@khorsheed/dsh-local-agent-codex 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,4 +1,9 @@
 # 变更记录
+## 0.2.2（2026-10-27）
+
+- **成员按会话的沙箱模式运行**：会话设成只读或可写，codex 成员跟着用同样的权限。
+- 成员的工具调用保留结构化参数和 MCP 结果；命令跑完一定带上输出和退出码。
+
 ## 0.2.1（2026-10-27）
 
 - **修复几个模式套件一起装时设置存不上**：卡片上的开关和设置改存在本 harness 自己的目录里，不再写进配置文件；原来配好的值照常生效。

package/lib/client.js

@@ -343,30 +343,30 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var ProviderAuthBlock_module_css_default = {
-			"promptText": "On5p7W_promptText",
-			"status": "On5p7W_status",
-			"title": "On5p7W_title",
-			"rowCard": "On5p7W_rowCard",
-			"loginButton": "On5p7W_loginButton",
-			"retryButton": "On5p7W_retryButton",
-			"rowActions": "On5p7W_rowActions",
-			"logoutButton": "On5p7W_logoutButton",
+			"dotOff": "On5p7W_dotOff",
+			"rows": "On5p7W_rows",
+			"rosterError": "On5p7W_rosterError",
 			"section": "On5p7W_section",
-			"intro": "On5p7W_intro",
-			"dotPending": "On5p7W_dotPending",
-			"dotOn": "On5p7W_dotOn",
 			"rowName": "On5p7W_rowName",
+			"status": "On5p7W_status",
+			"loginButton": "On5p7W_loginButton",
+			"loginPrompt": "On5p7W_loginPrompt",
+			"promptText": "On5p7W_promptText",
 			"codeInput": "On5p7W_codeInput",
+			"rowHead": "On5p7W_rowHead",
+			"rowTag": "On5p7W_rowTag",
 			"openPage": "On5p7W_openPage",
-			"rowPending": "On5p7W_rowPending",
+			"rowCard": "On5p7W_rowCard",
+			"logoutButton": "On5p7W_logoutButton",
+			"dotOn": "On5p7W_dotOn",
+			"intro": "On5p7W_intro",
 			"rowIdentity": "On5p7W_rowIdentity",
-			"rows": "On5p7W_rows",
-			"rosterError": "On5p7W_rosterError",
-			"rowTag": "On5p7W_rowTag",
-			"dotOff": "On5p7W_dotOff",
+			"dotPending": "On5p7W_dotPending",
+			"rowActions": "On5p7W_rowActions",
+			"title": "On5p7W_title",
 			"credentialDot": "On5p7W_credentialDot",
-			"rowHead": "On5p7W_rowHead",
-			"loginPrompt": "On5p7W_loginPrompt"
+			"rowPending": "On5p7W_rowPending",
+			"retryButton": "On5p7W_retryButton"
 		};
 		//#endregion
 		//#region ../local-agent/src/client/ProviderAuthBlock.tsx
@@ -645,10 +645,10 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var AuthStatusDot_module_css_default = {
-			"dotOn": "OFjNUG_dotOn",
 			"credentialDot": "OFjNUG_credentialDot",
 			"dotOff": "OFjNUG_dotOff",
-			"dotPending": "OFjNUG_dotPending"
+			"dotPending": "OFjNUG_dotPending",
+			"dotOn": "OFjNUG_dotOn"
 		};
 		//#endregion
 		//#region ../local-agent/src/client/AuthStatusDot.tsx
@@ -674,39 +674,39 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var ModelListSection_module_css_default = {
-			"dialogItemLabel": "_4eeJ7W_dialogItemLabel",
-			"dialogSelectAll": "_4eeJ7W_dialogSelectAll",
-			"row": "_4eeJ7W_row",
-			"block": "_4eeJ7W_block",
+			"modelRowValue": "_4eeJ7W_modelRowValue",
 			"blockTitle": "_4eeJ7W_blockTitle",
+			"dialogItemValue": "_4eeJ7W_dialogItemValue",
+			"dialogBackdrop": "_4eeJ7W_dialogBackdrop",
+			"block": "_4eeJ7W_block",
+			"dialogTitle": "_4eeJ7W_dialogTitle",
+			"row": "_4eeJ7W_row",
 			"modelInput": "_4eeJ7W_modelInput",
-			"dialogItem": "_4eeJ7W_dialogItem",
-			"hint": "_4eeJ7W_hint",
-			"dialog": "_4eeJ7W_dialog",
-			"modelList": "_4eeJ7W_modelList",
 			"modelRowDragging": "_4eeJ7W_modelRowDragging",
-			"dialogList": "_4eeJ7W_dialogList",
+			"dialog": "_4eeJ7W_dialog",
+			"dialogActions": "_4eeJ7W_dialogActions",
 			"modelAdd": "_4eeJ7W_modelAdd",
-			"errorText": "_4eeJ7W_errorText",
-			"dialogTitle": "_4eeJ7W_dialogTitle",
+			"modelDrag": "_4eeJ7W_modelDrag",
+			"dialogSelectAll": "_4eeJ7W_dialogSelectAll",
+			"dialogItemLabel": "_4eeJ7W_dialogItemLabel",
+			"dialogToolbar": "_4eeJ7W_dialogToolbar",
+			"dialogList": "_4eeJ7W_dialogList",
 			"modelSave": "_4eeJ7W_modelSave",
-			"modelRowValue": "_4eeJ7W_modelRowValue",
+			"dialogHead": "_4eeJ7W_dialogHead",
+			"dialogHint": "_4eeJ7W_dialogHint",
+			"modelList": "_4eeJ7W_modelList",
+			"dialogItem": "_4eeJ7W_dialogItem",
+			"modelDefaultChip": "_4eeJ7W_modelDefaultChip",
+			"errorText": "_4eeJ7W_errorText",
 			"saved": "_4eeJ7W_saved",
-			"modelRow": "_4eeJ7W_modelRow",
-			"dialogActions": "_4eeJ7W_dialogActions",
-			"dialogClose": "_4eeJ7W_dialogClose",
-			"modelDrag": "_4eeJ7W_modelDrag",
+			"hint": "_4eeJ7W_hint",
+			"dialogConfirm": "_4eeJ7W_dialogConfirm",
+			"modelRowLabel": "_4eeJ7W_modelRowLabel",
 			"info": "_4eeJ7W_info",
 			"modelDelete": "_4eeJ7W_modelDelete",
 			"dialogItemAdded": "_4eeJ7W_dialogItemAdded",
-			"dialogItemValue": "_4eeJ7W_dialogItemValue",
-			"dialogConfirm": "_4eeJ7W_dialogConfirm",
-			"dialogBackdrop": "_4eeJ7W_dialogBackdrop",
-			"dialogHead": "_4eeJ7W_dialogHead",
-			"dialogToolbar": "_4eeJ7W_dialogToolbar",
-			"dialogHint": "_4eeJ7W_dialogHint",
-			"modelDefaultChip": "_4eeJ7W_modelDefaultChip",
-			"modelRowLabel": "_4eeJ7W_modelRowLabel"
+			"modelRow": "_4eeJ7W_modelRow",
+			"dialogClose": "_4eeJ7W_dialogClose"
 		};
 		//#endregion
 		//#region ../local-agent/src/client/ModelListSection.tsx
@@ -1079,32 +1079,32 @@ window.__ModuleLoader__.load({
 		}
 		var SettingsCard_module_css_default = {
 			"configuredChip": "oWITGW_configuredChip",
-			"switchOn": "oWITGW_switchOn",
-			"block": "oWITGW_block",
-			"knob": "oWITGW_knob",
-			"endpointFields": "oWITGW_endpointFields",
+			"headText": "oWITGW_headText",
+			"info": "oWITGW_info",
 			"row": "oWITGW_row",
-			"card": "oWITGW_card",
-			"endpointField": "oWITGW_endpointField",
-			"chevron": "oWITGW_chevron",
-			"switch": "oWITGW_switch",
 			"body": "oWITGW_body",
+			"block": "oWITGW_block",
+			"nameRow": "oWITGW_nameRow",
+			"chevron": "oWITGW_chevron",
+			"chevronOpen": "oWITGW_chevronOpen",
+			"cardOpen": "oWITGW_cardOpen",
 			"blockTitle": "oWITGW_blockTitle",
+			"endpointField": "oWITGW_endpointField",
+			"header": "oWITGW_header",
 			"description": "oWITGW_description",
-			"info": "oWITGW_info",
-			"name": "oWITGW_name",
+			"endpointLabel": "oWITGW_endpointLabel",
 			"rowLabel": "oWITGW_rowLabel",
+			"switchOn": "oWITGW_switchOn",
+			"knob": "oWITGW_knob",
+			"endpointFields": "oWITGW_endpointFields",
+			"name": "oWITGW_name",
+			"saved": "oWITGW_saved",
+			"switch": "oWITGW_switch",
 			"errorText": "oWITGW_errorText",
+			"card": "oWITGW_card",
 			"hint": "oWITGW_hint",
-			"cardOpen": "oWITGW_cardOpen",
-			"endpointLabel": "oWITGW_endpointLabel",
-			"headText": "oWITGW_headText",
 			"modelInput": "oWITGW_modelInput",
-			"modelSave": "oWITGW_modelSave",
-			"saved": "oWITGW_saved",
-			"nameRow": "oWITGW_nameRow",
-			"chevronOpen": "oWITGW_chevronOpen",
-			"header": "oWITGW_header"
+			"modelSave": "oWITGW_modelSave"
 		};
 		//#endregion
 		//#region src/client/SettingsCard.tsx

package/lib/index.js

@@ -795,14 +795,15 @@ function codexAppServerItemToLine(item) {
 		} : void 0;
 		case "commandExecution": {
 			const command = typeof item["command"] === "string" ? item.command : void 0;
-			const output = typeof item["aggregatedOutput"] === "string" && item["aggregatedOutput"].trim() !== "" ? item["aggregatedOutput"] : void 0;
-			if (command === void 0 && output === void 0) return void 0;
+			const outcome = commandOutcome(item["aggregatedOutput"], item["exitCode"], item["status"]);
+			if (command === void 0 && outcome.result === void 0) return void 0;
 			return {
 				kind: "tool",
 				id: itemId ?? `codex-live-${randomUUID()}`,
 				name: "Bash",
 				...command === void 0 ? {} : { args: command },
-				...output === void 0 ? {} : { result: output }
+				...outcome.result === void 0 ? {} : { result: outcome.result },
+				...outcome.failed ? { failed: true } : {}
 			};
 		}
 		case "webSearch": return {
@@ -846,10 +847,20 @@ function codexAppServerItemToLine(item) {
 		case "mcpToolCall": {
 			const server = typeof item["server"] === "string" ? item.server : void 0;
 			const tool = typeof item["tool"] === "string" ? item.tool : void 0;
+			const args = item["arguments"] === void 0 || item["arguments"] === null ? void 0 : typeof item["arguments"] === "string" ? item["arguments"] : JSON.stringify(item["arguments"]);
+			const outcome = item["result"];
+			const text = (Array.isArray(outcome?.content) ? outcome.content : []).filter((block) => typeof block === "object" && block !== null).map((block) => typeof block["text"] === "string" ? block["text"] : void 0).filter((entry) => entry !== void 0 && entry !== "").join("\n");
+			const error = item["error"];
+			const failure = typeof error?.message === "string" && error.message !== "" ? error.message : void 0;
 			return {
 				kind: "tool",
 				id: itemId ?? `codex-live-${randomUUID()}`,
-				name: server !== void 0 && tool !== void 0 ? `${server}/${tool}` : tool ?? "mcp"
+				name: server !== void 0 && tool !== void 0 ? `${server}/${tool}` : tool ?? "mcp",
+				...args === void 0 || args === "" || args === "{}" ? {} : { args },
+				...failure !== void 0 ? {
+					result: failure,
+					failed: true
+				} : text === "" ? {} : { result: text }
 			};
 		}
 		case "plan": return typeof item["text"] === "string" && item["text"].trim() !== "" ? {
@@ -1376,7 +1387,7 @@ var CodexLiveDriver = class {
 		if (rt.threadId === void 0) {
 			const permissionParams = {
 				approvalPolicy: "never",
-				sandbox: this.config.sandbox ?? "workspace-write"
+				sandbox: this.config.sandbox ?? spec.sandbox ?? "workspace-write"
 			};
 			if (spec.resume === void 0) {
 				const response = await rt.peer.request("thread/start", {
@@ -2121,6 +2132,58 @@ async function listCodexConfigModels(homeDir) {
 	}
 	return found;
 }
+//#endregion
+//#region lib/types/codex-cli-provider.js
+/**
+* One-shot Codex CLI subagent lifecycle: spawn `codex exec "<task>"` through
+* the subprocess seam under the harness's scoped home, capture its printed
+* response as the run output, and dispose to whole-tree quiescence. Mirrors
+* the kimi-cli provider: every accepted run is a fresh process and a fresh
+* codex session; there is no continuation across runs.
+*
+* The provider name `codex-local` avoids colliding with the official
+* `subagent-codex` package's provider name `codex` — a composition that
+* mounts both would fail loud with DUPLICATE_PROVIDER. The tool row in this
+* bundle's patch takes the official model-facing name `subagent_codex`
+* instead: the official preset row ships disabled, and the patch disables
+* it too (a deliberate user re-enable conflicts loud, by design).
+* @module @khorsheed/dsh-local-agent-codex/codex-cli-provider
+*/
+/**
+* The synthesized result for a call whose result the stream never recorded
+* (a killed run, or a result-less item type like web_search_call). The
+* released-log contract resolves every advertised call before its step
+* closes, so an interrupted call folds with this error result. Same text as
+* the kimi provider's placeholder, for family consistency.
+*/
+/**
+* A finished command's result text and failure. Codex reports a command that
+* printed nothing with an empty aggregated output — a crash (exit 139) or a
+* silent failure read as "no result" and the mirror wrote the interrupted
+* placeholder. A finished command (an exit code, or a completed/failed status)
+* always carries a result: its output, or "（无输出）", with a non-zero exit
+* code appended and the result marked failed. A command still running yields
+* none, so the fold keeps waiting for it.
+* @param output - the item's aggregated output.
+* @param exitCode - the item's exit code, when finished.
+* @param status - the item's status.
+* @returns the result text (undefined while running) and whether it failed.
+*/
+function commandOutcome(output, exitCode, status) {
+	const text = typeof output === "string" && output.trim() !== "" ? output : void 0;
+	const code = typeof exitCode === "number" && Number.isFinite(exitCode) ? exitCode : void 0;
+	const finished = code !== void 0 || status === "completed" || status === "failed";
+	const failed = code !== void 0 && code !== 0 || status === "failed";
+	if (!finished) return text === void 0 ? { failed: false } : {
+		result: text,
+		failed: false
+	};
+	const exit = code !== void 0 && code !== 0 ? `（退出码 ${code}）` : status === "failed" ? "（执行失败）" : "";
+	return {
+		result: text === void 0 ? exit === "" ? "（无输出）" : `${exit.slice(0, -1)}，无输出）` : exit === "" ? text : `${text}\n${exit}`,
+		failed
+	};
+}
 /** Quote one TOML basic string for the `-c` config override. */
 function tomlString(value) {
 	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
@@ -2133,6 +2196,24 @@ const DEFAULT_DISPOSE_GRACE_MS = 3e3;
 * provider-controlled error output only.
 */
 const CODEX_AUTH_FAILURE = /401 unauthorized|unauthorized|authentication failed|not logged in|access token/i;
+/**
+* A session's standing sandbox mode — the host's `sandbox/mode` vocabulary is
+* codex's own (`read-only` | `workspace-write` | `danger-full-access`). Reads
+* the delegating session first (the mode the user sees and changes), then
+* the child's inherited record.
+* @param ctx - context carrying the live session store.
+* @param childSession - the member's child session, when one exists.
+* @param parentSessionId - the delegating session.
+* @returns the mode, or undefined when neither session records one.
+*/
+function sessionSandboxMode(ctx, childSession, parentSessionId) {
+	const sessions = ctx.get("sessions");
+	const parent = parentSessionId === void 0 ? void 0 : sessions?.get(SessionId(parentSessionId));
+	for (const session of [parent, childSession]) {
+		const mode = session?.snapshotEvents().filter((event) => event.type === "sandbox/mode").at(-1)?.data;
+		if (mode?.mode === "read-only" || mode?.mode === "workspace-write" || mode?.mode === "danger-full-access") return mode.mode;
+	}
+}
 /** Register one member run with the channel; see {@link CodexMemberRunHandle}. */
 function registerCodexMemberRun(ctx, childSessionId, parentSessionId) {
 	const registry = ctx.localAgent;
@@ -2229,7 +2310,7 @@ var CodexCliProvider = class {
 	*   relay (a custom `model_providers` entry on the argv, the key in the
 	*   env); with no key the spawn carries no credential at all.
 	*/
-	constructor(ctx, sandbox = "workspace-write", live, model, overrides, endpoint) {
+	constructor(ctx, sandbox = void 0, live, model, overrides, endpoint) {
 		this.ctx = ctx;
 		this.sandbox = sandbox;
 		this.live = live;
@@ -2237,6 +2318,18 @@ var CodexCliProvider = class {
 		this.overrides = overrides;
 		this.endpoint = endpoint;
 	}
+	/**
+	* The sandbox this round runs under: the plugin config's explicit policy
+	* when set, else the member's session's own standing mode — the delegating
+	* session's latest `sandbox/mode`, then the child's inherited one — so a
+	* member runs with exactly the access its session shows (a full-access
+	* session's Codex member was confined to workspace-write and Blender
+	* crashed under the seatbelt). `workspace-write` when neither says.
+	*/
+	sandboxFor(childSession, parentSessionId) {
+		if (this.sandbox !== void 0) return this.sandbox;
+		return sessionSandboxMode(this.ctx, childSession, parentSessionId) ?? "workspace-write";
+	}
 	/** The scope's endpoint credential for this round; absent resolver = never. */
 	resolveEndpoint(homeDir) {
 		return this.endpoint === void 0 ? Promise.resolve(void 0) : this.endpoint(homeDir).catch(() => void 0);
@@ -2327,6 +2420,7 @@ var CodexCliProvider = class {
 					homeDir,
 					childSession,
 					parentSessionId: request.parent.session.id,
+					sandbox: this.sandboxFor(childSession, request.parent.session.id),
 					...startModel === void 0 ? {} : { startModel },
 					...configuration === void 0 ? {} : { configuration: configuration.resolved },
 					onThreadId: (threadId) => {
@@ -2357,7 +2451,7 @@ var CodexCliProvider = class {
 				...exec === void 0 ? {} : { exec },
 				endpointLabel: baseUrl,
 				endpointArgv: endpointConfigOverrides(endpoint),
-				sandbox: this.sandbox,
+				sandbox: this.sandboxFor(childSession, request.parent.session.id),
 				...configuration?.resolved ?? resolveRoundModel(this.overrides?.(runId) ?? requestedModel, () => this.model?.(scope)),
 				disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
 				spawn: (spec) => this.ctx.subprocess.spawn(spec),
@@ -2416,6 +2510,7 @@ var CodexCliProvider = class {
 						homeDir,
 						childSession,
 						parentSessionId: request.parent.session.id,
+						sandbox: this.sandboxFor(childSession, request.parent.session.id),
 						resume: {
 							cliSessionId: intent.cliSessionId,
 							turn: nextTurn
@@ -2446,7 +2541,7 @@ var CodexCliProvider = class {
 					...exec === void 0 ? {} : { exec },
 					endpointLabel: baseUrl,
 					endpointArgv: endpointConfigOverrides(endpoint),
-					sandbox: this.sandbox,
+					sandbox: this.sandboxFor(childSession, request.parent.session.id),
 					...configuration?.resolved ?? resolveRoundModel(this.overrides?.(intent.childSessionId) ?? requestedModel, () => this.model?.(scope)),
 					disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
 					spawn: (spec) => this.ctx.subprocess.spawn(spec),
@@ -2574,13 +2669,14 @@ function foldCodexStreamLine(state, raw) {
 	} else if (item.type === "command_execution") {
 		countToolCall(state, "command_execution");
 		const command = typeof item.command === "string" ? item.command : void 0;
-		const output = typeof item.aggregated_output === "string" && item.aggregated_output.trim() !== "" ? item.aggregated_output : void 0;
-		if (command !== void 0 || output !== void 0) state.lines.push({
+		const outcome = commandOutcome(item.aggregated_output, item.exit_code, item.status);
+		if (command !== void 0 || outcome.result !== void 0) state.lines.push({
 			kind: "tool",
 			id: typeof item.id === "string" ? item.id : `codex-tool-${state.lines.length}`,
 			name: "Bash",
 			...command === void 0 ? {} : { args: command },
-			...output === void 0 ? {} : { result: output }
+			...outcome.result === void 0 ? {} : { result: outcome.result },
+			...outcome.failed ? { failed: true } : {}
 		});
 	} else if (item.type === "web_search_call") {
 		countToolCall(state, "web_search_call");
@@ -2976,7 +3072,7 @@ function appendCodexTranscriptLine(childSession, turn, step, line, usage) {
 					type: "text",
 					text: line.result ?? "（工具调用被中断，未能记录返回结果）"
 				}],
-				isError: line.result === void 0
+				isError: line.result === void 0 || line.failed === true
 			})
 		}, {
 			surfaceOp: "append",
@@ -3998,7 +4094,7 @@ function apply(ctx, config) {
 		}, CATALOG_WARMUP_DELAY_MS);
 		warmup.unref();
 		const liveSwitch = new LiveDriverSwitch(ctx, face, {
-			sandbox,
+			sandbox: config.sandbox,
 			model: (childSessionId) => memberModelOverrides.get(childSessionId) ?? resolveModel((ctx.localAgent.memberBinding?.(childSessionId) ?? ctx.localAgent.getDelegation(childSessionId))?.scope),
 			endpoint: resolveEndpoint,
 			...config.liveIdleMs === void 0 ? {} : { liveIdleMs: config.liveIdleMs }
@@ -4020,7 +4116,7 @@ function apply(ctx, config) {
 			catalog: (scopedHome, cwd) => modelCatalog.read(scopedHome, cwd),
 			catalogDefault: (scopedHome, cwd) => modelCatalog.readDefault(scopedHome, cwd)
 		});
-		const disposeProvider = ctx.subagents.registerProvider(new CodexCliProvider(ctx, sandbox, liveSwitch.resolve, resolveModel, (childSessionId) => memberModelOverrides.get(childSessionId), resolveEndpoint));
+		const disposeProvider = ctx.subagents.registerProvider(new CodexCliProvider(ctx, config.sandbox, liveSwitch.resolve, resolveModel, (childSessionId) => memberModelOverrides.get(childSessionId), resolveEndpoint));
 		const disposeHarness = ctx.localAgent.register({
 			prepareMember: async ({ binding, childSession, configuration, signal }) => {
 				const driver = liveSwitch.resolve(binding.childSessionId);

package/lib/types/codex-cli-provider.d.ts

@@ -28,6 +28,23 @@ import { type CodexEndpointAuth } from './endpoint-auth.ts';
  * closes, so an interrupted call folds with this error result. Same text as
  * the kimi provider's placeholder, for family consistency.
  */
+/**
+ * A finished command's result text and failure. Codex reports a command that
+ * printed nothing with an empty aggregated output — a crash (exit 139) or a
+ * silent failure read as "no result" and the mirror wrote the interrupted
+ * placeholder. A finished command (an exit code, or a completed/failed status)
+ * always carries a result: its output, or "（无输出）", with a non-zero exit
+ * code appended and the result marked failed. A command still running yields
+ * none, so the fold keeps waiting for it.
+ * @param output - the item's aggregated output.
+ * @param exitCode - the item's exit code, when finished.
+ * @param status - the item's status.
+ * @returns the result text (undefined while running) and whether it failed.
+ */
+export declare function commandOutcome(output: unknown, exitCode: unknown, status: unknown): {
+    result?: string;
+    failed: boolean;
+};
 export declare const CODEX_INTERRUPTED_TOOL_RESULT = "\uFF08\u5DE5\u5177\u8C03\u7528\u88AB\u4E2D\u65AD\uFF0C\u672A\u80FD\u8BB0\u5F55\u8FD4\u56DE\u7ED3\u679C\uFF09";
 /** Default POSIX grace between subprocess termination tiers. */
 export declare const DEFAULT_DISPOSE_GRACE_MS = 3000;
@@ -37,6 +54,17 @@ export declare const DEFAULT_DISPOSE_GRACE_MS = 3000;
  * provider-controlled error output only.
  */
 export declare const CODEX_AUTH_FAILURE: RegExp;
+/**
+ * A session's standing sandbox mode — the host's `sandbox/mode` vocabulary is
+ * codex's own (`read-only` | `workspace-write` | `danger-full-access`). Reads
+ * the delegating session first (the mode the user sees and changes), then
+ * the child's inherited record.
+ * @param ctx - context carrying the live session store.
+ * @param childSession - the member's child session, when one exists.
+ * @param parentSessionId - the delegating session.
+ * @returns the mode, or undefined when neither session records one.
+ */
+export declare function sessionSandboxMode(ctx: Context, childSession: Session | undefined, parentSessionId: string | undefined): CodexSandbox | undefined;
 /** Codex sandbox policy values accepted by `codex exec --sandbox`. */
 export type CodexSandbox = 'read-only' | 'workspace-write' | 'danger-full-access';
 /**
@@ -76,6 +104,7 @@ export declare function registerCodexMemberRun(ctx: Context, childSessionId: str
 export declare function codexCliVersion(ctx: Context, homeDir: string): Promise<string | undefined>;
 export declare class CodexCliProvider implements SubagentProvider {
     private readonly ctx;
+    /** An explicit policy from the plugin config; undefined follows the member's session. */
     private readonly sandbox;
     private readonly live?;
     private readonly model?;
@@ -107,7 +136,18 @@ export declare class CodexCliProvider implements SubagentProvider {
      *   relay (a custom `model_providers` entry on the argv, the key in the
      *   env); with no key the spawn carries no credential at all.
      */
-    constructor(ctx: Context, sandbox?: CodexSandbox, live?: CodexLiveDriver | ((childSessionId: string) => CodexLiveDriver | undefined) | undefined, model?: ((scope?: string) => string | undefined) | undefined, overrides?: ((childSessionId: string) => string | undefined) | undefined, endpoint?: ((scopeHome: string) => Promise<CodexEndpointAuth>) | undefined);
+    constructor(ctx: Context, 
+    /** An explicit policy from the plugin config; undefined follows the member's session. */
+    sandbox?: CodexSandbox | undefined, live?: CodexLiveDriver | ((childSessionId: string) => CodexLiveDriver | undefined) | undefined, model?: ((scope?: string) => string | undefined) | undefined, overrides?: ((childSessionId: string) => string | undefined) | undefined, endpoint?: ((scopeHome: string) => Promise<CodexEndpointAuth>) | undefined);
+    /**
+     * The sandbox this round runs under: the plugin config's explicit policy
+     * when set, else the member's session's own standing mode — the delegating
+     * session's latest `sandbox/mode`, then the child's inherited one — so a
+     * member runs with exactly the access its session shows (a full-access
+     * session's Codex member was confined to workspace-write and Blender
+     * crashed under the seatbelt). `workspace-write` when neither says.
+     */
+    sandboxFor(childSession: Session | undefined, parentSessionId: string | undefined): CodexSandbox;
     /** The scope's endpoint credential for this round; absent resolver = never. */
     private resolveEndpoint;
     /** Resolve the live driver for one round's member, if live is on for it. */
@@ -252,6 +292,7 @@ export type CodexTranscriptLine =
     name: string;
     args?: string;
     result?: string;
+    failed?: boolean;
 };
 /** Mutable fold state shared by the batch parse and the incremental parser. */
 interface CodexStreamFoldState {

package/lib/types/codex-cli-provider.js

@@ -30,6 +30,30 @@ import { codexRolloutRoundFacts, usageFromCodex } from './records.js';
  * closes, so an interrupted call folds with this error result. Same text as
  * the kimi provider's placeholder, for family consistency.
  */
+/**
+ * A finished command's result text and failure. Codex reports a command that
+ * printed nothing with an empty aggregated output — a crash (exit 139) or a
+ * silent failure read as "no result" and the mirror wrote the interrupted
+ * placeholder. A finished command (an exit code, or a completed/failed status)
+ * always carries a result: its output, or "（无输出）", with a non-zero exit
+ * code appended and the result marked failed. A command still running yields
+ * none, so the fold keeps waiting for it.
+ * @param output - the item's aggregated output.
+ * @param exitCode - the item's exit code, when finished.
+ * @param status - the item's status.
+ * @returns the result text (undefined while running) and whether it failed.
+ */
+export function commandOutcome(output, exitCode, status) {
+    const text = typeof output === 'string' && output.trim() !== '' ? output : undefined;
+    const code = typeof exitCode === 'number' && Number.isFinite(exitCode) ? exitCode : undefined;
+    const finished = code !== undefined || status === 'completed' || status === 'failed';
+    const failed = (code !== undefined && code !== 0) || status === 'failed';
+    if (!finished)
+        return text === undefined ? { failed: false } : { result: text, failed: false };
+    const exit = code !== undefined && code !== 0 ? `（退出码 ${code}）` : status === 'failed' ? '（执行失败）' : '';
+    const result = text === undefined ? (exit === '' ? '（无输出）' : `${exit.slice(0, -1)}，无输出）`) : exit === '' ? text : `${text}\n${exit}`;
+    return { result, failed };
+}
 export const CODEX_INTERRUPTED_TOOL_RESULT = '（工具调用被中断，未能记录返回结果）';
 /** Quote one TOML basic string for the `-c` config override. */
 function tomlString(value) {
@@ -43,6 +67,26 @@ export const DEFAULT_DISPOSE_GRACE_MS = 3_000;
  * provider-controlled error output only.
  */
 export const CODEX_AUTH_FAILURE = /401 unauthorized|unauthorized|authentication failed|not logged in|access token/i;
+/**
+ * A session's standing sandbox mode — the host's `sandbox/mode` vocabulary is
+ * codex's own (`read-only` | `workspace-write` | `danger-full-access`). Reads
+ * the delegating session first (the mode the user sees and changes), then
+ * the child's inherited record.
+ * @param ctx - context carrying the live session store.
+ * @param childSession - the member's child session, when one exists.
+ * @param parentSessionId - the delegating session.
+ * @returns the mode, or undefined when neither session records one.
+ */
+export function sessionSandboxMode(ctx, childSession, parentSessionId) {
+    const sessions = ctx.get('sessions');
+    const parent = parentSessionId === undefined ? undefined : sessions?.get(SessionId(parentSessionId));
+    for (const session of [parent, childSession]) {
+        const mode = session?.snapshotEvents().filter(event => event.type === 'sandbox/mode').at(-1)?.data;
+        if (mode?.mode === 'read-only' || mode?.mode === 'workspace-write' || mode?.mode === 'danger-full-access')
+            return mode.mode;
+    }
+    return undefined;
+}
 /** Register one member run with the channel; see {@link CodexMemberRunHandle}. */
 export function registerCodexMemberRun(ctx, childSessionId, parentSessionId) {
     const registry = ctx.localAgent;
@@ -155,7 +199,9 @@ export class CodexCliProvider {
      *   relay (a custom `model_providers` entry on the argv, the key in the
      *   env); with no key the spawn carries no credential at all.
      */
-    constructor(ctx, sandbox = 'workspace-write', live, model, overrides, endpoint) {
+    constructor(ctx, 
+    /** An explicit policy from the plugin config; undefined follows the member's session. */
+    sandbox = undefined, live, model, overrides, endpoint) {
         this.ctx = ctx;
         this.sandbox = sandbox;
         this.live = live;
@@ -163,6 +209,19 @@ export class CodexCliProvider {
         this.overrides = overrides;
         this.endpoint = endpoint;
     }
+    /**
+     * The sandbox this round runs under: the plugin config's explicit policy
+     * when set, else the member's session's own standing mode — the delegating
+     * session's latest `sandbox/mode`, then the child's inherited one — so a
+     * member runs with exactly the access its session shows (a full-access
+     * session's Codex member was confined to workspace-write and Blender
+     * crashed under the seatbelt). `workspace-write` when neither says.
+     */
+    sandboxFor(childSession, parentSessionId) {
+        if (this.sandbox !== undefined)
+            return this.sandbox;
+        return sessionSandboxMode(this.ctx, childSession, parentSessionId) ?? 'workspace-write';
+    }
     /** The scope's endpoint credential for this round; absent resolver = never. */
     resolveEndpoint(homeDir) {
         return this.endpoint === undefined ? Promise.resolve(undefined) : this.endpoint(homeDir).catch(() => undefined);
@@ -311,6 +370,7 @@ export class CodexCliProvider {
                     homeDir,
                     childSession,
                     parentSessionId: request.parent.session.id,
+                    sandbox: this.sandboxFor(childSession, request.parent.session.id),
                     ...startModel === undefined ? {} : { startModel },
                     ...configuration === undefined ? {} : { configuration: configuration.resolved },
                     // The thread id arrives with thread/start (server-assigned), far
@@ -352,7 +412,7 @@ export class CodexCliProvider {
                 ...exec === undefined ? {} : { exec },
                 endpointLabel: baseUrl,
                 endpointArgv: endpointConfigOverrides(endpoint),
-                sandbox: this.sandbox,
+                sandbox: this.sandboxFor(childSession, request.parent.session.id),
                 ...(configuration?.resolved ?? resolveRoundModel(this.overrides?.(runId) ?? requestedModel, () => this.model?.(scope))),
                 disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
                 spawn: spec => this.ctx.subprocess.spawn(spec),
@@ -441,6 +501,7 @@ export class CodexCliProvider {
                         homeDir,
                         childSession,
                         parentSessionId: request.parent.session.id,
+                        sandbox: this.sandboxFor(childSession, request.parent.session.id),
                         resume: { cliSessionId: intent.cliSessionId, turn: nextTurn },
                         ...startModel === undefined ? {} : { startModel },
                         ...configuration === undefined ? {} : { configuration: configuration.resolved },
@@ -466,7 +527,7 @@ export class CodexCliProvider {
                     ...exec === undefined ? {} : { exec },
                     endpointLabel: baseUrl,
                     endpointArgv: endpointConfigOverrides(endpoint),
-                    sandbox: this.sandbox,
+                    sandbox: this.sandboxFor(childSession, request.parent.session.id),
                     ...(configuration?.resolved ?? resolveRoundModel(this.overrides?.(intent.childSessionId) ?? requestedModel, () => this.model?.(scope))),
                     disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
                     spawn: spec => this.ctx.subprocess.spawn(spec),
@@ -600,16 +661,15 @@ function foldCodexStreamLine(state, raw) {
         // command with neither text nor output is still a call the CLI made.
         countToolCall(state, 'command_execution');
         const command = typeof item.command === 'string' ? item.command : undefined;
-        const output = typeof item.aggregated_output === 'string' && item.aggregated_output.trim() !== ''
-            ? item.aggregated_output
-            : undefined;
-        if (command !== undefined || output !== undefined) {
+        const outcome = commandOutcome(item.aggregated_output, item.exit_code, item.status);
+        if (command !== undefined || outcome.result !== undefined) {
             state.lines.push({
                 kind: 'tool',
                 id: typeof item.id === 'string' ? item.id : `codex-tool-${state.lines.length}`,
                 name: 'Bash',
                 ...command === undefined ? {} : { args: command },
-                ...output === undefined ? {} : { result: output },
+                ...outcome.result === undefined ? {} : { result: outcome.result },
+                ...outcome.failed ? { failed: true } : {},
             });
         }
     }
@@ -1095,7 +1155,7 @@ export function appendCodexTranscriptLine(childSession, turn, step, line, usage)
             message: createToolResultMessage({
                 callId: line.id,
                 content: [{ type: 'text', text: line.result ?? CODEX_INTERRUPTED_TOOL_RESULT }],
-                isError: line.result === undefined,
+                isError: line.result === undefined || line.failed === true,
             }),
         }, { surfaceOp: 'append', sourceEventSeqs: [call.seq] });
         childSession.append('step/end', { turn, step });

package/lib/types/index.d.ts

@@ -28,7 +28,11 @@ export declare const CATALOG_WARMUP_DELAY_MS = 1500;
 export declare const inject: string[];
 /** Plugin config: the sandbox mode fresh delegations default to, plus the live driver. */
 export interface Config {
-    /** Codex sandbox policy for `codex exec` / app-server threads; defaults to workspace-write. */
+    /**
+     * An explicit Codex sandbox policy for `codex exec` / app-server threads.
+     * Unset (the default), each member runs under its own session's sandbox
+     * mode — the access the session shows.
+     */
     sandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
     /**
      * Deployment-level endpoint credential: the relay's base URL (an

package/lib/types/index.js

@@ -188,7 +188,8 @@ export function apply(ctx, config) {
         }, CATALOG_WARMUP_DELAY_MS);
         warmup.unref();
         const liveSwitch = new LiveDriverSwitch(ctx, face, {
-            sandbox,
+            // Only an explicit policy overrides the member's session mode.
+            sandbox: config.sandbox,
             // The member's scope decides whose list answers: a named scope's
             // rounds read that scope's models.json, exactly like its endpoint
             // credential.
@@ -220,7 +221,7 @@ export function apply(ctx, config) {
             // cache.
             catalogDefault: (scopedHome, cwd) => modelCatalog.readDefault(scopedHome, cwd),
         });
-        const disposeProvider = ctx.subagents.registerProvider(new CodexCliProvider(ctx, sandbox, liveSwitch.resolve, resolveModel, childSessionId => memberModelOverrides.get(childSessionId), resolveEndpoint));
+        const disposeProvider = ctx.subagents.registerProvider(new CodexCliProvider(ctx, config.sandbox, liveSwitch.resolve, resolveModel, childSessionId => memberModelOverrides.get(childSessionId), resolveEndpoint));
         const disposeHarness = ctx.localAgent.register({
             prepareMember: async ({ binding, childSession, configuration, signal }) => {
                 const driver = liveSwitch.resolve(binding.childSessionId);

package/lib/types/live-driver.d.ts

@@ -64,6 +64,8 @@ export interface CodexLiveRoundSpec {
     readonly childSession: Session;
     /** The delegating session (member-channel registration). */
     readonly parentSessionId: string;
+    /** The sandbox the member's thread starts under (its session's mode; see CodexCliProvider.sandboxFor). */
+    readonly sandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
     /**
      * Resume round: continue the thread recorded as `cliSessionId`, appending
      * under this turn number. Also the reattach path after a runtime crash.

package/lib/types/live-driver.js

@@ -27,7 +27,7 @@ import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { SessionId } from '@deepseek-ai/dsh-session';
 import { settleRunResult, subprocessRunHandle, } from '@deepseek-ai/dsh-subagent';
 import { delegationEnv, persistChildSession, LiveStreamPublisher, LiveFlush, LIVE_FLUSH_INTERVAL_MS } from '@khorsheed/dsh-local-agent';
-import { appendCodexRequestHeader, appendCodexTranscriptLine, codexAssistantEvent, codexLineText, DEFAULT_DISPOSE_GRACE_MS, registerCodexMemberRun, textTask, } from './codex-cli-provider.js';
+import { appendCodexRequestHeader, appendCodexTranscriptLine, codexAssistantEvent, codexLineText, commandOutcome, DEFAULT_DISPOSE_GRACE_MS, registerCodexMemberRun, textTask, } from './codex-cli-provider.js';
 import { codexRolloutRoundFacts } from './records.js';
 import { endpointAuthEnv, endpointConfigOverrides } from './endpoint-auth.js';
 /** Default idle lifetime of an unused resident runtime before reclaim. */
@@ -99,17 +99,16 @@ export function codexAppServerItemToLine(item) {
                 : undefined;
         case 'commandExecution': {
             const command = typeof item['command'] === 'string' ? item.command : undefined;
-            const output = typeof item['aggregatedOutput'] === 'string' && item['aggregatedOutput'].trim() !== ''
-                ? item['aggregatedOutput']
-                : undefined;
-            if (command === undefined && output === undefined)
+            const outcome = commandOutcome(item['aggregatedOutput'], item['exitCode'], item['status']);
+            if (command === undefined && outcome.result === undefined)
                 return undefined;
             return {
                 kind: 'tool',
                 id: itemId ?? `codex-live-${randomUUID()}`,
                 name: 'Bash',
                 ...command === undefined ? {} : { args: command },
-                ...output === undefined ? {} : { result: output },
+                ...outcome.result === undefined ? {} : { result: outcome.result },
+                ...outcome.failed ? { failed: true } : {},
             };
         }
         case 'webSearch':
@@ -162,12 +161,30 @@ export function codexAppServerItemToLine(item) {
             return { kind: 'tool', id: itemId ?? `codex-live-${randomUUID()}`, name: `collab/${tool}` };
         }
         case 'mcpToolCall': {
+            // An MCP call (the member bridge's room tools): {server, tool,
+            // arguments, status, result?: {content}, error?: {message}} — the
+            // arguments and the outcome ride the completed item; without them a
+            // member's ask_user_question read as a bare name.
             const server = typeof item['server'] === 'string' ? item.server : undefined;
             const tool = typeof item['tool'] === 'string' ? item.tool : undefined;
+            const args = item['arguments'] === undefined || item['arguments'] === null
+                ? undefined
+                : typeof item['arguments'] === 'string' ? item['arguments'] : JSON.stringify(item['arguments']);
+            const outcome = item['result'];
+            const content = Array.isArray(outcome?.content) ? outcome.content : [];
+            const text = content
+                .filter((block) => typeof block === 'object' && block !== null)
+                .map(block => typeof block['text'] === 'string' ? block['text'] : undefined)
+                .filter((entry) => entry !== undefined && entry !== '')
+                .join('\n');
+            const error = item['error'];
+            const failure = typeof error?.message === 'string' && error.message !== '' ? error.message : undefined;
             return {
                 kind: 'tool',
                 id: itemId ?? `codex-live-${randomUUID()}`,
                 name: server !== undefined && tool !== undefined ? `${server}/${tool}` : tool ?? 'mcp',
+                ...args === undefined || args === '' || args === '{}' ? {} : { args },
+                ...failure !== undefined ? { result: failure, failed: true } : text === '' ? {} : { result: text },
             };
         }
         case 'plan':
@@ -719,7 +736,7 @@ export class CodexLiveDriver {
         if (rt.threadId === undefined) {
             const permissionParams = {
                 approvalPolicy: 'never',
-                sandbox: this.config.sandbox ?? 'workspace-write',
+                sandbox: this.config.sandbox ?? spec.sandbox ?? 'workspace-write',
             };
             if (spec.resume === undefined) {
                 const response = await rt.peer.request('thread/start', {

package/package.json

@@ -8,7 +8,7 @@
     "local-agent",
     "codex"
   ],
-  "version": "0.2.1",
+  "version": "0.2.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -69,7 +69,7 @@
     "dsh": ">=0.1.5-rc.1 <0.3.0-0"
   },
   "dependencies": {
-    "@khorsheed/dsh-local-agent": "^0.2.1"
+    "@khorsheed/dsh-local-agent": "^0.2.2"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",