@mono-agent/agent-runtime 0.6.1 → 0.8.0

package/src/ai/providers/codex-app.js

@@ -7,6 +7,7 @@ import { estimateCost } from "../cost.js";
 import { codexModelSupportsFastMode, normalizeFastMode } from "../runtime/fast-mode.js";
 import { readRuntimeBrand } from "../../agent/tools/shared/runtime-context.js";
 import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
+import { resolveSandboxPolicy } from "../../agent/tools/shared/tool-context.js";
 import { createSessionRegistry } from "../runtime/sessions.js";
 import { createSessionLiveness } from "../runtime/session-liveness.js";
 
@@ -17,6 +18,417 @@ const MIN_THREAD_START_TIMEOUT_MS = 60_000;
 const MAX_THREAD_START_TIMEOUT_MS = 180_000;
 const THREAD_START_PROMPT_CHARS_PER_STEP = 50_000;
 const THREAD_START_TIMEOUT_STEP_MS = 30_000;
+const CODEX_DIAGNOSTIC_BYTES = 8 * 1024;
+const CODEX_STDERR_TAIL_BYTES = 8 * 1024;
+const CODEX_SHUTDOWN_GRACE_MS = 1_000;
+const CODEX_KILL_GRACE_MS = 1_000;
+
+const SENSITIVE_ASSIGNMENT_RE = /((?:api[_-]?key|private[_-]?key|access[_-]?key|authorization|authentication|auth|bearer|cookie|credential|password|signature|sig|secret|token)\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,\r\n]+)/giu;
+const SENSITIVE_HEADER_RE = /((?:(?:proxy-)?authorization|cookie|set-cookie)\s*[:=]\s*)[^\r\n]*/giu;
+const SENSITIVE_JSON_LINE_RE = /("(?:api[_-]?key|private[_-]?key|access[_-]?key|authorization|authentication|auth|bearer|cookie|credential|password|signature|sig|secret|token)"\s*:\s*)[^\r\n]*/giu;
+const SENSITIVE_ESCAPED_JSON_LINE_RE = /(\\"(?:api[_-]?key|private[_-]?key|access[_-]?key|authorization|authentication|auth|bearer|cookie|credential|password|signature|sig|secret|token)\\"\s*:\s*)[^\r\n]*/giu;
+
+function normalizedSensitiveName(name) {
+  return String(name || "")
+    .replace(/([a-z0-9])([A-Z])/gu, "$1_$2")
+    .replace(/[^A-Za-z0-9]+/gu, "_")
+    .replace(/^_+|_+$/gu, "")
+    .toLowerCase();
+}
+
+function isSensitivePayloadField(name) {
+  const normalized = normalizedSensitiveName(name);
+  return /(?:^|_)(?:token|secret|password|authorization|api_key|apikey|credential|cookie|auth|authentication|bearer|private_key|access_key|signature|sig)$/u.test(normalized);
+}
+
+function isSensitiveEnvironmentKey(name) {
+  const normalized = normalizedSensitiveName(name);
+  return /(?:^|_)(?:token|secret|password|authorization|api_key|apikey|credential|cookie|auth|authentication|bearer|private_key|access_key|signature|sig)(?:_|$)/u.test(normalized);
+}
+
+function isSensitiveCliFlag(name) {
+  const normalized = normalizedSensitiveName(String(name || "").replace(/^-+/u, ""));
+  return isSensitivePayloadField(normalized)
+    || /(?:^|_)(?:auth|private_key|access_key|signature|sig)$/u.test(normalized);
+}
+
+function boundedTimeout(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 1 ? Math.trunc(parsed) : fallback;
+}
+
+function sensitiveEnvironmentValues(env) {
+  return [...new Set(Object.entries(env || {})
+    .filter(([key, value]) => isSensitiveEnvironmentKey(key) && typeof value === "string" && value.length >= 8)
+    .map(([, value]) => value))]
+    .sort((left, right) => right.length - left.length);
+}
+
+function addOpaqueSensitiveValue(target, value, { splitCredentials = false } = {}) {
+  if (typeof value !== "string" || value.length < 8) return;
+  target.add(value);
+  if (!splitCredentials) return;
+  const schemeMatch = value.match(/^\s*(Bearer|Basic|Token)\s+(.+?)\s*$/iu);
+  const payload = schemeMatch?.[2];
+  if (payload?.length >= 8) target.add(payload);
+  if (schemeMatch?.[1]?.toLowerCase() === "basic" && payload && payload.length <= 16 * 1024) {
+    try {
+      const decoded = Buffer.from(payload, "base64").toString("utf8");
+      if (decoded && !decoded.includes("\uFFFD")) {
+        addOpaqueSensitiveValue(target, decoded);
+        const separator = decoded.indexOf(":");
+        if (separator >= 0) {
+          addOpaqueSensitiveValue(target, decoded.slice(0, separator));
+          addOpaqueSensitiveValue(target, decoded.slice(separator + 1));
+        }
+      }
+    } catch {
+      // The raw Basic payload remains protected even if it is malformed.
+    }
+  }
+}
+
+function addOpaqueSensitiveValues(target, values, { splitCredentials = false } = {}) {
+  if (!values || typeof values !== "object") return;
+  for (const value of Object.values(values)) {
+    if (Array.isArray(value)) {
+      value.forEach((entry) => addOpaqueSensitiveValue(target, entry, { splitCredentials }));
+    } else {
+      addOpaqueSensitiveValue(target, value, { splitCredentials });
+    }
+  }
+}
+
+function addEncodedCredentialValue(target, value) {
+  addOpaqueSensitiveValue(target, value);
+  try {
+    const decoded = decodeURIComponent(value);
+    addOpaqueSensitiveValue(target, decoded);
+    addOpaqueSensitiveValue(target, encodeURIComponent(decoded));
+  } catch {
+    // Invalid percent escapes are still covered by the original raw value.
+  }
+}
+
+function addUrlSensitiveValues(target, rawUrl) {
+  if (typeof rawUrl !== "string" || !rawUrl) return;
+  try {
+    const parsed = new URL(rawUrl);
+    addEncodedCredentialValue(target, parsed.username);
+    addEncodedCredentialValue(target, parsed.password);
+    for (const value of parsed.searchParams.values()) {
+      // Query parameter names are provider-defined. All opaque query values are
+      // treated as credentials rather than betting on a finite key allowlist.
+      addEncodedCredentialValue(target, value);
+    }
+    for (const part of parsed.search.slice(1).split("&")) {
+      if (part.includes("=")) addEncodedCredentialValue(target, part.slice(part.indexOf("=") + 1));
+    }
+  } catch {
+    // Non-URL templates are passed through unchanged and may still be covered
+    // by a surrounding secret-bearing CLI flag or payload-field redaction.
+  }
+}
+
+function addHeaderArgumentSensitiveValues(target, header) {
+  if (typeof header !== "string") return;
+  const separator = header.indexOf(":");
+  const value = separator >= 0 ? header.slice(separator + 1).trim() : header.trim();
+  addOpaqueSensitiveValue(target, value, { splitCredentials: true });
+}
+
+function addCliSensitiveValues(target, args) {
+  if (!Array.isArray(args)) return;
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (typeof argument !== "string") continue;
+    addUrlSensitiveValues(target, argument);
+    const equals = argument.indexOf("=");
+    if (equals > 0) {
+      const flag = argument.slice(0, equals);
+      const value = argument.slice(equals + 1);
+      // `--url=...` and `--endpoint=...` are not themselves secret flags, but
+      // their inline RHS can contain URL userinfo or query credentials.
+      addUrlSensitiveValues(target, value);
+      if (/^(?:-H|--header|--http-header)$/iu.test(flag)) {
+        addHeaderArgumentSensitiveValues(target, value);
+        continue;
+      }
+      if (isSensitiveCliFlag(flag)) {
+        addOpaqueSensitiveValue(target, value, { splitCredentials: true });
+        continue;
+      }
+    }
+    if (isSensitiveCliFlag(argument) && typeof args[index + 1] === "string") {
+      addOpaqueSensitiveValue(target, args[index + 1], { splitCredentials: true });
+      index += 1;
+      continue;
+    }
+    if (/^(?:-H|--header|--http-header)$/iu.test(argument) && typeof args[index + 1] === "string") {
+      addHeaderArgumentSensitiveValues(target, args[index + 1]);
+      index += 1;
+    }
+  }
+}
+
+function codexRequestSensitiveValues(options = {}) {
+  const values = new Set(sensitiveEnvironmentValues({
+    ...process.env,
+    ...(options.codexAppServerEnv || {}),
+  }));
+  for (const server of Object.values(options.mcpServers || {})) {
+    if (!server || typeof server !== "object") continue;
+    // MCP env/header names are provider-defined and need not contain words such
+    // as "token" or "secret". Treat every opaque value on these credential-
+    // bearing surfaces as sensitive instead of relying on a key-name heuristic.
+    addOpaqueSensitiveValues(values, server.env);
+    addOpaqueSensitiveValues(values, server.headers, { splitCredentials: true });
+    addUrlSensitiveValues(values, server.url);
+    addCliSensitiveValues(values, server.args);
+  }
+  addCliSensitiveValues(values, options.codexAppServerArgs);
+  return [...values].sort((left, right) => right.length - left.length);
+}
+
+function leadingSensitiveOverlap(text, sensitiveValue) {
+  const maxLength = Math.min(text.length, sensitiveValue.length, CODEX_STDERR_TAIL_BYTES);
+  if (maxLength < 8) return 0;
+  const pattern = text.slice(0, maxLength);
+  const failure = new Array(pattern.length).fill(0);
+  for (let index = 1, matched = 0; index < pattern.length; index += 1) {
+    while (matched > 0 && pattern[index] !== pattern[matched]) matched = failure[matched - 1];
+    if (pattern[index] === pattern[matched]) matched += 1;
+    failure[index] = matched;
+  }
+  let matched = 0;
+  for (const character of sensitiveValue.slice(-maxLength)) {
+    while (matched > 0 && character !== pattern[matched]) matched = failure[matched - 1];
+    if (character === pattern[matched]) matched += 1;
+  }
+  return matched >= 8 ? matched : 0;
+}
+
+function redactCodexDiagnostic(text, sensitiveValues, truncatedStart = false) {
+  let redacted = String(text || "");
+  for (const value of sensitiveValues) {
+    if (truncatedStart) {
+      const overlap = leadingSensitiveOverlap(redacted, value);
+      if (overlap > 0) redacted = `[REDACTED]${redacted.slice(overlap)}`;
+    }
+    redacted = redacted.split(value).join("[REDACTED]");
+  }
+  return redacted
+    .replace(SENSITIVE_HEADER_RE, "$1[REDACTED]")
+    .replace(/\bBearer\s+[A-Za-z0-9._~+\/-]{12,}/giu, "Bearer [REDACTED]")
+    .replace(/\b(?:sk|pk|sess|oauth)[-_][A-Za-z0-9._-]{12,}\b/giu, "[REDACTED]")
+    .replace(SENSITIVE_ESCAPED_JSON_LINE_RE, '$1\\"[REDACTED]\\"')
+    .replace(SENSITIVE_JSON_LINE_RE, '$1"[REDACTED]"')
+    .replace(SENSITIVE_ASSIGNMENT_RE, "$1[REDACTED]");
+}
+
+function utf8Head(text, limit) {
+  if (limit <= 0) return "";
+  const bytes = Buffer.from(String(text || ""));
+  if (bytes.length <= limit) return bytes.toString("utf8");
+  let end = limit;
+  while (end > 0 && (bytes[end] & 0xc0) === 0x80) end -= 1;
+  return bytes.subarray(0, end).toString("utf8");
+}
+
+function boundCodexDiagnostic(text, limit = CODEX_DIAGNOSTIC_BYTES) {
+  const value = String(text || "");
+  const byteLength = Buffer.byteLength(value);
+  if (byteLength <= limit) return value;
+  let droppedBytes = byteLength - limit;
+  let marker = `\n[truncated ${droppedBytes} later bytes]`;
+  let bodyLimit = Math.max(0, limit - Buffer.byteLength(marker));
+  droppedBytes = byteLength - bodyLimit;
+  marker = `\n[truncated ${droppedBytes} later bytes]`;
+  bodyLimit = Math.max(0, limit - Buffer.byteLength(marker));
+  return utf8Head(value, bodyLimit) + marker;
+}
+
+function safeDiagnosticString(value) {
+  if (typeof value === "string") return value;
+  if (value instanceof Error && typeof value.message === "string") return value.message;
+  try {
+    const serialized = JSON.stringify(value);
+    return typeof serialized === "string" ? serialized : String(value ?? "");
+  } catch {
+    try {
+      return String(value);
+    } catch {
+      return "Codex app-server diagnostic unavailable";
+    }
+  }
+}
+
+function sanitizeCodexDiagnostic(value, sensitiveValues, limit = CODEX_DIAGNOSTIC_BYTES) {
+  return boundCodexDiagnostic(
+    redactCodexDiagnostic(safeDiagnosticString(value), sensitiveValues),
+    limit,
+  );
+}
+
+function sanitizeCodexProtocolCode(value, sensitiveValues) {
+  return typeof value === "number"
+    ? value
+    : sanitizeCodexDiagnostic(value, sensitiveValues, 256);
+}
+
+function boundedCodexDiagnosticPayload(value, sensitiveValues, limit) {
+  const sanitized = redactCodexPayload(value, sensitiveValues);
+  try {
+    if (Buffer.byteLength(JSON.stringify(sanitized) || "") <= limit) return sanitized;
+  } catch {
+    // Fall through to a safe string summary for non-serializable values.
+  }
+  return sanitizeCodexDiagnostic(value, sensitiveValues, limit);
+}
+
+function redactCodexPayload(value, sensitiveValues, seen = new WeakSet(), depth = 0) {
+  if (typeof value === "string") return redactCodexDiagnostic(value, sensitiveValues);
+  if (value === null || typeof value !== "object") return value;
+  if (value instanceof Error) {
+    const errorCode = /** @type {any} */ (value).code;
+    return {
+      name: redactCodexDiagnostic(value.name || "Error", sensitiveValues),
+      message: sanitizeCodexDiagnostic(value.message || value, sensitiveValues),
+      ...(errorCode !== undefined
+        ? { code: sanitizeCodexProtocolCode(errorCode, sensitiveValues) }
+        : {}),
+    };
+  }
+  if (depth >= 20) return "[truncated nested Codex payload]";
+  if (seen.has(value)) return "[circular Codex payload]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const result = value.map((entry) => redactCodexPayload(entry, sensitiveValues, seen, depth + 1));
+    seen.delete(value);
+    return result;
+  }
+  const result = {};
+  for (const [key, entry] of Object.entries(value)) {
+    result[key] = isSensitivePayloadField(key)
+      ? "[REDACTED]"
+      : redactCodexPayload(entry, sensitiveValues, seen, depth + 1);
+  }
+  seen.delete(value);
+  return result;
+}
+
+function sanitizeCodexResponseError(error, sensitiveValues) {
+  const sanitized = redactCodexPayload(error, sensitiveValues);
+  let serialized;
+  try {
+    serialized = JSON.stringify(sanitized);
+  } catch {
+    serialized = "";
+  }
+  if (Buffer.byteLength(serialized || "") <= CODEX_DIAGNOSTIC_BYTES) return sanitized;
+
+  const data = error && typeof error === "object" ? error.data : null;
+  const nestedError = data && typeof data === "object" ? data.error : null;
+  const info = data?.info ?? nestedError?.info ?? error?.info;
+  return {
+    ...(error?.code !== undefined
+      ? { code: sanitizeCodexProtocolCode(error.code, sensitiveValues) }
+      : {}),
+    message: sanitizeCodexDiagnostic(codexErrorMessage(error), sensitiveValues, 6 * 1024),
+    ...(info !== undefined
+      ? { data: { info: boundedCodexDiagnosticPayload(info, sensitiveValues, 1_024) } }
+      : {}),
+    diagnostic_truncated: true,
+  };
+}
+
+const CODEX_DIAGNOSTIC_NOTIFICATION_METHODS = new Set([
+  "warning",
+  "error",
+  "configWarning",
+  "guardianWarning",
+]);
+
+function sanitizeCodexNotification(notification, sensitiveValues) {
+  const safe = redactCodexPayload(notification, sensitiveValues);
+  if (!safe || typeof safe !== "object") return safe;
+  if (CODEX_DIAGNOSTIC_NOTIFICATION_METHODS.has(safe.method)) {
+    const params = safe.params && typeof safe.params === "object" ? safe.params : {};
+    return {
+      ...safe,
+      params: {
+        ...(params.code !== undefined
+          ? { code: sanitizeCodexProtocolCode(params.code, sensitiveValues) }
+          : {}),
+        message: sanitizeCodexDiagnostic(params.message || params.error || params, sensitiveValues),
+      },
+    };
+  }
+  if (safe.method === "turn/completed" && safe.params?.turn?.error !== undefined) {
+    return {
+      ...safe,
+      params: {
+        ...safe.params,
+        turn: {
+          ...safe.params.turn,
+          error: sanitizeCodexResponseError(safe.params.turn.error, sensitiveValues),
+        },
+      },
+    };
+  }
+  if ((safe.method === "item/started" || safe.method === "item/completed") && safe.params?.item?.error !== undefined) {
+    return {
+      ...safe,
+      params: {
+        ...safe.params,
+        item: {
+          ...safe.params.item,
+          error: sanitizeCodexResponseError(safe.params.item.error, sensitiveValues),
+        },
+      },
+    };
+  }
+  return safe;
+}
+
+function utf8Tail(text, limit) {
+  if (limit <= 0) return "";
+  const bytes = Buffer.from(String(text || ""));
+  if (bytes.length <= limit) return bytes.toString("utf8");
+  let start = bytes.length - limit;
+  while (start < bytes.length && (bytes[start] & 0xc0) === 0x80) start += 1;
+  return bytes.subarray(start).toString("utf8");
+}
+
+function createCodexStderrTail(sensitiveValues, limit = CODEX_STDERR_TAIL_BYTES) {
+  let buffer = Buffer.alloc(0);
+  let bytesDropped = 0;
+  return {
+    push(chunk) {
+      const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk ?? ""));
+      if (incoming.length === 0) return;
+      if (incoming.length >= limit) {
+        bytesDropped += buffer.length + incoming.length - limit;
+        buffer = Buffer.from(incoming.subarray(incoming.length - limit));
+        return;
+      }
+      const overflow = Math.max(0, buffer.length + incoming.length - limit);
+      bytesDropped += overflow;
+      buffer = Buffer.concat([buffer.subarray(overflow), incoming], Math.min(limit, buffer.length + incoming.length));
+    },
+    toString() {
+      const redacted = redactCodexDiagnostic(
+        buffer.toString("utf8").replace(/^\uFFFD/u, ""),
+        sensitiveValues,
+        bytesDropped > 0,
+      ).trim();
+      if (bytesDropped === 0) return utf8Tail(redacted, limit);
+      const marker = `[truncated ${bytesDropped} earlier bytes]\n`;
+      const bodyLimit = Math.max(0, limit - Buffer.byteLength(marker));
+      return marker + utf8Tail(redacted, bodyLimit);
+    },
+  };
+}
 
 const CODEX_APP_CAPABILITIES = {
   kind: "codex-app",
@@ -108,17 +520,78 @@ function delay(ms, signal) {
   });
 }
 
-function sandboxForPermissionMode(permissionMode) {
-  if (permissionMode === "bypassPermissions") return "danger-full-access";
-  if (permissionMode === "plan") return "read-only";
+function sandboxForRun(options) {
+  if (options.codexNoToolsProbe === true) return "read-only";
+  if (options.permissionMode === "bypassPermissions") return "danger-full-access";
+  if (options.permissionMode === "plan") return "read-only";
   return "workspace-write";
 }
 
-function approvalPolicyForPermissionMode(permissionMode) {
-  if (permissionMode === "bypassPermissions") return "never";
-  return "on-request";
+function approvalPolicyForRun(options) {
+  // mono-agent channel turns are unattended: there is no interactive app-server
+  // approval UI on the other end of stdio. `never` lets Codex execute within the
+  // selected sandbox and deny escalations itself instead of waiting forever for
+  // a client response that cannot arrive.
+  return "never";
 }
 
+function sandboxPolicyForRun(options) {
+  if (options.codexNoToolsProbe === true) return { type: "readOnly", networkAccess: false };
+  if (options.permissionMode === "bypassPermissions") return { type: "dangerFullAccess" };
+  if (options.permissionMode === "plan") return { type: "readOnly", networkAccess: false };
+  return {
+    type: "workspaceWrite",
+    writableRoots: [options.cwd || process.cwd()],
+    networkAccess: false,
+    excludeTmpdirEnvVar: false,
+    excludeSlashTmp: false,
+  };
+}
+
+function codexToolPolicyProblem(options) {
+  const allowedTools = Array.isArray(options.allowedTools) ? options.allowedTools : null;
+  const disallowedTools = Array.isArray(options.disallowedTools) ? options.disallowedTools : [];
+  if (options.codexNoToolsProbe === true) {
+    const mcpServerCount = Object.keys(options.mcpServers || {}).length;
+    if (allowedTools?.length === 0 && disallowedTools.length === 0 && mcpServerCount === 0 && options.sessionKeepAlive !== true) {
+      return null;
+    }
+    return "Codex no-tool probe mode requires an empty tool policy, no MCP servers, and a disposable session.";
+  }
+  // `undefined` retains the public runtime's documented allow-all default.
+  // Once a caller specifies a policy, require the exact wildcard contract.
+  // Extra entries can conceal a caller's mistaken belief that Codex enforces a
+  // mixed allowlist, which the app-server cannot project.
+  const effectiveAllowAll = allowedTools === null || (allowedTools.length === 1 && allowedTools[0] === "*");
+  return effectiveAllowAll && disallowedTools.length === 0
+    ? null
+    : "Direct Codex cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or another runtime.";
+}
+
+const CODEX_NO_TOOL_ACTION_ITEMS = new Set([
+  "commandExecution",
+  "fileChange",
+  "mcpToolCall",
+  "dynamicToolCall",
+  "collabAgentToolCall",
+  "subAgentActivity",
+  "webSearch",
+  "imageView",
+  "sleep",
+  "imageGeneration",
+]);
+
+const CODEX_NO_TOOL_REQUEST_METHODS = new Set([
+  "item/commandExecution/requestApproval",
+  "item/fileChange/requestApproval",
+  "item/tool/requestUserInput",
+  "item/permissions/requestApproval",
+  "item/tool/call",
+  "mcpServer/elicitation/request",
+  "applyPatchApproval",
+  "execCommandApproval",
+]);
+
 function codexMcpConfig(mcpServers = {}) {
   const servers = {};
   for (const [name, cfg] of Object.entries(mcpServers || {})) {
@@ -152,7 +625,7 @@ function codexErrorMessage(error) {
   if (info && typeof info === "object" && "activeTurnNotSteerable" in info) {
     return "Codex active turn is not steerable";
   }
-  return error.message || data.message || JSON.stringify(error);
+  return error.message || data.message || safeDiagnosticString(error);
 }
 
 function isActiveTurnNotSteerable(error) {
@@ -169,17 +642,21 @@ function isCodexRequestTimeout(error, method = null) {
     && (!method || error.method === method);
 }
 
-function codexErrorDiagnostics(error) {
+function codexErrorDiagnostics(error, sensitiveValues = []) {
   if (!error) return {};
   if (isCodexRequestTimeout(error)) {
     return {
       codex_error_code: "codex_app_server_request_timeout",
-      codex_request_method: error.method || null,
+      codex_request_method: error.method ? sanitizeCodexDiagnostic(error.method, sensitiveValues, 256) : null,
       codex_request_timeout_ms: error.timeoutMs || null,
-      ...(error.stderrTail ? { stderr_tail: error.stderrTail } : {}),
+      ...(error.stderrTail
+        ? { stderr_tail: sanitizeCodexDiagnostic(error.stderrTail, sensitiveValues) }
+        : {}),
     };
   }
-  return error.code ? { codex_error_code: String(error.code) } : {};
+  return error.code
+    ? { codex_error_code: sanitizeCodexDiagnostic(error.code, sensitiveValues, 256) }
+    : {};
 }
 
 function withoutCodexRequestErrorDiagnostics(diagnostics) {
@@ -224,7 +701,7 @@ function codexCollaborationModePayload(nativeSubagents, { model, effort, systemP
 }
 
 /**
- * @param {{command?: string, args?: string[], cwd?: any, env?: any, onNotification?: (msg: any) => void}} [options]
+ * @param {{command?: string, args?: string[], cwd?: any, env?: any, redactionValues?: string[], onNotification?: (msg: any) => void, onServerRequest?: (msg: any) => Promise<any> | any, shutdownGraceMs?: number, killGraceMs?: number}} [options]
  */
 export function createCodexAppServerClient({
   command = "codex",
@@ -233,17 +710,37 @@ export function createCodexAppServerClient({
   args = ["app-server", "--listen", "stdio://", "-c", "project_doc_max_bytes=0"],
   cwd,
   env = {},
+  redactionValues = [],
   onNotification = () => {},
+  onServerRequest = (message) => {
+    throw new Error(`Unsupported Codex app-server request: ${String(message?.method || "unknown")}`);
+  },
+  shutdownGraceMs = CODEX_SHUTDOWN_GRACE_MS,
+  killGraceMs = CODEX_KILL_GRACE_MS,
 } = {}) {
+  const childEnv = { ...process.env, ...env };
+  const configuredSensitiveValues = new Set();
+  for (const value of redactionValues) {
+    addOpaqueSensitiveValue(configuredSensitiveValues, value, { splitCredentials: true });
+  }
+  const sensitiveValues = [...new Set([
+    ...sensitiveEnvironmentValues(childEnv),
+    ...configuredSensitiveValues,
+  ])].sort((left, right) => right.length - left.length);
   const child = spawn(command, args, {
     cwd,
-    env: { ...process.env, ...env },
+    env: childEnv,
     stdio: ["pipe", "pipe", "pipe"],
   });
   const pending = new Map();
-  const stderr = [];
+  const stderrTail = createCodexStderrTail(sensitiveValues);
+  const shutdownTimers = new Set();
   let nextId = 1;
   let closed = false;
+  let processSettled = false;
+  let closing = false;
+  /** @type {Promise<void> | null} */
+  let closePromise = null;
   let resolveClosed;
   const closedPromise = new Promise((resolve) => { resolveClosed = resolve; });
 
@@ -255,22 +752,56 @@ export function createCodexAppServerClient({
     pending.clear();
   }
 
-  function stderrTail() {
-    const text = stderr.join("").trim();
-    if (!text) return "";
-    return text.length > 8_192 ? text.slice(text.length - 8_192) : text;
+  function safeTransportError(error) {
+    const message = sanitizeCodexDiagnostic(error?.message || error || "codex app-server failed", sensitiveValues);
+    const safe = new Error(message || "codex app-server failed");
+    return error?.code === undefined ? safe : Object.assign(safe, { code: error.code });
   }
 
-  child.stderr.on("data", (chunk) => stderr.push(chunk.toString()));
+  function onStderrData(chunk) {
+    stderrTail.push(chunk);
+  }
+
+  child.stderr.on("data", onStderrData);
+
+  function writeProtocolMessage(payload) {
+    if (closed || child.stdin?.destroyed || child.stdin?.writableEnded) return;
+    child.stdin.write(`${JSON.stringify(payload)}\n`, () => {});
+  }
+
+  function respondToServerRequest(message) {
+    // Preserve request visibility for the normal event/fail-fast path, then
+    // always settle the JSON-RPC request. Never leave the app-server blocked on
+    // an inbound request that this unattended client cannot service.
+    const safeMessage = redactCodexPayload(message, sensitiveValues);
+    onNotification(safeMessage);
+    Promise.resolve()
+      .then(() => onServerRequest(safeMessage))
+      .then(
+        (result) => writeProtocolMessage({ id: message.id, result: result ?? {} }),
+        () => writeProtocolMessage({
+          id: message.id,
+          error: { code: -32601, message: `Unsupported Codex app-server request: ${String(message.method || "unknown")}` },
+        }),
+      );
+  }
 
   const rl = createInterface({ input: child.stdout });
-  rl.on("line", (line) => {
+  function onLine(line) {
     if (!line.trim()) return;
     let message;
     try {
       message = JSON.parse(line);
     } catch {
-      onNotification({ method: "warning", params: { message: `Malformed Codex app-server output: ${line}` } });
+      onNotification({
+        method: "warning",
+        params: {
+          message: sanitizeCodexDiagnostic(
+            `Malformed Codex app-server output: ${line}`,
+            sensitiveValues,
+          ),
+        },
+      });
       return;
     }
     if (Object.prototype.hasOwnProperty.call(message, "id") && (message.result !== undefined || message.error !== undefined)) {
@@ -278,25 +809,74 @@ export function createCodexAppServerClient({
       if (!entry) return;
       pending.delete(message.id);
       clearTimeout(entry.timer);
-      if (message.error) entry.reject(Object.assign(new Error(codexErrorMessage(message.error)), { responseError: message.error }));
+      if (message.error) {
+        const responseError = sanitizeCodexResponseError(message.error, sensitiveValues);
+        entry.reject(Object.assign(
+          new Error(sanitizeCodexDiagnostic(codexErrorMessage(responseError), sensitiveValues)),
+          { responseError },
+        ));
+      }
       else entry.resolve(message.result);
       return;
     }
-    if (message.method) onNotification(message);
-  });
+    if (Object.prototype.hasOwnProperty.call(message, "id") && message.method) {
+      respondToServerRequest(message);
+      return;
+    }
+    if (message.method) onNotification(sanitizeCodexNotification(message, sensitiveValues));
+  }
+  rl.on("line", onLine);
+
+  function cleanupTransport() {
+    for (const timer of shutdownTimers) clearTimeout(timer);
+    shutdownTimers.clear();
+    rl.off("line", onLine);
+    try { rl.close(); } catch {}
+    child.stderr?.off?.("data", onStderrData);
+    child.off("error", onChildError);
+    child.off("close", onChildClose);
+    try { child.stdin?.destroy?.(); } catch {}
+    try { child.stdout?.destroy?.(); } catch {}
+    try { child.stderr?.destroy?.(); } catch {}
+  }
 
-  child.on("error", (err) => {
+  function settleClosed(error) {
+    if (processSettled) return;
+    processSettled = true;
     closed = true;
-    rejectAll(err);
-    resolveClosed(err);
-  });
-  child.on("close", (code) => {
+    rejectAll(error);
+    cleanupTransport();
+    resolveClosed(error);
+  }
+
+  function onChildError(error) {
+    const safe = safeTransportError(error);
     closed = true;
-    const detail = stderr.join("").trim();
-    const err = new Error(detail || `codex app-server exited ${code}`);
-    rejectAll(err);
-    resolveClosed(err);
-  });
+    rejectAll(safe);
+    // A spawn failure has no live process and may not emit `close`. By contrast,
+    // ChildProcess also emits `error` when signaling a live child fails (EPERM,
+    // ESRCH races). Only `close` proves that such a process actually exited.
+    if (child.pid === undefined) {
+      settleClosed(safe);
+      return;
+    }
+    if (!closing) void close();
+  }
+
+  function onChildClose(code, signal) {
+    if (closing) {
+      settleClosed(new Error("codex app-server closed"));
+      return;
+    }
+    const summary = signal === null
+      ? `codex app-server exited ${code ?? "unknown"}`
+      : `codex app-server terminated by ${signal}`;
+    const detail = stderrTail.toString();
+    settleClosed(new Error(detail ? `${summary}: ${detail}` : summary));
+  }
+
+  child.on("error", onChildError);
+  child.once("close", onChildClose);
 
   function request(method, params, { timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS } = {}) {
     if (closed || child.stdin?.destroyed || child.stdin?.writableEnded) {
@@ -311,7 +891,7 @@ export function createCodexAppServerClient({
           code: "CODEX_APP_SERVER_REQUEST_TIMEOUT",
           method,
           timeoutMs,
-          stderrTail: stderrTail(),
+          stderrTail: stderrTail.toString(),
         }));
       }, timeoutMs);
       timer.unref?.();
@@ -320,17 +900,51 @@ export function createCodexAppServerClient({
         if (!err) return;
         pending.delete(id);
         clearTimeout(timer);
-        reject(err);
+        reject(safeTransportError(err));
       });
     });
   }
 
+  function waitForProcessClose(timeoutMs) {
+    if (processSettled) return Promise.resolve(true);
+    return new Promise((resolve) => {
+      let settled = false;
+      let timer;
+      const finish = (didClose) => {
+        if (settled) return;
+        settled = true;
+        if (timer !== undefined) {
+          clearTimeout(timer);
+          shutdownTimers.delete(timer);
+        }
+        resolve(didClose);
+      };
+      timer = setTimeout(() => finish(false), timeoutMs);
+      timer.unref?.();
+      shutdownTimers.add(timer);
+      closedPromise.then(() => finish(true));
+    });
+  }
+
   function close() {
-    if (closed) return;
-    closed = true;
-    try { child.stdin?.end?.(); } catch {}
-    try { child.kill("SIGTERM"); } catch {}
-    rejectAll(new Error("codex app-server closed"));
+    if (closePromise !== null) return closePromise;
+    closePromise = (async () => {
+      closing = true;
+      closed = true;
+      rejectAll(new Error("codex app-server closed"));
+      if (processSettled) return;
+
+      try { child.stdin?.end?.(); } catch {}
+      try { child.kill("SIGTERM"); } catch {}
+      if (await waitForProcessClose(boundedTimeout(shutdownGraceMs, CODEX_SHUTDOWN_GRACE_MS))) return;
+
+      try { child.kill("SIGKILL"); } catch {}
+      if (await waitForProcessClose(boundedTimeout(killGraceMs, CODEX_KILL_GRACE_MS))) return;
+
+      try { child.unref?.(); } catch {}
+      settleClosed(new Error("codex app-server did not exit after SIGKILL"));
+    })();
+    return closePromise;
   }
 
   return { request, close, child, closed: closedPromise };
@@ -436,11 +1050,21 @@ function usageFromTokenUsage(tokenUsage) {
 
 const noopNotificationHandler = () => {};
 
+async function closeCodexClient(client) {
+  if (!client?.close) return;
+  try {
+    await client.close();
+  } catch {
+    // Teardown is best-effort at result boundaries, but the returned promise is
+    // always observed so a custom client cannot create an unhandled rejection.
+  }
+}
+
 // Live keep-alive sessions keyed by codex thread id.
 const codexSessions = createSessionRegistry({
   isBusy: (entry) => entry.busy === true,
   onEvict: async (entry) => {
-    try { entry.client.close(); } catch {}
+    await closeCodexClient(entry.client);
   },
 });
 // Synchronous liveness primitives over the registry. Codex only needs the
@@ -452,9 +1076,17 @@ const codexLiveness = createSessionLiveness(codexSessions);
 export async function generateCodexAppResponse(systemPrompt, options = {}) {
   const start = Date.now();
   const resolved = options.model;
+  // Resolve every credential-bearing value before the app-server client is
+  // constructed. The same set protects transport errors and provider events,
+  // including MCP servers whose custom env/header names are not recognizable
+  // through key-name heuristics.
+  const sensitiveValues = codexRequestSensitiveValues(options);
+  const safeDiagnostic = (value, limit) => sanitizeCodexDiagnostic(value, sensitiveValues, limit);
+  const safeResponseError = (error) => sanitizeCodexResponseError(error, sensitiveValues);
   // Test seam: lets tests drive the bridge with a stub app-server client.
   const makeClient = options.codexClientFactory || createCodexAppServerClient;
   const keepAlive = options.sessionKeepAlive === true;
+  const noToolsProbe = options.codexNoToolsProbe === true;
   // The bridge TTL is a backstop behind the host's session policy; the grace
   // keeps the host's lazy expiry firing first so eviction stays host-driven.
   const sessionTtlMs = Number.isFinite(Number(options.sessionIdleTimeoutMs))
@@ -464,11 +1096,12 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     ? options.sessionId
     : null;
   const prompt = promptFromMessages(options.messages);
-  // Effort is expected to be pre-normalized by core/ai.js#generateResponse
-  // before reaching this provider. We trust options.effort verbatim.
-  const normalizedEffort = typeof options.effort === "string" && options.effort.trim()
+  // Effort arrives pre-normalized; codex has no "max" reasoning tier, so clamp
+  // to its ceiling here instead of failing the app-server turn.
+  const requestedEffort = typeof options.effort === "string" && options.effort.trim()
     ? options.effort
     : null;
+  const normalizedEffort = requestedEffort === "max" ? "xhigh" : requestedEffort;
   const events = [];
   const texts = [];
   const agentTextByItem = new Map();
@@ -479,6 +1112,8 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
   let failureKind = null;
   let usage = {};
   let codexDiagnostics = {};
+  let noToolsViolation = null;
+  let serverRequestViolation = null;
   let resolveTurn;
   let resolveTurnReady;
   let turnReadyResolved = false;
@@ -508,17 +1143,80 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
 
   function emitEvent(event) {
     if (!event) return;
-    events.push(event);
-    options.onEvent?.(event);
+    const safeEvent = redactCodexPayload(event, sensitiveValues);
+    events.push(safeEvent);
+    options.onEvent?.(safeEvent);
   }
 
   function handleAgentText(text) {
-    pushUniqueText(texts, text);
-    emitEvent({ type: "assistant", message: { content: [{ type: "text", text }] } });
+    const safeText = redactCodexDiagnostic(text, sensitiveValues);
+    pushUniqueText(texts, safeText);
+    emitEvent({ type: "assistant", message: { content: [{ type: "text", text: safeText }] } });
+  }
+
+  function failNoToolsProbe(action) {
+    if (!noToolsProbe || noToolsViolation) return;
+    const safeAction = safeDiagnostic(action, 512);
+    noToolsViolation = safeAction;
+    errorMessage = `Codex attempted ${safeAction} during a no-tool readiness probe`;
+    failureKind = "tool_policy_violation";
+    codexDiagnostics = { ...codexDiagnostics, codex_error_code: "codex_no_tools_violation", codex_tool_action: safeAction };
+    emitEvent({
+      type: "runtime_warning",
+      warning_kind: "codex_no_tools_violation",
+      message: "Codex attempted a tool action during the no-tool readiness probe; the turn was interrupted.",
+    });
+    if (threadId && activeTurnId && !interruptSent) {
+      interruptSent = true;
+      client?.request("turn/interrupt", { threadId, turnId: activeTurnId }).catch(() => {});
+    }
+    turnCompleted = true;
+    resolveTurn({ id: activeTurnId, status: "interrupted" });
+  }
+
+  function failUnsupportedServerRequest(method) {
+    if (noToolsProbe) {
+      failNoToolsProbe(method);
+      return;
+    }
+    if (serverRequestViolation) return;
+    const safeMethod = safeDiagnostic(method, 512);
+    serverRequestViolation = safeMethod;
+    errorMessage = `Codex requested unsupported client interaction (${safeMethod}); the unattended turn was stopped.`;
+    failureKind = "skipped_capability_mismatch";
+    codexDiagnostics = {
+      ...codexDiagnostics,
+      codex_error_code: "codex_server_request_unsupported",
+      codex_server_request_method: safeMethod,
+    };
+    emitEvent({
+      type: "runtime_warning",
+      warning_kind: "codex_server_request_unsupported",
+      message: errorMessage,
+    });
+    turnCompleted = true;
+    resolveTurn({ id: activeTurnId, status: "interrupted" });
+  }
+
+  function assertNoUnsupportedServerRequest() {
+    if (serverRequestViolation) {
+      throw new Error(errorMessage || `Unsupported Codex app-server request: ${serverRequestViolation}`);
+    }
   }
 
   function handleNotification(notification) {
-    const { method, params = {} } = notification;
+    const safeNotification = sanitizeCodexNotification(notification, sensitiveValues);
+    const { method, params = {} } = safeNotification;
+    if (noToolsProbe) {
+      const itemType = params.item?.type;
+      if (
+        CODEX_NO_TOOL_REQUEST_METHODS.has(method)
+        || ((method === "item/started" || method === "item/completed") && CODEX_NO_TOOL_ACTION_ITEMS.has(itemType))
+      ) {
+        failNoToolsProbe(typeof itemType === "string" ? itemType : method);
+        return;
+      }
+    }
     if (method === "turn/started") {
       setActiveTurnId(params.turn?.id, { steerReady: true });
       emitEvent({ type: "cli_event", raw: { type: "turn_started", turn: params.turn } });
@@ -528,10 +1226,13 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       setActiveTurnId(params.turn?.id);
       turnCompleted = true;
       if (params.turn?.status === "failed") {
-        errorMessage = params.turn?.error?.message || params.turn?.error || "Codex turn failed";
+        errorMessage = safeDiagnostic(params.turn?.error?.message || params.turn?.error || "Codex turn failed");
         failureKind = "provider_unavailable";
       }
-      emitEvent({ type: "cli_event", raw: { type: "turn_completed", turn: params.turn } });
+      const safeTurn = params.turn?.error === undefined
+        ? params.turn
+        : { ...params.turn, error: safeResponseError(params.turn.error) };
+      emitEvent({ type: "cli_event", raw: { type: "turn_completed", turn: safeTurn } });
       resolveTurn(params.turn);
       return;
     }
@@ -552,7 +1253,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       emitEvent({
         type: "runtime_warning",
         warning_kind: method.replace(/\W+/g, "_"),
-        message: params.message || params.error || JSON.stringify(params),
+        message: safeDiagnostic(params.message || params.error || params),
       });
       return;
     }
@@ -582,7 +1283,15 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       args: options.codexAppServerArgs,
       cwd: options.cwd,
       env: options.codexAppServerEnv,
-      onNotification: (notification) => notificationTarget.handler(notification),
+      redactionValues: sensitiveValues,
+      onNotification: (notification) => notificationTarget.handler(
+        sanitizeCodexNotification(notification, sensitiveValues),
+      ),
+      onServerRequest: (request) => {
+        const method = typeof request?.method === "string" ? request.method : "unknown";
+        failUnsupportedServerRequest(method);
+        throw new Error(`Unsupported Codex app-server request: ${method}`);
+      },
     });
   }
 
@@ -592,6 +1301,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       clientInfo: { name: brand.clientInfoName, title: brand.clientInfoTitle, version: "0" },
       capabilities: { experimentalApi: true },
     });
+    assertNoUnsupportedServerRequest();
   }
 
   async function requestThreadStart(params) {
@@ -605,6 +1315,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       }
       try {
         const thread = await client.request("thread/start", params, { timeoutMs: policy.timeoutMs });
+        assertNoUnsupportedServerRequest();
         codexDiagnostics = {
           ...withoutCodexRequestErrorDiagnostics(codexDiagnostics),
           codex_thread_start_attempts: attempt,
@@ -617,7 +1328,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
         lastError = err;
         codexDiagnostics = {
           ...codexDiagnostics,
-          ...codexErrorDiagnostics(err),
+          ...codexErrorDiagnostics(err, sensitiveValues),
           codex_thread_start_attempts: attempt,
           codex_thread_start_timeout_ms: policy.timeoutMs,
           codex_thread_start_duration_ms: Date.now() - startedAt,
@@ -631,7 +1342,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
           warning_kind: "codex_thread_start_retry",
           message: `Codex app-server thread/start timed out after ${policy.timeoutMs}ms; retrying with a fresh app-server.`,
         });
-        client.close();
+        await closeCodexClient(client);
         client = null;
         await delay(policy.backoffMs, options.abortSignal);
       }
@@ -647,7 +1358,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     }
     // Resumed sessions stay alive across an interrupt; only fresh runs tear
     // down their subprocess on abort.
-    if (!resumeEntry) client?.close();
+    if (!resumeEntry) void closeCodexClient(client);
   };
 
   async function steerLiveInput() {
@@ -688,11 +1399,13 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
             activeTurnId = response?.turnId || activeTurnId;
             continue;
           } catch (retryErr) {
-            const retryProviderError = retryErr?.responseError;
+            const retryProviderError = retryErr?.responseError
+              ? safeResponseError(retryErr.responseError)
+              : null;
             emitEvent({
               type: "runtime_warning",
               warning_kind: isActiveTurnNotSteerable(retryProviderError) ? "active_turn_not_steerable" : "live_input_rejected",
-              message: codexErrorMessage(retryProviderError || retryErr),
+              message: safeDiagnostic(codexErrorMessage(retryProviderError || retryErr)),
             });
             continue;
           }
@@ -700,7 +1413,9 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
         emitEvent({
           type: "runtime_warning",
           warning_kind: isActiveTurnNotSteerable(providerError) ? "active_turn_not_steerable" : "live_input_rejected",
-          message: codexErrorMessage(providerError || err),
+          message: safeDiagnostic(codexErrorMessage(
+            providerError ? safeResponseError(providerError) : err,
+          )),
         });
       }
     }
@@ -737,6 +1452,23 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     };
   }
 
+  if (resolveSandboxPolicy(options.toolContext, options.sandboxPolicy) !== undefined) {
+    return sessionUnavailableResult(
+      "skipped_capability_mismatch",
+      "Direct Codex cannot enforce mono-agent's native srt sandbox scopes. Remove the mono-agent sandbox policy or use a Pi runtime for exact readableRoots, writableRoots, denyWrite, and network rules.",
+      "codex_sandbox_policy_unsupported",
+    );
+  }
+
+  const toolPolicyProblem = codexToolPolicyProblem(options);
+  if (toolPolicyProblem) {
+    return sessionUnavailableResult(
+      "skipped_capability_mismatch",
+      toolPolicyProblem,
+      "codex_tool_policy_unsupported",
+    );
+  }
+
   if (resumeSessionId) {
     // Await-free busy claim (get -> busy check -> set-busy in one span). A miss
     // fails fast: the host sent no conversation history for a resume, so silently
@@ -776,11 +1508,13 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       else options.abortSignal.addEventListener("abort", abortHandler, { once: true });
     }
     if (!resumeEntry) await initializeClient(client);
-    let collaborationMode = codexCollaborationModePayload(options.nativeSubagents, {
-      model: resolved.model,
-      effort: normalizedEffort,
-      systemPrompt,
-    });
+    let collaborationMode = noToolsProbe
+      ? null
+      : codexCollaborationModePayload(options.nativeSubagents, {
+        model: resolved.model,
+        effort: normalizedEffort,
+        systemPrompt,
+      });
     if (collaborationMode) {
       try {
         await client.request("collaborationMode/list", {}, { timeoutMs: 5_000 });
@@ -788,20 +1522,26 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
         emitEvent({
           type: "runtime_warning",
           warning_kind: "codex_collaboration_mode_unavailable",
-          message: codexErrorMessage(err?.responseError || err),
+          message: safeDiagnostic(codexErrorMessage(
+            err?.responseError ? safeResponseError(err.responseError) : err,
+          )),
         });
         collaborationMode = null;
       }
     }
     const fastMode = codexModelSupportsFastMode(resolved.model) && normalizeFastMode(options.fastMode, true);
     if (!resumeEntry) {
-      const mcpServers = codexMcpConfig(options.mcpServers);
+      const mcpServers = noToolsProbe ? {} : codexMcpConfig(options.mcpServers);
       // Incrementally assembled config handed across the codex app-server
       // boundary; the reasoning fields below are attached conditionally.
       const config = /** @type {any} */ ({
         ...(fastMode ? { service_tier: "fast" } : {}),
         features: { fast_mode: fastMode },
-        ...(Object.keys(mcpServers).length ? { mcp_servers: mcpServers } : {}),
+        ...(noToolsProbe
+          ? { mcp_servers: {} }
+          : Object.keys(mcpServers).length
+            ? { mcp_servers: mcpServers }
+            : {}),
       });
       if (normalizedEffort) {
         config.model_reasoning_effort = normalizedEffort;
@@ -816,13 +1556,14 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
         modelProvider: "openai",
         ...(fastMode ? { serviceTier: "fast" } : {}),
         cwd: options.cwd || process.cwd(),
-        approvalPolicy: approvalPolicyForPermissionMode(options.permissionMode),
-        sandbox: sandboxForPermissionMode(options.permissionMode),
+        approvalPolicy: approvalPolicyForRun(options),
+        sandbox: sandboxForRun(options),
         config,
         serviceName: (options.toolContext?.runtimeBrand ?? readRuntimeBrand()).serviceName,
         developerInstructions: systemPrompt,
         ephemeral: true,
         sessionStartSource: "startup",
+        ...(noToolsProbe ? { environments: [], dynamicTools: [], selectedCapabilityRoots: [] } : {}),
         experimentalRawEvents: false,
         persistExtendedHistory: false,
       });
@@ -835,15 +1576,15 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       emitEvent({
         type: "runtime_warning",
         warning_kind: "live_input_failed",
-        message: err?.message || String(err),
+        message: safeDiagnostic(err?.message || err),
       });
     });
     const turnParams = {
       threadId,
       input: userTextInput(prompt),
       cwd: options.cwd || process.cwd(),
-      approvalPolicy: approvalPolicyForPermissionMode(options.permissionMode),
-      sandboxPolicy: options.permissionMode === "bypassPermissions" ? { type: "dangerFullAccess" } : null,
+      approvalPolicy: approvalPolicyForRun(options),
+      sandboxPolicy: sandboxPolicyForRun(options),
       model: resolved.model,
       ...(fastMode ? { serviceTier: "fast" } : {}),
       effort: normalizedEffort,
@@ -854,16 +1595,20 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     let turn;
     try {
       turn = await client.request("turn/start", turnParams);
+      assertNoUnsupportedServerRequest();
     } catch (err) {
       if (!collaborationMode) throw err;
       emitEvent({
         type: "runtime_warning",
         warning_kind: "codex_collaboration_mode_rejected",
-        message: codexErrorMessage(err?.responseError || err),
+        message: safeDiagnostic(codexErrorMessage(
+          err?.responseError ? safeResponseError(err.responseError) : err,
+        )),
       });
       const fallbackParams = { ...turnParams };
       delete fallbackParams.collaborationMode;
       turn = await client.request("turn/start", fallbackParams);
+      assertNoUnsupportedServerRequest();
     }
     setActiveTurnId(turn?.turn?.id);
 
@@ -902,7 +1647,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       ]);
     } catch (err) {
       if (prematureClose && !errorMessage) {
-        errorMessage = err?.message || "codex app-server stream closed before turn completed";
+        errorMessage = safeDiagnostic(err?.message || "codex app-server stream closed before turn completed");
         failureKind = "provider_unavailable";
       } else if (!prematureClose) {
         throw err;
@@ -1010,11 +1755,11 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       providerSessionId: threadId || null,
       provider_session_id: threadId || null,
       cancelled: !!options.abortSignal?.aborted,
-      error: err?.message || String(err),
+      error: safeDiagnostic(err?.message || err),
       failureKind: failureKind || "provider_unavailable",
       diagnostics: {
         ...codexDiagnostics,
-        ...codexErrorDiagnostics(err),
+        ...codexErrorDiagnostics(err, sensitiveValues),
         ...(events.length > 0 || texts.length > 0 ? { had_partial_progress: true } : {}),
       },
       capabilitiesUsed: buildCapabilitiesUsed({
@@ -1035,7 +1780,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       resumeEntry.notificationTarget.handler = noopNotificationHandler;
       resumeEntry.closedTarget.handler = null;
     }
-    if (!sessionRetained) client?.close();
+    if (!sessionRetained) await closeCodexClient(client);
   }
 }