@rallycry/conveyor-agent 11.0.11 → 11.0.12

package/dist/{chunk-PGNV3DGV.js → chunk-ZNRF5EFU.js}

@@ -346,7 +346,7 @@ var projectCheckpointSettingsSchema = z.object({
     }
   }
 });
-var TUI_KINDS = ["claude-code", "opencode"];
+var TUI_KINDS = ["claude-code", "opencode", "codex"];
 var ACHIEVEMENT_RARITIES = [
   {
     key: "common",
@@ -2639,8 +2639,8 @@ var ClaudeCodeHarness = class {
 
 // src/harness/pty/session.ts
 import { randomUUID } from "crypto";
-import { mkdtemp, mkdir as mkdir3, rm as rm2, writeFile as writeFile5 } from "fs/promises";
-import { join as join6, dirname } from "path";
+import { mkdtemp, mkdir as mkdir3, rm as rm2, writeFile as writeFile6 } from "fs/promises";
+import { join as join7, dirname } from "path";
 
 // src/harness/opencode/plugin.ts
 import { writeFile } from "fs/promises";
@@ -2963,150 +2963,64 @@ function describeSessionError(event) {
   return `opencode reported a session error: ${JSON.stringify(event.properties ?? {}).slice(0, 300)}`;
 }
 
-// src/harness/pty/event-queue.ts
-var AsyncEventQueue = class {
-  items = [];
-  closed = false;
-  wake = null;
-  push(item) {
-    if (this.closed) return;
-    this.items.push(item);
-    this.signal();
-  }
-  close() {
-    this.closed = true;
-    this.signal();
-  }
-  get isClosed() {
-    return this.closed;
-  }
-  signal() {
-    const wake = this.wake;
-    if (wake) {
-      this.wake = null;
-      wake();
-    }
-  }
-  async *drain() {
-    while (!this.closed || this.items.length > 0) {
-      if (this.items.length > 0) {
-        const item = this.items.shift();
-        if (item !== void 0) yield item;
-        continue;
-      }
-      await new Promise((resolve) => {
-        this.wake = resolve;
-      });
-    }
-  }
-};
-
-// src/harness/pty/hook-socket.ts
-import { createServer } from "net";
-import { unlink } from "fs/promises";
-function parseEnvelope(line) {
-  let parsed;
-  try {
-    parsed = JSON.parse(line);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const record = parsed;
-  if (record.kind === "pre_tool_use") {
-    if (typeof record.id !== "string" || typeof record.tool_name !== "string") return null;
-    const toolInput = typeof record.tool_input === "object" && record.tool_input !== null ? record.tool_input : {};
-    return {
-      kind: "pre_tool_use",
-      request: { id: record.id, tool_name: record.tool_name, tool_input: toolInput }
-    };
-  }
-  const result = {};
-  if (typeof record.tool_name === "string") result.tool_name = record.tool_name;
-  if (typeof record.elapsed_time_seconds === "number") {
-    result.elapsed_time_seconds = record.elapsed_time_seconds;
-  }
-  return { kind: "progress", progress: result };
+// src/execution/redactor.ts
+var REDACTED = "<redacted>";
+var BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9_\-.]{20,}/g;
+var VENDOR_KEY_RE = /\b(?:sk-[a-zA-Z0-9_-]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|xoxb-[A-Za-z0-9-]+|xai-[A-Za-z0-9-]{20,})\b/g;
+var AWS_ACCESS_KEY_RE = /\bAKIA[0-9A-Z]{16}\b/g;
+var JWT_RE = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
+var ENV_SECRET_RE = /^(\s*(?:export\s+)?([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|CREDENTIAL|CREDENTIALS)[A-Z0-9_]*)\s*=\s*)['"]?([^\s'"]+)['"]?/gm;
+var COOKIE_HEADER_RE = /(Cookie:\s*)[^\r\n]+/gi;
+var BASIC_AUTH_URL_RE = /(https?:\/\/)([^:@\s/]+):([^@\s]+)@/g;
+var AWS_SECRET_LINE_RE = /^.*(?:secret|aws_secret).*$/gim;
+var AWS_SECRET_VALUE_RE = /\b([A-Za-z0-9/+=]{40})\b/g;
+var SYSTEM_REMINDER_RE = /<system-reminder>[\s\S]*?<\/system-reminder>/gi;
+function redact(input) {
+  if (!input) return { output: input, redacted: 0 };
+  let count = 0;
+  let output = input;
+  output = output.replace(SYSTEM_REMINDER_RE, () => {
+    count++;
+    return "<!-- stripped injection -->";
+  });
+  output = output.replace(BEARER_RE, (_match, prefix) => {
+    count++;
+    return `${prefix}${REDACTED}`;
+  });
+  output = output.replace(VENDOR_KEY_RE, () => {
+    count++;
+    return REDACTED;
+  });
+  output = output.replace(AWS_ACCESS_KEY_RE, () => {
+    count++;
+    return REDACTED;
+  });
+  output = output.replace(JWT_RE, () => {
+    count++;
+    return REDACTED;
+  });
+  output = output.replace(
+    AWS_SECRET_LINE_RE,
+    (line) => line.replace(AWS_SECRET_VALUE_RE, (match) => {
+      if (/^[a-f0-9]+$/i.test(match)) return match;
+      count++;
+      return REDACTED;
+    })
+  );
+  output = output.replace(ENV_SECRET_RE, (_match, prefix, _key, _value) => {
+    count++;
+    return `${prefix}${REDACTED}`;
+  });
+  output = output.replace(COOKIE_HEADER_RE, (_match, prefix) => {
+    count++;
+    return `${prefix}${REDACTED}`;
+  });
+  output = output.replace(BASIC_AUTH_URL_RE, (_match, scheme, user) => {
+    count++;
+    return `${scheme}${user}:${REDACTED}@`;
+  });
+  return { output, redacted: count };
 }
-var HookSocketServer = class {
-  constructor(socketPath, onProgress, onPreToolUse) {
-    this.socketPath = socketPath;
-    this.onProgress = onProgress;
-    this.onPreToolUse = onPreToolUse;
-  }
-  socketPath;
-  onProgress;
-  onPreToolUse;
-  server = null;
-  _closed = false;
-  async listen() {
-    await unlink(this.socketPath).catch(() => void 0);
-    await new Promise((resolve, reject) => {
-      const server = createServer((socket) => this.handleConnection(socket));
-      server.on("error", reject);
-      server.listen(this.socketPath, () => {
-        resolve();
-      });
-      this.server = server;
-    });
-  }
-  get isClosed() {
-    return this._closed;
-  }
-  async close() {
-    if (this._closed) return;
-    this._closed = true;
-    const server = this.server;
-    this.server = null;
-    if (server) {
-      await new Promise((resolve) => {
-        server.close(() => {
-          resolve();
-        });
-      });
-    }
-    await unlink(this.socketPath).catch(() => void 0);
-  }
-  handleConnection(socket) {
-    socket.on("error", () => void 0);
-    let buffer = "";
-    socket.on("data", (chunk) => {
-      buffer += chunk.toString("utf8");
-      let index = buffer.indexOf("\n");
-      while (index >= 0) {
-        const line = buffer.slice(0, index);
-        buffer = buffer.slice(index + 1);
-        this.dispatch(line, socket);
-        index = buffer.indexOf("\n");
-      }
-    });
-  }
-  dispatch(line, socket) {
-    const envelope = parseEnvelope(line);
-    if (!envelope) return;
-    if (envelope.kind === "progress") {
-      this.onProgress(envelope.progress);
-      return;
-    }
-    void this.respondToPreToolUse(envelope.request, socket);
-  }
-  async respondToPreToolUse(request, socket) {
-    let verdict;
-    try {
-      verdict = this.onPreToolUse ? await this.onPreToolUse(request) : { decision: "allow" };
-    } catch (err) {
-      verdict = {
-        decision: "deny",
-        reason: `Conveyor validation failed: ${err instanceof Error ? err.message : String(err)}. Fix the issue and try again.`
-      };
-    }
-    try {
-      socket.write(`${JSON.stringify({ id: request.id, ...verdict })}
-`);
-    } catch {
-    }
-  }
-};
 
 // src/harness/pty/jsonl-tailer.ts
 import { open } from "fs/promises";
@@ -3277,56 +3191,368 @@ var JsonlTailer = class {
       this.timer = null;
     }
   }
-  /** Read any remaining bytes and flush a trailing line without a newline. */
-  async flush() {
-    await this.enqueueRead();
-    if (this.buffer.length > 0) {
-      this.emitLine(this.buffer);
-      this.buffer = "";
+  /** Read any remaining bytes and flush a trailing line without a newline. */
+  async flush() {
+    await this.enqueueRead();
+    if (this.buffer.length > 0) {
+      this.emitLine(this.buffer);
+      this.buffer = "";
+    }
+  }
+  enqueueRead() {
+    this.chain = this.chain.then(() => this.readOnce());
+    return this.chain;
+  }
+  async readOnce() {
+    let handle = null;
+    try {
+      handle = await open(this.path, "r");
+      const stats = await handle.stat();
+      if (stats.size <= this.offset) return;
+      const length = stats.size - this.offset;
+      const buf = Buffer.alloc(length);
+      await handle.read(buf, 0, length, this.offset);
+      this.offset = stats.size;
+      this.consume(buf.toString("utf8"));
+    } catch {
+    } finally {
+      if (handle) await handle.close();
+    }
+  }
+  consume(chunk) {
+    this.buffer += chunk;
+    let index = this.buffer.indexOf("\n");
+    while (index >= 0) {
+      const line = this.buffer.slice(0, index);
+      this.buffer = this.buffer.slice(index + 1);
+      this.emitLine(line);
+      index = this.buffer.indexOf("\n");
+    }
+  }
+  emitLine(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) return;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      return;
+    }
+    this.onRawRecord?.(parsed);
+    const event = this.mapRecord(parsed);
+    if (event) this.onEvent(event);
+  }
+};
+
+// src/harness/codex/event-source.ts
+var CodexEventSource = class {
+  constructor(emit, onSession, chat) {
+    this.emit = emit;
+    this.onSession = onSession;
+    this.chat = chat;
+  }
+  emit;
+  onSession;
+  chat;
+  sessionId = null;
+  completed = /* @__PURE__ */ new Set();
+  transcript = null;
+  handleRecord(raw) {
+    if (!raw || typeof raw !== "object") return;
+    const e = raw;
+    const id = e.session_id ?? e["thread-id"];
+    if (typeof id !== "string") return;
+    if (!this.sessionId) {
+      this.sessionId = id;
+      this.onSession(id);
+    }
+    if (id !== this.sessionId) return;
+    if (e.hook_event_name === "SessionStart") this.watchTranscript(e);
+    if (e.type === "agent-turn-complete") {
+      this.finish(e);
+      return;
+    }
+    if (e.hook_event_name === "UserPromptSubmit") {
+      this.emit({ type: "tool_progress", tool_name: "Codex", elapsed_time_seconds: 0 });
+      if (typeof e.prompt === "string")
+        this.chat({ kind: "user_text", text: e.prompt.slice(0, 16e3) });
+    } else if (e.hook_event_name === "PreToolUse") {
+      this.toolStarted(e);
+    } else if (e.hook_event_name === "PostToolUse") {
+      this.emit({
+        type: "tool_progress",
+        tool_name: String(e.tool_name ?? "tool"),
+        elapsed_time_seconds: 0
+      });
+    } else if (e.hook_event_name === "Interrupt") {
+      this.emit({ type: "result", subtype: "error", errors: ["Codex turn interrupted"] });
+      this.chat({ kind: "turn_end" });
+    }
+  }
+  async close() {
+    this.transcript?.close();
+    await this.transcript?.flush();
+    this.transcript = null;
+  }
+  watchTranscript(e) {
+    if (this.transcript || typeof e.transcript_path !== "string" || typeof e.transcript_offset !== "number" || e.transcript_offset < 0)
+      return;
+    this.transcript = new JsonlTailer(
+      e.transcript_path,
+      () => void 0,
+      (raw) => this.handleTranscriptRecord(raw),
+      () => null
+    );
+    this.transcript.start(e.transcript_offset);
+  }
+  handleTranscriptRecord(raw) {
+    if (!raw || typeof raw !== "object") return;
+    const record = raw;
+    if (record.type !== "event_msg" || !record.payload || typeof record.payload !== "object")
+      return;
+    const event = record.payload;
+    if (event.type !== "task_complete" || !event.error || typeof event.error !== "object") return;
+    const turn = event.turn_id;
+    if (typeof turn !== "string" || this.completed.has(turn)) return;
+    this.rememberTurn(turn);
+    const error = event.error;
+    this.emit({
+      type: "result",
+      subtype: "error",
+      errors: [redact(String(error.message ?? "Codex turn failed")).output]
+    });
+    this.chat({ kind: "turn_end" });
+  }
+  rememberTurn(turn) {
+    this.completed.add(turn);
+    const oldest = this.completed.values().next().value;
+    if (this.completed.size > 200 && oldest) this.completed.delete(oldest);
+  }
+  toolStarted(e) {
+    const name = typeof e.tool_name === "string" ? e.tool_name : "tool";
+    const id = typeof e.tool_use_id === "string" ? e.tool_use_id : "";
+    this.emit({
+      type: "assistant",
+      message: {
+        role: "assistant",
+        content: [{ type: "tool_use", id, name, input: e.tool_input }]
+      }
+    });
+    this.chat({
+      kind: "tool_use",
+      name,
+      id,
+      input: redact(JSON.stringify(e.tool_input ?? {})).output.slice(0, 1900)
+    });
+  }
+  finish(e) {
+    const turn = e["turn-id"];
+    if (typeof turn !== "string" || this.completed.has(turn)) return;
+    this.rememberTurn(turn);
+    const text = typeof e["last-assistant-message"] === "string" ? e["last-assistant-message"] : "";
+    if (text) {
+      this.emit({
+        type: "assistant",
+        message: { role: "assistant", content: [{ type: "text", text }] }
+      });
+      this.chat({ kind: "assistant_text", text: text.slice(0, 16e3) });
+    }
+    this.emit({ type: "result", subtype: "success", result: text, total_cost_usd: 0 });
+    this.chat({ kind: "turn_end" });
+  }
+};
+
+// src/harness/codex/config.ts
+import { writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+function tomlValue(value) {
+  if (Array.isArray(value)) return `[${value.map(tomlValue).join(", ")}]`;
+  if (value && typeof value === "object") {
+    return `{ ${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)} = ${tomlValue(v)}`).join(", ")} }`;
+  }
+  return JSON.stringify(value);
+}
+function codexMcpConfig(entries) {
+  return Object.fromEntries(
+    Object.entries(entries).map(([name, entry]) => [
+      name,
+      entry.type === "http" ? { url: entry.url, http_headers: entry.headers, tool_timeout_sec: 600 } : { command: entry.command, args: entry.args ?? [], env: entry.env ?? {} }
+    ])
+  );
+}
+async function stageCodexEvents(dir) {
+  const pluginPath = join2(dir, "codex-events.cjs");
+  const eventsSinkPath = join2(dir, "codex-events.ndjson");
+  await writeFile2(eventsSinkPath, "", { mode: 384 });
+  await writeFile2(
+    pluginPath,
+    `const fs = require('node:fs');
+const input = process.argv[3] || fs.readFileSync(0, 'utf8');
+const event = JSON.parse(input);
+if (event.hook_event_name === 'SessionStart' && event.transcript_path) {
+  try { event.transcript_offset = fs.statSync(event.transcript_path).size; }
+  catch { event.transcript_offset = 0; }
+}
+fs.appendFileSync(process.argv[2], JSON.stringify(event) + '\\n');
+process.stdout.write('{}');
+`,
+    { mode: 384 }
+  );
+  return { pluginPath, eventsSinkPath };
+}
+function codexHookConfig(script, sink) {
+  const quote = (s) => `'${s.replaceAll("'", "'\\''")}'`;
+  const command = `node ${quote(script)} ${quote(sink)}`;
+  return Object.fromEntries(
+    ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Interrupt"].map((event) => [
+      event,
+      [{ hooks: [{ type: "command", command, timeout: 3 }] }]
+    ])
+  );
+}
+
+// src/harness/pty/event-queue.ts
+var AsyncEventQueue = class {
+  items = [];
+  closed = false;
+  wake = null;
+  push(item) {
+    if (this.closed) return;
+    this.items.push(item);
+    this.signal();
+  }
+  close() {
+    this.closed = true;
+    this.signal();
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  signal() {
+    const wake = this.wake;
+    if (wake) {
+      this.wake = null;
+      wake();
+    }
+  }
+  async *drain() {
+    while (!this.closed || this.items.length > 0) {
+      if (this.items.length > 0) {
+        const item = this.items.shift();
+        if (item !== void 0) yield item;
+        continue;
+      }
+      await new Promise((resolve) => {
+        this.wake = resolve;
+      });
+    }
+  }
+};
+
+// src/harness/pty/hook-socket.ts
+import { createServer } from "net";
+import { unlink } from "fs/promises";
+function parseEnvelope(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const record = parsed;
+  if (record.kind === "pre_tool_use") {
+    if (typeof record.id !== "string" || typeof record.tool_name !== "string") return null;
+    const toolInput = typeof record.tool_input === "object" && record.tool_input !== null ? record.tool_input : {};
+    return {
+      kind: "pre_tool_use",
+      request: { id: record.id, tool_name: record.tool_name, tool_input: toolInput }
+    };
+  }
+  const result = {};
+  if (typeof record.tool_name === "string") result.tool_name = record.tool_name;
+  if (typeof record.elapsed_time_seconds === "number") {
+    result.elapsed_time_seconds = record.elapsed_time_seconds;
+  }
+  return { kind: "progress", progress: result };
+}
+var HookSocketServer = class {
+  constructor(socketPath, onProgress, onPreToolUse) {
+    this.socketPath = socketPath;
+    this.onProgress = onProgress;
+    this.onPreToolUse = onPreToolUse;
+  }
+  socketPath;
+  onProgress;
+  onPreToolUse;
+  server = null;
+  _closed = false;
+  async listen() {
+    await unlink(this.socketPath).catch(() => void 0);
+    await new Promise((resolve, reject) => {
+      const server = createServer((socket) => this.handleConnection(socket));
+      server.on("error", reject);
+      server.listen(this.socketPath, () => {
+        resolve();
+      });
+      this.server = server;
+    });
+  }
+  get isClosed() {
+    return this._closed;
+  }
+  async close() {
+    if (this._closed) return;
+    this._closed = true;
+    const server = this.server;
+    this.server = null;
+    if (server) {
+      await new Promise((resolve) => {
+        server.close(() => {
+          resolve();
+        });
+      });
     }
+    await unlink(this.socketPath).catch(() => void 0);
   }
-  enqueueRead() {
-    this.chain = this.chain.then(() => this.readOnce());
-    return this.chain;
+  handleConnection(socket) {
+    socket.on("error", () => void 0);
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      let index = buffer.indexOf("\n");
+      while (index >= 0) {
+        const line = buffer.slice(0, index);
+        buffer = buffer.slice(index + 1);
+        this.dispatch(line, socket);
+        index = buffer.indexOf("\n");
+      }
+    });
   }
-  async readOnce() {
-    let handle = null;
-    try {
-      handle = await open(this.path, "r");
-      const stats = await handle.stat();
-      if (stats.size <= this.offset) return;
-      const length = stats.size - this.offset;
-      const buf = Buffer.alloc(length);
-      await handle.read(buf, 0, length, this.offset);
-      this.offset = stats.size;
-      this.consume(buf.toString("utf8"));
-    } catch {
-    } finally {
-      if (handle) await handle.close();
+  dispatch(line, socket) {
+    const envelope = parseEnvelope(line);
+    if (!envelope) return;
+    if (envelope.kind === "progress") {
+      this.onProgress(envelope.progress);
+      return;
     }
+    void this.respondToPreToolUse(envelope.request, socket);
   }
-  consume(chunk) {
-    this.buffer += chunk;
-    let index = this.buffer.indexOf("\n");
-    while (index >= 0) {
-      const line = this.buffer.slice(0, index);
-      this.buffer = this.buffer.slice(index + 1);
-      this.emitLine(line);
-      index = this.buffer.indexOf("\n");
+  async respondToPreToolUse(request, socket) {
+    let verdict;
+    try {
+      verdict = this.onPreToolUse ? await this.onPreToolUse(request) : { decision: "allow" };
+    } catch (err) {
+      verdict = {
+        decision: "deny",
+        reason: `Conveyor validation failed: ${err instanceof Error ? err.message : String(err)}. Fix the issue and try again.`
+      };
     }
-  }
-  emitLine(line) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) return;
-    let parsed;
     try {
-      parsed = JSON.parse(trimmed);
+      socket.write(`${JSON.stringify({ id: request.id, ...verdict })}
+`);
     } catch {
-      return;
     }
-    this.onRawRecord?.(parsed);
-    const event = this.mapRecord(parsed);
-    if (event) this.onEvent(event);
   }
 };
 
@@ -3518,17 +3744,17 @@ function mapChatRecords(raw) {
 }
 
 // src/harness/pty/settings.ts
-import { mkdir, writeFile as writeFile2, chmod } from "fs/promises";
+import { mkdir, writeFile as writeFile3, chmod } from "fs/promises";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function claudeConfigHome() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join3(homedir(), ".claude");
 }
 function projectSlug(cwd) {
   return cwd.replace(/\//g, "-");
 }
 function sessionTranscriptPath(cwd, sessionId) {
-  return join2(claudeConfigHome(), "projects", projectSlug(cwd), `${sessionId}.jsonl`);
+  return join3(claudeConfigHome(), "projects", projectSlug(cwd), `${sessionId}.jsonl`);
 }
 var ALLOW_RULES = [
   "Bash",
@@ -3731,10 +3957,10 @@ function buildPreToolUseHooks(helperPath, gateAllTools) {
   ];
 }
 async function writeHookSettings(dir, opts = {}) {
-  const helperPath = join2(dir, "hook-helper.cjs");
-  const settingsPath = join2(dir, "settings.json");
+  const helperPath = join3(dir, "hook-helper.cjs");
+  const settingsPath = join3(dir, "settings.json");
   await mkdir(dir, { recursive: true });
-  await writeFile2(helperPath, HOOK_HELPER_SOURCE, "utf8");
+  await writeFile3(helperPath, HOOK_HELPER_SOURCE, "utf8");
   await chmod(helperPath, 493);
   const settings = {
     // Pre-accept Claude Code's "Bypass Permissions mode" disclaimer. Build-capable
@@ -3771,69 +3997,10 @@ async function writeHookSettings(dir, opts = {}) {
       ]
     }
   };
-  await writeFile2(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+  await writeFile3(settingsPath, JSON.stringify(settings, null, 2), "utf8");
   return { settingsPath, helperPath };
 }
 
-// src/execution/redactor.ts
-var REDACTED = "<redacted>";
-var BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9_\-.]{20,}/g;
-var VENDOR_KEY_RE = /\b(?:sk-[a-zA-Z0-9_-]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|xoxb-[A-Za-z0-9-]+|xai-[A-Za-z0-9-]{20,})\b/g;
-var AWS_ACCESS_KEY_RE = /\bAKIA[0-9A-Z]{16}\b/g;
-var JWT_RE = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
-var ENV_SECRET_RE = /^(\s*(?:export\s+)?([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASS|CREDENTIAL|CREDENTIALS)[A-Z0-9_]*)\s*=\s*)['"]?([^\s'"]+)['"]?/gm;
-var COOKIE_HEADER_RE = /(Cookie:\s*)[^\r\n]+/gi;
-var BASIC_AUTH_URL_RE = /(https?:\/\/)([^:@\s/]+):([^@\s]+)@/g;
-var AWS_SECRET_LINE_RE = /^.*(?:secret|aws_secret).*$/gim;
-var AWS_SECRET_VALUE_RE = /\b([A-Za-z0-9/+=]{40})\b/g;
-var SYSTEM_REMINDER_RE = /<system-reminder>[\s\S]*?<\/system-reminder>/gi;
-function redact(input) {
-  if (!input) return { output: input, redacted: 0 };
-  let count = 0;
-  let output = input;
-  output = output.replace(SYSTEM_REMINDER_RE, () => {
-    count++;
-    return "<!-- stripped injection -->";
-  });
-  output = output.replace(BEARER_RE, (_match, prefix) => {
-    count++;
-    return `${prefix}${REDACTED}`;
-  });
-  output = output.replace(VENDOR_KEY_RE, () => {
-    count++;
-    return REDACTED;
-  });
-  output = output.replace(AWS_ACCESS_KEY_RE, () => {
-    count++;
-    return REDACTED;
-  });
-  output = output.replace(JWT_RE, () => {
-    count++;
-    return REDACTED;
-  });
-  output = output.replace(
-    AWS_SECRET_LINE_RE,
-    (line) => line.replace(AWS_SECRET_VALUE_RE, (match) => {
-      if (/^[a-f0-9]+$/i.test(match)) return match;
-      count++;
-      return REDACTED;
-    })
-  );
-  output = output.replace(ENV_SECRET_RE, (_match, prefix, _key, _value) => {
-    count++;
-    return `${prefix}${REDACTED}`;
-  });
-  output = output.replace(COOKIE_HEADER_RE, (_match, prefix) => {
-    count++;
-    return `${prefix}${REDACTED}`;
-  });
-  output = output.replace(BASIC_AUTH_URL_RE, (_match, scheme, user) => {
-    count++;
-    return `${scheme}${user}:${REDACTED}@`;
-  });
-  return { output, redacted: count };
-}
-
 // src/harness/pty/output-coalescer.ts
 var DEFAULT_FLUSH_MS = 40;
 var DEFAULT_MAX_BUFFER_CHARS = 48 * 1024;
@@ -3889,8 +4056,8 @@ var PtyOutputCoalescer = class {
 // src/harness/pty/tool-server.ts
 import { createServer as createServer2 } from "http";
 import { z as z12 } from "zod";
-import { writeFile as writeFile3 } from "fs/promises";
-import { join as join3 } from "path";
+import { writeFile as writeFile4 } from "fs/promises";
+import { join as join4 } from "path";
 import { randomBytes } from "crypto";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -4081,21 +4248,21 @@ async function startToolServers(mcpServers, tempDir) {
     config[name] = { type: "http", url, headers: { Authorization: `Bearer ${token}` } };
   }
   if (Object.keys(config).length === 0) return { servers, mcpConfigPath: null, entries: config };
-  const mcpConfigPath = join3(tempDir, "mcp-config.json");
-  await writeFile3(mcpConfigPath, JSON.stringify({ mcpServers: config }, null, 2), "utf8");
+  const mcpConfigPath = join4(tempDir, "mcp-config.json");
+  await writeFile4(mcpConfigPath, JSON.stringify({ mcpServers: config }, null, 2), "utf8");
   return { servers, mcpConfigPath, entries: config };
 }
 
 // src/harness/pty/credentials.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile, rm, writeFile as writeFile4 } from "fs/promises";
+import { chmod as chmod2, mkdir as mkdir2, readFile, rm, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/harness/pty/credentials-marker.ts
 import { createHash } from "crypto";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function conveyorCredentialsMarkerPath() {
-  return join4(claudeConfigHome(), ".conveyor-credentials.json");
+  return join5(claudeConfigHome(), ".conveyor-credentials.json");
 }
 function tokenFingerprint(accessToken) {
   return createHash("sha256").update(accessToken).digest("hex");
@@ -4291,7 +4458,7 @@ function planCredentialsWrite(input) {
 
 // src/harness/pty/credentials.ts
 function claudeCredentialsPath() {
-  return join5(claudeConfigHome(), ".credentials.json");
+  return join6(claudeConfigHome(), ".credentials.json");
 }
 function isConveyorCloudEnv(env = process.env) {
   return Boolean(env.CLAUDESPACE_NAME || env.CODESPACE_NAME || env.CODESPACES);
@@ -4341,7 +4508,7 @@ async function writeWithReadBackRetry(io, contents, delaysMs = READ_BACK_DELAYS_
 }
 function fsWriteIo(path, mode) {
   return {
-    write: (contents) => writeFile4(path, contents, mode === void 0 ? "utf8" : { encoding: "utf8", mode }),
+    write: (contents) => writeFile5(path, contents, mode === void 0 ? "utf8" : { encoding: "utf8", mode }),
     read: () => readRaw(path)
   };
 }
@@ -4421,7 +4588,7 @@ async function sanitizeApprovedApiKeys(oauthToken) {
 }
 function claudeJsonPath() {
   const configDir = process.env.CLAUDE_CONFIG_DIR;
-  return configDir ? join5(configDir, ".claude.json") : join5(homedir2(), ".claude.json");
+  return configDir ? join6(configDir, ".claude.json") : join6(homedir2(), ".claude.json");
 }
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
@@ -4514,7 +4681,7 @@ function planClaudeJsonSeed(existingRaw, trustCwd, oauthIdentity) {
   return changed ? JSON.stringify(config) : null;
 }
 function conveyorOauthMarkerPath() {
-  return join5(claudeConfigHome(), "conveyor-oauth-account.json");
+  return join6(claudeConfigHome(), "conveyor-oauth-account.json");
 }
 function parseOauthIdentity(raw) {
   if (!raw || raw.trim() === "") return null;
@@ -4754,6 +4921,10 @@ var PtySession = class {
   // start from the constructor args (turn 1) and are replaced by beginTurn.
   turnPrompt;
   turn;
+  codexPromptInArgv = false;
+  codexInitialPrompt;
+  codexSource = null;
+  adapterCleanupPaths = [];
   onIdle(listener) {
     this.idleListeners.push(listener);
   }
@@ -4817,6 +4988,10 @@ var PtySession = class {
   get reportedSessionId() {
     return this.reportedOpenCodeId;
   }
+  /** Conveyor's logical conversation, distinct from a native runner's session id. */
+  get lineageId() {
+    return this.options.sessionId;
+  }
   /** Fingerprint of the spawn-time options a reused process cannot change. */
   get spawnFingerprint() {
     return this.adapter.spawnFingerprint({
@@ -4960,7 +5135,21 @@ var PtySession = class {
       this.abortHandler = null;
     }
   }
+  async collectCodexPrompt() {
+    if (this.adapter.id === "codex" && typeof this.turnPrompt !== "string") {
+      const stream = this.turnPrompt;
+      const first = await stream.next();
+      if (first.done) return;
+      const content = first.value.message.content;
+      this.codexInitialPrompt = typeof content === "string" ? content : renderPromptContentText(content);
+      this.turnPrompt = (async function* () {
+        yield first.value;
+        yield* stream;
+      })();
+    }
+  }
   async start() {
+    await this.collectCodexPrompt();
     const sessionId = this.resume ?? this.options.sessionId;
     if (!sessionId) {
       throw new Error("PtySession requires options.sessionId or a resume target");
@@ -4973,14 +5162,17 @@ var PtySession = class {
       return;
     }
     try {
-      if (this.adapter.capabilities.structuredEvents && this.adapter.id === "opencode") {
+      if (this.adapter.id === "codex") {
+        const extras = await this.startCodexEventSources();
+        await this.spawn(void 0, void 0, extras);
+      } else if (this.adapter.capabilities.structuredEvents && this.adapter.id === "opencode") {
         const extras = await this.startOpenCodeEventSources();
         await this.spawn(void 0, void 0, extras);
       } else if (this.adapter.capabilities.structuredEvents) {
         const { settingsPath, socketPath } = await this.startStructuredEventSources(sessionId);
         await this.spawn(settingsPath, socketPath);
       } else {
-        this.tempDir = await mkdtemp(join6(sessionTempBase(), "conveyor-pty-"));
+        this.tempDir = await mkdtemp(join7(sessionTempBase(), "conveyor-pty-"));
         await this.spawn();
         this.pushEvent({
           type: "system",
@@ -5024,8 +5216,41 @@ var PtySession = class {
    * synthetic `system init` reports the opencode-assigned session id the
    * moment it is known, which is how the runner learns the resume target.
    */
+  async startCodexEventSources() {
+    this.tempDir = await mkdtemp(join7(sessionTempBase(), "conveyor-codex-"));
+    const { servers, entries } = await startToolServers(
+      this.options.mcpServers ?? {},
+      this.tempDir
+    );
+    this.toolServers = servers;
+    const extras = await stageCodexEvents(this.tempDir);
+    const source = new CodexEventSource(
+      (event) => this.handleTranscriptEvent(event),
+      (id) => {
+        this.reportedOpenCodeId = id;
+        this.adapter.recordSessionId?.(id, this.options);
+        this.pushEvent({
+          type: "system",
+          subtype: "init",
+          session_id: id,
+          model: this.options.model
+        });
+        this.sendChatEvent({ kind: "init", model: this.options.model, claudeSessionId: id });
+      },
+      (event) => this.sendChatEvent(event)
+    );
+    this.codexSource = source;
+    this.tailer = new JsonlTailer(
+      extras.eventsSinkPath,
+      () => void 0,
+      (raw) => source.handleRecord(raw),
+      () => null
+    );
+    this.tailer.start(0);
+    return { ...extras, mcpEntries: entries };
+  }
   async startOpenCodeEventSources() {
-    this.tempDir = await mkdtemp(join6(sessionTempBase(), "conveyor-pty-"));
+    this.tempDir = await mkdtemp(join7(sessionTempBase(), "conveyor-pty-"));
     const { servers, entries } = await startToolServers(
       this.options.mcpServers ?? {},
       this.tempDir
@@ -5035,8 +5260,8 @@ var PtySession = class {
     let instructionsPath;
     const systemPrompt = this.options.appendSystemPrompt;
     if (systemPrompt && systemPrompt.trim() !== "") {
-      instructionsPath = join6(this.tempDir, "conveyor-instructions.md");
-      await writeFile5(instructionsPath, systemPrompt, "utf8");
+      instructionsPath = join7(this.tempDir, "conveyor-instructions.md");
+      await writeFile6(instructionsPath, systemPrompt, "utf8");
     }
     this.opencodeSource = new OpenCodeEventSource(
       (event) => this.handleTranscriptEvent(event),
@@ -5074,8 +5299,8 @@ var PtySession = class {
    * paths spawn() must wire into the child's argv/env.
    */
   async startStructuredEventSources(sessionId) {
-    this.tempDir = await mkdtemp(join6(sessionTempBase(), "conveyor-pty-"));
-    const socketPath = join6(this.tempDir, "hook.sock");
+    this.tempDir = await mkdtemp(join7(sessionTempBase(), "conveyor-pty-"));
+    const socketPath = join7(this.tempDir, "hook.sock");
     this.socket = new HookSocketServer(
       socketPath,
       (progress) => this.handleProgress(progress),
@@ -5246,8 +5471,7 @@ var PtySession = class {
     if (pty) killPtyWithEscalation(pty, () => this.exited);
     this.coalescer?.dispose();
     this.coalescer = null;
-    this.tailer?.close();
-    this.tailer = null;
+    await this.stopEventSources();
     if (this.socket) {
       await this.socket.close();
       this.socket = null;
@@ -5262,11 +5486,19 @@ var PtySession = class {
     this.mcpConfigPath = null;
     this.activeQueue?.close();
     this.activeQueue = null;
+    for (const path of this.adapterCleanupPaths) await rm2(path, { force: true });
+    this.adapterCleanupPaths = [];
     if (this.tempDir) {
       await rm2(this.tempDir, { recursive: true, force: true });
       this.tempDir = "";
     }
   }
+  async stopEventSources() {
+    this.tailer?.close();
+    this.tailer = null;
+    await this.codexSource?.close();
+    this.codexSource = null;
+  }
   /**
    * Serve the harness's in-process tools to the spawned CLI over loopback HTTP
    * (handlers run in THIS process against the live task-token connection) and
@@ -5283,8 +5515,11 @@ var PtySession = class {
   }
   async spawn(settingsPath, socketPath, opencodeExtras) {
     const resume = this.reportedOpenCodeId ?? this.resume;
+    const initialPrompt = this.adapter.id === "codex" && this.turn.promptDelivery !== "prefill" && (typeof this.turnPrompt === "string" || this.codexInitialPrompt !== void 0) ? this.codexInitialPrompt ?? this.turnPrompt : void 0;
+    this.codexPromptInArgv = Boolean(initialPrompt);
     const spec = this.adapter.buildSpawn({
       options: this.options,
+      ...initialPrompt ? { initialPrompt } : {},
       ...resume ? { resume } : {},
       ...settingsPath ? { settingsPath } : {},
       ...socketPath ? { hookSocketPath: socketPath } : {},
@@ -5295,6 +5530,7 @@ var PtySession = class {
       ...opencodeExtras ?? {}
     });
     const spawn2 = await resolvePtySpawn();
+    this.adapterCleanupPaths = spec.cleanupPaths ?? [];
     const pty = spawn2(spec.file, spec.args, {
       name: "xterm-color",
       cols: this.cols,
@@ -5402,6 +5638,11 @@ var PtySession = class {
     this.probeWindow = null;
   }
   async deliverPrompt(text) {
+    if (this.codexPromptInArgv) {
+      this.codexPromptInArgv = false;
+      this.wroteToProcess = true;
+      return;
+    }
     if (text === "" && !this.adapter.capabilities.prefill) return;
     if (!this.wroteToProcess) {
       await this.awaitRawTuiInputLive();
@@ -5592,7 +5833,7 @@ var PtySession = class {
     if (this.pendingPlanApproval && event.type === "result") {
       this.disarmPlanDialogAutoAccept();
     }
-    if (this.pendingSubmitNudge && (event.type === "assistant" || event.type === "result")) {
+    if (this.pendingSubmitNudge && (event.type === "assistant" || event.type === "result" || this.adapter.id === "codex" && event.type === "tool_progress")) {
       this.disarmSubmitNudge();
     }
     this.synthesizeRateLimitFromBanner(event);
@@ -5668,7 +5909,7 @@ var PtySession = class {
 // src/harness/pty/config-home-health.ts
 import { lstat, mkdir as mkdir4, symlink, unlink as unlink2 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var MOUNT_DISCONNECT_CODES = /* @__PURE__ */ new Set(["ENOTCONN", "EIO", "ESTALE", "ENXIO"]);
 var MOUNT_DISCONNECT_MESSAGES = [
   "socket is not connected",
@@ -5684,10 +5925,10 @@ function isMountDisconnectError(err) {
   return MOUNT_DISCONNECT_MESSAGES.some((needle) => lower.includes(needle));
 }
 function podLocalConfigHome() {
-  return join7(homedir3(), ".claude-local");
+  return join8(homedir3(), ".claude-local");
 }
 function sharedConfigHomePath() {
-  return join7(homedir3(), ".claude");
+  return join8(homedir3(), ".claude");
 }
 function isConfigHomeFallbackActive() {
   return claudeConfigHome() === podLocalConfigHome();
@@ -5718,7 +5959,7 @@ async function repointSharedConfigHomeSymlink(fallback, log) {
 }
 async function isConfigHomeMountDead(cwd) {
   try {
-    await mkdir4(join7(claudeConfigHome(), "projects", projectSlug(cwd)), { recursive: true });
+    await mkdir4(join8(claudeConfigHome(), "projects", projectSlug(cwd)), { recursive: true });
     return false;
   } catch (err) {
     return isMountDisconnectError(err);
@@ -5727,7 +5968,7 @@ async function isConfigHomeMountDead(cwd) {
 async function ensureUsableClaudeConfigHome(cwd, log) {
   const configHome = claudeConfigHome();
   try {
-    await mkdir4(join7(configHome, "projects", projectSlug(cwd)), { recursive: true });
+    await mkdir4(join8(configHome, "projects", projectSlug(cwd)), { recursive: true });
     return { configHome, fellBack: false };
   } catch (err) {
     if (!isMountDisconnectError(err)) throw err;
@@ -5741,7 +5982,7 @@ async function ensureUsableClaudeConfigHome(cwd, log) {
       }
     );
     process.env.CLAUDE_CONFIG_DIR = fallback;
-    await mkdir4(join7(fallback, "projects", projectSlug(cwd)), { recursive: true });
+    await mkdir4(join8(fallback, "projects", projectSlug(cwd)), { recursive: true });
     await repointSharedConfigHomeSymlink(fallback, log);
     return { configHome: fallback, fellBack: true };
   }
@@ -5837,7 +6078,8 @@ var PtyHarness = class _PtyHarness {
     }
   }
   async *executeQuery(opts) {
-    const want = opts.resume ?? opts.options.resume ?? this.parked?.reportedSessionId ?? void 0;
+    const parkedId = this.adapter.id === "codex" && this.parked?.lineageId !== opts.options.sessionId ? void 0 : this.parked?.reportedSessionId;
+    const want = opts.resume ?? opts.options.resume ?? parkedId ?? void 0;
     const options = ensureSessionTarget(opts.options, want);
     if (options !== opts.options) {
       _PtyHarness.log.warn("spawn had no session target \u2014 minted one", {
@@ -6103,7 +6345,7 @@ import { spawn } from "child_process";
 
 // src/harness/pty/adapters/types.ts
 import { accessSync, constants, statSync } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var TuiUnavailableError = class extends Error {
   constructor(tui, message) {
     super(message);
@@ -6127,7 +6369,7 @@ function findOnPath(binary, env = process.env) {
   }
   for (const dir of (env.PATH ?? "").split(":")) {
     if (!dir) continue;
-    const candidate = join8(dir, binary);
+    const candidate = join9(dir, binary);
     if (isExecutable(candidate)) return candidate;
   }
   return null;
@@ -6135,18 +6377,18 @@ function findOnPath(binary, env = process.env) {
 
 // src/harness/pty/adapters/opencode-auth.ts
 import { promises as fs } from "fs";
-import { dirname as dirname2, join as join9 } from "path";
+import { dirname as dirname2, join as join10 } from "path";
 import { homedir as homedir4 } from "os";
 var logger = createServiceLogger("opencode-auth");
 var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
 var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
 function opencodeAuthPath(env) {
-  const dataHome = env.XDG_DATA_HOME ?? join9(env.HOME ?? homedir4(), ".local", "share");
-  return join9(dataHome, "opencode", "auth.json");
+  const dataHome = env.XDG_DATA_HOME ?? join10(env.HOME ?? homedir4(), ".local", "share");
+  return join10(dataHome, "opencode", "auth.json");
 }
 function opencodeConfigPath(env) {
-  const configHome = env.XDG_CONFIG_HOME ?? join9(env.HOME ?? homedir4(), ".config");
-  return join9(configHome, "opencode", "opencode.json");
+  const configHome = env.XDG_CONFIG_HOME ?? join10(env.HOME ?? homedir4(), ".config");
+  return join10(configHome, "opencode", "opencode.json");
 }
 function parseOauthSeed(b64) {
   if (!b64) return null;
@@ -6323,8 +6565,8 @@ function buildOpenCodeConfigContent(input) {
 }
 
 // src/harness/opencode/index.ts
-import { mkdtemp as mkdtemp2, rm as rm3, writeFile as writeFile6 } from "fs/promises";
-import { join as join10 } from "path";
+import { mkdtemp as mkdtemp2, rm as rm3, writeFile as writeFile7 } from "fs/promises";
+import { join as join11 } from "path";
 var MAX_STDERR_TAIL = 4e3;
 var OpenCodeHeadlessHarness = class {
   /** NDJSON from `--format json` is a trusted structured source. */
@@ -6346,7 +6588,7 @@ var OpenCodeHeadlessHarness = class {
     const prompt = await collectPrompt(opts.prompt);
     const binary = resolveOpenCodeBinary(process.env);
     await prepareOpenCodeCredentials(process.env);
-    this.tempDir = await mkdtemp2(join10(sessionTempBase(), "opencode-headless-"));
+    this.tempDir = await mkdtemp2(join11(sessionTempBase(), "opencode-headless-"));
     const { servers, entries } = await startToolServers(
       opts.options.mcpServers ?? {},
       this.tempDir
@@ -6428,8 +6670,8 @@ var OpenCodeHeadlessHarness = class {
    */
   async writeSystemPrompt(text) {
     if (!text || text.trim() === "") return null;
-    const path = join10(this.tempDir, "conveyor-instructions.md");
-    await writeFile6(path, text, "utf8");
+    const path = join11(this.tempDir, "conveyor-instructions.md");
+    await writeFile7(path, text, "utf8");
     return path;
   }
   /**
@@ -6566,6 +6808,202 @@ ${tail}`);
   }
 };
 
+// src/harness/pty/adapters/codex.ts
+import { realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname3, join as join14 } from "path";
+
+// src/harness/codex/credentials.ts
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir5, readFile as readFile2, writeFile as writeFile8 } from "fs/promises";
+import { homedir as homedir5, tmpdir } from "os";
+import { join as join12 } from "path";
+function codexHome(env = process.env) {
+  const key = env.CONVEYOR_CODING_AGENT_KEY_ID ?? "local";
+  const scope = createHash2("sha256").update(key).digest("hex").slice(0, 24);
+  return env.CONVEYOR_CODEX_HOME ?? join12(env.HOME ?? homedir5(), ".conveyor-codex", scope);
+}
+function codexSqliteHome(env = process.env) {
+  const scope = createHash2("sha256").update(codexHome(env)).digest("hex").slice(0, 24);
+  return env.CONVEYOR_CODEX_SQLITE_HOME ?? join12(tmpdir(), "conveyor-codex-state", scope);
+}
+async function readAuth(path) {
+  try {
+    return JSON.parse(await readFile2(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function prepareCodexCredentials(env) {
+  const home = codexHome(env);
+  await mkdir5(home, { recursive: true, mode: 448 });
+  await mkdir5(codexSqliteHome(env), { recursive: true, mode: 448 });
+  const path = join12(home, "auth.json");
+  const seed = env.CONVEYOR_CODEX_OAUTH;
+  if (seed) {
+    const tokens = JSON.parse(Buffer.from(seed, "base64").toString("utf8"));
+    if (typeof tokens.access !== "string" || typeof tokens.refresh !== "string" || typeof tokens.idToken !== "string" || typeof tokens.expires !== "number") {
+      throw new Error(
+        "Codex ChatGPT credential is incomplete. Sign in with ChatGPT again in Conveyor."
+      );
+    }
+    const existing = await readAuth(path);
+    const stored = existing.tokens;
+    const seededAt = await readAuth(join12(home, "conveyor-auth-seed.json"));
+    if (stored?.refresh_token && stored.account_id === tokens.accountId && typeof seededAt.expires === "number" && seededAt.expires >= tokens.expires)
+      return;
+    await writeFile8(
+      path,
+      JSON.stringify({
+        auth_mode: "chatgpt",
+        OPENAI_API_KEY: null,
+        tokens: {
+          id_token: tokens.idToken,
+          access_token: tokens.access,
+          refresh_token: tokens.refresh,
+          account_id: tokens.accountId
+        },
+        last_refresh: (/* @__PURE__ */ new Date()).toISOString()
+      }),
+      { mode: 384 }
+    );
+    await writeFile8(
+      join12(home, "conveyor-auth-seed.json"),
+      JSON.stringify({ expires: tokens.expires }),
+      { mode: 384 }
+    );
+  } else if (env.CONVEYOR_AGENT_KEY || env.OPENAI_API_KEY) {
+    await writeFile8(
+      path,
+      JSON.stringify({ OPENAI_API_KEY: env.CONVEYOR_AGENT_KEY ?? env.OPENAI_API_KEY }),
+      { mode: 384 }
+    );
+  }
+}
+
+// src/harness/codex/lineage.ts
+import { createHash as createHash3 } from "crypto";
+import { readFileSync, mkdirSync, writeFileSync, renameSync } from "fs";
+import { join as join13 } from "path";
+function lineagePath(id, cwd, env = process.env) {
+  const key = createHash3("sha256").update(`${cwd}\0${id}`).digest("hex");
+  return join13(codexHome(env), `conveyor-lineage-${key}.json`);
+}
+function readCodexLineage(id, cwd) {
+  try {
+    const stored = JSON.parse(readFileSync(lineagePath(id, cwd), "utf8"));
+    return typeof stored.sessionId === "string" ? stored.sessionId : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function saveCodexLineage(id, cwd, sessionId, env = process.env) {
+  mkdirSync(codexHome(env), { recursive: true });
+  const path = lineagePath(id, cwd, env);
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, JSON.stringify({ sessionId }), { mode: 384 });
+  renameSync(temp, path);
+}
+
+// src/harness/pty/adapters/codex.ts
+var CodexTuiAdapter = class {
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  env;
+  id = "codex";
+  capabilities = {
+    resume: true,
+    structuredEvents: true,
+    prefill: true,
+    passiveTurns: true,
+    rawPromptGate: true
+  };
+  resolveBinary(env = this.env) {
+    const path = findOnPath(env.CONVEYOR_CODEX_BIN ?? "codex", env);
+    if (!path)
+      throw new TuiUnavailableError(
+        "codex",
+        "Codex CLI is missing. Rebuild the project's image or set CONVEYOR_CODEX_BIN."
+      );
+    return path;
+  }
+  childEnv() {
+    const env = { ...inheritedEnv(), CODEX_HOME: codexHome(this.env) };
+    for (const [key, value] of Object.entries(this.env)) if (value !== void 0) env[key] = value;
+    env.CODEX_HOME = codexHome(this.env);
+    for (const key of [
+      "OPENAI_API_KEY",
+      "CODEX_API_KEY",
+      "CODEX_ACCESS_TOKEN",
+      "CONVEYOR_AGENT_KEY",
+      "CONVEYOR_CODEX_OAUTH",
+      "CONVEYOR_OPENCODE_OAUTH",
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "CONVEYOR_CLAUDE_OAUTH"
+    ])
+      delete env[key];
+    return env;
+  }
+  buildSpawn(input) {
+    const env = this.childEnv();
+    const cleanupPaths = [];
+    let trustedCwd = input.options.cwd;
+    try {
+      trustedCwd = realpathSync(trustedCwd);
+    } catch {
+    }
+    const config = {
+      cli_auth_credentials_store: "file",
+      sqlite_home: codexSqliteHome(this.env),
+      approval_policy: "never",
+      sandbox_mode: input.options.permissionMode === "plan" ? "read-only" : "danger-full-access",
+      developer_instructions: input.options.appendSystemPrompt ?? "",
+      mcp_servers: codexMcpConfig(input.mcpEntries ?? {}),
+      projects: { [trustedCwd]: { trust_level: "trusted" } }
+    };
+    if (input.pluginPath && input.eventsSinkPath) {
+      const profile = basename(dirname3(input.pluginPath));
+      const profilePath = join14(env.CODEX_HOME, `${profile}.config.toml`);
+      writeFileSync2(
+        profilePath,
+        `hooks = ${tomlValue(codexHookConfig(input.pluginPath, input.eventsSinkPath))}
+`,
+        { mode: 384 }
+      );
+      cleanupPaths.push(profilePath);
+      config.notify = ["node", input.pluginPath, input.eventsSinkPath];
+      config["features.hooks"] = true;
+    }
+    const args = ["--no-alt-screen", "--dangerously-bypass-hook-trust"];
+    if (input.pluginPath) args.push("--profile", basename(dirname3(input.pluginPath)));
+    for (const [key, value] of Object.entries(config))
+      args.push("-c", `${key}=${tomlValue(value)}`);
+    const model = this.env.CONVEYOR_AGENT_MODEL ?? input.options.model;
+    if (model && !/^(anthropic\/|claude-)/.test(model))
+      args.push("--model", model.replace(/^openai\//, ""));
+    if (input.resume) args.push("resume", input.resume);
+    if (input.initialPrompt) args.push("--", input.initialPrompt);
+    return { file: this.resolveBinary(), args, env, cleanupPaths };
+  }
+  recordSessionId(id, options) {
+    if (options.sessionId) saveCodexLineage(options.sessionId, options.cwd, id, this.env);
+  }
+  prepareEnvironment() {
+    return prepareCodexCredentials(this.env);
+  }
+  spawnFingerprint(input) {
+    return JSON.stringify([this.id, input]);
+  }
+  encodePromptBytes(text) {
+    return buildPromptBytes(text);
+  }
+  buildExitErrors(code, output) {
+    return [`Codex exited (code ${code}) without a result`, cleanTerminalOutput(output)].filter(
+      Boolean
+    );
+  }
+};
+
 // src/harness/pty/adapters/index.ts
 function resolveTuiKindFromEnv(env) {
   const raw = env.CONVEYOR_TUI ?? "claude-code";
@@ -6574,6 +7012,8 @@ function resolveTuiKindFromEnv(env) {
 }
 function resolveTuiAdapter(kind = "claude-code") {
   switch (kind) {
+    case "codex":
+      return new CodexTuiAdapter();
     case "claude-code":
       return new ClaudeTuiAdapter();
     case "opencode":
@@ -6892,8 +7332,8 @@ function wrapBridgeWithDirectStream(inner, reporter, options = {}) {
 }
 
 // src/execution/query-executor.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
-import { existsSync, readFileSync as readFileSync2, renameSync, truncateSync } from "fs";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
+import { existsSync, readFileSync as readFileSync3, renameSync as renameSync2, truncateSync } from "fs";
 
 // src/execution/chat-instructions.ts
 function buildChatInstructions(context, scenario, newMessages) {
@@ -7973,11 +8413,11 @@ function buildPmRelaunchParts(context, lastAgentIdx, isAuto, agentMode) {
 }
 
 // src/execution/system-prompt.ts
-import { readFileSync } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join15 } from "path";
 function repoHasScript(workspaceDir, script) {
   try {
-    const pkg = JSON.parse(readFileSync(join11(workspaceDir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join15(workspaceDir, "package.json"), "utf8"));
     return typeof pkg.scripts?.[script] === "string";
   } catch {
     return false;
@@ -10751,7 +11191,7 @@ function buildMutationTools(connection, config) {
 }
 
 // src/tools/attachment-tools.ts
-import { basename, extname, isAbsolute, join as join12 } from "path";
+import { basename as basename2, extname, isAbsolute, join as join16 } from "path";
 var MIME_BY_EXT = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -10804,7 +11244,7 @@ ${snippet}`;
 function buildUploadAttachmentTool(connection, config) {
   return defineContractTool(uploadAttachmentContract, async ({ path, title, tags }) => {
     try {
-      const filePath = isAbsolute(path) ? path : join12(config.workspaceDir, path);
+      const filePath = isAbsolute(path) ? path : join16(config.workspaceDir, path);
       const mimeType = inferMimeType(filePath);
       const info = await statWorkspacePath(filePath);
       if (!info.isFile) {
@@ -10815,7 +11255,7 @@ function buildUploadAttachmentTool(connection, config) {
           `File is ${info.size} bytes \u2014 exceeds the ${MAX_FILE_SIZE_BYTES} byte (25MB) upload limit.`
         );
       }
-      const fileName = basename(filePath);
+      const fileName = basename2(filePath);
       const { fileId, uploadUrl } = await connection.call("requestFileUpload", {
         sessionId: connection.sessionId,
         fileName,
@@ -11417,8 +11857,8 @@ function buildDiscoveryTools(connection) {
 import { z as z19 } from "zod";
 
 // src/execution/context-path-verifier.ts
-import { readFile as readFile2 } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join13, normalize } from "path";
+import { readFile as readFile3 } from "fs/promises";
+import { isAbsolute as isAbsolute2, join as join17, normalize } from "path";
 var PROBLEM_TEXT = {
   not_found: "does not exist in the repo",
   expected_folder: "is a file, not a folder \u2014 use type 'file', 'rule', or 'doc'",
@@ -11433,7 +11873,7 @@ async function verifyLocator(link, absolutePath, fileSize) {
   if (fileSize !== void 0 && fileSize > MAX_LOCATOR_FILE_BYTES) return null;
   let content;
   try {
-    content = await readFile2(absolutePath, "utf8");
+    content = await readFile3(absolutePath, "utf8");
   } catch {
     return null;
   }
@@ -11463,7 +11903,7 @@ async function verifyContextPaths(links, workspaceDir) {
       problems.push({ type: link.type, path: link.path, reason: shape });
       continue;
     }
-    const absolutePath = join13(workspaceDir, toRelativePath(link.path));
+    const absolutePath = join17(workspaceDir, toRelativePath(link.path));
     const stat = await statWorkspacePath(absolutePath);
     const wantsDirectory = expectsDirectory(link.type);
     if (!stat.exists) {
@@ -13074,10 +13514,12 @@ function applyCycledKeyEnv(envVars, env = process.env) {
     env[key] = value;
   }
   if (!envVars.CONVEYOR_CLAUDE_OAUTH) delete env.CONVEYOR_CLAUDE_OAUTH;
+  if (!envVars.CONVEYOR_CODEX_OAUTH) delete env.CONVEYOR_CODEX_OAUTH;
+  if (!envVars.CONVEYOR_OPENCODE_OAUTH) delete env.CONVEYOR_OPENCODE_OAUTH;
   if (envVars.CLAUDE_CODE_OAUTH_TOKEN) {
     delete env.ANTHROPIC_API_KEY;
     if (!envVars.CONVEYOR_AGENT_KEY) delete env.CONVEYOR_AGENT_KEY;
-  } else if (envVars.CONVEYOR_AGENT_KEY || envVars.CONVEYOR_OPENCODE_OAUTH) {
+  } else if (envVars.CONVEYOR_AGENT_KEY || envVars.CONVEYOR_OPENCODE_OAUTH || envVars.CONVEYOR_CODEX_OAUTH) {
     delete env.CLAUDE_CODE_OAUTH_TOKEN;
   }
 }
@@ -13550,7 +13992,7 @@ function buildHooks(host) {
   };
 }
 function taskIdToSessionUuid(lineageKey) {
-  const hash = createHash2("sha256").update(lineageKey).digest("hex");
+  const hash = createHash4("sha256").update(lineageKey).digest("hex");
   return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
 }
 function sessionLineageKey(taskId, agentMode, runnerMode) {
@@ -13567,10 +14009,17 @@ function sessionFileExists(sessionUuid, cwd) {
 }
 function hasExistingSessionFile(taskId, cwd, lineage) {
   const key = sessionLineageKey(taskId, lineage.agentMode, lineage.runnerMode);
+  if (process.env.CONVEYOR_TUI === "codex" && lineage.runnerMode !== "code-review") {
+    return !!readCodexLineage(taskIdToSessionUuid(key), cwd);
+  }
   return sessionFileExists(taskIdToSessionUuid(key), cwd);
 }
-function resolveSessionStart(lineageKey, cwd) {
+function resolveSessionStart(lineageKey, cwd, tui = process.env.CONVEYOR_TUI) {
   const sessionUuid = taskIdToSessionUuid(lineageKey);
+  if (tui === "codex") {
+    const resume = readCodexLineage(sessionUuid, cwd);
+    return { sessionId: sessionUuid, ...resume ? { resume } : {} };
+  }
   if (sessionFileExists(sessionUuid, cwd)) {
     repairTornSessionFile(sessionTranscriptPath(cwd, sessionUuid));
     return { resume: sessionUuid };
@@ -13580,7 +14029,7 @@ function resolveSessionStart(lineageKey, cwd) {
 function repairTornSessionFile(path) {
   try {
     if (!existsSync(path)) return false;
-    const content = readFileSync2(path, "utf8");
+    const content = readFileSync3(path, "utf8");
     if (content.length === 0) return false;
     let keepEnd = content.length;
     if (!content.endsWith("\n")) {
@@ -13879,7 +14328,8 @@ async function runSdkQuery(host, context, followUpContent, promptDeliveryOverrid
   const isDiscoveryLike = mode === "discovery" || mode === "help";
   const sessionStart = resolveSessionStart(
     sessionLineageKey(context.taskId, mode, host.config.mode),
-    host.config.workspaceDir
+    host.config.workspaceDir,
+    host.config.mode === "code-review" ? "claude-code" : process.env.CONVEYOR_TUI
   );
   const hasExistingSession = !!sessionStart.resume;
   const promptDelivery = promptDeliveryOverride ?? resolvePromptDelivery({
@@ -14029,7 +14479,7 @@ function rotateSessionFile(cwd, sessionUuid) {
   const path = sessionTranscriptPath(cwd, sessionUuid);
   try {
     if (!existsSync(path)) return true;
-    renameSync(path, `${path.replace(/\.jsonl$/, "")}.aborted-${Date.now()}.jsonl`);
+    renameSync2(path, `${path.replace(/\.jsonl$/, "")}.aborted-${Date.now()}.jsonl`);
     return true;
   } catch (error) {
     logger5.warn("Could not rotate an aborted transcript aside", {