@inetafrica/open-claudia 3.4.5 → 3.4.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v3.4.6 — Codex runs again: the gate stopped asking for the impossible
+
+- **Every Codex turn since Codex CLI 0.153.x failed with `OpenAI Codex is incompatible: Codex rejected the isolated PreToolUse configuration or could not disable uncovered tool transports`.** The mandatory tool-hook gate ran `codex features list` with our overrides and required `unified_exec` to read `false`. Codex 0.153.2, 0.153.3 and 0.153.4 all ignore `-c features.unified_exec=false` (the feature is locked on and `codex features list` reports `unified_exec stable true` regardless), so the gate refused the provider on every turn — the failure Sumeet hit right after switching to gpt-6-astra on 3.4.5.
+- **Why it is safe to stop requiring it off.** Probed live on 0.153.4 (2026-09-05): a shell command run through unified exec still arrives at the PreToolUse hook as tool_name `Bash` with `tool_input.command`, and the real deny gate caught the probe command (deny audited, marker file never written). Unified exec is a covered transport, not an uncovered one. Plugins stay forced off and hooks stay forced on; project trust stays untrusted.
+- **What changed.** `core/providers/codex-hook.js` no longer emits the `features.unified_exec=false` override nor checks its state. Fixtures and the tool-hook tests now model Codex as it is (`unified_exec stable true`) and assert no unified_exec override is generated. Fleet pods are affected identically (the 3.4.4 and 3.4.5 images carry Codex 0.153.x), so Codex on pods works only from this release onward.
+
 ## v3.4.5 — Astra on the picker, two shortcuts fewer
 
 - **gpt-6-astra is offered by the codex provider.** OpenAI rolled GPT-6 (Astra) out to ChatGPT-plan Codex accounts on 2026-09-05 — the earlier 400 (`not supported when using Codex with a ChatGPT account`) was a staged rollout, not client staleness. It sits first in `CODEX_MODELS`, so it appears as a `/model` button; the typed form `/model gpt-6-astra` already worked because the typed path never validated against the list. The default model is unchanged (`gpt-5.6-sol` unless `CODEX_MODEL` is set).

package/core/providers/codex-hook.js

@@ -38,7 +38,12 @@ function buildCodexHookOverrides({ cwd, nodePath, cliPath } = {}) {
   return Object.freeze({
     featuresHooks: "features.hooks=true",
     featuresPlugins: "features.plugins=false",
-    featuresUnifiedExec: "features.unified_exec=false",
+    // unified_exec is deliberately NOT forced off. Probed live 2026-09-05 on
+    // Codex 0.153.4 (0.153.2 and 0.153.3 behave the same): `-c
+    // features.unified_exec=false` is silently ignored — the feature is locked
+    // on — while unified-exec shell calls still reach PreToolUse as tool_name
+    // "Bash" (the deny gate observed the probe command, marker not executed).
+    // Requiring it off made every Codex turn fail MANDATORY_TOOL_HOOK_UNAVAILABLE.
     // A path is a dynamic TOML map key. Current Codex `-c` parsing rejects a
     // quoted path inside dotted-key notation, so replace the isolated projects
     // table with one explicit inline table (user config is ignored below).
@@ -58,7 +63,6 @@ function hookArgs(overrides) {
     "--strict-config",
     "-c", overrides.featuresHooks,
     "-c", overrides.featuresPlugins,
-    "-c", overrides.featuresUnifiedExec,
     "-c", overrides.projectTrust,
     "-c", overrides.preToolUse,
     "--dangerously-bypass-hook-trust",
@@ -150,15 +154,13 @@ function checkCodexHookCompatibility({ binary, runCommand, env, cwd, prepared =
       "features",
       "-c", o.featuresHooks,
       "-c", o.featuresPlugins,
-      "-c", o.featuresUnifiedExec,
       "-c", o.projectTrust,
       "-c", o.preToolUse,
       "list",
     ], opts);
     const configured = features.ok
       && featureState(features.output, "hooks", true)
-      && featureState(features.output, "plugins", false)
-      && featureState(features.output, "unified_exec", false);
+      && featureState(features.output, "plugins", false);
     result = configured
       ? { ok: true, code: null, reason: null }
       : {

package/docs/permissions-audit-2026-07.md

@@ -246,7 +246,9 @@ Verified-OK pathways (no change needed): scheduler re-runs stamp
 `OC_CHANNEL_USER_ID` (file gate stays live on approved external re-runs);
 Spaces turns flow through the common router (triage covered); sub-agents
 spawn read-only and inherit channel env; codex transport confinement
-(hooks on, plugins/unified_exec off, untrusted trust) is mandatory-or-refuse.
+(hooks on, plugins off, untrusted trust) is mandatory-or-refuse. unified_exec is
+no longer forced off (2026-09-05): Codex 0.153.x locks it on and its shell calls
+still reach the PreToolUse hook as "Bash".
 
 G3 closed with P3 (test-approval-cards.js pins the `apr:` handler). `tool run`
 remains the one authorised channel reachable on external turns — by design:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.5",
+  "version": "3.4.6",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-fixtures/fake-agent-cli.js

@@ -143,7 +143,7 @@ function handleCompatibilityCommand() {
     process.stdout.write([
       `hooks stable ${overrides.includes("features.hooks=true")}`,
       `plugins stable ${!overrides.includes("features.plugins=false")}`,
-      `unified_exec stable ${!overrides.includes("features.unified_exec=false")}`,
+      "unified_exec stable true",
     ].join("\n") + "\n");
     return true;
   }
@@ -160,7 +160,6 @@ function runHookProbe() {
     && !argv.includes("--profile")
     && overrides.includes("features.hooks=true")
     && overrides.includes("features.plugins=false")
-    && overrides.includes("features.unified_exec=false")
     && overrides.some((value) => /^projects=\{.+trust_level="untrusted".+\}$/.test(value))
     && hookOverrides.length === 1
     && /matcher\s*=\s*"\^\(Bash\|apply_patch\)\$"/.test(hookOverrides[0]);

package/test-provider-boot-matrix.js

@@ -34,7 +34,7 @@ if (same("--version")) {
     ? "--config --json --sandbox --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n"
     : "--config --json --sandbox --image --model --skip-git-repo-check --strict-config --ignore-user-config --dangerously-bypass-hook-trust\n")});
 } else if (${JSON.stringify(kind)} === "codex" && args[0] === "features" && args.at(-1) === "list") {
-  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable false\\n");
+  process.stdout.write("hooks stable true\\nplugins stable false\\nunified_exec stable true\\n");
 } else if (${JSON.stringify(kind)} === "codex" && same("login", "status")) {
   if (${JSON.stringify(mode)} === "unauthenticated") {
     process.stderr.write("not logged in\\n");

package/test-provider-language.js

@@ -456,7 +456,14 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // joins CODEX_MODELS first; the /claude and /codex shortcuts go — /backend and
 // the /model picker already switch providers; Codex CLI bumped to 0.153.4 on
 // the operator host and the image (unpinned install) picks it up at build.
-assert.strictEqual(pkg.version, "3.4.5", "release version must remain unchanged without explicit approval");
+// 3.4.6 prepared 2026-09-05 after Sumeet sent a screenshot of the first Codex
+// turn on 3.4.5 failing ("Codex rejected the isolated PreToolUse configuration
+// or could not disable uncovered tool transports"): Codex 0.153.x ignores
+// `-c features.unified_exec=false` (locked on), so the hook gate refused every
+// Codex turn. Live probe: unified-exec shell calls still reach PreToolUse as
+// tool_name "Bash" and the deny gate caught the probe, so the gate no longer
+// requires unified_exec off. Push approved by Sumeet before release.
+assert.strictEqual(pkg.version, "3.4.6", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-tool-hooks.js

@@ -59,7 +59,7 @@ function compatibleCodexCommand(_binary, args) {
       output: [
         "hooks stable true",
         "plugins stable false",
-        "unified_exec stable false",
+        "unified_exec stable true",
       ].join("\n"),
       code: 0,
     };
@@ -137,12 +137,15 @@ try {
   assert.ok(defaultClaudeInvocation.args.includes("--settings"), "Claude factories enforce the generated hook by default");
 
   // Codex uses only transient, generated CLI overrides. User config is ignored,
-  // the current project is explicitly untrusted, plugin hooks and unified_exec
-  // are disabled, and hook trust is bypassed only after exact verification.
+  // the current project is explicitly untrusted, plugin hooks are disabled, and
+  // hook trust is bypassed only after exact verification. unified_exec is NOT
+  // forced off: Codex 0.153.x ignores the override (locked on) and its shell
+  // calls still arrive as tool_name "Bash" (probed live 2026-09-05).
   const overrides = buildCodexHookOverrides({ cwd: projectDir });
   assert.strictEqual(overrides.featuresHooks, "features.hooks=true");
   assert.strictEqual(overrides.featuresPlugins, "features.plugins=false");
-  assert.strictEqual(overrides.featuresUnifiedExec, "features.unified_exec=false");
+  assert.strictEqual(overrides.featuresUnifiedExec, undefined, "unified_exec is no longer forced off (Codex ignores it)");
+  assert.ok(!Object.values(overrides).some((value) => String(value).includes("unified_exec")), "no unified_exec override is generated");
   assert.match(overrides.projectTrust, /^projects=\{.+trust_level="untrusted".+\}$/);
   assert.match(overrides.preToolUse, /^hooks\.PreToolUse=/);
   assert.match(overrides.preToolUse, /deny-gate-hook/);
@@ -158,6 +161,7 @@ try {
   assert.ok(prepared.args.includes("--ignore-user-config"));
   assert.ok(prepared.args.includes("--strict-config"));
   assert.ok(prepared.args.includes("--dangerously-bypass-hook-trust"));
+  assert.ok(!prepared.args.some((value) => String(value).includes("features.unified_exec")), "argv carries no unified_exec override");
   assert.ok(!prepared.args.includes("--profile"), "a merging Codex profile is never trusted");
   const tampered = Object.freeze({ ...prepared, args: Object.freeze([...prepared.args, "--profile", "project-hooks"]) });
   assert.strictEqual(verifyPreparedCodexHook(tampered), false, "trust bypass rejects non-generated argv");