMPDIR that sits under the home it is testing.
+mkdir -p "$WORK/fakehome/tmp"
+out="$(STUB_BEHAVIOR=stderr_only REVIEW_WRAPPER_TEST_STATE="$WORK/state" \
+  PATH="$WORK/bin:$PATH" TMPDIR="$WORK/fakehome/tmp" HOME="$WORK/fakehome/" \
+  CODEX_HOME="$WORK/codex-source" TEST_DIFF_PATH="$WORK/diff.patch" \
+  TEST_PROFILE_PATH="$WORK/review-profile.json" \
+  bash "$DIR/codex_review.sh" --implementer-family claude \
+    --diff-file "$WORK/diff.patch" --review-profile-file "$WORK/review-profile.json" \
+    --mode review --timeout 30)"; rc=$?
+run_dir="$(field transport_run_dir "$out")"
+# HOME=/ is real in root and arbitrary-uid containers. Treated as a home
+# spelling it would rewrite every separator in the excerpt.
+out2="$(STUB_BEHAVIOR=sensitive_streams REVIEW_WRAPPER_TEST_STATE="$WORK/state" \
+  PATH="$WORK/bin:$PATH" TMPDIR="$WORK/tmp" HOME=/ \
+  CODEX_HOME="$WORK/codex-source" TEST_DIFF_PATH="$WORK/diff.patch" \
+  TEST_PROFILE_PATH="$WORK/review-profile.json" \
+  bash "$DIR/codex_review.sh" --implementer-family claude \
+    --diff-file "$WORK/diff.patch" --review-profile-file "$WORK/review-profile.json" \
+    --mode review --timeout 30)"
+dir2="$(field transport_run_dir "$out2")"
+check "Codex does not treat a separator-only home as a path to elide" \
+  'case "$dir2" in "~"*) false ;; /*) [ -d "$dir2" ] ;; *) false ;; esac'
+
+check "Codex elides a home path spelled with a trailing slash" \
+  'case "$run_dir" in "~/"*) case "$run_dir" in *fakehome*) false ;; *) true ;; esac ;; *) false ;; esac'
+
+out="$(run_codex pass)"; rc=$?
+check "Codex adds no diagnostic field to a successful review" \
+  '[ "$rc" = 0 ] && json_lacks_key "$out" transport_diagnostic && json_lacks_key "$out" transport_run_dir'
+
 echo '----'
 if [ "$fails" -eq 0 ]; then
   echo cli_review_wrapper_tests_ok