@mrciphersmith/keryx 0.3.40 → 0.3.42

package/README.md

@@ -95,6 +95,13 @@ keryx auth login <provider>  # subscription login (device code / OAuth) or API k
 Inside a running session, `/provider` reopens the same add/reconfigure wizard
 and `/connect` switches between providers you already configured.
 
+ChatGPT / Codex model discovery reads the current stable Codex version from npm
+metadata and caches it for one day. **Test** in `/connect` (or
+`keryx providers test openai-codex`) always checks for a newer version before
+listing models. This does not install Codex or poll npm in the background.
+If npm is unavailable, a previously discovered version is reused; without a
+cached version, discovery reports the problem instead of guessing a version.
+
 Once you have more than one provider connected, `keryx routing` (and, inside a
 session, `/routing`) maps a task category — `review`, `subagents`, and a
 catalogue of others — to a specific model, so reviews and subagent spawns can
@@ -480,7 +487,7 @@ What is in it today:
   bounded parallel scheduling, and an offline fleet report over a recorded event
   log (`keryx agents monitor <events-file>`).
 - **Vendor CLIs as child agents — off by default.** keryx can hand a bounded,
-  **read-only** task (or, for `claude-cli` only, a reviewed write — see below)
+  **read-only** task (or, for `claude-cli` and `codex-cli`, a reviewed write — see below)
   to a coding CLI you already have installed (`codex exec`,
   `claude -p`, or Google's Antigravity CLI, `agy -p --output-format
   stream-json`) and host it as a child of the same harness: a disposable git
@@ -502,16 +509,20 @@ What is in it today:
 - **A write from an external agent you review before it lands.**
   `keryx agents external run claude-cli --task "…" --write` runs `claude` in a
   throwaway worktree with only `Read Grep Glob Edit Write` (no shell, no network,
-  no MCP). Its diff is captured, secret-redacted, hashed and stored as a pending
+  no MCP); `codex-cli --write` runs `codex` in the same kind of worktree under an
+  OS sandbox (as measured: writes outside the worktree fail, a DNS lookup fails, `.git` read-only)
+  that still leaves it a shell able to read files your account can read, so review
+  its output too. Its diff is captured, secret-redacted, hashed and stored as a pending
   review — nothing reaches your checkout. `keryx agents external review <run-id>`
   shows it; `apply <run-id>` needs a real terminal, shows the diff and asks you to
   type the first 12 hex digits of the patch hash, then creates a NEW local branch
   `external/<run-id>` with one commit. Your current branch and working tree are
   never touched, nothing is pushed and no pull request is opened;
   `discard <run-id>` drops it. There is no flag that skips the confirmation. Only
-  `claude-cli` can write (`codex-cli` and `antigravity-cli` refuse `--write`), the
-  review is a human reading the diff (a model review is not built), and a full run
-  through the installed CLI is not recorded yet. In the TUI: `/external-diff` and a
+  `claude-cli` and `codex-cli` can write (`antigravity-cli` refuses `--write`), the
+  review is a human reading the diff (a model review is not built), and neither
+  has a long live history (`codex` was verified in a scratch repository on
+  `codex` 0.159.2; versions outside 0.159.2 up to 0.160.0 are refused). In the TUI: `/external-diff` and a
   sidebar row while a diff waits. See the [external agent write
   guide](docs/docs/guides/external-agent-write.md).
 - **Completion you can audit.** The completion gate blocks on missing evidence: a
@@ -941,7 +952,7 @@ untouched.
 | No bundled embedding runtime | No semantic ranking in memory search | Lexical memory search remains fully available |
 | ripgrep is external | `keryx ctx rg` needs `rg` on `PATH` | Install ripgrep, or let the agent read files directly |
 | Model commands need a credential | Four of the five commands above exit non-zero without one; `wiki enrich` exits `0` and marks the affected pages skipped | Everything else runs deterministically offline |
-| External agents are read-only, except `claude-cli` write mode, which has no full live run recorded | A delegated CLI can read and search; only `claude-cli` can write, and only as a stored diff a human reviews (`keryx agents external review\|apply\|discard`) that lands as a new local branch — never on your checkout, never pushed. `codex-cli` and `antigravity-cli` refuse `--write` ("write mode is claude-only in this release"). A model review is not built. The parent gets the child's result and nothing before it — supervision of a running external child is not implemented. `claude` and `agy` read-only runs are live-verified; a write run through the installed CLI is not yet | Use keryx's own child agents for work that must mutate the tree, or the [external agent write guide](docs/docs/guides/external-agent-write.md) for a reviewed `claude-cli` diff |
+| External agents are read-only, except `claude-cli` and `codex-cli` write mode, which have no long live history | A delegated CLI can read and search; only `claude-cli` and `codex-cli` can write, and only as a stored diff a human reviews (`keryx agents external review\|apply\|discard`) that lands as a new local branch — never on your checkout, never pushed. `claude` is confined by a tool allow-list (no shell, no network); `codex` by an OS sandbox that still leaves it a shell that can read files your user can read (it cannot send them, but they can show up in the run output), and is refused when older than 0.159.0 — live-verified in a scratch repository on `codex` 0.159.0. `antigravity-cli` refuses `--write`. A model review is not built. The parent gets the child's result and nothing before it — supervision of a running external child is not implemented. `claude` and `agy` read-only runs are live-verified | Use keryx's own child agents for work that must mutate the tree, or the [external agent write guide](docs/docs/guides/external-agent-write.md) for a reviewed `claude-cli` or `codex-cli` diff |
 | A dispatched `flow-next` task is "done" by checks, not review | `task done` means normal end + a commit on the trigger branch + `keryx health gate` passing in the worktree; nobody has read the diff | Review and merge the `trigger/<flow>-<task>` branch yourself |
 | `trust` dispatch needs Linux + a working bubblewrap | The hardened unattended sandbox (network off, home hidden, allow-listed env) is bwrap-only; without it — or on macOS — a `trust` dispatch refuses before starting | Use `permissionMode: "ask"` (read-only), or run triggers on a Linux host with bwrap |
 | `dispatch.network: true` is the host's full network | The agent's commands then reach the internet and every host loopback service; the model call never needs it (it is made outside the sandbox) | Leave `network` off; review the `trigger/*` branch before installing or building it |

package/dist/cli.js

@@ -14119,7 +14119,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.40",
+    version: "0.3.42",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -24043,6 +24043,90 @@ var init_openai_subscription = __esm(() => {
   };
 });
 
+// src/lib/oauth/codex-catalog-version.ts
+import { join as join2 } from "path";
+function validVersion(value) {
+  return typeof value === "string" && value.length <= 64 && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value);
+}
+function loadCache(file, now) {
+  try {
+    const content = readConfigFile(file);
+    if (!content.ok)
+      return;
+    const cache = JSON.parse(content.text);
+    if (typeof cache !== "object" || cache === null)
+      return;
+    const record = cache;
+    if (!validVersion(record.version) || typeof record.fetchedAt !== "number" || !Number.isFinite(record.fetchedAt) || record.fetchedAt < 0 || record.fetchedAt > now)
+      return;
+    return { version: record.version, fetchedAt: record.fetchedAt };
+  } catch {
+    return;
+  }
+}
+async function readMetadata(response) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null && Number(declared) > RESPONSE_LIMIT_BYTES)
+    return;
+  if (response.body === null)
+    return;
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > RESPONSE_LIMIT_BYTES) {
+        await reader.cancel().catch(() => {});
+        return;
+      }
+      chunks.push(chunk.value);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } finally {
+    reader.releaseLock();
+  }
+}
+async function resolveCodexCatalogVersion(fetchFn, opts = {}) {
+  if (opts.signal?.aborted)
+    return;
+  const now = (opts.now ?? Date.now)();
+  const file = join2(keryxConfigDir(opts.configDir), CACHE_FILE);
+  const cached = loadCache(file, now);
+  if (!opts.forceRefresh && cached !== undefined && now - cached.fetchedAt < CODEX_VERSION_CACHE_TTL_MS)
+    return cached.version;
+  try {
+    const timeout = AbortSignal.timeout(2000);
+    const response = await fetchFn(CODEX_VERSION_REGISTRY_URL, {
+      headers: { Accept: "application/json" },
+      credentials: "omit",
+      redirect: "error",
+      signal: opts.signal === undefined ? timeout : AbortSignal.any([opts.signal, timeout])
+    });
+    if (response.ok) {
+      const body = await readMetadata(response);
+      if (typeof body === "object" && body !== null && "name" in body && body.name === "@openai/codex" && "version" in body && validVersion(body.version) && !opts.signal?.aborted) {
+        const version = body.version;
+        try {
+          ensureKeryxConfigDir(opts.configDir);
+          writeOwnerOnlyFileAtomic(file, JSON.stringify({ version, fetchedAt: now }));
+        } catch {}
+        return version;
+      }
+    }
+  } catch {}
+  return opts.signal?.aborted ? undefined : cached?.version;
+}
+var CODEX_VERSION_REGISTRY_URL = "https://registry.npmjs.org/@openai%2Fcodex/latest", CODEX_VERSION_CACHE_TTL_MS, CACHE_FILE = "codex-catalog-version.json", RESPONSE_LIMIT_BYTES;
+var init_codex_catalog_version = __esm(() => {
+  init_config_dir();
+  CODEX_VERSION_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+  RESPONSE_LIMIT_BYTES = 64 * 1024;
+});
+
 // src/commands/subscription-models.ts
 async function fetchOpenAiCodexModels(fetchFn, opts = {}) {
   const controller = new AbortController;
@@ -24051,7 +24135,17 @@ async function fetchOpenAiCodexModels(fetchFn, opts = {}) {
   try {
     const grant = await ensureOpenAiCodexGrant({ fetch: fetchFn, signal: controller.signal, ...opts.configDir !== undefined ? { configDir: opts.configDir } : {} });
     authenticated = true;
-    const response = await fetchFn(`${OPENAI_CODEX_PICKER.baseUrl}/models?client_version=${CODEX_CATALOG_CLIENT_VERSION}`, {
+    const clientVersion = await resolveCodexCatalogVersion(fetchFn, {
+      signal: controller.signal,
+      ...opts.refreshCatalogVersion !== undefined ? { forceRefresh: opts.refreshCatalogVersion } : {},
+      ...opts.configDir !== undefined ? { configDir: opts.configDir } : {}
+    });
+    if (clientVersion === undefined)
+      return { models: [], source: "fallback", failure: {
+        kind: "unreachable",
+        detail: "could not discover the Codex catalog version from npm; no cached version is available"
+      } };
+    const response = await fetchFn(`${OPENAI_CODEX_PICKER.baseUrl}/models?client_version=${clientVersion}`, {
       headers: { Authorization: `Bearer ${grant.access}`, "ChatGPT-Account-ID": grant.accountId, originator: "keryx", Accept: "application/json" },
       signal: controller.signal,
       redirect: "error"
@@ -24075,9 +24169,10 @@ async function fetchOpenAiCodexModels(fetchFn, opts = {}) {
     clearTimeout(timer);
   }
 }
-var OPENAI_CODEX_PICKER, CODEX_CATALOG_CLIENT_VERSION = "0.157.0";
+var OPENAI_CODEX_PICKER;
 var init_subscription_models = __esm(() => {
   init_openai_subscription();
+  init_codex_catalog_version();
   OPENAI_CODEX_PICKER = {
     name: "openai-codex",
     label: "ChatGPT / Codex",
@@ -26678,7 +26773,10 @@ function providerApiKey(provider, env = process.env) {
 }
 async function testProviderConnection(provider, fetchFn = globalThis.fetch, env = process.env, profiles) {
   if (provider.name === "openai-codex")
-    return fetchOpenAiCodexModels(fetchFn, { ...profiles?.dir !== undefined ? { configDir: profiles.dir } : {} });
+    return fetchOpenAiCodexModels(fetchFn, {
+      refreshCatalogVersion: true,
+      ...profiles?.dir !== undefined ? { configDir: profiles.dir } : {}
+    });
   const apiKey = providerApiKey(provider, envWithSavedApiKeys(env, profiles?.dir)) ?? provider.apiKey;
   return fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, {
     timeoutMs: MODELS_FETCH_TIMEOUT_MS,
@@ -31306,7 +31404,7 @@ var init_wiki_freshness = () => {};
 
 // src/harness/tool/builtin/interactive-tools.ts
 import { readdir as readdir9 } from "fs/promises";
-import { basename, dirname, isAbsolute, join as join2, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "path";
 import { lstatSync as lstatSync5, realpathSync as realpathSync3 } from "fs";
 async function readFromLine(file, startLine, cap) {
   const reader = file.stream().getReader();
@@ -31391,7 +31489,7 @@ function realpathThroughAncestors(absolute) {
   for (;; ) {
     try {
       const real = realpathSync3(current);
-      return missing.length === 0 ? real : join2(real, ...missing.reverse());
+      return missing.length === 0 ? real : join3(real, ...missing.reverse());
     } catch {
       try {
         lstatSync5(current);
@@ -51270,13 +51368,15 @@ permission bridge.
 A line-stream agent (\`claude-cli\`, \`codex-cli\`) is a DIFFERENT thing:
 \`run\` refuses it outright ("speaks the one-way line stream. Delegate to it
 from \`keryx shell\` with /delegate"). There is no ACP permission bridge and
-no patch capture for it \u2014 this release implements \`worktree-write\` for the
-ACP transport only; a dispatch that asks for \`worktree-write\` on a
-line-stream agent is REFUSED fail-closed with a distinguishable
-\`not-implemented\` reason everywhere keryx dispatches one (the internal
-\`runtime\` block, and \`keryx shell\`'s /delegate) \u2014 never silently accepted
-and its writes discarded. It stays \`read-only\`, contained by the same
-disposable worktree as every external run.
+no patch capture for it in those paths \u2014 \`worktree-write\` is implemented for
+the ACP transport, and for \`claude-cli\` and \`codex-cli\` only through the
+operator's own \`keryx agents external run <id> --write\`, which captures the
+diff for human review. A dispatch that asks for \`worktree-write\` on a
+line-stream agent anywhere else (the internal \`runtime\` block, and
+\`keryx shell\`'s /delegate) is REFUSED fail-closed with a distinguishable
+\`not-implemented\` reason \u2014 never silently accepted and its writes
+discarded. There it stays \`read-only\`, contained by the same disposable
+worktree as every external run.
 
 See \`docs/docs/guides/acp-client.md\` for the full ACP contract, including the
 output size bounds (a stderr-only flood and an output flood both end the run
@@ -52592,7 +52692,7 @@ var init_github = __esm(() => {
 
 // src/harness/tool/metaproject-adapter.ts
 import { lstat as lstat8, readdir as readdir21, readFile as readFile60, realpath as realpath11, stat as stat15 } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve3 } from "path";
+import { isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve3 } from "path";
 function isMissingExecutable(cause) {
   const message = cause instanceof Error ? cause.message : String(cause);
   return /Executable not found|\bENOENT\b|not found in \$?PATH/i.test(message);
@@ -52633,7 +52733,7 @@ function portableMemoryPath(candidate) {
   return !isAbsolute2(normalized) && normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../") ? normalized : null;
 }
 function confineToWiki(cwd, candidate) {
-  const wikiRoot = join3(cwd, ".metaproject", "wiki");
+  const wikiRoot = join4(cwd, ".metaproject", "wiki");
   const target = resolve3(wikiRoot, candidate);
   const rel = relative2(wikiRoot, target);
   if (rel === "") {
@@ -52676,7 +52776,7 @@ async function projectRemovalTrail(cwd, query) {
 async function detectMemoryStoreUnreadable(cwd) {
   const root = memoryRoot(cwd);
   for (const { folder } of MEMORY_TYPES) {
-    const dir = join3(root, folder);
+    const dir = join4(root, folder);
     try {
       await readdir21(dir);
     } catch (error) {
@@ -52690,7 +52790,7 @@ async function detectMemoryStoreUnreadable(cwd) {
   return null;
 }
 function confineToSkills(cwd, candidate) {
-  const skillsRoot = join3(cwd, ".metaproject", "skills", "gdskills");
+  const skillsRoot = join4(cwd, ".metaproject", "skills", "gdskills");
   const target = resolve3(cwd, candidate);
   const rel = relative2(skillsRoot, target);
   if (rel === "") {
@@ -52705,7 +52805,7 @@ async function parseCatalogSummaries(cwd) {
   const summaries = new Map;
   let content;
   try {
-    const bytes = await readContainedFile(join3(cwd, ".metaproject", "skills"), join3(cwd, ".metaproject", "skills", "catalog.md"), { maxBytes: 512 * 1024, requireRegularFile: true });
+    const bytes = await readContainedFile(join4(cwd, ".metaproject", "skills"), join4(cwd, ".metaproject", "skills", "catalog.md"), { maxBytes: 512 * 1024, requireRegularFile: true });
     content = bytes.toString("utf8");
   } catch {
     return summaries;
@@ -52726,7 +52826,7 @@ async function parseCatalogSummaries(cwd) {
   return summaries;
 }
 async function walkSkillCatalog(cwd) {
-  const root = join3(cwd, ".metaproject", "skills", "gdskills");
+  const root = join4(cwd, ".metaproject", "skills", "gdskills");
   const entries = [];
   const rootInfo = await lstat8(root).catch(() => null);
   if (!rootInfo || !rootInfo.isDirectory() || rootInfo.isSymbolicLink())
@@ -52744,7 +52844,7 @@ async function walkSkillCatalog(cwd) {
   for (const categoryDir of categoryDirs) {
     if (!categoryDir.isDirectory() && !categoryDir.isSymbolicLink())
       continue;
-    const categoryPath = join3(root, categoryDir.name);
+    const categoryPath = join4(root, categoryDir.name);
     const categoryReal = await realpath11(categoryPath).catch(() => null);
     const categoryInfo = await stat15(categoryPath).catch(() => null);
     if (!categoryReal || !categoryInfo?.isDirectory() || !isPathInside(rootReal, categoryReal))
@@ -52756,12 +52856,12 @@ async function walkSkillCatalog(cwd) {
       continue;
     }
     for (const skillDir of skillDirs) {
-      const skillPath = join3(categoryPath, skillDir.name);
+      const skillPath = join4(categoryPath, skillDir.name);
       const skillReal = await realpath11(skillPath).catch(() => null);
       const skillInfo = await stat15(skillPath).catch(() => null);
       if (!skillReal || !skillInfo?.isDirectory() || !isPathInside(rootReal, skillReal))
         continue;
-      const skillMdPath = join3(skillPath, "SKILL.md");
+      const skillMdPath = join4(skillPath, "SKILL.md");
       let content;
       try {
         const bytes = await readContainedFile(root, skillMdPath, { maxBytes: 512 * 1024, requireRegularFile: true });
@@ -53027,7 +53127,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
         exists = false;
       }
       if (!exists) {
-        const relativePath = toPosix(relative2(join3(cwd, ".metaproject", "wiki"), target));
+        const relativePath = toPosix(relative2(join4(cwd, ".metaproject", "wiki"), target));
         const registry = await readSectionRegistryState(cwd);
         if (registry.state === "unreadable") {
           return {
@@ -53068,7 +53168,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
         };
       }
       try {
-        const content = (await readContainedFile(join3(cwd, ".metaproject", "wiki"), target, {
+        const content = (await readContainedFile(join4(cwd, ".metaproject", "wiki"), target, {
           maxBytes: 8 * 1024 * 1024,
           requireRegularFile: true
         })).toString("utf8");
@@ -53112,7 +53212,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       }
       let hasWikiIndex;
       try {
-        await readFile60(join3(cwd, ".metaproject", "wiki", "index.md"), "utf8");
+        await readFile60(join4(cwd, ".metaproject", "wiki", "index.md"), "utf8");
         hasWikiIndex = true;
       } catch {
         hasWikiIndex = false;
@@ -53387,7 +53487,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       const byName = catalog.find((entry) => entry.name === input.name);
       if (byName !== undefined) {
         try {
-          const content = (await readContainedFile(join3(cwd, ".metaproject", "skills", "gdskills"), join3(cwd, byName.path), {
+          const content = (await readContainedFile(join4(cwd, ".metaproject", "skills", "gdskills"), join4(cwd, byName.path), {
             maxBytes: 512 * 1024,
             requireRegularFile: true
           })).toString("utf8");
@@ -53400,12 +53500,12 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       if (confined === null) {
         return { name: input.name, path: "", content: "", found: false };
       }
-      const byPath = catalog.find((entry) => join3(cwd, entry.path) === confined);
+      const byPath = catalog.find((entry) => join4(cwd, entry.path) === confined);
       if (byPath === undefined) {
         return { name: input.name, path: "", content: "", found: false };
       }
       try {
-        const content = (await readContainedFile(join3(cwd, ".metaproject", "skills", "gdskills"), confined, {
+        const content = (await readContainedFile(join4(cwd, ".metaproject", "skills", "gdskills"), confined, {
           maxBytes: 512 * 1024,
           requireRegularFile: true
         })).toString("utf8");
@@ -85041,14 +85141,14 @@ var init_registry3 = __esm(() => {
       label: "Codex",
       binary: "codex",
       detect: ["--version"],
-      versionPattern: "codex-cli (\\d+\\.\\d+\\.\\d+)",
+      versionPattern: "codex-cli (\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.]+)?)",
       knownGoodRange: { min: "0.147.0" },
       sandboxModes: ["read-only", "worktree-write"],
       streamingInput: false,
       resumable: true,
       reportsCost: false,
       budgetFlag: false,
-      notes: "Resume requires NOT passing `--ephemeral`: an ephemeral thread fails resume with " + "`no rollout found for thread id \u2026 (code -32600)`. `codex exec resume` also takes a " + "narrower flag set than `codex exec` \u2014 no `-s`, no `-C` \u2014 so its sandbox level cannot " + "be re-asserted and it must be spawned with cwd already set to the worktree."
+      notes: "Resume requires NOT passing `--ephemeral`: an ephemeral thread fails resume with " + "`no rollout found for thread id \u2026 (code -32600)`. `codex exec resume` also takes a " + "narrower flag set than `codex exec` \u2014 no `-s`, no `-C` \u2014 so a read-only resume inherits " + "its sandbox, a write run re-asserts its confinement as `-c` overrides, and it must be " + "spawned with cwd already set to the worktree. Write mode needs codex 0.159.2 up to, but not including, 0.160.0."
     },
     {
       id: "claude-cli",
@@ -85098,10 +85198,27 @@ var init_registry3 = __esm(() => {
 });
 
 // src/harness/external/dispatch.ts
+function codecWriteVersionRefusal(entry, version) {
+  const verified = CODEC_WRITE_VERIFIED_VERSIONS[entry.id];
+  if (verified === undefined)
+    return;
+  const range = `\`${entry.binary}\` ${verified.min} up to, but not including, ${verified.before}`;
+  const prefix = `${entry.label} write mode needs ${range}, the versions whose sandbox confinement was measured; `;
+  if (version === undefined)
+    return `${prefix}the installed version could not be read`;
+  if (!/^\d+\.\d+\.\d+$/.test(version))
+    return `${prefix}found ${version}, a pre-release`;
+  if (compareVersions(version, verified.min) < 0)
+    return `${prefix}found ${version}, which is older`;
+  if (compareVersions(version, verified.before) >= 0) {
+    return `${prefix}found ${version}, which is newer and not yet verified: update keryx, or use \`--task\` without \`--write\``;
+  }
+  return;
+}
 function implementedSandboxModesFor(entry, options = {}) {
   if (transportOf(entry) === "acp")
     return IMPLEMENTED_ACP_SANDBOX_MODES;
-  return entry.id === CODEC_WRITE_AGENT_ID && options.ownsWriteCapture === true ? IMPLEMENTED_ACP_SANDBOX_MODES : IMPLEMENTED_SANDBOX_MODES;
+  return CODEC_WRITE_AGENT_IDS.includes(entry.id) && options.ownsWriteCapture === true ? IMPLEMENTED_ACP_SANDBOX_MODES : IMPLEMENTED_SANDBOX_MODES;
 }
 function validateRuntimeBlock(runtime, allowedActions, options = {}) {
   if (runtime === undefined || runtime.kind === "keryx") {
@@ -85143,7 +85260,7 @@ function validateRuntimeBlock(runtime, allowedActions, options = {}) {
     return {
       ok: false,
       code: "not-implemented",
-      reason: `sandbox "${sandbox}" is not implemented in this release; only ${implemented.join(", ")} is available` + (sandbox === "worktree-write" && transportOf(entry) !== "acp" ? `; write mode is claude-only in this release (${CODEC_WRITE_AGENT_ID})` : "")
+      reason: `sandbox "${sandbox}" is not implemented in this release; only ${implemented.join(", ")} is available` + (sandbox === "worktree-write" && transportOf(entry) !== "acp" ? `; write mode is available for ${CODEC_WRITE_AGENT_IDS.join(", ")} only` + (entry.id === "antigravity-cli" ? ": antigravity-cli's edit tool writes outside the worktree" : "") : "")
     };
   }
   if (sandbox === "read-only") {
@@ -85169,12 +85286,16 @@ function readRuntimeBlock(dispatch) {
     return;
   return raw;
 }
-var READ_ONLY_FORBIDDEN_ACTIONS, IMPLEMENTED_SANDBOX_MODES, IMPLEMENTED_ACP_SANDBOX_MODES, CODEC_WRITE_AGENT_ID = "claude-cli";
+var READ_ONLY_FORBIDDEN_ACTIONS, IMPLEMENTED_SANDBOX_MODES, IMPLEMENTED_ACP_SANDBOX_MODES, CODEC_WRITE_AGENT_IDS, CODEC_WRITE_VERIFIED_VERSIONS;
 var init_dispatch = __esm(() => {
   init_registry3();
   READ_ONLY_FORBIDDEN_ACTIONS = ["write", "network", "spawn-subagent"];
   IMPLEMENTED_SANDBOX_MODES = ["read-only"];
   IMPLEMENTED_ACP_SANDBOX_MODES = ["read-only", "worktree-write"];
+  CODEC_WRITE_AGENT_IDS = ["claude-cli", "codex-cli"];
+  CODEC_WRITE_VERIFIED_VERSIONS = {
+    "codex-cli": { min: "0.159.2", before: "0.160.0" }
+  };
 });
 
 // src/harness/external/env-deny.ts
@@ -85708,7 +85829,7 @@ var init_prompt2 = __esm(() => {
   EXTERNAL_WRITE_RUNTIME_DIRECTIVE = [
     "# Runtime directive",
     "",
-    "You are running non-interactively as a bounded child agent. Produce the work itself as " + "your final message, in the requested output schema. Do not ask questions, do not offer a " + "choice of modes, do not route to another skill, orchestrator, or flow, do not delegate to " + "another agent. You may create and modify files, only inside your current working " + "directory, using the Read, Grep, Glob, Edit and Write tools; no shell is available. Do not " + "touch .git, .github, .claude or .metaproject. Your changes are captured as a patch that a " + "human reviews before anything lands, so summarise what you changed in the final message."
+    "You are running non-interactively as a bounded child agent. Produce the work itself as " + "your final message, in the requested output schema. Do not ask questions, do not offer a " + "choice of modes, do not route to another skill, orchestrator, or flow, do not delegate to " + "another agent. You may create and modify files, only inside your current working " + "directory, using your file reading, searching and editing tools. Do not use a shell to reach " + "outside it. Do not touch .git, .github, .claude or .metaproject. Your changes are captured as a patch that a " + "human reviews before anything lands, so summarise what you changed in the final message."
   ].join(`
 `);
   DIFF_INTRO_COMPLETE = "The operator's uncommitted changes are below. Your worktree is checked out at HEAD and " + "does not contain them, so this diff is the only place they exist for you.";
@@ -88240,6 +88361,8 @@ function buildCodexArgv(input) {
     "--ignore-user-config",
     "--skip-git-repo-check"
   ];
+  if (input.sandbox === "worktree-write")
+    argv.push(...CODEX_WRITE_CONFINEMENT_FLAGS);
   if (input.resultSchemaPath !== undefined)
     argv.push("--output-schema", input.resultSchemaPath);
   if (input.model !== undefined)
@@ -88247,8 +88370,9 @@ function buildCodexArgv(input) {
   argv.push(input.prompt);
   return argv;
 }
-function buildCodexResumeArgv(sessionRef, message) {
-  return ["codex", "exec", "resume", sessionRef, "--json", "--ignore-user-config", "--skip-git-repo-check", message];
+function buildCodexResumeArgv(sessionRef, message, input) {
+  const confinement = input?.sandbox === "worktree-write" ? ["-c", `sandbox_mode="${CODEX_SANDBOX_MODES["worktree-write"]}"`, ...CODEX_WRITE_CONFINEMENT_FLAGS] : [];
+  return ["codex", "exec", "resume", sessionRef, "--json", "--ignore-user-config", "--skip-git-repo-check", ...confinement, message];
 }
 function parseCodexEvents(line) {
   const record = readJsonObject2(line);
@@ -88403,12 +88527,21 @@ function brief2(text, max = 200) {
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length <= max ? flat : `${flat.slice(0, max - 1)}\u2026`;
 }
-var CODEX_SANDBOX_MODES, RECOGNISED_TYPES, NARRATED_FAILURE_LINE, CLI_USAGE_PATTERNS, AUTH_PATTERNS2, LIMIT_PATTERNS2, codexCliCodec;
+var CODEX_SANDBOX_MODES, CODEX_WRITE_CONFINEMENT_FLAGS, RECOGNISED_TYPES, NARRATED_FAILURE_LINE, CLI_USAGE_PATTERNS, AUTH_PATTERNS2, LIMIT_PATTERNS2, codexCliCodec;
 var init_codex_cli = __esm(() => {
   CODEX_SANDBOX_MODES = {
     "read-only": "read-only",
     "worktree-write": "workspace-write"
   };
+  CODEX_WRITE_CONFINEMENT_FLAGS = [
+    "--ignore-rules",
+    "-c",
+    "sandbox_workspace_write.exclude_slash_tmp=true",
+    "-c",
+    "sandbox_workspace_write.exclude_tmpdir_env_var=true",
+    "-c",
+    "sandbox_workspace_write.network_access=false"
+  ];
   RECOGNISED_TYPES = new Set([
     "thread.started",
     "turn.started",
@@ -88438,7 +88571,7 @@ var init_codex_cli = __esm(() => {
     parseLine: parseCodexLine,
     parseEvents: parseCodexEvents,
     classifyFailure: classifyCodexFailure,
-    buildResumeArgv: (sessionRef, message) => buildCodexResumeArgv(sessionRef, message),
+    buildResumeArgv: buildCodexResumeArgv,
     isRecognisedLine: isRecognisedCodexLine
   };
 });
@@ -88552,15 +88685,21 @@ async function runExternalChild(input, deps) {
   if (!isAcp && codec === undefined) {
     return refuse2("Error", `no codec is registered for external agent "${entry.id}"`);
   }
+  let detectedVersion;
   if (deps.detect !== undefined) {
     const availability = resolveAvailability(entry, await deps.detect(entry.binary, entry.detect));
     if (availability.state === "binary-missing") {
       return refuse2("Denied", `${entry.label} is not installed (\`${entry.binary}\` not on PATH)`);
     }
+    if (availability.state === "available")
+      detectedVersion = availability.version;
     if (availability.state === "available" && availability.verdict.state !== "in-range") {
       deps.onWarning?.(`${entry.label} version ${availability.version ?? "unknown"} is outside the range this build's fixtures were recorded against`);
     }
   }
+  const versionRefusal = sandbox === "worktree-write" ? codecWriteVersionRefusal(entry, detectedVersion) : undefined;
+  if (versionRefusal !== undefined)
+    return refuse2("Denied", versionRefusal);
   const schemaPrep = await prepareResultSchema();
   if (!schemaPrep.ok)
     return refuse2("Error", schemaPrep.reason);
@@ -112748,7 +112887,7 @@ var init_jev_rules = __esm(() => {
 
 // src/commands/review-jev-rules.ts
 import { readFile as readFile112, readdir as readdir41, stat as stat25 } from "fs/promises";
-import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, join as join4, relative as relative3 } from "path";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, join as join5, relative as relative3 } from "path";
 function rejectUnknownJevRulesFlags(args) {
   const unknown = args.filter((arg) => arg.startsWith("--") && !JEV_RULES_FLAGS.includes(arg.split("=")[0]));
   if (unknown.length > 0) {
@@ -112790,7 +112929,7 @@ async function walkMatching(root, suffixes) {
       return;
     }
     for (const entry of entries) {
-      const full = join4(dir, entry.name);
+      const full = join5(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
@@ -112818,7 +112957,7 @@ function stripKeryxManagedBlock(text) {
 }
 async function discoverRuleSources(cwd, explicitPaths) {
   const discovered = [];
-  for (const root of [join4(cwd, ".metaproject", "rules"), join4(cwd, "rules"), join4(cwd, ".claude", "rules")]) {
+  for (const root of [join5(cwd, ".metaproject", "rules"), join5(cwd, "rules"), join5(cwd, ".claude", "rules")]) {
     for (const file of await walkMatching(root, [".md", ".mdc"])) {
       const text = await readIfExists(file);
       if (text === undefined)
@@ -112827,7 +112966,7 @@ async function discoverRuleSources(cwd, explicitPaths) {
     }
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const text = await readIfExists(join4(cwd, name));
+    const text = await readIfExists(join5(cwd, name));
     if (text === undefined)
       continue;
     const body = stripKeryxManagedBlock(text);
@@ -112836,8 +112975,8 @@ async function discoverRuleSources(cwd, explicitPaths) {
     break;
   }
   const skillRoots = [
-    [join4(cwd, ".metaproject", "project-skills"), "project-skill"],
-    [join4(cwd, ".metaproject", "skills", "gdskills"), "gdskill"]
+    [join5(cwd, ".metaproject", "project-skills"), "project-skill"],
+    [join5(cwd, ".metaproject", "skills", "gdskills"), "gdskill"]
   ];
   for (const [root, kind] of skillRoots) {
     for (const skillMd of await walkMatching(root, ["SKILL.md"])) {
@@ -112862,7 +113001,7 @@ async function discoverRuleSources(cwd, explicitPaths) {
   const explicitFiles = [];
   const explicitDirSources = [];
   for (const raw of explicitPaths) {
-    const resolved = isAbsolute3(raw) ? raw : join4(cwd, raw);
+    const resolved = isAbsolute3(raw) ? raw : join5(cwd, raw);
     const stats = await stat25(resolved).catch(() => {
       return;
     });
@@ -112905,11 +113044,11 @@ async function discoverRuleSources(cwd, explicitPaths) {
   return { sources: [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path)), excluded: excluded.sort((a, b) => a.path.localeCompare(b.path)) };
 }
 async function fixturePrPort(dir) {
-  const raw = await readFile112(join4(dir, "pr.json"), "utf8");
+  const raw = await readFile112(join5(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureJevFetch(dir) {
-  const raw = await readFile112(join4(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile112(join5(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -115269,7 +115408,7 @@ var init_jev_scenarios = __esm(() => {
 
 // src/commands/review-jev-scenarios.ts
 import { readFile as readFile121, readdir as readdir43 } from "fs/promises";
-import { join as join5, relative as relative4 } from "path";
+import { join as join6, relative as relative4 } from "path";
 function symbolsByPathFromRegions(regions) {
   const byPath = new Map;
   for (const region of regions) {
@@ -115322,7 +115461,7 @@ async function walkMarkdown2(root) {
       return;
     }
     for (const entry of entries) {
-      const full = join5(dir, entry.name);
+      const full = join6(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
@@ -115336,19 +115475,19 @@ async function walkMarkdown2(root) {
 }
 async function discoverScenarioSources(cwd) {
   const scenarios = [];
-  for (const file of await walkMarkdown2(join5(cwd, ".metaproject", "wiki", "user-scenarios"))) {
+  for (const file of await walkMarkdown2(join6(cwd, ".metaproject", "wiki", "user-scenarios"))) {
     const text = await readIfExists2(file);
     if (text === undefined)
       continue;
     scenarios.push(scenarioFromWikiPage(relative4(cwd, file), text));
   }
-  for (const file of await walkMarkdown2(join5(cwd, "docs", "requirements"))) {
+  for (const file of await walkMarkdown2(join6(cwd, "docs", "requirements"))) {
     const text = await readIfExists2(file);
     if (text === undefined)
       continue;
     scenarios.push(...scenariosFromPrd(relative4(cwd, file), text));
   }
-  const readmeLikeFiles = [join5(cwd, "README.md"), ...await walkMarkdown2(join5(cwd, "docs", "docs"))];
+  const readmeLikeFiles = [join6(cwd, "README.md"), ...await walkMarkdown2(join6(cwd, "docs", "docs"))];
   for (const file of readmeLikeFiles) {
     const text = await readIfExists2(file);
     if (text === undefined)
@@ -115358,11 +115497,11 @@ async function discoverScenarioSources(cwd) {
   return scenarios;
 }
 async function fixturePrPort4(dir) {
-  const raw = await readFile121(join5(dir, "pr.json"), "utf8");
+  const raw = await readFile121(join6(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureJevFetch5(dir) {
-  const raw = await readFile121(join5(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile121(join6(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -115987,7 +116126,7 @@ var init_jev_docs = __esm(() => {
 
 // src/commands/review-jev-docs.ts
 import { readFile as readFile123, readdir as readdir44 } from "fs/promises";
-import { join as join6, relative as relative5 } from "path";
+import { join as join7, relative as relative5 } from "path";
 function messageOf4(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -116049,7 +116188,7 @@ async function walkMatching2(root, suffixes) {
       return;
     }
     for (const entry of entries) {
-      const full = join6(dir, entry.name);
+      const full = join7(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
         continue;
@@ -116109,7 +116248,7 @@ async function walkAllDocFiles(dir) {
     return out;
   }
   for (const entry of entries) {
-    const full = join6(dir, entry.name);
+    const full = join7(dir, entry.name);
     if (entry.isDirectory()) {
       if (INCLUDE_WALK_PRUNE_DIRS.has(entry.name))
         continue;
@@ -116123,19 +116262,19 @@ async function walkAllDocFiles(dir) {
 async function resolveIncludeGlob(cwd, glob) {
   const rootDir = includeGlobRootDir(glob);
   const regex = includeGlobToRegExp(glob);
-  const candidates = await walkAllDocFiles(join6(cwd, rootDir));
+  const candidates = await walkAllDocFiles(join7(cwd, rootDir));
   return candidates.filter((file) => regex.test(relative5(cwd, file)));
 }
 async function discoverDocFiles(cwd, includeGlobs = []) {
   const files = new Set;
-  for (const file of await walkMatching2(join6(cwd, "docs"), [".md"]))
+  for (const file of await walkMatching2(join7(cwd, "docs"), [".md"]))
     files.add(file);
   for (const name of await matchingFileNames(cwd, /^readme/i)) {
     if (/^changelog/i.test(name))
       continue;
-    files.add(join6(cwd, name));
+    files.add(join7(cwd, name));
   }
-  for (const file of await walkMatching2(join6(cwd, ".metaproject", "wiki"), [".md"]))
+  for (const file of await walkMatching2(join7(cwd, ".metaproject", "wiki"), [".md"]))
     files.add(file);
   for (const glob of includeGlobs) {
     for (const file of await resolveIncludeGlob(cwd, glob))
@@ -116163,11 +116302,11 @@ function changedCommandNamesFromRegions(regions) {
   return names;
 }
 async function fixturePrPort5(dir) {
-  const raw = await readFile123(join6(dir, "pr.json"), "utf8");
+  const raw = await readFile123(join7(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureJevFetch6(dir) {
-  const raw = await readFile123(join6(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile123(join7(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -116585,7 +116724,7 @@ var init_jev_comments = __esm(() => {
 
 // src/commands/review-jev-comments.ts
 import { readFile as readFile125 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function rejectUnknownJevCommentsFlags(args) {
   const unknown = args.filter((arg) => arg.startsWith("--") && !JEV_COMMENTS_FLAGS.includes(arg.split("=")[0]));
   if (unknown.length > 0) {
@@ -116671,15 +116810,15 @@ function createFixtureJevCommentsFactsPort(facts) {
   };
 }
 async function fixturePrPort6(dir) {
-  const raw = await readFile125(join7(dir, "pr.json"), "utf8");
+  const raw = await readFile125(join8(dir, "pr.json"), "utf8");
   return createFixtureConformPrPort({ pr: JSON.parse(raw) });
 }
 async function fixtureFactsPort(dir) {
-  const raw = await readFile125(join7(dir, "git-facts.json"), "utf8").catch(() => "{}");
+  const raw = await readFile125(join8(dir, "git-facts.json"), "utf8").catch(() => "{}");
   return createFixtureJevCommentsFactsPort(JSON.parse(raw));
 }
 async function fixtureJevFetch7(dir) {
-  const raw = await readFile125(join7(dir, "jev-responses.json"), "utf8");
+  const raw = await readFile125(join8(dir, "jev-responses.json"), "utf8");
   const responses = JSON.parse(raw);
   let index = 0;
   const fn = async () => {
@@ -116693,7 +116832,7 @@ async function fixtureJevFetch7(dir) {
   return fn;
 }
 function advisoryLabelsPath(cwd, repo, number) {
-  return join7(cwd, ".metaproject", "data", "review-jev-comments", `labels__${repo.replace(/\//g, "__")}__${number}.json`);
+  return join8(cwd, ".metaproject", "data", "review-jev-comments", `labels__${repo.replace(/\//g, "__")}__${number}.json`);
 }
 async function readCommentAdvisoryLabels(cwd, repo, number) {
   const file = advisoryLabelsPath(cwd, repo, number);
@@ -127961,7 +128100,7 @@ var init_narrate = __esm(() => {
 // src/commands/memory.ts
 import { randomUUID as randomUUID34 } from "crypto";
 import { readdir as readdir45 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function getService() {
   service4 ??= createMemoryService();
   return service4;
@@ -128068,7 +128207,7 @@ async function runIndex(args) {
 async function detectMemoryStoreUnreadable2(cwd) {
   const root = memoryRoot(cwd);
   for (const { folder } of MEMORY_TYPES) {
-    const dir = join8(root, folder);
+    const dir = join9(root, folder);
     try {
       await readdir45(dir);
     } catch (error) {
@@ -152693,7 +152832,7 @@ function referencesHash(entry) {
   }
   return hash.digest("hex");
 }
-function loadCache(cachePath) {
+function loadCache2(cachePath) {
   if (!existsSync51(cachePath))
     return {};
   try {
@@ -152821,7 +152960,7 @@ async function runStocktake(root, options = {}) {
   const now = options.now ?? (() => new Date);
   const { entries: catalog, unreadable } = loadSkillCatalogWithDiagnostics(root, { scope });
   const cachePath = options.cachePath ?? path295.join(root, ".metaproject", "data", "skills", "stocktake", "cache.json");
-  const cache = loadCache(cachePath);
+  const cache = loadCache2(cachePath);
   const fingerprint = catalogFingerprint(catalog);
   let hits = 0;
   let misses = 0;
@@ -159572,7 +159711,7 @@ var init_post = __esm(() => {
 
 // src/commands/review-bot.ts
 import { readFile as readFile158 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function reject(args, valued, boolean, usage) {
   const problems = [];
   for (let index = 0;index < args.length; index += 1) {
@@ -159601,7 +159740,7 @@ async function portFor(args) {
     return createGhPort();
   let pull;
   try {
-    pull = JSON.parse(await readFile158(join9(fixtures, "pull.json"), "utf8"));
+    pull = JSON.parse(await readFile158(join10(fixtures, "pull.json"), "utf8"));
   } catch {
     pull = {};
   }
@@ -161041,7 +161180,7 @@ var init_floor = __esm(() => {
 
 // src/commands/review.ts
 import { mkdir as mkdir66, readdir as readdir58, readFile as readFile162 } from "fs/promises";
-import path317, { join as join10 } from "path";
+import path317, { join as join11 } from "path";
 function reviewerList(args) {
   return (optionValue(args, "--reviewers") ?? "").split(",").map((item) => item.trim()).filter(Boolean);
 }
@@ -161716,7 +161855,7 @@ async function resolvePort(args) {
   }
   const files = {};
   for (const key of ["pull", "pull-comments", "pull-reviews", "issue-comments"]) {
-    const file = join10(fixtures, `${key}.json`);
+    const file = join11(fixtures, `${key}.json`);
     try {
       files[key] = JSON.parse(await readFile162(file, "utf8"));
     } catch {
@@ -161726,13 +161865,13 @@ async function resolvePort(args) {
   return createFixturePort(files);
 }
 async function fixtureCiPort(dir) {
-  const runInfo = JSON.parse(await readFile162(join10(dir, "ci-run-info.json"), "utf8"));
-  const log = await readFile162(join10(dir, "ci-failed-log.txt"), "utf8").catch(() => "");
-  const history = await readFile162(join10(dir, "ci-history.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const attempts = await readFile162(join10(dir, "ci-attempts.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const changedFiles = await readFile162(join10(dir, "ci-changed-files.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const runsByHeadSha = await readFile162(join10(dir, "ci-runs-by-head-sha.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
-  const related = await readFile162(join10(dir, "ci-related-runs.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const runInfo = JSON.parse(await readFile162(join11(dir, "ci-run-info.json"), "utf8"));
+  const log = await readFile162(join11(dir, "ci-failed-log.txt"), "utf8").catch(() => "");
+  const history = await readFile162(join11(dir, "ci-history.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const attempts = await readFile162(join11(dir, "ci-attempts.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const changedFiles = await readFile162(join11(dir, "ci-changed-files.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const runsByHeadSha = await readFile162(join11(dir, "ci-runs-by-head-sha.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
+  const related = await readFile162(join11(dir, "ci-related-runs.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => ({}));
   return createFixtureCiPort({
     runs: { [runInfo.runId]: runInfo, ...related.runs },
     logs: { [runInfo.runId]: log, ...related.logs },
@@ -161743,7 +161882,7 @@ async function fixtureCiPort(dir) {
   });
 }
 async function fixtureJevFetch9(dir) {
-  const body = await readFile162(join10(dir, "jev-response.json"), "utf8");
+  const body = await readFile162(join11(dir, "jev-response.json"), "utf8");
   const fn = async () => new Response(body, { status: 200, headers: { "content-type": "application/json" } });
   return fn;
 }
@@ -161912,12 +162051,12 @@ async function runCiTriageEval(cwd, args, evalFile) {
   }
 }
 async function fixtureConformJevFetch(dir) {
-  const body = await readFile162(join10(dir, "jev-response.json"), "utf8");
+  const body = await readFile162(join11(dir, "jev-response.json"), "utf8");
   const fn = async () => new Response(body, { status: 200, headers: { "content-type": "application/json" } });
   return fn;
 }
 async function fixtureConformPrPortFrom(dir) {
-  const pr = JSON.parse(await readFile162(join10(dir, "pr.json"), "utf8"));
+  const pr = JSON.parse(await readFile162(join11(dir, "pr.json"), "utf8"));
   return createFixtureConformPrPort({ pr });
 }
 function accumulateJevUsage(acc, usage) {
@@ -161998,7 +162137,7 @@ async function explainConformVerdicts(cwd, refPath, verdicts, threshold, fixture
     return {};
   if (fixturesDir !== undefined) {
     try {
-      return JSON.parse(await readFile162(join10(fixturesDir, "explain-response.json"), "utf8"));
+      return JSON.parse(await readFile162(join11(fixturesDir, "explain-response.json"), "utf8"));
     } catch {
       return {};
     }
@@ -162046,7 +162185,7 @@ function parsePositiveIntFlag(args, flag, fallback) {
 }
 async function readReportFindings2(reportDir) {
   try {
-    const raw = JSON.parse(await readFile162(join10(reportDir, "findings.json"), "utf8"));
+    const raw = JSON.parse(await readFile162(join11(reportDir, "findings.json"), "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -162118,7 +162257,7 @@ async function runConform(args) {
   const fetchFn = fixturesDir === undefined ? globalThis.fetch : await fixtureConformJevFetch(fixturesDir);
   const acc = { jevCalls: 0, inputTokens: 0, outputTokens: 0, costUsd: 0, sawUsage: false };
   const clauses = await resolveConformClauseTags(cwd, refPath, docText, rawClauses, fetchFn, model, acc);
-  await writeFileAtomic(join10(cwd, CONFORM_RECENTS_PATH), `${JSON.stringify(withRecentDoc(await readRecentConformDocs2(cwd), refPath), null, 2)}
+  await writeFileAtomic(join11(cwd, CONFORM_RECENTS_PATH), `${JSON.stringify(withRecentDoc(await readRecentConformDocs2(cwd), refPath), null, 2)}
 `, { mode: 384 }).catch(() => {});
   const notCheckable = clauses.filter((c) => !c.checkable);
   const checkable = clauses.filter((c) => c.checkable);
@@ -162150,7 +162289,7 @@ async function runConform(args) {
     hunkTotalRegions = hunkResult.totalRegions;
   } else if (reportDir !== undefined) {
     target = { kind: "report", label: reportDir };
-    const reportMarkdown = await readFile162(join10(reportDir, "report.md"), "utf8").catch(() => "");
+    const reportMarkdown = await readFile162(join11(reportDir, "report.md"), "utf8").catch(() => "");
     const findings = await readReportFindings2(reportDir);
     const facts = computeReportConformFacts(reportMarkdown, findings);
     const redacted = reportRedactedStateText(reportMarkdown);
@@ -162191,7 +162330,7 @@ async function runConform(args) {
 }
 async function readRecentConformDocs2(cwd) {
   try {
-    const raw = JSON.parse(await readFile162(join10(cwd, CONFORM_RECENTS_PATH), "utf8"));
+    const raw = JSON.parse(await readFile162(join11(cwd, CONFORM_RECENTS_PATH), "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -162440,7 +162579,7 @@ async function runStack(args) {
   console.log(renderStackScopingMarkdown(detected, decisions));
 }
 async function stackScopingForInstalledReviewers(cwd, detected) {
-  const reviewRoot = join10(cwd, ".metaproject", "skills", "gdskills", "review");
+  const reviewRoot = join11(cwd, ".metaproject", "skills", "gdskills", "review");
   let entries;
   try {
     entries = await readdir58(reviewRoot, { withFileTypes: true });
@@ -162452,7 +162591,7 @@ async function stackScopingForInstalledReviewers(cwd, detected) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const skillMdPath = join10(reviewRoot, entry.name, "SKILL.md");
+    const skillMdPath = join11(reviewRoot, entry.name, "SKILL.md");
     let content;
     try {
       content = await readFile162(skillMdPath, "utf8");
@@ -179345,7 +179484,7 @@ async function runCommand4(args, deps, log) {
     maxExternalDepth: DEFAULT_MAX_EXTERNAL_DEPTH,
     onWarning: (warning) => console.error(`warning: ${plain(warning)}`)
   };
-  if (write && id === CODEC_WRITE_AGENT_ID) {
+  if (write && CODEC_WRITE_AGENT_IDS.includes(id)) {
     let handle;
     let interrupted = false;
     const onSigint = () => {
@@ -179619,7 +179758,7 @@ function printExternalHelp() {
     { flag: "--no-probe", desc: "Skip detection entirely; every entry reports `not-probed`." },
     { flag: "--task", desc: "run: what the agent should do. It runs in a disposable worktree; your tree is never touched." },
     { flag: "--unattended", desc: "run: refuse every permission that would need a human (also implied without a TTY)." },
-    { flag: "--write", desc: "run: writes land in the disposable worktree and leave as a never-applied patch. An ACP agent advertises fs.writeTextFile; for a line-stream agent only claude is supported (Edit and Write inside the worktree)." },
+    { flag: "--write", desc: "run: writes land in the disposable worktree and leave as a never-applied patch. An ACP agent advertises fs.writeTextFile; for a line-stream agent only claude-cli and codex-cli are supported. claude gets Edit and Write inside the worktree and no shell; codex runs under its OS sandbox (writes confined to the worktree, network closed as far as measured) and keeps a shell that can read any file you can read. codex needs version 0.159.2 or newer but older than 0.160.0. antigravity-cli is refused: its edit tool writes outside the worktree." },
     { flag: "--timeout", desc: "run: wall-clock ceiling in ms (default: externalAgents.defaultTimeoutMs)." }
   ]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.40",
+  "version": "0.3.42",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {

package/src/gdskills/contracts/subagent-dispatch.schema.json

@@ -165,7 +165,7 @@
           "minLength": 1
         },
         "sandbox": {
-          "description": "Permission level for the external child. `worktree-write` is schema-valid but refused at runtime in the read-only release, with a reason distinguishable from an unsupported-by-this-agent refusal.",
+          "description": "Permission level for the external child. `worktree-write` is schema-valid but refused at runtime except for an ACP agent and, through the operator's `--write` command only, `claude-cli` and `codex-cli`, with a reason distinguishable from an unsupported-by-this-agent refusal.",
           "type": "string",
           "enum": ["read-only", "worktree-write"]
         },