@phnx-labs/agents-cli 1.22.52 → 1.22.54

package/dist/lib/memory.js

@@ -13,9 +13,10 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { getUserAgentsDir, getSystemAgentsDir, getProjectAgentsDir, ensureAgentsDir, } from './state.js';
+import { getUserAgentsDir, getSystemAgentsDir, getProjectAgentsDir, ensureAgentsDir, getRuntimeStateDir, } from './state.js';
 import { agentConfigDirName } from './agents.js';
 import { supports } from './capabilities.js';
+import { claudeProjectDirName } from './project-key.js';
 /** User-layer memory root (~/.agents/memory/). */
 export function getUserMemoryDir() {
     return path.join(getUserAgentsDir(), 'memory');
@@ -273,3 +274,81 @@ export function syncMemoryToVersionHome(agent, versionHome, cwd = process.cwd())
     catch { /* best-effort */ }
     return written;
 }
+/**
+ * Canonical shared dir for Claude Code's NATIVE per-project auto-memory —
+ * `<versionHome>/.claude/projects/<project-key>/memory/*.md`, the freeform
+ * notes Claude writes for itself during a session. Distinct from the layered
+ * `memory` resource above (~/.agents/memory/ facts synced into
+ * `.claude/memory/`): this dir is keyed by project (via
+ * {@link claudeProjectDirName}), not by agent version, and Claude Code itself
+ * decides what goes in it — agents-cli only makes the directory
+ * version-independent, never writes into it.
+ */
+export function getClaudeProjectMemoryDir(cwd) {
+    const projectKey = claudeProjectDirName(path.resolve(cwd));
+    return path.join(getRuntimeStateDir(), 'claude-project-memory', projectKey);
+}
+/**
+ * Make Claude Code's native per-project memory dir version-independent by
+ * symlinking `<versionHome>/.claude/projects/<project-key>/memory/` into the
+ * one canonical dir every installed Claude version's home shares for this
+ * project (PHNX-2817). Without this, `getVersionHomePath` gives every
+ * installed version its own isolated HOME, so a note written under one
+ * version is invisible under another — the directory is just empty there.
+ *
+ * Idempotent and safe to call on every sync: a dir already linked to the
+ * canonical target is left alone; a PRE-EXISTING real directory with content
+ * (the common case today, since this bug has always left one behind) has its
+ * files migrated into the canonical dir first — never discarded — before
+ * being replaced by the symlink.
+ */
+export function syncClaudeProjectMemoryDir(versionHome, cwd = process.cwd()) {
+    const projectKey = claudeProjectDirName(path.resolve(cwd));
+    const canonicalDir = path.join(getRuntimeStateDir(), 'claude-project-memory', projectKey);
+    const projectDir = path.join(versionHome, agentConfigDirName('claude'), 'projects', projectKey);
+    const nativeMemoryDir = path.join(projectDir, 'memory');
+    fs.mkdirSync(canonicalDir, { recursive: true, mode: 0o700 });
+    let existing;
+    try {
+        existing = fs.lstatSync(nativeMemoryDir);
+    }
+    catch { /* nothing there yet */ }
+    if (existing?.isSymbolicLink()) {
+        let currentTarget;
+        try {
+            currentTarget = fs.readlinkSync(nativeMemoryDir);
+        }
+        catch { /* dangling link */ }
+        if (currentTarget === canonicalDir)
+            return; // already wired correctly
+        fs.unlinkSync(nativeMemoryDir); // stale/foreign link — replace below
+    }
+    else if (existing?.isDirectory()) {
+        // Migrate first (never clobber content already promoted to canonical by
+        // an earlier-synced version home), then remove the now-redundant copy.
+        fs.cpSync(nativeMemoryDir, canonicalDir, { recursive: true, force: false, errorOnExist: false });
+        fs.rmSync(nativeMemoryDir, { recursive: true, force: true });
+    }
+    else if (existing) {
+        return; // an unexpected file at this path — leave it alone rather than destroy it
+    }
+    fs.mkdirSync(projectDir, { recursive: true });
+    try {
+        fs.symlinkSync(canonicalDir, nativeMemoryDir, process.platform === 'win32' ? 'junction' : undefined);
+    }
+    catch (err) {
+        // A concurrent sync (e.g. two `agents run claude` launches racing on a
+        // first-ever project) can win this exact link between our lstat above
+        // and this call. If it landed the same canonical target, that's the
+        // outcome we wanted — treat it as success rather than throwing.
+        if (err?.code !== 'EEXIST')
+            throw err;
+        let racedTarget;
+        try {
+            racedTarget = fs.readlinkSync(nativeMemoryDir);
+        }
+        catch { /* not even a symlink — fall through to rethrow */ }
+        if (racedTarget !== canonicalDir)
+            throw err;
+    }
+}

package/dist/lib/monitors/config.d.ts

@@ -84,6 +84,17 @@ export interface ActionConfig {
     notifyChannel?: string;
     /** webhook-out: URL to POST the event to. */
     url?: string;
+    /**
+     * Shell command that must exit 0 after a `run`/`routine` action settles.
+     * Asserts the stated effect actually happened (PHNX-2842) — e.g.
+     * `gh pr view 1682 --json state --jq .state | grep -qx MERGED`. `{event}` is
+     * replaced with the fired event summary, same as the prompt. Evaluated once
+     * the dispatched run is no longer `running`; a failed check makes the fire
+     * `ok: false` with effect `none` (`postcondition not met`), not a healthy
+     * `completed`. Notify/webhook-out already have a synchronous ok and refuse
+     * this field.
+     */
+    postcondition?: string;
 }
 /** Full monitor configuration (persisted as YAML in ~/.agents/monitors/). */
 export interface MonitorConfig {

package/dist/lib/monitors/config.js

@@ -238,6 +238,14 @@ export function validateMonitor(config) {
                 errors.push(`action.url must be an absolute URL (got ${JSON.stringify(action.url)})`);
             }
         }
+        if (action.postcondition !== undefined) {
+            if (action.type !== 'run' && action.type !== 'routine') {
+                errors.push("action.postcondition only applies to run or routine actions");
+            }
+            else if (typeof action.postcondition !== 'string' || action.postcondition.trim() === '') {
+                errors.push('action.postcondition must be a non-empty shell command');
+            }
+        }
     }
     // ─── PLACEMENT ───────────────────────────────────────────────────────────────
     if (config.device !== undefined && config.devices !== undefined) {

package/dist/lib/monitors/engine.js

@@ -14,7 +14,7 @@
 import { listMonitors, monitorRunsOnThisDevice, parseInterval, setMonitorEnabled, } from './config.js';
 import { evaluateSource } from './sources/index.js';
 import { hasChanged, readState, writeState, recordFireTime, writeFireRecord, recordCheck, markDroughtNotified, } from './state.js';
-import { dispatchAction } from './dispatch.js';
+import { dispatchAction, injectEvent } from './dispatch.js';
 import { sendToOwner } from '../notify.js';
 import { readRunMeta } from '../scheduling/routines.js';
 /** How often the engine wakes to check which monitors are due. */
@@ -282,12 +282,19 @@ export class MonitorEngine {
         // exactly the fires whose `ok` needs revisiting; `resolveFireOutcome`
         // (state.ts) never trusts this field — it re-reads the run fresh instead.
         const runStatusAtFire = result.runId ? readRunMeta(monitor.name, result.runId)?.status : undefined;
+        // Snapshot the postcondition with `{event}` already interpolated so a later
+        // `resolveFireOutcome` can assert the stated effect without re-reading YAML
+        // (PHNX-2842). Notify/webhook-out have no run to settle, so they skip this.
+        const postcondition = (result.kind === 'run' || result.kind === 'routine') && monitor.action.postcondition
+            ? injectEvent(monitor.action.postcondition, event)
+            : undefined;
         writeFireRecord(event, {
             ...(result.runId ? { runId: result.runId } : {}),
             action: result.kind,
             ok: result.ok,
             ...(result.error ? { error: result.error } : {}),
             ...(runStatusAtFire ? { runStatusAtFire } : {}),
+            ...(postcondition ? { postcondition } : {}),
         });
         writeState(monitor.name, decision.value, decision.dedupeKey, { lastFiredAt: event.firedAt, fireTimes });
         this.logFn(result.ok ? 'INFO' : 'ERROR', `monitor '${monitor.name}' fired → ${result.kind}` +

package/dist/lib/monitors/state.d.ts

@@ -118,6 +118,16 @@ export interface FireRecord extends MonitorEvent {
      * run fresh on every call instead of trusting this snapshot.
      */
     runStatusAtFire?: RunMeta['status'];
+    /**
+     * The action's postcondition command, snapshotted at fire time with `{event}`
+     * already interpolated (PHNX-2842). `resolveFireOutcome` runs this once the
+     * dispatched run has settled `completed`.
+     */
+    postcondition?: string;
+    /** Result of the postcondition check, persisted after the first evaluation. */
+    postconditionOk?: boolean;
+    /** stderr/stdout snippet when `postconditionOk` is false. */
+    postconditionError?: string;
 }
 /** List a monitor's fire history, chronologically ascending. */
 export declare function listFires(name: string): FireRecord[];
@@ -127,10 +137,28 @@ export interface ReconciledFireOutcome {
     ok: boolean;
     /** The run's live terminal status, when a runId is present and resolvable. */
     runStatus?: RunMeta['status'];
+    /**
+     * Present when a `completed` run had a postcondition to assert (PHNX-2842).
+     * `met` = the command exited 0; `none` = ran but the intended effect did not
+     * happen (the fire must not read as `ok`).
+     */
+    effect?: 'met' | 'none';
+    /** Why the fire is not ok, when the postcondition failed. */
+    error?: string;
 }
+/**
+ * Run a fire's postcondition command. Exit 0 means the intended effect happened;
+ * anything else (nonzero, timeout, spawn error, empty command) is "no effect".
+ * Real `/bin/sh -c` (or `cmd /c`) — the same seam command sources use.
+ */
+export declare function evaluatePostcondition(command: string): {
+    ok: boolean;
+    error?: string;
+};
 /**
  * Reconcile a fire's frozen `ok` against its dispatched run's REAL, current
- * status — the render-time fix for RUSH-2690.
+ * status — the render-time fix for RUSH-2690 — and, when the run has settled
+ * `completed`, against a declared postcondition (PHNX-2842).
  *
  * `writeFireRecord` (this module) persists `ok` once, at fire time, from
  * `dispatchAction`'s synchronous return. For a `run`/`routine` action that
@@ -146,5 +174,13 @@ export interface ReconciledFireOutcome {
  * A fire with no `runId` (a `notify`/`webhook-out` action, or a `run`/`routine`
  * dispatch that never got a runId at all) has nothing to reconcile against —
  * its frozen `ok` is the only signal and is returned as-is.
+ *
+ * `completed` is not success by itself. An agent that exits 0 without doing
+ * the job (merge-on-green that never merged) used to record `ok` because
+ * `OK_RUN_STATUSES` treated `completed` as healthy. When the fire carries a
+ * `postcondition` command, this function runs it once the run has settled and
+ * returns `ok: false, effect: 'none'` when it fails — distinguishing "ran but
+ * no effect" from a working fire. The result is persisted on the fire record
+ * so later listings do not re-exec the command.
  */
 export declare function resolveFireOutcome(jobName: string, fire: FireRecord): ReconciledFireOutcome;

package/dist/lib/monitors/state.js

@@ -13,6 +13,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createHash } from 'crypto';
+import { spawnSync } from 'child_process';
 import { getMonitorsHistoryDir, ensureAgentsDir } from '../state.js';
 import { safeJoin } from '../paths.js';
 import { readRunMeta } from '../scheduling/routines.js';
@@ -199,11 +200,50 @@ export function listFires(name) {
     }
     return fires;
 }
-/** Run statuses that read as a healthy fire: still in flight, or settled clean. */
-const OK_RUN_STATUSES = new Set(['running', 'completed']);
+/** Cap a display-time postcondition so `monitors runs` cannot hang on a stuck command. */
+const POSTCONDITION_TIMEOUT_MS = 15_000;
+/**
+ * Run a fire's postcondition command. Exit 0 means the intended effect happened;
+ * anything else (nonzero, timeout, spawn error, empty command) is "no effect".
+ * Real `/bin/sh -c` (or `cmd /c`) — the same seam command sources use.
+ */
+export function evaluatePostcondition(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return { ok: false, error: 'postcondition not met: empty command' };
+    const [bin, args] = process.platform === 'win32'
+        ? ['cmd', ['/c', trimmed]]
+        : ['/bin/sh', ['-c', trimmed]];
+    const result = spawnSync(bin, args, {
+        encoding: 'utf-8',
+        timeout: POSTCONDITION_TIMEOUT_MS,
+        maxBuffer: 8 * 1024 * 1024,
+        env: { ...process.env, CLICOLOR: '0', NO_COLOR: '1', FORCE_COLOR: '0' },
+    });
+    if (result.status === 0)
+        return { ok: true };
+    if (result.error) {
+        const err = result.error;
+        if (err.code === 'ETIMEDOUT') {
+            return { ok: false, error: `postcondition not met: timed out after ${POSTCONDITION_TIMEOUT_MS / 1000}s` };
+        }
+        return { ok: false, error: `postcondition not met: ${err.message}` };
+    }
+    const detail = (result.stderr || result.stdout || '').trim().replace(/\s+/g, ' ').slice(0, 200);
+    const exit = result.status ?? 'unknown';
+    return { ok: false, error: `postcondition not met${detail ? `: ${detail}` : ` (exit ${exit})`}` };
+}
+/** Persist the postcondition result onto the existing fire record. Frozen `ok` is left as the fire-time snapshot. */
+function persistPostcondition(fire, result) {
+    writeFireRecord(fire, {
+        postconditionOk: result.ok,
+        ...(result.error ? { postconditionError: result.error } : {}),
+    });
+}
 /**
  * Reconcile a fire's frozen `ok` against its dispatched run's REAL, current
- * status — the render-time fix for RUSH-2690.
+ * status — the render-time fix for RUSH-2690 — and, when the run has settled
+ * `completed`, against a declared postcondition (PHNX-2842).
  *
  * `writeFireRecord` (this module) persists `ok` once, at fire time, from
  * `dispatchAction`'s synchronous return. For a `run`/`routine` action that
@@ -219,6 +259,14 @@ const OK_RUN_STATUSES = new Set(['running', 'completed']);
  * A fire with no `runId` (a `notify`/`webhook-out` action, or a `run`/`routine`
  * dispatch that never got a runId at all) has nothing to reconcile against —
  * its frozen `ok` is the only signal and is returned as-is.
+ *
+ * `completed` is not success by itself. An agent that exits 0 without doing
+ * the job (merge-on-green that never merged) used to record `ok` because
+ * `OK_RUN_STATUSES` treated `completed` as healthy. When the fire carries a
+ * `postcondition` command, this function runs it once the run has settled and
+ * returns `ok: false, effect: 'none'` when it fails — distinguishing "ran but
+ * no effect" from a working fire. The result is persisted on the fire record
+ * so later listings do not re-exec the command.
  */
 export function resolveFireOutcome(jobName, fire) {
     if (!fire.runId)
@@ -226,5 +274,32 @@ export function resolveFireOutcome(jobName, fire) {
     const run = readRunMeta(jobName, fire.runId);
     if (!run)
         return { ok: fire.ok !== false };
-    return { ok: OK_RUN_STATUSES.has(run.status), runStatus: run.status };
+    if (run.status === 'running')
+        return { ok: true, runStatus: run.status };
+    if (run.status !== 'completed')
+        return { ok: false, runStatus: run.status };
+    if (!fire.postcondition)
+        return { ok: true, runStatus: 'completed' };
+    if (fire.postconditionOk === true) {
+        return { ok: true, runStatus: 'completed', effect: 'met' };
+    }
+    if (fire.postconditionOk === false) {
+        return {
+            ok: false,
+            runStatus: 'completed',
+            effect: 'none',
+            ...(fire.postconditionError ? { error: fire.postconditionError } : {}),
+        };
+    }
+    const result = evaluatePostcondition(fire.postcondition);
+    persistPostcondition(fire, result);
+    fire.postconditionOk = result.ok;
+    if (result.error)
+        fire.postconditionError = result.error;
+    return {
+        ok: result.ok,
+        runStatus: 'completed',
+        effect: result.ok ? 'met' : 'none',
+        ...(result.error ? { error: result.error } : {}),
+    };
 }

package/dist/lib/permissions-registry.d.ts

@@ -7,6 +7,8 @@ export declare const KIRO_CAPABILITY_BY_TOOL: Record<string, string | undefined>
 export declare const CANONICAL_TO_OPENCLAW_TOOL: Record<string, string>;
 /** Canonical tool -> Antigravity's action namespace. */
 export declare const ANTIGRAVITY_ACTION_BY_TOOL: Record<string, string | undefined>;
+/** Filename Codex stores generated deny rules under `.codex/rules/`. */
+export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
 /**
  * Strip JSON comments for JSONC parsing, only OUTSIDE string literals.
  *

package/dist/lib/permissions-registry.js

@@ -97,6 +97,8 @@ const CANONICAL_BY_GROK_TOOL = invertFirstWins(GROK_TOOL_BY_CANONICAL);
 const CANONICAL_BY_KIRO_CAPABILITY = invertFirstWins(KIRO_CAPABILITY_BY_TOOL);
 const CANONICAL_BY_OPENCLAW_TOOL = invertFirstWins(CANONICAL_TO_OPENCLAW_TOOL);
 const CANONICAL_BY_ANTIGRAVITY_ACTION = invertFirstWins(ANTIGRAVITY_ACTION_BY_TOOL);
+/** Filename Codex stores generated deny rules under `.codex/rules/`. */
+export const CODEX_RULES_FILENAME = 'agents-deny.rules';
 /** Canonical TitleCase spelling for a lowercased canonical tool name. */
 const CANONICAL_TOOL_CASE = {
     bash: 'Bash',
@@ -248,6 +250,106 @@ function existingOr(preferred, alternate) {
 function stringList(value) {
     return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
 }
+/**
+ * Invert `convertDenyToCodexRules` (permissions.ts). The writer emits
+ * `prefix_rule(pattern=["git", "reset"], decision="forbidden")` from a
+ * canonical `Bash(git reset:*)`. Prefix-match is the native form of `:*`,
+ * so the reverse always reconstructs `Bash(<parts>:*)`.
+ *
+ * Only `decision = "forbidden"` is a deny; anything else is skipped rather
+ * than guessed into an allow (Codex grants come from sandbox_mode).
+ */
+function convertCodexRulesToDeny(content) {
+    const deny = [];
+    const marker = 'prefix_rule';
+    let searchFrom = 0;
+    while (searchFrom < content.length) {
+        const start = content.indexOf(marker, searchFrom);
+        if (start < 0)
+            break;
+        const open = content.indexOf('(', start + marker.length);
+        if (open < 0)
+            break;
+        const bodyEnd = findMatchingCloser(content, open, '(', ')');
+        if (bodyEnd < 0) {
+            searchFrom = open + 1;
+            continue;
+        }
+        const body = content.slice(open + 1, bodyEnd);
+        searchFrom = bodyEnd + 1;
+        const decision = body.match(/decision\s*=\s*"((?:\\.|[^"\\])*)"/);
+        if (!decision || decision[1] !== 'forbidden')
+            continue;
+        const patternKw = body.search(/pattern\s*=/);
+        if (patternKw < 0)
+            continue;
+        const arrayStart = body.indexOf('[', patternKw);
+        if (arrayStart < 0)
+            continue;
+        const arrayEnd = findMatchingCloser(body, arrayStart, '[', ']');
+        if (arrayEnd < 0)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(body.slice(arrayStart, arrayEnd + 1));
+        }
+        catch {
+            continue;
+        }
+        if (!Array.isArray(parsed))
+            continue;
+        const parts = parsed.filter((p) => typeof p === 'string' && p.length > 0);
+        if (parts.length === 0)
+            continue;
+        deny.push(`Bash(${parts.join(' ')}:*)`);
+    }
+    return deny;
+}
+/** Index of the closer matching `source[openIdx]`, skipping quoted strings. */
+function findMatchingCloser(source, openIdx, open, close) {
+    let depth = 0;
+    let inString = false;
+    let escape = false;
+    for (let i = openIdx; i < source.length; i++) {
+        const c = source[i];
+        if (inString) {
+            if (escape) {
+                escape = false;
+                continue;
+            }
+            if (c === '\\') {
+                escape = true;
+                continue;
+            }
+            if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"') {
+            inString = true;
+            continue;
+        }
+        if (c === open)
+            depth++;
+        else if (c === close) {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+function readCodexDenyRules(configPath) {
+    const rulesPath = path.join(path.dirname(configPath), 'rules', CODEX_RULES_FILENAME);
+    if (!fs.existsSync(rulesPath))
+        return [];
+    try {
+        return convertCodexRulesToDeny(fs.readFileSync(rulesPath, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Single source of truth for where each allowlist-capable agent stores
  * permissions and how to read them back. Keys MUST equal
@@ -309,24 +411,24 @@ export const PERMISSION_TARGETS = {
     codex: {
         home: (h) => path.join(h, '.codex', 'config.toml'),
         project: (cwd) => path.join(cwd, '.codex', 'config.toml'),
-        lossyBecause: 'Codex has no rule list — its sandbox mode is widened into representative blanket grants',
+        lossyBecause: 'sandbox mode widens into representative blanket grants; deny round-trips from agents-deny.rules as Bash(prefix:*)',
         toCanonical(configPath) {
             const config = readToml(configPath);
-            if (!config)
-                return null;
             const allow = [];
-            const sandboxMode = config.sandbox_mode;
-            if (config.approval_policy === 'never' || sandboxMode === 'danger-full-access') {
-                allow.push('Bash(*)', 'Read(**)', 'Write(**)', 'Edit(**)');
-            }
-            else if (sandboxMode === 'workspace-write') {
-                allow.push('Bash(*)', 'Read(**)');
-            }
-            const sw = config.sandbox_workspace_write;
-            if (sw && typeof sw === 'object' && !Array.isArray(sw) && sw.network_access) {
-                allow.push('WebSearch(*)', 'WebFetch(*)');
+            if (config) {
+                const sandboxMode = config.sandbox_mode;
+                if (config.approval_policy === 'never' || sandboxMode === 'danger-full-access') {
+                    allow.push('Bash(*)', 'Read(**)', 'Write(**)', 'Edit(**)');
+                }
+                else if (sandboxMode === 'workspace-write') {
+                    allow.push('Bash(*)', 'Read(**)');
+                }
+                const sw = config.sandbox_workspace_write;
+                if (sw && typeof sw === 'object' && !Array.isArray(sw) && sw.network_access) {
+                    allow.push('WebSearch(*)', 'WebFetch(*)');
+                }
             }
-            return permissionSet(allow, []);
+            return permissionSet(allow, readCodexDenyRules(configPath));
         },
     },
     cursor: {

package/dist/lib/permissions.d.ts

@@ -1,6 +1,6 @@
 import type { AgentId, PermissionSet, InstalledPermission, ClaudePermissions, CursorPermissions, OpenCodePermissions, CodexPermissions } from './types.js';
-/** Filename used for Codex Starlark deny-rules generated from permission groups. */
-export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
+import { CODEX_RULES_FILENAME } from './permissions-registry.js';
+export { CODEX_RULES_FILENAME };
 export type ParsedRules = PermissionSet;
 export declare const COMPUTER_PERMISSION_RULE_PREFIX = "Computer";
 export declare const COMPUTER_APP_GATED_VERBS: readonly ["screenshot", "describe", "get-text", "launch", "raise", "click", "right-click", "type", "type-text", "key", "drag", "scroll", "ax-action", "focus", "wait"];
@@ -13,6 +13,9 @@ export declare function containsBroadGrants(rules: ParsedRules): {
 /**
  * Convert canonical deny rules to Codex Starlark .rules format.
  * E.g. "Bash(git reset:*)" -> prefix_rule(pattern=["git", "reset"], decision="forbidden")
+ *
+ * Inverse: `toCanonical` for `PERMISSION_TARGETS.codex` reads
+ * `.codex/rules/agents-deny.rules` back into `Bash(<parts>:*)`.
  */
 export declare function convertDenyToCodexRules(deny: string[]): string | null;
 /**
@@ -344,4 +347,3 @@ export declare function saveDefaultPermissionSet(set: PermissionSet): {
     success: boolean;
     error?: string;
 };
-export {};

package/dist/lib/permissions.js

@@ -20,16 +20,9 @@ import { updateGeminiSettings } from './gemini-settings.js';
 // The canonical<->native tool vocabularies live in the registry, which also owns
 // the reverse projections — so the serializers below and the readers there can
 // never disagree about what `fs_read` or `developer__shell` means.
-import { ANTIGRAVITY_ACTION_BY_TOOL, CANONICAL_TO_OPENCLAW_TOOL, stripJsonComments, GROK_TOOL_BY_CANONICAL, KIRO_CAPABILITY_BY_TOOL, PERMISSION_TARGETS, readCanonicalPermissions, } from './permissions-registry.js';
+import { ANTIGRAVITY_ACTION_BY_TOOL, CANONICAL_TO_OPENCLAW_TOOL, CODEX_RULES_FILENAME, stripJsonComments, GROK_TOOL_BY_CANONICAL, KIRO_CAPABILITY_BY_TOOL, PERMISSION_TARGETS, readCanonicalPermissions, } from './permissions-registry.js';
+export { CODEX_RULES_FILENAME };
 const HOME = os.homedir();
-// PERMISSIONS_CAPABLE_AGENTS removed — use `capableAgents('allowlist')`
-// from lib/capabilities.ts. The capability matrix on AgentConfig is the
-// single source of truth. (Per-agent native format details:
-//   antigravity → ~/.gemini/antigravity-cli/settings.json `permissions.{allow,deny}`
-//   grok        → ~/.grok/config.toml `[permission].rules`
-// the writer in `applyPermissionsToVersion` handles the format dispatch.)
-/** Filename used for Codex Starlark deny-rules generated from permission groups. */
-export const CODEX_RULES_FILENAME = 'agents-deny.rules';
 export const COMPUTER_PERMISSION_RULE_PREFIX = 'Computer';
 export const COMPUTER_APP_GATED_VERBS = [
     'screenshot',
@@ -103,6 +96,9 @@ export function containsBroadGrants(rules) {
 /**
  * Convert canonical deny rules to Codex Starlark .rules format.
  * E.g. "Bash(git reset:*)" -> prefix_rule(pattern=["git", "reset"], decision="forbidden")
+ *
+ * Inverse: `toCanonical` for `PERMISSION_TARGETS.codex` reads
+ * `.codex/rules/agents-deny.rules` back into `Bash(<parts>:*)`.
  */
 export function convertDenyToCodexRules(deny) {
     const rules = [];
@@ -122,6 +118,24 @@ export function convertDenyToCodexRules(deny) {
         return null;
     return `# Auto-generated by agents-cli from deny permission groups.\n# Do not edit manually — re-run "agents use" to regenerate.\n\n${rules.join('\n\n')}\n`;
 }
+/**
+ * Write `.codex/rules/agents-deny.rules` to match `deny`, or delete it when
+ * the current set has nothing to forbid. The reader (PHNX-2703) now surfaces
+ * this file, so a later apply with an empty deny must not leave a stale
+ * forbid behind — `agents permissions list codex` would keep reporting it.
+ */
+function syncCodexDenyRules(configDir, deny) {
+    const rulesPath = path.join(configDir, 'rules', CODEX_RULES_FILENAME);
+    const rulesContent = deny && deny.length > 0 ? convertDenyToCodexRules(deny) : null;
+    if (rulesContent) {
+        fs.mkdirSync(path.dirname(rulesPath), { recursive: true });
+        fs.writeFileSync(rulesPath, rulesContent, 'utf-8');
+        return;
+    }
+    if (fs.existsSync(rulesPath)) {
+        fs.unlinkSync(rulesPath);
+    }
+}
 /**
  * Ensure central permissions directory exists.
  */
@@ -1274,15 +1288,7 @@ function applyCodexPermissions(set, scope = 'user', cwd, merge = true) {
                 : newPermissions.sandbox_workspace_write;
         }
         fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
-        // Write .rules file for deny permissions
-        if (set.deny && set.deny.length > 0) {
-            const rulesContent = convertDenyToCodexRules(set.deny);
-            if (rulesContent) {
-                const rulesDir = path.join(configDir, 'rules');
-                fs.mkdirSync(rulesDir, { recursive: true });
-                fs.writeFileSync(path.join(rulesDir, CODEX_RULES_FILENAME), rulesContent, 'utf-8');
-            }
-        }
+        syncCodexDenyRules(configDir, set.deny);
         return { success: true };
     }
     catch (err) {
@@ -1393,15 +1399,7 @@ export function applyPermissionsToVersion(agentId, set, versionHome, merge = tru
                     : newPermissions.sandbox_workspace_write;
             }
             fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
-            // Write .rules file for deny permissions
-            if (set.deny && set.deny.length > 0) {
-                const rulesContent = convertDenyToCodexRules(set.deny);
-                if (rulesContent) {
-                    const rulesDir = path.join(configDir, 'rules');
-                    fs.mkdirSync(rulesDir, { recursive: true });
-                    fs.writeFileSync(path.join(rulesDir, CODEX_RULES_FILENAME), rulesContent, 'utf-8');
-                }
-            }
+            syncCodexDenyRules(configDir, set.deny);
             return { success: true };
         }
         if (agentId === 'antigravity') {

package/dist/lib/profiles.d.ts

@@ -248,13 +248,14 @@ export interface ResolvedProfileRun {
      */
     tierNote?: string;
     /**
-     * Set when `requestedModel` was a tier token AND this profile resolved it
-     * against its own `models:` map. Callers that forward a `--model` value
-     * downstream (e.g. as `ExecOptions.model`) should substitute this in place
-     * of the original tier token — exec.ts's native tier block only knows how
-     * to resolve a tier against the HOST agent's own catalog, which is the
-     * wrong catalog for a profile's own harness identity. Undefined both when
-     * no tier was requested and when tier resolution degraded (see `tierNote`).
+     * Concrete model id callers should forward as `ExecOptions.model`. Set when:
+     * - `requestedModel` was a cost-tier token resolved against this profile's
+     *   `models:` map, OR
+     * - no `--model` was requested and this is an OpenCode host whose pin lives
+     *   in `OPENCODE_MODEL` (OpenCode does not read that env var, so the pin
+     *   has to become `--model` on the argv).
+     * Undefined when the caller already passed a concrete `--model`, or when
+     * tier resolution degraded (see `tierNote`).
      */
     resolvedModel?: string;
 }

package/dist/lib/profiles.js

@@ -164,6 +164,7 @@ const MODEL_ENV_KEYS = [
     'OPENAI_MODEL',
     'GEMINI_MODEL',
     'GROK_MODEL',
+    'OPENCODE_MODEL',
 ];
 /** Return the configured model env value for display. */
 export function profileModelLabel(profile) {
@@ -583,6 +584,17 @@ export function resolveProfileForRun(name, requestedModel) {
         // the raw tier token downstream and handles the message -- this function
         // doesn't compete with that canonical fallback for the no-opt-in case.
     }
+    // OpenCode does not honor OPENCODE_MODEL (unlike claude/codex/gemini/grok,
+    // whose host CLIs read their MODEL env var). Copy the pin into resolvedModel
+    // so callers set ExecOptions.model and buildExecCommand emits `--model`.
+    // An explicit `--model` (including a cost-tier token the caller may still
+    // discard) wins and is left alone.
+    if (resolved.resolvedModel === undefined && !requestedModel && profile.host.agent === 'opencode') {
+        const envKey = profileModelEnvKey(profile) ?? modelEnvKeyForHost('opencode');
+        const pinned = env[envKey];
+        if (pinned)
+            resolved.resolvedModel = pinned;
+    }
     return resolved;
 }
 /**