@probelabs/probe 0.6.0-rc339 → 0.6.0-rc341

package/build/agent/ProbeAgent.d.ts

@@ -82,6 +82,12 @@ export interface ProbeAgentOptions {
   allowedTools?: string[] | null;
   /** Attested, fail-closed Codex runtime profile. Requires provider codex and an exact allowedTools match. */
   governedCodexProfile?: GovernedCodexProfile;
+  /** Transport for an attested governed Codex profile. The exec transport requires codexBin and codexSha256. */
+  governedCodexTransport?: 'mcp-server-v1' | 'exec-jsonl-default-auth-v1';
+  /** Absolute Codex executable used by exec-jsonl-default-auth-v1. */
+  codexBin?: string;
+  /** Caller-supplied SHA-256 (sha256:<64 hex> or bare 64 hex) for codexBin. */
+  codexSha256?: string;
   /** Convenience flag to disable all tools (equivalent to allowedTools: []). Takes precedence over allowedTools if set. */
   disableTools?: boolean;
   /** Retry configuration for handling transient API failures */
@@ -104,9 +110,9 @@ export interface ProbeAgentOptions {
   completionPrompt?: string;
   /** Enable task management system for tracking multi-step progress */
   enableTasks?: boolean;
-  /** Timeout in ms for AI requests (default: 120000 or REQUEST_TIMEOUT env var). Used to abort hung requests. */
+  /** Timeout in ms for AI requests (default: 120000 or REQUEST_TIMEOUT env var). `0` disables the per-request deadline; Codex startup remains bounded. */
   requestTimeout?: number;
-  /** Maximum timeout in ms for the entire operation including all retries and fallbacks (default: 300000 or MAX_OPERATION_TIMEOUT env var). This is the absolute maximum time for streamTextWithRetryAndFallback. */
+  /** Maximum timeout in ms for the entire operation including all retries and fallbacks (default: 300000 or MAX_OPERATION_TIMEOUT env var). `0` disables the overall operation deadline. */
   maxOperationTimeout?: number;
   /** Timeout behavior: 'graceful' winds down with bonus steps, 'hard' aborts immediately, 'negotiated' uses a timeout observer (separate LLM call) to decide extensions (default: 'graceful'). Env var: TIMEOUT_BEHAVIOR */
   timeoutBehavior?: 'graceful' | 'hard' | 'negotiated';
@@ -272,7 +278,9 @@ export interface GovernedResultIdentity {
 export type GovernedCodexProfile =
   { version: 'probe.governed-codex-profile/v1'; profileId: 'luna-xhigh-readonly-v1'; engine: 'codex'; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'read-only'; approvalPolicy: 'never'; cwd: string; probeTools: ['search', 'extract', 'listFiles']; fallback: false; retries: 0; }
   /** Admits pinned-protocol `exec` inside the attested sandbox; does not claim commands are semantically safe. */
-  | { version: 'probe.governed-codex-profile/v2'; profileId: 'luna-xhigh-readonly-native-exec-v1'; engine: 'codex'; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'read-only'; approvalPolicy: 'never'; cwd: string; probeMcpTools: ['search', 'extract', 'listFiles']; codexNativeTools: ['exec']; fallback: false; retries: 0; };
+  | { version: 'probe.governed-codex-profile/v2'; profileId: 'luna-xhigh-readonly-native-exec-v1'; engine: 'codex'; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'read-only'; approvalPolicy: 'never'; cwd: string; probeMcpTools: ['search', 'extract', 'listFiles']; codexNativeTools: ['exec']; fallback: false; retries: 0; }
+  /** Admits observed native `apply_patch` and `exec` inside the configured workspace-write cwd; callers bind that cwd to an isolated worktree. */
+  | { version: 'probe.governed-codex-profile/v3'; profileId: 'luna-xhigh-isolated-writer-v1'; engine: 'codex'; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'workspace-write'; approvalPolicy: 'never'; cwd: string; probeMcpTools: ['search', 'extract', 'listFiles']; codexNativeTools: ['apply_patch', 'exec']; fallback: false; retries: 0; };
 
 export interface GovernedCodexRuntimeAttestation {
   version: 'probe.governed-codex-attestation/v1';
@@ -285,7 +293,7 @@ export interface GovernedCodexRuntimeAttestation {
 
 export interface GovernedAnswerResult {
   data: unknown;
-  runtimeAttestation: GovernedCodexRuntimeAttestation | GovernedCodexRuntimeAttestationV3;
+  runtimeAttestation: GovernedCodexRuntimeAttestation | GovernedCodexRuntimeAttestationV3 | GovernedCodexExecAttestation;
 }
 
 export interface GovernedCodexRuntimeAttestationV2 {
@@ -301,26 +309,46 @@ export interface GovernedCodexRuntimeAttestationV2 {
 
 export interface GovernedInvocationAnswerResult {
   data: unknown;
-  runtimeAttestation: GovernedCodexRuntimeAttestationV2 | GovernedCodexRuntimeAttestationV3;
+  runtimeAttestation: GovernedCodexRuntimeAttestationV2 | GovernedCodexRuntimeAttestationV3 | GovernedCodexExecAttestation;
 }
 
 export interface GovernedIdentifiedAnswerResult {
   data: unknown;
-  runtimeAttestation: GovernedCodexRuntimeAttestationV2 | GovernedCodexRuntimeAttestationV3;
+  runtimeAttestation: GovernedCodexRuntimeAttestationV2 | GovernedCodexRuntimeAttestationV3 | GovernedCodexExecAttestation;
   resultIdentity: GovernedResultIdentity;
 }
 
 export interface GovernedCodexRuntimeAttestationV3 {
   version: 'probe.governed-codex-attestation/v3';
-  profileId: 'luna-xhigh-readonly-native-exec-v1';
-  requested: { profileDigest: string; cwdDigest: string; probeMcpToolsDigest: string; codexNativeToolsDigest: string; probeMcpTools: ['search', 'extract', 'listFiles']; codexNativeTools: ['exec']; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'read-only'; approvalPolicy: 'never'; };
-  observed: { source: 'session_configured+raw_response_item'; model: 'gpt-5.6-luna'; modelProviderId: 'openai'; reasoningEffort: 'xhigh'; approvalPolicy: 'never'; cwdDigest: string; permissionProfileDigest: string; filesystem: 'restricted-read-root'; network: 'restricted'; nativeTools: { total: number; tools: GovernedCodexNativeToolAggregate[]; }; };
+  profileId: 'luna-xhigh-readonly-native-exec-v1' | 'luna-xhigh-isolated-writer-v1';
+  requested:
+    | { profileDigest: string; cwdDigest: string; probeMcpToolsDigest: string; codexNativeToolsDigest: string; probeMcpTools: ['search', 'extract', 'listFiles']; codexNativeTools: ['exec']; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'read-only'; approvalPolicy: 'never'; }
+    | { profileDigest: string; cwdDigest: string; probeMcpToolsDigest: string; codexNativeToolsDigest: string; probeMcpTools: ['search', 'extract', 'listFiles']; codexNativeTools: ['apply_patch', 'exec']; model: 'gpt-5.6-luna'; reasoningEffort: 'xhigh'; sandbox: 'workspace-write'; approvalPolicy: 'never'; };
+  observed:
+    | { source: 'session_configured+raw_response_item'; model: 'gpt-5.6-luna'; modelProviderId: 'openai'; reasoningEffort: 'xhigh'; approvalPolicy: 'never'; cwdDigest: string; permissionProfileDigest: string; filesystem: 'restricted-read-root'; network: 'restricted'; nativeTools: { total: number; tools: GovernedCodexNativeToolAggregate[]; }; }
+    | { source: 'session_configured+raw_response_item'; model: 'gpt-5.6-luna'; modelProviderId: 'openai'; reasoningEffort: 'xhigh'; approvalPolicy: 'never'; cwdDigest: string; permissionProfileDigest: string; filesystem: 'restricted-write-cwd'; network: 'restricted'; nativeTools: { total: number; tools: GovernedCodexNativeToolAggregate[]; }; };
   executionContext?: { source: 'caller'; invocationDigest: string; };
   dispatch?: { source: 'probe-host-tools-call'; tool: 'codex'; promptDigest: string; promptBytes: number; };
   evidence: { sessionEventCount: 1; nativeCallCount: number; probeMcpCallCount: number; };
   usage: { status: 'unavailable'; };
 }
 
+export interface GovernedCodexExecAttestation {
+  version: 'probe.governed-codex-exec-attestation/v1';
+  profileId: 'luna-xhigh-readonly-v1' | 'luna-xhigh-readonly-native-exec-v1' | 'luna-xhigh-isolated-writer-v1';
+  requested: Record<string, unknown>;
+  enforced: {
+    source: 'probe-host-codex-exec-argv/v1'; transport: 'exec-jsonl-default-auth-v1'; cliPath: string; cliSha256: `sha256:${string}`; cliVersion: string;
+    configDigest: `sha256:${string}`; launchDigest: `sha256:${string}`; cwdDigest: string; codexHome: 'omitted';
+    environmentPolicy: 'inherit-with-CODEX_HOME-omitted-v1'; ignoreUserConfig: true; ignoreRules: true; ephemeral: true; noShell: true; loopbackMcpDigest: `sha256:${string}`;
+  };
+  observed: { source: 'codex-exec-jsonl/v1'; threadDigest: string; streamDigest: string; terminal: 'turn.completed'; eventCount: number; completedItemCount: number; agentMessageCount: number; usedToolItems: Array<{ category: 'mcp_tool_call' | 'command_execution' | 'file_change'; name: string | null; status: 'completed'; count: number }>; probeMcpCallCount: number; finalDigest: string; finalBytes: number; processExitCode: 0; processSignal: null; };
+  executionContext?: { source: 'caller'; invocationDigest: string };
+  dispatch: { source: 'probe-host-exec'; tool: 'codex-exec'; promptDigest: string; promptBytes: number };
+  evidence: { eventCount: number; completedItemCount: number; agentMessageCount: number; probeMcpCallCount: number };
+  usage: { status: 'observed'; inputTokens: number; cachedInputTokens: number; outputTokens: number };
+}
+
 /**
  * Clone options for creating a new agent with shared history
  */

package/build/agent/ProbeAgent.js

@@ -23,6 +23,10 @@ export const ENGINE_ACTIVITY_TIMEOUT_MIN = 5000;
  */
 export const ENGINE_ACTIVITY_TIMEOUT_MAX = 600000;
 
+const REQUEST_TIMEOUT_DEFAULT = 120000;
+const REQUEST_TIMEOUT_MIN = 1000;
+const REQUEST_TIMEOUT_MAX = 3600000;
+
 import { createProviderInstance, DEFAULT_MODELS } from '../utils/provider.js';
 import { streamText, generateText, tool, stepCountIs, jsonSchema, Output } from 'ai';
 import { createHash, randomUUID } from 'crypto';
@@ -103,10 +107,16 @@ import {
 } from './tasks/index.js';
 import { z } from 'zod';
 import { validateGovernedCodexProfile } from './engines/governed-codex-profile.js';
+import { normalizeGovernedCodexExecFailure, previewGovernedCodexExecDispatch, validateGovernedCodexExecAttestation } from './engines/governed-codex-exec.js';
 import { governedAnswerFailure, normalizeGovernedAnswerFailure } from './engines/governed-answer-failure.js';
 
 const GOVERNED_RESULT_IDENTITY = 'probe.governed-result-identity/v1';
 const GOVERNED_RESULT_DOMAIN = 'probe.governed-result-identity/data/v1';
+const GOVERNED_CODEX_EXEC_TRANSPORT = 'exec-jsonl-default-auth-v1';
+
+function isGovernedCodexNativeProfile(profile) {
+  return Array.isArray(profile?.codexNativeTools);
+}
 
 function normalizeGovernedJson(value) {
   if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;
@@ -129,6 +139,33 @@ function freezeGovernedTree(value) {
   return value;
 }
 
+const GOVERNED_CANDIDATE_ORIGINS = new Set(['result_content', 'raw_final', 'none']);
+const GOVERNED_CANDIDATE_BOUNDARY_FIELDS = [
+  'selectedChunkCount', 'selectedBytes', 'resultTextItemCount', 'resultTextBytes',
+  'rawFinalMessageCount', 'rawFinalPartCount', 'rawFinalBytes'
+];
+
+function governedCandidateUint(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+
+function governedCandidateOwn(value, key) {
+  if (!value || typeof value !== 'object') return undefined;
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor && 'value' in descriptor ? descriptor.value : undefined;
+  } catch { return undefined; }
+}
+
+function projectGovernedCandidateBoundary(value) {
+  const selectedOriginValue = governedCandidateOwn(value, 'selectedOrigin');
+  const selectedOrigin = GOVERNED_CANDIDATE_ORIGINS.has(selectedOriginValue)
+    ? selectedOriginValue : 'none';
+  const projected = { selectedOrigin };
+  for (const field of GOVERNED_CANDIDATE_BOUNDARY_FIELDS) projected[field] = governedCandidateUint(governedCandidateOwn(value, field));
+  return Object.freeze(projected);
+}
+
 function identifyGovernedResult(value) {
   const data = freezeGovernedTree(normalizeGovernedJson(value));
   const canonical = Buffer.from(JSON.stringify(data), 'utf8');
@@ -329,8 +366,8 @@ export class ProbeAgent {
    * @param {number} [options.fallback.maxTotalAttempts=10] - Maximum total attempts across all providers
    * @param {string} [options.completionPrompt] - Custom prompt to run after completion for validation/review (runs before mermaid/JSON validation)
    * @param {number} [options.maxOutputTokens] - Maximum tokens for tool output before truncation (default: 20000, can also be set via PROBE_MAX_OUTPUT_TOKENS env var)
-   * @param {number} [options.requestTimeout] - Timeout in ms for AI requests (default: 120000 or REQUEST_TIMEOUT env var). Used to abort hung requests.
-   * @param {number} [options.maxOperationTimeout] - Maximum timeout in ms for the entire operation including all retries and fallbacks (default: 300000 or MAX_OPERATION_TIMEOUT env var). This is the absolute maximum time for streamTextWithRetryAndFallback.
+   * @param {number} [options.requestTimeout] - Timeout in ms for AI requests (default: 120000 or REQUEST_TIMEOUT env var). `0` disables the per-request deadline; the Codex startup handshake remains bounded.
+   * @param {number} [options.maxOperationTimeout] - Maximum timeout in ms for the entire operation including all retries and fallbacks (default: 300000 or MAX_OPERATION_TIMEOUT env var). `0` disables the overall operation deadline.
    * @param {string|number} [options.thinkingEffort] - Native thinking/reasoning effort level: 'low', 'medium', 'high', or a number (budget tokens). When set, passes provider-specific thinking options to the LLM via providerOptions.
    */
   constructor(options = {}) {
@@ -353,6 +390,9 @@ export class ProbeAgent {
     this.searchDelegate = options.searchDelegate !== undefined ? !!options.searchDelegate : true;
     this.searchDelegateProvider = options.searchDelegateProvider || null;
     this.searchDelegateModel = options.searchDelegateModel || null;
+    this.governedCodexTransport = options.governedCodexTransport || 'mcp-server-v1';
+    this.governedCodexBin = options.codexBin ?? options.codexPath;
+    this.governedCodexSha256 = options.codexSha256;
     this.maxResponseTokens = options.maxResponseTokens || (() => {
       const val = parseInt(process.env.MAX_RESPONSE_TOKENS || '0', 10);
       if (isNaN(val) || val < 0 || val > 200000) {
@@ -384,6 +424,10 @@ export class ProbeAgent {
 
     if (options.governedCodexProfile !== undefined) {
       if (options.provider !== 'codex') throw new TypeError('governedCodexProfile requires provider codex'); const profile = validateGovernedCodexProfile(options.governedCodexProfile);
+      if (!['mcp-server-v1', GOVERNED_CODEX_EXEC_TRANSPORT].includes(this.governedCodexTransport)) throw new TypeError('Invalid governedCodexTransport');
+      if (this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT &&
+        (typeof this.governedCodexBin !== 'string' || !isAbsolute(this.governedCodexBin) ||
+          typeof this.governedCodexSha256 !== 'string')) throw new TypeError('exec-jsonl-default-auth-v1 requires codexBin and codexSha256');
       const probeTools = profile.probeTools ?? profile.probeMcpTools;
       if (options.disableTools || !Array.isArray(options.allowedTools) || options.allowedTools.length !== probeTools.length || options.allowedTools.some((tool, index) => tool !== probeTools[index])) throw new TypeError('allowedTools must exactly match governedCodexProfile Probe MCP tools');
       this.governedCodexProfile = profile;
@@ -498,19 +542,21 @@ export class ProbeAgent {
     // When set, every AI API call acquires a slot before calling the provider.
     this.concurrencyLimiter = options.concurrencyLimiter || null;
 
-    // Request timeout configuration (default 2 minutes)
-    // Validates env var to prevent NaN or unreasonable values
-    this.requestTimeout = options.requestTimeout ?? (() => {
-      if (process.env.REQUEST_TIMEOUT) {
-        const parsed = parseInt(process.env.REQUEST_TIMEOUT, 10);
-        // Validate: must be positive number between 1s and 1 hour
-        if (isNaN(parsed) || parsed < 1000 || parsed > 3600000) {
-          return 120000; // Default 2 minutes
-        }
-        return parsed;
-      }
-      return 120000;
-    })();
+    // Request timeout configuration (default 2 minutes for ordinary providers).
+    // Codex keeps its standalone 10-minute default unless this is explicitly configured.
+    const optionRequestTimeout = options.requestTimeout;
+    const validOptionRequestTimeout = Number.isInteger(optionRequestTimeout) &&
+      (optionRequestTimeout === 0 ||
+        (optionRequestTimeout >= REQUEST_TIMEOUT_MIN && optionRequestTimeout <= REQUEST_TIMEOUT_MAX));
+    const requestTimeoutEnv = process.env.REQUEST_TIMEOUT;
+    const explicitEnvRequestTimeoutZero = typeof requestTimeoutEnv === 'string' && requestTimeoutEnv.trim() === '0';
+    const parsedRequestTimeout = parseInt(requestTimeoutEnv, 10);
+    const validEnvRequestTimeout = explicitEnvRequestTimeoutZero || (!isNaN(parsedRequestTimeout) &&
+      parsedRequestTimeout >= REQUEST_TIMEOUT_MIN && parsedRequestTimeout <= REQUEST_TIMEOUT_MAX);
+    this._requestTimeoutExplicit = validOptionRequestTimeout || validEnvRequestTimeout;
+    this.requestTimeout = validOptionRequestTimeout ? optionRequestTimeout
+      : explicitEnvRequestTimeoutZero ? 0
+        : validEnvRequestTimeout ? parsedRequestTimeout : REQUEST_TIMEOUT_DEFAULT;
     if (this.debug) {
       console.log(`[DEBUG] Request timeout: ${this.requestTimeout}ms`);
     }
@@ -519,13 +565,16 @@ export class ProbeAgent {
     // This is the absolute maximum time including all retries and fallbacks
     // Validates env var to prevent NaN or unreasonable values
     this.maxOperationTimeout = options.maxOperationTimeout ?? (() => {
-      if (process.env.MAX_OPERATION_TIMEOUT) {
-        const parsed = parseInt(process.env.MAX_OPERATION_TIMEOUT, 10);
-        // Validate: must be positive number between 1s and 2 hours
-        if (isNaN(parsed) || parsed < 1000 || parsed > 7200000) {
+      const operationTimeoutEnv = process.env.MAX_OPERATION_TIMEOUT;
+      const explicitEnvOperationTimeoutZero = typeof operationTimeoutEnv === 'string' && operationTimeoutEnv.trim() === '0';
+      if (operationTimeoutEnv) {
+        const parsed = parseInt(operationTimeoutEnv, 10);
+        // Validate: zero disables the overall deadline; positive values remain 1s to 2h.
+        if (!explicitEnvOperationTimeoutZero &&
+          (isNaN(parsed) || parsed < 1000 || parsed > 7200000)) {
           return 300000; // Default 5 minutes
         }
-        return parsed;
+        return explicitEnvOperationTimeoutZero ? 0 : parsed;
       }
       return 300000;
     })();
@@ -1014,7 +1063,7 @@ export class ProbeAgent {
       // Timeout settings for delegate subagents to inherit
       timeoutBehavior: this.timeoutBehavior,
       maxOperationTimeout: this.maxOperationTimeout,
-      requestTimeout: this.requestTimeout,
+      requestTimeout: this._requestTimeoutExplicit ? this.requestTimeout : undefined,
       gracefulTimeoutBonusSteps: this.gracefulTimeoutBonusSteps,
       negotiatedTimeoutBudget: this.negotiatedTimeoutBudget,
       negotiatedTimeoutMaxRequests: this.negotiatedTimeoutMaxRequests,
@@ -1411,10 +1460,11 @@ export class ProbeAgent {
    * @param {AbortSignal} abortSignal - Signal for aborting the operation
    * @param {number} requestTimeout - Per-request timeout in ms
    * @param {Object} timeoutState - Object with timeoutId property (mutable for cleanup)
+   * @param {boolean} [disableActivityTimeout=false] - Disable the post-hoc host activity check for explicit Codex no-deadline requests
    * @returns {Object} - streamText-compatible result with textStream
    * @private
    */
-  _createEngineTextStreamResult(engineStream, abortSignal, requestTimeout, timeoutState) {
+  _createEngineTextStreamResult(engineStream, abortSignal, requestTimeout, timeoutState, disableActivityTimeout = false) {
     // Activity timeout for engine stream - validates env var against defined bounds
     const activityTimeout = (() => {
       const parsed = parseInt(process.env.ENGINE_ACTIVITY_TIMEOUT, 10);
@@ -1442,7 +1492,7 @@ export class ProbeAgent {
           const now = Date.now();
 
           // Check for activity timeout (no data received for too long)
-          if (now - lastActivity > activityTimeout) {
+          if (!disableActivityTimeout && now - lastActivity > activityTimeout) {
             throw new Error(`Engine stream timeout - no activity for ${activityTimeout}ms`);
           }
 
@@ -1516,7 +1566,8 @@ export class ProbeAgent {
     // Get the engine's query result and wrap with timeout handling
     const engineStream = engine.query(prompt, engineOptions);
     return this._createEngineTextStreamResult(
-      engineStream, controller.signal, this.requestTimeout, timeoutState
+      engineStream, controller.signal, this.requestTimeout, timeoutState,
+      this.clientApiProvider === 'codex' && this._requestTimeoutExplicit && this.requestTimeout === 0
     );
   }
 
@@ -2445,8 +2496,10 @@ export class ProbeAgent {
       return this.engine;
     }
 
+    const governedCodex = this.governedCodexProfile !== undefined;
+
     // Try Claude Code engine if requested
-    if (this.clientApiProvider === 'claude-code' || process.env.USE_CLAUDE_CODE === 'true') {
+    if (!governedCodex && (this.clientApiProvider === 'claude-code' || process.env.USE_CLAUDE_CODE === 'true')) {
       try {
         const { createEnhancedClaudeCLIEngine } = await import('./engines/enhanced-claude-code.js');
 
@@ -2477,8 +2530,18 @@ export class ProbeAgent {
     }
 
     // Try Codex CLI engine if requested
-    if (this.clientApiProvider === 'codex' || process.env.USE_CODEX === 'true') {
+    if (governedCodex || this.clientApiProvider === 'codex' || process.env.USE_CODEX === 'true') {
       try {
+        if (governedCodex && this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT) {
+          const { createGovernedCodexExecEngine } = await import('./engines/governed-codex-exec.js');
+          const systemPrompt = await this._getCachedCodexNativeSystemPrompt();
+          this.engine = await createGovernedCodexExecEngine({
+            agent: this, profile: this.governedCodexProfile,
+            codexPath: this.governedCodexBin, codexSha256: this.governedCodexSha256,
+            systemPrompt, timeoutMs: this._requestTimeoutExplicit ? this.requestTimeout : undefined,
+          });
+          return this.engine;
+        }
         const { createCodexEngine } = await import('./engines/codex.js');
 
         // For Codex CLI, use a cleaner system prompt without XML formatting
@@ -2492,6 +2555,7 @@ export class ProbeAgent {
           debug: this.debug,
           allowedTools: this.allowedTools,  // Pass tool filtering configuration
           model: this.model,  // Pass model name (e.g., gpt-5.2, o3, etc.)
+          requestTimeout: this._requestTimeoutExplicit ? this.requestTimeout : undefined,
           governedCodexProfile: this.governedCodexProfile
         });
         if (this.debug) {
@@ -2503,8 +2567,9 @@ export class ProbeAgent {
         return this.engine;
       } catch (error) {
         if (this.governedCodexProfile) {
-          throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
-            null, null, 'acquire');
+          throw this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT
+            ? normalizeGovernedCodexExecFailure(error, 'acquire')
+            : normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null, null, null, 'acquire');
         }
         console.warn('[WARNING] Failed to load Codex CLI engine:', error.message);
         console.warn('[WARNING] Falling back to Vercel AI SDK');
@@ -3335,6 +3400,7 @@ ${extractGuidance2}
     }
     const { prompt } = this._prepareGovernedAnswerPrompt(message, options);
     const systemPrompt = await this._getCachedCodexNativeSystemPrompt();
+    if (this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT) return previewGovernedCodexExecDispatch(prompt, systemPrompt);
     const { previewGovernedCodexInitialDispatch } = await import('./engines/codex.js');
     return previewGovernedCodexInitialDispatch({ systemPrompt, prompt });
   }
@@ -3530,41 +3596,46 @@ Follow these instructions carefully:
     }
 
     let engine, answerFailure = null;
+    const normalizeProviderFailure = (error, boundary) => this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT
+      ? normalizeGovernedCodexExecFailure(error, boundary)
+      : normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null, null, null, boundary);
     try {
       try { engine = await this.getEngine(); }
       catch (error) {
-        throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
-          null, null, 'acquire');
+        throw normalizeProviderFailure(error, 'acquire');
       }
       if (!engine?.query) throw governedAnswerFailure('internal_contract');
       const candidateChunks = [];
       let runtimeAttestation;
+      let candidateBoundary;
       let attestationCount = 0;
       let nativeToolBatch;
       let nativeToolBatchCount = 0;
-      const queryOptions = hasInvocationDigest
-        ? { abortSignal: this._abortController.signal, invocationDigest: invocationDigest }
-        : { abortSignal: this._abortController.signal };
+      const queryOptions = {
+        abortSignal: this._abortController.signal,
+        ...(hasInvocationDigest ? { invocationDigest } : {}),
+        ...(this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT ? {} : { schema }),
+      };
       try {
         for await (const chunk of engine.query(prompt, queryOptions)) {
           if (chunk.type === 'text' && chunk.content) candidateChunks.push(chunk.content);
           else if (chunk.type === 'metadata' && chunk.data?.attestation) {
             runtimeAttestation = chunk.data.attestation;
+            if (chunk.data.candidateBoundary !== undefined) candidateBoundary = projectGovernedCandidateBoundary(chunk.data.candidateBoundary);
             attestationCount++;
           } else if (chunk.type === 'toolBatch') {
             nativeToolBatch = chunk;
             nativeToolBatchCount++;
           } else if (chunk.type === 'error') {
-            throw normalizeGovernedAnswerFailure(chunk.error, 'provider_engine', null, null, null,
-              null, null, 'query');
+            throw normalizeProviderFailure(chunk.error, 'query');
           }
         }
       } catch (error) {
-        throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
-          null, null, 'query');
+        throw normalizeProviderFailure(error, 'query');
       }
       if (hasInvocationDigest) {
-        const expectedAttestation = this.governedCodexProfile?.version === 'probe.governed-codex-profile/v2'
+        const execTransport = this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT;
+        const expectedAttestation = execTransport ? 'probe.governed-codex-exec-attestation/v1' : isGovernedCodexNativeProfile(this.governedCodexProfile)
           ? 'probe.governed-codex-attestation/v3' : 'probe.governed-codex-attestation/v2';
         if (attestationCount !== 1 || runtimeAttestation?.version !== expectedAttestation || runtimeAttestation?.executionContext?.source !== 'caller' || runtimeAttestation?.executionContext?.invocationDigest !== invocationDigest) {
           throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
@@ -3574,7 +3645,10 @@ Follow these instructions carefully:
         throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
           'invocation_attestation');
       }
-      if (this.governedCodexProfile?.version === 'probe.governed-codex-profile/v2') {
+      if (runtimeAttestation?.version === 'probe.governed-codex-exec-attestation/v1') {
+        try { validateGovernedCodexExecAttestation(runtimeAttestation); }
+        catch { throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null, 'invocation_attestation'); }
+      } else if (isGovernedCodexNativeProfile(this.governedCodexProfile)) {
         if (nativeToolBatchCount !== 1 || !Number.isSafeInteger(nativeToolBatch?.total) ||
           !Array.isArray(nativeToolBatch?.tools) || nativeToolBatch.total !== runtimeAttestation?.observed?.nativeTools?.total ||
           JSON.stringify(nativeToolBatch.tools) !== JSON.stringify(runtimeAttestation?.observed?.nativeTools?.tools)) {
@@ -3586,7 +3660,23 @@ Follow these instructions carefully:
         throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
           'native_capability_aggregate');
       }
-      const validation = validateJsonResponse(candidateChunks.join(''), {debug:this.debug,schema});
+      const candidateText = candidateChunks.join('');
+      if (runtimeAttestation?.version === 'probe.governed-codex-exec-attestation/v1') {
+        const candidateDigest = `sha256:${createHash('sha256').update(candidateText, 'utf8').digest('hex')}`;
+        if (runtimeAttestation.observed?.finalDigest !== candidateDigest ||
+            runtimeAttestation.observed?.finalBytes !== Buffer.byteLength(candidateText, 'utf8')) {
+          throw governedAnswerFailure('native_event_grammar', 'live_envelope_session', 'attestation', null,
+            'internal_contract');
+        }
+      }
+      const candidate = Object.freeze({
+        version: 'probe.governed-answer-candidate/v1',
+        text: candidateText,
+        boundary: candidateBoundary || projectGovernedCandidateBoundary(undefined),
+      });
+      try { await this.hooks.emit(HOOK_TYPES.MESSAGE_ASSISTANT, candidate); }
+      catch { /* Candidate observation is not part of parsing or authority. */ }
+      const validation = validateJsonResponse(candidateText, {debug:this.debug,schema});
       if (!validation.isValid) throw governedSchemaResultValidationFailure(validation);
       if (hasResultIdentity) {
         let identified;
@@ -3604,8 +3694,7 @@ Follow these instructions carefully:
       if (engine) {
         try { await engine.close(); }
         catch (error) {
-          if (!answerFailure) throw normalizeGovernedAnswerFailure(error, 'provider_engine', null, null, null,
-            null, null, 'close');
+          if (!answerFailure) throw normalizeProviderFailure(error, 'close');
         }
       }
     }
@@ -3780,8 +3869,9 @@ Follow these instructions carefully:
       const maxIterations = (options._maxIterationsOverride) ? baseMaxIterations : (options.schema ? baseMaxIterations + 4 : baseMaxIterations);
 
       // Check if we're using CLI-based engines which handle their own agentic loop
-      const isClaudeCode = this.clientApiProvider === 'claude-code' || process.env.USE_CLAUDE_CODE === 'true';
-      const isCodex = this.clientApiProvider === 'codex' || process.env.USE_CODEX === 'true';
+      const governedCodex = this.governedCodexProfile !== undefined;
+      const isClaudeCode = !governedCodex && (this.clientApiProvider === 'claude-code' || process.env.USE_CLAUDE_CODE === 'true');
+      const isCodex = governedCodex || this.clientApiProvider === 'codex' || process.env.USE_CODEX === 'true';
 
       if (isClaudeCode) {
         // For Claude Code, bypass the tool loop entirely - it handles its own internal dialogue
@@ -3862,28 +3952,54 @@ Follow these instructions carefully:
         }
 
         // Send the message directly to Codex and collect the response
-        let engine; try {
-          engine = await this.getEngine();
+        let engine;
+        let queryFailure = null;
+        const governedExecTransport = this.governedCodexProfile &&
+          this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT;
+        const normalizeCodexProviderFailure = (error, boundary) => governedExecTransport
+          ? normalizeGovernedCodexExecFailure(error, boundary) : error;
+        try {
+          try {
+            engine = await this.getEngine();
+          } catch (error) {
+            throw normalizeCodexProviderFailure(error, 'acquire');
+          }
           if (engine && engine.query) {
             let assistantResponseContent = '';
             let toolBatch = null;
+            let queryOptions = this.governedCodexProfile
+              ? { ...options, abortSignal: this._abortController.signal }
+              : options;
+            if (this.governedCodexTransport === GOVERNED_CODEX_EXEC_TRANSPORT) {
+              const { schema: requestedSchema, ...withoutSchema } = options;
+              queryOptions = {
+                ...withoutSchema,
+                ...(typeof requestedSchema === 'string' && isJsonSchema(requestedSchema) ? { schema: requestedSchema } : {}),
+                abortSignal: this._abortController.signal,
+              };
+            }
 
             // Query Codex directly with the message and schema
-            for await (const chunk of engine.query(message, this.governedCodexProfile ? { ...options, abortSignal: this._abortController.signal } : options)) {
-              if (chunk.type === 'text' && chunk.content) {
-                assistantResponseContent += chunk.content;
-                if (options.onStream) {
-                  options.onStream(chunk.content);
-                }
-              } else if (chunk.type === 'toolBatch' && chunk.tools) {
-                // Store tool batch for processing after response
-                toolBatch = chunk.tools;
-                if (this.debug) {
-                  console.log(`[DEBUG] Received batch of ${chunk.tools.length} tool events from Codex`);
+            try {
+              for await (const chunk of engine.query(message, this.governedCodexProfile ? queryOptions : options)) {
+                if (chunk.type === 'text' && chunk.content) {
+                  assistantResponseContent += chunk.content;
+                  if (options.onStream) {
+                    options.onStream(chunk.content);
+                  }
+                } else if (chunk.type === 'toolBatch' && chunk.tools) {
+                  // Store tool batch for processing after response
+                  toolBatch = chunk.tools;
+                  if (this.debug) {
+                    console.log(`[DEBUG] Received batch of ${chunk.tools.length} tool events from Codex`);
+                  }
+                } else if (chunk.type === 'error') {
+                  throw normalizeCodexProviderFailure(chunk.error, 'query');
                 }
-              } else if (chunk.type === 'error') {
-                throw chunk.error;
               }
+            } catch (error) {
+              queryFailure = normalizeCodexProviderFailure(error, 'query');
+              throw queryFailure;
             }
 
             // Emit tool events after response is complete (batch mode)
@@ -3921,7 +4037,19 @@ Follow these instructions carefully:
             console.error('[DEBUG] Codex error:', error);
           }
           throw error;
-        } finally { if (this.governedCodexProfile && engine) await engine.close(); }
+        } finally {
+          if (this.governedCodexProfile && engine) {
+            if (!governedExecTransport) {
+              await engine.close();
+            } else {
+              try {
+                await engine.close();
+              } catch (error) {
+                if (!queryFailure) throw normalizeCodexProviderFailure(error, 'close');
+              }
+            }
+          }
+        }
       }
 
       if (this.debug) {
@@ -5492,7 +5620,12 @@ Double-check your response based on the criteria above. If everything looks good
       return finalResult;
 
     } catch (error) {
-      console.error(`[ERROR] ProbeAgent.answer failed:`, error);
+      // Governed failures are already closed and are surfaced to the caller;
+      // logging the Error object here would re-expose provider-owned fields.
+      // Preserve the historical diagnostic for ordinary answer() calls.
+      if (!this.governedCodexProfile) {
+        console.error(`[ERROR] ProbeAgent.answer failed:`, error);
+      }
       
       // Clean up tool execution data
       clearToolExecutionData(this.sessionId);
@@ -5656,6 +5789,7 @@ Double-check your response based on the criteria above. If everything looks good
       cwd: this.cwd, // Preserve explicit working directory
       provider: this.clientApiProvider,
       model: this.clientApiModel,
+      requestTimeout: this._requestTimeoutExplicit ? this.requestTimeout : undefined,
       debug: this.debug,
       outline: this.outline,
       searchDelegate: this.searchDelegate,
@@ -5878,7 +6012,7 @@ Double-check your response based on the criteria above. If everything looks good
       this._abortController.abort();
     }
 
-    if (this.governedCodexProfile && this.engine?.close) await this.engine.close();
+    if (this.engine?.close) await this.engine.close();
 
     // Clean up MCP bridge
     if (this.mcpBridge) {

package/build/agent/acp/tools.js

@@ -322,7 +322,7 @@ export class ACPToolManager {
             },
             language: {
               type: 'string',
-              description: 'Programming language to search in (rust, javascript, python, go, crystal, etc.)'
+              description: 'Programming language to search in (rust, javascript, python, go, bash, qml, crystal, solidity, haskell, etc.)'
             },
             max_results: {
               type: 'number',