@inetafrica/open-claudia 3.4.4 → 3.4.6

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v3.4.6 — Codex runs again: the gate stopped asking for the impossible
+
+- **Every Codex turn since Codex CLI 0.153.x failed with `OpenAI Codex is incompatible: Codex rejected the isolated PreToolUse configuration or could not disable uncovered tool transports`.** The mandatory tool-hook gate ran `codex features list` with our overrides and required `unified_exec` to read `false`. Codex 0.153.2, 0.153.3 and 0.153.4 all ignore `-c features.unified_exec=false` (the feature is locked on and `codex features list` reports `unified_exec stable true` regardless), so the gate refused the provider on every turn — the failure Sumeet hit right after switching to gpt-6-astra on 3.4.5.
+- **Why it is safe to stop requiring it off.** Probed live on 0.153.4 (2026-09-05): a shell command run through unified exec still arrives at the PreToolUse hook as tool_name `Bash` with `tool_input.command`, and the real deny gate caught the probe command (deny audited, marker file never written). Unified exec is a covered transport, not an uncovered one. Plugins stay forced off and hooks stay forced on; project trust stays untrusted.
+- **What changed.** `core/providers/codex-hook.js` no longer emits the `features.unified_exec=false` override nor checks its state. Fixtures and the tool-hook tests now model Codex as it is (`unified_exec stable true`) and assert no unified_exec override is generated. Fleet pods are affected identically (the 3.4.4 and 3.4.5 images carry Codex 0.153.x), so Codex on pods works only from this release onward.
+
+## v3.4.5 — Astra on the picker, two shortcuts fewer
+
+- **gpt-6-astra is offered by the codex provider.** OpenAI rolled GPT-6 (Astra) out to ChatGPT-plan Codex accounts on 2026-09-05 — the earlier 400 (`not supported when using Codex with a ChatGPT account`) was a staged rollout, not client staleness. It sits first in `CODEX_MODELS`, so it appears as a `/model` button; the typed form `/model gpt-6-astra` already worked because the typed path never validated against the list. The default model is unchanged (`gpt-5.6-sol` unless `CODEX_MODEL` is set).
+- **`/claude` and `/codex` are gone.** They were one-line aliases of `/backend claude|codex`, and the `/model` picker switches the backend by itself, so three ways to do one thing became one. `/backend` stays.
+- **Codex CLI: the Dockerfile installs `@openai/codex` unpinned, so every image build bakes the then-latest CLI; a running pod keeps whatever its image carried until the next build + roll.** This release's image picks up 0.153.4.
+
 ## v3.4.4 — The room's model was saved, shown, and never once used
 
 - **A model pinned in a room was silently ignored by every turn in it.** `/model` wrote the choice to the room, `/status` read it back from the room, and the picker highlighted it — all three already room-aware. Only the code that actually launches the provider was not: `captureRunContext` read `state.providerSettings[provider]`, the *speaker's* own bucket, so the room's pinned model was never consulted. The setting looked applied everywhere a human could look while every turn ran the personal default.

package/Dockerfile

@@ -8,7 +8,7 @@ FROM ${BASE_IMAGE}
 RUN curl -fsSL https://claude.ai/install.sh | sh || \
     npm install -g @anthropic-ai/claude-code
 
-# Install OpenAI Codex CLI for the /codex backend
+# Install OpenAI Codex CLI for the codex backend (unpinned: each image build bakes the then-latest CLI)
 RUN npm install -g @openai/codex
 
 # Browser automation for the agent: vercel-labs agent-browser (Rust CLI, token-efficient,

package/README.md

@@ -8,7 +8,7 @@ Send text, voice notes, screenshots, and files from your phone. Open Claudia run
 
 ### Channels & providers
 - **Multi-channel** — run the same bot on Telegram, Kazee Chat, or both at once (`CHANNELS=telegram,kazee`). Each channel renders keyboards, files, voice notes, and edits natively
-- **Multi-provider** — switch between Claude Code and OpenAI Codex on the fly (`/claude`, `/codex`); each keeps its own project-scoped session state
+- **Multi-provider** — switch between Claude Code and OpenAI Codex on the fly (`/backend claude|codex`, or pick a model in `/model`); each keeps its own project-scoped session state
 - **Multi-user / team mode** — one bot serves multiple authorized users in parallel, each with their own conversations, settings, model, provider, and usage counters
 - **Multi-project sessions** — switch between workspace projects; per-project conversation history auto-resumes
 
@@ -137,8 +137,6 @@ If installed as a background service, the bot starts automatically on login and
 
 | Command | Description |
 |---------|-------------|
-| `/claude` | Switch to the Claude Code provider |
-| `/codex` | Switch to the OpenAI Codex provider |
 | `/backend` | Show the current provider with picker |
 
 Each provider keeps its own persistent project session. Switching doesn't lose your place — you can go back and forth freely.

package/core/handlers.js

@@ -1537,30 +1537,6 @@ register({
   },
 });
 
-async function switchProviderCommand(env, providerId) {
-  if (!authorized(env)) return;
-  const provider = providerFromRegistry(providerId);
-  if (!provider) return send(`Unknown provider: ${providerId}`);
-  if (!providerAvailability(provider)) {
-    return send(`${provider.label} is unavailable. Install its CLI or configure its path, then run /doctor.`);
-  }
-  const state = currentState();
-  const switched = switchProviderState(provider.id, { state });
-  if (!switched.ok) return send(`Could not switch provider: ${switched.error.message}`);
-  const session = switched.sessionId ? `\nSession: ${switched.sessionId.slice(0, 8)}...` : "\nNew session.";
-  return send(`Switched to ${provider.label}.${session}`);
-}
-
-register({
-  name: "claude", description: "Switch to Claude Code provider",
-  handler: async (env) => switchProviderCommand(env, "claude"),
-});
-
-register({
-  name: "codex", description: "Switch to OpenAI Codex provider",
-  handler: async (env) => switchProviderCommand(env, "codex"),
-});
-
 register({
   name: "backend", description: "Show/switch active provider", args: "[claude|codex]",
   handler: async (env, { tail }) => {

package/core/providers/codex-hook.js

@@ -38,7 +38,12 @@ function buildCodexHookOverrides({ cwd, nodePath, cliPath } = {}) {
   return Object.freeze({
     featuresHooks: "features.hooks=true",
     featuresPlugins: "features.plugins=false",
-    featuresUnifiedExec: "features.unified_exec=false",
+    // unified_exec is deliberately NOT forced off. Probed live 2026-09-05 on
+    // Codex 0.153.4 (0.153.2 and 0.153.3 behave the same): `-c
+    // features.unified_exec=false` is silently ignored — the feature is locked
+    // on — while unified-exec shell calls still reach PreToolUse as tool_name
+    // "Bash" (the deny gate observed the probe command, marker not executed).
+    // Requiring it off made every Codex turn fail MANDATORY_TOOL_HOOK_UNAVAILABLE.
     // A path is a dynamic TOML map key. Current Codex `-c` parsing rejects a
     // quoted path inside dotted-key notation, so replace the isolated projects
     // table with one explicit inline table (user config is ignored below).
@@ -58,7 +63,6 @@ function hookArgs(overrides) {
     "--strict-config",
     "-c", overrides.featuresHooks,
     "-c", overrides.featuresPlugins,
-    "-c", overrides.featuresUnifiedExec,
     "-c", overrides.projectTrust,
     "-c", overrides.preToolUse,
     "--dangerously-bypass-hook-trust",
@@ -150,15 +154,13 @@ function checkCodexHookCompatibility({ binary, runCommand, env, cwd, prepared =
       "features",
       "-c", o.featuresHooks,
       "-c", o.featuresPlugins,
-      "-c", o.featuresUnifiedExec,
       "-c", o.projectTrust,
       "-c", o.preToolUse,
       "list",
     ], opts);
     const configured = features.ok
       && featureState(features.output, "hooks", true)
-      && featureState(features.output, "plugins", false)
-      && featureState(features.output, "unified_exec", false);
+      && featureState(features.output, "plugins", false);
     result = configured
       ? { ok: true, code: null, reason: null }
       : {

package/core/providers/codex.js

@@ -7,7 +7,8 @@ const { createCodexParserState, normalizeCodexEvent } = require("./codex-events"
 const { createCodexHookTransport } = require("./codex-hook");
 
 // gpt-5.6-sol-pro is rejected on ChatGPT-plan auth (400 from the API); it needs API-key billing.
-const CODEX_MODELS = Object.freeze(["gpt-5.6-sol", "gpt-5.6-sol-pro", "gpt-5.6-terra", "gpt-5.6-luna"]);
+// gpt-6-astra (GPT-6) reached ChatGPT-plan accounts on 2026-09-05; verified live with codex 0.153.
+const CODEX_MODELS = Object.freeze(["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-sol-pro", "gpt-5.6-terra", "gpt-5.6-luna"]);
 // max + ultra verified live against codex 0.144 (ultra = proactive multi-agent behavior).
 const CODEX_EFFORT_VALUES = Object.freeze(["minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
 const REQUIRED_EXEC_HELP_FLAGS = Object.freeze(["--config", "--json", "--sandbox", "--image", "--model", "--skip-git-repo-check"]);

package/docs/permissions-audit-2026-07.md

@@ -246,7 +246,9 @@ Verified-OK pathways (no change needed): scheduler re-runs stamp
 `OC_CHANNEL_USER_ID` (file gate stays live on approved external re-runs);
 Spaces turns flow through the common router (triage covered); sub-agents
 spawn read-only and inherit channel env; codex transport confinement
-(hooks on, plugins/unified_exec off, untrusted trust) is mandatory-or-refuse.
+(hooks on, plugins off, untrusted trust) is mandatory-or-refuse. unified_exec is
+no longer forced off (2026-09-05): Codex 0.153.x locks it on and its shell calls
+still reach the PreToolUse hook as "Bash".
 
 G3 closed with P3 (test-approval-cards.js pins the `apr:` handler). `tool run`
 remains the one authorised channel reachable on external turns — by design:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.4",
+  "version": "3.4.6",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-fixtures/fake-agent-cli.js

@@ -143,7 +143,7 @@ function handleCompatibilityCommand() {
     process.stdout.write([
       `hooks stable ${overrides.includes("features.hooks=true")}`,
       `plugins stable ${!overrides.includes("features.plugins=false")}`,
-      `unified_exec stable ${!overrides.includes("features.unified_exec=false")}`,
+      "unified_exec stable true",
     ].join("\n") + "\n");
     return true;
   }
@@ -160,7 +160,6 @@ function runHookProbe() {
     && !argv.includes("--profile")
     && overrides.includes("features.hooks=true")
     && overrides.includes("features.plugins=false")
-    && overrides.includes("features.unified_exec=false")
     && overrides.some((value) => /^projects=\{.+trust_level="untrusted".+\}$/.test(value))
     && hookOverrides.length === 1
     && /matcher\s*=\s*"\^\(Bash\|apply_patch\)\$"/.test(hookOverrides[0]);

package/test-provider-boot-matrix.js

@@ -34,7 +34,7 @@ if (same("--version")) {
     ? "--config --json --sandbox --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n"
     : "--config --json --sandbox --image --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n")});
 } else if (${JSON.stringify(kind)} === "codex" && args[0] === "features" && args.at(-1) === "list") {
-  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable false\\n");
+  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable true\\n");
 } else if (${JSON.stringify(kind)} === "codex" && same("login", "status")) {
   if (${JSON.stringify(mode)} === "unauthenticated") {
     process.stderr.write("not logged in\\n");

package/test-provider-codex.js

@@ -46,7 +46,7 @@ assert.strictEqual(provider.label, "OpenAI Codex");
 assert.strictEqual(provider.isAvailable(), true);
 assert.strictEqual(provider.executable(), "/fixture/codex");
 assert.strictEqual(provider.defaultModel(), "gpt-5-codex");
-assert.deepStrictEqual(provider.modelChoices(), ["gpt-5.6-sol", "gpt-5.6-sol-pro", "gpt-5.6-terra", "gpt-5.6-luna"]);
+assert.deepStrictEqual(provider.modelChoices(), ["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-sol-pro", "gpt-5.6-terra", "gpt-5.6-luna"]);
 assert.ok(!provider.modelChoices().includes("o4-mini"));
 assert.deepStrictEqual(provider.compatibilityStatus(), {
   state: "compatible",

package/test-provider-language.js

@@ -449,7 +449,21 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // code with exactly the reported symptom. Also ships the Kazee inbound
 // dedupe: chat-central fans message:new to both the chat room and each user
 // room, and v3.4.2's room join put the bot in both, so it replied twice.
-assert.strictEqual(pkg.version, "3.4.4", "release version must remain unchanged without explicit approval");
+// 3.4.5 approved by Sumeet 2026-09-05 ("Can you update open Claudia model
+// picker /model ... /codex probably worth getting rid off. Then I think let's
+// upgrade the CLI to the latest"): gpt-6-astra reached ChatGPT-plan accounts
+// on 2026-09-05 (the 400 was a staged rollout, not client staleness), so it
+// joins CODEX_MODELS first; the /claude and /codex shortcuts go — /backend and
+// the /model picker already switch providers; Codex CLI bumped to 0.153.4 on
+// the operator host and the image (unpinned install) picks it up at build.
+// 3.4.6 prepared 2026-09-05 after Sumeet sent a screenshot of the first Codex
+// turn on 3.4.5 failing ("Codex rejected the isolated PreToolUse configuration
+// or could not disable uncovered tool transports"): Codex 0.153.x ignores
+// `-c features.unified_exec=false` (locked on), so the hook gate refused every
+// Codex turn. Live probe: unified-exec shell calls still reach PreToolUse as
+// tool_name "Bash" and the deny gate caught the probe, so the gate no longer
+// requires unified_exec off. Push approved by Sumeet before release.
+assert.strictEqual(pkg.version, "3.4.6", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-session-commands.js

@@ -139,10 +139,12 @@ function restartProbe() {
 
 function commandRegistrationProbe() {
   const names = new Set(commands.list().map((command) => command.name));
-  for (const name of ["new", "end", "continue", "backend", "claude", "codex"]) assert.ok(names.has(name), `/${name} registered`);
+  for (const name of ["new", "end", "continue", "backend"]) assert.ok(names.has(name), `/${name} registered`);
+  // v3.4.5: the /claude and /codex aliases were removed — /backend and the /model picker switch providers.
+  for (const name of ["claude", "codex"]) assert.ok(!names.has(name), `/${name} must no longer be registered`);
   const source = fs.readFileSync(path.join(root, "core", "handlers.js"), "utf8");
-  assert.match(source, /name: "claude"[\s\S]*switchProviderCommand\(env, "claude"/);
-  assert.match(source, /name: "codex"[\s\S]*switchProviderCommand\(env, "codex"/);
+  assert.doesNotMatch(source, /switchProviderCommand/, "the per-provider shortcut helper went with the aliases");
+  assert.match(source, /name: "backend"[\s\S]*switchProviderState\(descriptor\.id\)/);
   assert.match(source, /name: "continue"[\s\S]*activeContinueOptions/);
   const actions = fs.readFileSync(path.join(root, "core", "actions.js"), "utf8");
   assert.match(actions, /switchProviderState/);

package/test-provider-tool-hooks.js

@@ -59,7 +59,7 @@ function compatibleCodexCommand(_binary, args) {
       output: [
         "hooks stable true",
         "plugins stable false",
-        "unified_exec stable false",
+        "unified_exec stable true",
       ].join("\n"),
       code: 0,
     };
@@ -137,12 +137,15 @@ try {
   assert.ok(defaultClaudeInvocation.args.includes("--settings"), "Claude factories enforce the generated hook by default");
 
   // Codex uses only transient, generated CLI overrides. User config is ignored,
-  // the current project is explicitly untrusted, plugin hooks and unified_exec
-  // are disabled, and hook trust is bypassed only after exact verification.
+  // the current project is explicitly untrusted, plugin hooks are disabled, and
+  // hook trust is bypassed only after exact verification. unified_exec is NOT
+  // forced off: Codex 0.153.x ignores the override (locked on) and its shell
+  // calls still arrive as tool_name "Bash" (probed live 2026-09-05).
   const overrides = buildCodexHookOverrides({ cwd: projectDir });
   assert.strictEqual(overrides.featuresHooks, "features.hooks=true");
   assert.strictEqual(overrides.featuresPlugins, "features.plugins=false");
-  assert.strictEqual(overrides.featuresUnifiedExec, "features.unified_exec=false");
+  assert.strictEqual(overrides.featuresUnifiedExec, undefined, "unified_exec is no longer forced off (Codex ignores it)");
+  assert.ok(!Object.values(overrides).some((value) => String(value).includes("unified_exec")), "no unified_exec override is generated");
   assert.match(overrides.projectTrust, /^projects=\{.+trust_level="untrusted".+\}$/);
   assert.match(overrides.preToolUse, /^hooks\.PreToolUse=/);
   assert.match(overrides.preToolUse, /deny-gate-hook/);
@@ -158,6 +161,7 @@ try {
   assert.ok(prepared.args.includes("--ignore-user-config"));
   assert.ok(prepared.args.includes("--strict-config"));
   assert.ok(prepared.args.includes("--dangerously-bypass-hook-trust"));
+  assert.ok(!prepared.args.some((value) => String(value).includes("features.unified_exec")), "argv carries no unified_exec override");
   assert.ok(!prepared.args.includes("--profile"), "a merging Codex profile is never trusted");
   const tampered = Object.freeze({ ...prepared, args: Object.freeze([...prepared.args, "--profile", "project-hooks"]) });
   assert.strictEqual(verifyPreparedCodexHook(tampered), false, "trust bypass rejects non-generated argv");