@sabaiway/agent-workflow-kit 14.22.0 → 14.23.0

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
-# Read-only ADVISORY review BY the OpenAI Codex CLI. Runs under the read-only
-# sandbox, so codex structurally CANNOT edit/create/delete files or write to git
+# Read-only ADVISORY review BY the OpenAI Codex CLI. Runs read-only — on Linux with
+# codex-cli 0.160.0 or newer, off a codex version and profile digest recorded as
+# refused, under the permissions profile `jev` with no write entry
+# (network to api.typesafe.ai and docs.typesafe.ai only), elsewhere under --sandbox
+# read-only — so codex structurally CANNOT edit/create/delete files or write to git
 # — it can only read and emit findings. The orchestrator reads those findings and
 # decides what to act on; codex never applies them itself.
 #
@@ -28,9 +31,10 @@
 #
 # Best-effort read hygiene: the review runs under a temporary HOME / XDG_* with an
 # ABSOLUTE CODEX_HOME so codex auth + history still resolve, but its default config
-# / cache / skill-scan roots point at a throwaway dir instead of the real $HOME.
-# This trims roaming noise; it is NOT a security boundary (absolute paths anywhere
-# on disk remain readable under read-only — read-scoping is a prompt concern).
+# / cache roots point at a throwaway dir instead of the real $HOME; the user's real
+# skill root ($HOME/.agents/skills) is linked into it when it exists, so a review can
+# load a skill. This trims roaming noise; it is NOT a security boundary (absolute paths
+# anywhere on disk remain readable under read-only — read-scoping is a prompt concern).
 set -euo pipefail
 
 # --- --help / -h (pre-preflight: no codex, no login, no git tree needed) -------
@@ -97,12 +101,16 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
   CODEX_REVIEW_MAX_TOTAL_BYTES — inline-payload cap, integer bytes 1..100000000 (default 1500000); above it the diff rides via a git-dir temp file
 
 Notes:
-  the review posture banner appends a banner-only source=model:<s>,effort:<s> field — where each
-  value came from: default, setting or environment — then a banner-only timeout=<duration> field —
-  exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no
-  timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped
-  review run can no longer happen), and neither field enters the receipt posture or the D5
-  banner↔receipt parity
+  the review posture banner states what the run reaches in a jev= field:
+  jev=api.typesafe.ai,docs.typesafe.ai when the run carries the read-only permissions profile `jev`
+  (Linux, codex-cli 0.160.0 or newer, a version and profile digest not recorded as refused), else
+  jev=unreachable (<reason>) under --sandbox read-only; a run whose codex refuses the profile exits
+  72 with no receipt; then a banner-only source=model:<s>,effort:<s> field — where each value came
+  from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the
+  duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout
+  binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no
+  longer happen), and none of the three fields enters the receipt posture or the D5 banner↔receipt
+  parity
   quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
   posture; a prose re-type drifts
 
@@ -110,8 +118,8 @@ Honesty + posture (D4/D5):
   a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or
   missing output included — exits 4 with NO receipt: a FAILED review to RE-RUN, never a fatal
   session error. One stderr banner line states the ACTUAL run posture (review posture: model=…
-  effort=… tier=… source=… timeout=…) and the receipt records the same posture {model, effort, tier} (tier
-  null on the standard tier; the timeout field is banner-only — never a receipt field). Quote the
+  effort=… tier=… jev=… source=… timeout=…) and the receipt records the same posture {model, effort, tier} (tier
+  null on the standard tier; the jev= and timeout= fields are banner-only — never a receipt field). Quote the
   posture banner verbatim when labeling this dispatch. A posture value carrying control bytes
   refuses pre-spend in every mode.
 
@@ -126,6 +134,9 @@ esac
 AW_SETTINGS_APPLIED="CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES"
 DEFAULT_CODEX_MODEL="gpt-6.1-sol"
 DEFAULT_CODEX_EFFORT="high"
+# This wrapper's filesystem part of the permissions profile `jev` (the shared block below): the whole disk read
+# and no write entry at all (P14: the tree, .git and /tmp refused writes).
+AW_PROFILE_FILESYSTEM='{":root"="read"}'
 
 # --- Bridge settings file (host-level, kit-independent) — byte-identical across the four wrappers ---
 # ${XDG_CONFIG_HOME:-$HOME/.config}/agent-workflow/bridge-settings.conf holds KEY=VALUE lines,
@@ -314,11 +325,24 @@ aw_resolve_timeout_bin() {
   [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
   printf '%s' "$bin"
 }
+aw_scrub_billing_keys() {
+  # The one key rule (spec jev-every-run): OPENAI_BASE_URL and every *_API_KEY are unset, so a stray key can never
+  # switch a run to paid billing; TYPESAFE_API_KEY is neither read nor set, so it reaches the CLI exactly as given.
+  local name
+  unset OPENAI_BASE_URL 2>/dev/null || true
+  for name in $(compgen -v); do
+    case "$name" in
+      TYPESAFE_API_KEY) ;;
+      *_API_KEY) unset "$name" 2>/dev/null || true ;;
+    esac
+  done
+  return 0
+}
 
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="4.0.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="5.0.0"  # aw-version-anchor
 # Generous hard cap for a slow review at the host posture's effort (subscription latency varies).
 CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-1800}"
 # Above this assembled-payload size (bytes), the diff goes via a git-dir-local temp
@@ -367,6 +391,9 @@ if [[ -n "$CODEX_SERVICE_TIER" ]]; then
 fi
 CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 
+# --- Subscription-only guard (see codex-exec.sh): the shared key rule, before the first spawn of codex ---
+aw_scrub_billing_keys
+
 # --- D5 banner (one line, the ACTUAL run posture) -------------------------------------------
 # The control-byte screen already ran above (BEFORE tier validation); the banner states the
 # EFFECTIVE posture (post tier validation) and the receipt records the same fields — except
@@ -384,8 +411,174 @@ if [[ -z "$timeout_bin" ]]; then
   echo "       on macOS: brew install coreutils for gtimeout), then re-run." >&2
   exit 127
 fi
+
+# --- The permissions profile `jev` (spec jev-every-run) — byte-identical in codex-exec.sh and codex-review.sh ---
+# On Linux with codex-cli 0.160.0 or newer a run carries the profile `jev` by four -c overrides, with neither
+# --sandbox nor sandbox_mode beside them: its filesystem part is this wrapper's AW_PROFILE_FILESYSTEM, and its
+# network reaches api.typesafe.ai and docs.typesafe.ai and no other host (a literal of this bridge, which never
+# imports the kit). Elsewhere, and on a codex version and profile digest recorded as refused, the run keeps
+# today's flags and its banner says jev=unreachable (<reason>). Each run, a resume included, chooses afresh.
+AW_PROFILE_FLOOR="0.160.0"
+AW_PROFILE_HOSTS="api.typesafe.ai,docs.typesafe.ai"
+AW_PROFILE_FLAGS=(-c default_permissions=jev -c permissions.jev.network.enabled=true
+  -c 'permissions.jev.network.domains={"api.typesafe.ai"="allow","docs.typesafe.ai"="allow"}'
+  -c "permissions.jev.filesystem=$AW_PROFILE_FILESYSTEM")
+# The version on the first line of `codex --version` ("codex-cli X.Y.Z[-pre]"); nothing when unreadable.
+aw_codex_version() {   # $1 = the timeout binary or ""
+  local raw="" line="" re='^codex-cli[[:space:]]+([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?)[[:space:]]*$'
+  if [[ -n "$1" ]]; then
+    raw="$("$1" --kill-after=5s 15 codex --version </dev/null 2>/dev/null)" || raw=""
+  else
+    raw="$(codex --version </dev/null 2>/dev/null)" || raw=""
+  fi
+  line="${raw%%$'\n'*}"
+  line="${line%$'\r'}"
+  if [[ "$line" =~ $re ]]; then printf '%s' "${BASH_REMATCH[1]}"; fi
+  return 0
+}
+# 0 when version $1 is at or above $2, compared as major.minor.patch; a prerelease sorts below its release.
+aw_version_at_least() {
+  local core="${1%%-*}" have=() want=() i
+  IFS=. read -r -a have <<<"$core"
+  IFS=. read -r -a want <<<"$2"
+  for i in 0 1 2; do
+    if (( 10#${have[i]} != 10#${want[i]} )); then
+      (( 10#${have[i]} > 10#${want[i]} ))
+      return
+    fi
+  done
+  [[ "$1" == "$core" ]]
+}
+aw_profile_state_file() {
+  printf '%s/agent-workflow/codex-jev-profile-refused' "${XDG_STATE_HOME:-$HOME/.local/state}"
+}
+# sha256 of this run's profile overrides, one per line; nothing without a sha256 tool.
+aw_profile_digest() {
+  local sum=""
+  if command -v sha256sum >/dev/null 2>&1; then
+    sum="$(printf '%s\n' "${AW_PROFILE_FLAGS[@]}" | sha256sum 2>/dev/null)" || sum=""
+  elif command -v shasum >/dev/null 2>&1; then
+    sum="$(printf '%s\n' "${AW_PROFILE_FLAGS[@]}" | shasum -a 256 2>/dev/null)" || sum=""
+  fi
+  printf '%s' "${sum%% *}"
+}
+# 0 when the state file $1 lists "<version $2> <digest $3>"; an unreadable file reads as empty.
+aw_profile_refused() {
+  local line=""
+  [[ -n "$3" && -f "$1" && -r "$1" ]] || return 1
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    if [[ "${line%$'\r'}" == "$2 $3" ]]; then return 0; fi
+  done <"$1"
+  return 1
+}
+# Appends "<version $2> <digest $3>" to the state file $1, its directory made 0700; one stderr line when it cannot.
+aw_profile_record() {
+  local dir="${1%/*}"
+  if [[ -n "$3" ]] && { ( umask 077 && mkdir -p -- "$dir" ) && chmod 700 -- "$dir" && printf '%s %s\n' "$2" "$3" >>"$1"; } 2>/dev/null; then
+    return 0
+  fi
+  echo "warning: could not append the refused profile to $1 — until it can be written, every run on this codex version spends one run on the refusal." >&2
+  return 1
+}
+# Chooses this run's posture: profile_on (1 or 0), profile_reason, and the banner's jev= value in profile_label.
+aw_profile_choose() {   # $1 = the timeout binary or "", $2 = the repository's temp root or ""
+  local os=""
+  profile_on=0
+  profile_reason=""
+  profile_version="$(aw_codex_version "$1")"
+  profile_digest="$(aw_profile_digest)"
+  os="$(uname -s 2>/dev/null)" || os=""
+  if [[ "$os" != "Linux" ]]; then
+    profile_reason="not linux (${os:-unreadable})"
+  elif [[ -z "$profile_version" ]]; then
+    profile_reason="codex version unreadable"
+  elif ! aw_version_at_least "$profile_version" "$AW_PROFILE_FLOOR"; then
+    profile_reason="codex $profile_version below $AW_PROFILE_FLOOR"
+  elif [[ -n "$2" ]]; then
+    profile_reason="repository under $2"
+  elif aw_profile_refused "$(aw_profile_state_file)" "$profile_version" "$profile_digest"; then
+    profile_reason="profile not recognized by codex $profile_version, recorded in $(aw_profile_state_file)"
+  else
+    profile_on=1
+  fi
+  if (( profile_on )); then profile_label="$AW_PROFILE_HOSTS"; else profile_label="unreachable ($profile_reason)"; fi
+  profile_label="${profile_label//[$'\x01'-$'\x1f'$'\x7f']/?}"
+  return 0
+}
+# The loud failure, judged on ONE attempt's trace: 0 on a match, its kind in profile_refusal (1 = a P1/P13-shaped
+# error item before the first turn.started, 2 = `bwrap: execvp` in a command item whose failure is proven) and
+# the matched text in profile_refusal_text. The same strings in a successful command or the final message never fire.
+aw_profile_scan() {   # $1 = the trace
+  local line="" started=0
+  local item_re='^\{"type":"item\.completed","item":\{("id":"[^"]*",)?"type":"error","message":"((Permissions profile `jev` |Configured filesystem path `[^`"]*` is not recognized )[^"\\]*)"'
+  profile_refusal=0
+  profile_refusal_text=""
+  [[ -r "$1" ]] || return 1
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    if [[ "$line" == '{"type":"turn.started"'* ]]; then started=1; fi
+    if (( ! started )) && [[ "$line" =~ $item_re ]]; then
+      profile_refusal=1
+      profile_refusal_text="${BASH_REMATCH[2]}"
+      return 0
+    fi
+    if aw_ns_item_evidence "$line" && [[ "$AW_NS_OUTPUT" == *'bwrap: execvp'* ]]; then
+      profile_refusal=2
+      profile_refusal_text="${AW_NS_OUTPUT%%\\n*}"
+      return 0
+    fi
+  done <"$1"
+  return 1
+}
+# Prints the matched refusal (no "update codex" remedy: none is known) and records a refused profile key.
+aw_profile_refusal_report() {
+  local file=""
+  echo "error: codex refused this run's permissions profile \`jev\` (exit 72): $profile_refusal_text" >&2
+  if (( profile_refusal == 1 )); then
+    file="$(aw_profile_state_file)"
+    if aw_profile_record "$file" "$profile_version" "$profile_digest"; then
+      echo "       recorded in $file: the next run on codex $profile_version with this profile runs today's flags (jev=unreachable)." >&2
+    fi
+  fi
+  return 0
+}
+
+# codex-exec.sh's command-item walk, byte-identical (its comments state the shape and the measured slice costs):
+# 0 when a trace line is a command_execution item with a PROVEN failure, its aggregated_output in AW_NS_OUTPUT.
+aw_ns_is_string_content() {
+  if grep -qE '(^|[^\\])(\\\\)*"' <<<"$1"; then return 1; fi
+  return 0
+}
+aw_ns_item_evidence() {
+  local LC_ALL=C
+  local line="$1" d1='","aggregated_output":"' d2='","exit_code":' rest tail cmd agg code after off
+  case "$line" in '{'*) ;; *) return 1 ;; esac
+  rest="${line#*'"type":"command_execution","command":"'}"
+  if [[ "$rest" == "$line" ]]; then return 1; fi
+  tail="${rest#*"$d1"}"
+  if [[ "$tail" == "$rest" ]]; then return 1; fi
+  cmd="${rest:0:$(( ${#rest} - ${#tail} - ${#d1} ))}"
+  aw_ns_is_string_content "$cmd" || return 1
+  while IFS=: read -r off _; do break; done < <(grep -aboF -- "$d2" <<<"$tail")
+  if [[ -z "$off" ]]; then return 1; fi
+  agg="${tail:0:off}"
+  after="${tail:$(( off + ${#d2} ))}"
+  aw_ns_is_string_content "$agg" || return 1
+  code="${after%%,*}"
+  if [[ "$code" =~ ^-?[0-9]+$ && "$code" != "0" ]]; then
+    :
+  elif [[ "${after#"$code",}" == '"status":"failed"'* ]]; then
+    :
+  else
+    return 1
+  fi
+  AW_NS_OUTPUT="$agg"
+  return 0
+}
+
+# A review has no temp-root rule: its profile writes nothing, so a .git under a temp root stays read-only (P14).
+aw_profile_choose "$timeout_bin" ""
 aw_timeout_banner="$(aw_timeout_label "$timeout_bin" "$CODEX_HARD_TIMEOUT")"
-echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} source=model:$CODEX_MODEL_SOURCE,effort:$CODEX_EFFORT_SOURCE timeout=$aw_timeout_banner" >&2
+echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} jev=$profile_label source=model:$CODEX_MODEL_SOURCE,effort:$CODEX_EFFORT_SOURCE timeout=$aw_timeout_banner" >&2
 
 # A probe run is RECORDED, not just warned about: the receipt carries probe:true so the kit's
 # review-state gate rejects it — "do NOT use this as a real review" becomes a mechanism, not a plea.
@@ -396,12 +589,6 @@ if [[ "${CODEX_PROBE:-}" == "1" ]]; then
   echo "         output as a real review (model='$CODEX_MODEL' effort='$CODEX_EFFORT')." >&2
 fi
 
-# --- Subscription-only guard (see codex-exec.sh) -----------------------------
-unset OPENAI_API_KEY CODEX_API_KEY OPENAI_BASE_URL 2>/dev/null || true
-while IFS= read -r _api_key_var; do
-  unset "$_api_key_var" 2>/dev/null || true
-done < <(compgen -v 2>/dev/null | grep '_API_KEY$' || true)
-
 # Resolve the real CODEX_HOME (where the cached ChatGPT login lives) to an ABSOLUTE
 # path BEFORE the env fence repoints HOME — auth must keep resolving.
 real_codex_home="${CODEX_HOME:-$HOME/.codex}"
@@ -999,6 +1186,19 @@ REVIEW_ARTIFACT=""
 REVIEW_FINGERPRINT=""
 REVIEW_ARTIFACT_PATH=""
 
+# The user's real Codex skill root, resolved before the fence home repoints HOME (spec jev-every-run): when it
+# exists, the fence home links .agents/skills to it on a profile and a fallback run alike, read-only in both, and
+# the fence directives admit reading it; on a profile run they also name the two reachable hosts.
+skills_root="$(builtin cd -P -- "$HOME/.agents/skills" 2>/dev/null && builtin pwd -P)" || skills_root=""
+fence_skills=""
+if [[ -n "$skills_root" ]]; then
+  fence_skills=" A skill under ~/.agents/skills (linked into this run's home) may be read when the review needs one."
+fi
+fence_hosts=""
+if (( profile_on )); then
+  fence_hosts=" The hosts api.typesafe.ai and docs.typesafe.ai are reachable; every other host is refused, and still no file may be edited, created or deleted."
+fi
+
 case "$mode" in
   plan)
     target="${1:-}"
@@ -1015,7 +1215,7 @@ case "$mode" in
     # Plan-mode receipt identity: the artifact-file sha256 (informational-only for the tree checker).
     REVIEW_ARTIFACT="plan"
     REVIEW_FINGERPRINT="$(sha256_stdin <"$target" || true)"
-    fence_plan="Do not read files outside this git working tree; the plan above plus the in-repo code it references are your whole surface."
+    fence_plan="Do not read files outside this git working tree; the plan above plus the in-repo code it references are your whole surface.${fence_skills}${fence_hosts}"
     directive="You are REVIEWING an implementation plan — ADVISORY ONLY. You are in a read-only sandbox: do NOT edit, create, or delete any file, and do NOT rewrite the plan. Obey the project's Hard Constraints from its root AGENTS.md (already merged into your context). Read the plan below and the relevant repository code it references. ${fence_plan} ${OUTPUT_FORMAT_PLAN} Cover: correctness risks, missing or mis-ordered steps, ambiguities a cold executor would trip on, violated project Hard Constraints, scope creep, and missing verification/gates."
     prompt="${directive}"$'\n\nPLAN:\n'"$(cat -- "$target")"
     ;;
@@ -1041,12 +1241,12 @@ case "$mode" in
     payload_bytes="$(wc -c <"$review_diff_file")"
     base_directive="You are REVIEWING the uncommitted working-tree changes of a git repository — ADVISORY ONLY. You are in a read-only sandbox: do NOT edit, create, or delete any file and do NOT run any git write command. The COMPLETE change set (repo file map, git status, staged + unstaged diffs, and untracked file contents — binaries noted but skipped, symlinks shown as targets) has been assembled FOR you; you do NOT need to run git yourself, though you MAY read other in-repo files for surrounding context. Obey the project's Hard Constraints from its root AGENTS.md (already merged into your context)."
     if [[ "$payload_bytes" -gt "$CODEX_REVIEW_MAX_TOTAL_BYTES" ]]; then
-      fence_code="Do not read files outside this git working tree, with ONE exception — the precomputed-diff file at ${review_diff_file}; read it IN FULL before reviewing. That file plus the in-repo code are your whole surface."
+      fence_code="Do not read files outside this git working tree, with ONE exception — the precomputed-diff file at ${review_diff_file}; read it IN FULL before reviewing. That file plus the in-repo code are your whole surface.${fence_skills}${fence_hosts}"
       directive="${base_directive} ${fence_code} ${OUTPUT_FORMAT_CODE}"
       if [[ $# -gt 0 ]]; then directive="${directive} Extra focus: $*"; fi
       prompt="$directive"
     else
-      fence_code="Do not read files outside this git working tree; the assembled change set below plus the in-repo code are your whole surface."
+      fence_code="Do not read files outside this git working tree; the assembled change set below plus the in-repo code are your whole surface.${fence_skills}${fence_hosts}"
       directive="${base_directive} ${fence_code} ${OUTPUT_FORMAT_CODE}"
       if [[ $# -gt 0 ]]; then directive="${directive} Extra focus: $*"; fi
       prompt="${directive}"$'\n\nASSEMBLED CHANGE SET:\n'"$(cat -- "$review_diff_file")"
@@ -1066,14 +1266,23 @@ fence_home="$(mktemp -d)"
 out="$(mktemp)"
 trace="$(mktemp)"
 mkdir -p "$fence_home/.config" "$fence_home/.cache" "$fence_home/.local/share"
+if [[ -n "$skills_root" ]]; then
+  mkdir -p "$fence_home/.agents"
+  ln -s "$skills_root" "$fence_home/.agents/skills"
+fi
 
 # --- Optional structured findings (CODEX_REVIEW_SCHEMA=1) ---------------------
 # A FLEXIBLE schema (optional evidence, free-text notes) so codex can almost always
 # conform (a live probe confirmed --output-schema CONSTRAINS the output rather than
 # failing); a raw-text retry covers the rare validation/run failure. Default OFF.
+if (( profile_on )); then
+  posture_flags=("${AW_PROFILE_FLAGS[@]}")
+else
+  posture_flags=(--sandbox read-only)
+fi
 codex_flags=(codex exec
   --ignore-user-config
-  --sandbox read-only
+  "${posture_flags[@]}"
   -c approval_policy="never"
   -c model_reasoning_effort="$CODEX_EFFORT"
   -c hide_agent_reasoning=true
@@ -1126,13 +1335,18 @@ fence_env=(env
 # guaranteed non-empty there (the fail-closed preflight) — the run reuses the exact binary the
 # banner reported.
 
-# Run codex with the current ${codex_cmd[@]}; capture rc, stream → $trace.
+# Run codex with the current ${codex_cmd[@]}; capture rc, stream → $trace. Each attempt's own trace is scanned
+# for the loud failure (spec jev-every-run) before a retry and before any output: a match exits 72, no receipt.
 invoke_codex() {
   set +e
   printf '%s' "$prompt" \
     | "${fence_env[@]}" "$timeout_bin" --kill-after=15s "$CODEX_HARD_TIMEOUT" "${codex_cmd[@]}" >"$trace" 2>&1
   rc=$?
   set -e
+  if (( profile_on )) && aw_profile_scan "$trace"; then
+    aw_profile_refusal_report
+    exit 72
+  fi
 }
 
 codex_cmd=("${codex_flags[@]}" -)

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -19,6 +19,7 @@ const FAKE_CODEX = [
   '#!/usr/bin/env bash',
   'set -u',
   'if [[ "${1:-}" == "login" ]]; then echo "${CODEX_FAKE_LOGIN:-Logged in using ChatGPT}"; exit 0; fi',
+  'if [[ "${1:-}" == "--version" ]]; then echo "codex-cli ${CODEX_FAKE_VERSION:-0.160.0}"; exit 0; fi',
   'if [[ "${1:-}" == "debug" ]]; then [[ -z "${CODEX_FAKE_NO_CATALOG:-}" ]] || exit 1; cat <<EOF',
   '{"models":[{"slug":"gpt-6.1-sol","priority":1,"visibility":"list","default_reasoning_level":"low","supported_reasoning_levels":[{"effort":"low"},{"effort":"medium"},{"effort":"high"}]},{"slug":"gpt-6-astra","priority":2,"visibility":"list","default_reasoning_level":"medium","supported_reasoning_levels":[{"effort":"medium"},{"effort":"high"}]}]}',
   'EOF',
@@ -184,14 +185,15 @@ describe('codex-review.sh — clean output + session capture (1.2)', { concurren
     assert.doesNotMatch(r.stdout, /thread\.started/);
   });
 
-  it('passes the clean-capture flags and read-only sandbox to codex', async () => {
+  // The fallback (spec jev-every-run: codex below 0.160.0); the review profile is codex-review-jev.test.mjs's.
+  it('passes the clean-capture flags and, on a fallback run, the read-only sandbox to codex', async () => {
     const sb = makeSandbox();
-    const r = await run(sb);
+    const r = await run(sb, { env: { CODEX_FAKE_VERSION: '0.159.0' } });
     rmSync(sb.root, { recursive: true, force: true });
-    for (const f of [/(^|\n)-o(\n|$)/, /(^|\n)--json(\n|$)/, /hide_agent_reasoning=true/,
-      /(^|\n)read-only(\n|$)/]) {
+    for (const f of [/(^|\n)-o(\n|$)/, /(^|\n)--json(\n|$)/, /hide_agent_reasoning=true/, /(^|\n)--sandbox\nread-only(\n|$)/]) {
       assert.match(r.argv, f, `expected ${f} among codex argv`);
     }
+    assert.match(r.stderr, /^review posture: .* jev=unreachable \(.*\) source=/m);
   });
 
   it('surfaces the session id on STDERR only — never the shared resume sidecar', async () => {
@@ -267,9 +269,7 @@ describe('codex-review.sh — best-effort env read-fence (1.5)', { concurrency:
 describe('codex-review.sh — subscription / config isolation (invariant)', { concurrency: 2 }, () => {
   it('clears every *_API_KEY + OPENAI_BASE_URL and passes --ignore-user-config', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: {
-      OPENAI_API_KEY: 'sk-x', OPENAI_BASE_URL: 'http://evil.example', FOO_API_KEY: 'bar',
-    } });
+    const r = await run(sb, { env: { OPENAI_API_KEY: 'sk-x', OPENAI_BASE_URL: 'http://evil.example', FOO_API_KEY: 'bar' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.capEnv, /^OPENAI_API_KEY=<unset>$/m);
@@ -1634,7 +1634,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /review posture: model=gpt-6\.1-sol effort=high tier=standard source=model:default,effort:default/, 'the banner states the actual run posture');
+    assert.match(r.stderr, /review posture: model=gpt-6\.1-sol effort=high tier=standard jev=(api\.typesafe\.ai,docs\.typesafe\.ai|unreachable \(.*\)) source=model:default,effort:default/, 'the banner states the actual run posture');
     assert.deepEqual(receipts[0].posture, { model: 'gpt-6.1-sol', effort: 'high', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
     assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
   });
@@ -1677,7 +1677,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /^review posture: model=gpt-6\.1-sol effort=high tier=standard source=model:default,effort:default timeout=1800s$/m);
+    assert.match(r.stderr, /^review posture: model=gpt-6\.1-sol effort=high tier=standard jev=(api\.typesafe\.ai,docs\.typesafe\.ai|unreachable \(.*\)) source=model:default,effort:default timeout=1800s$/m);
     assert.deepEqual(Object.keys(receipts[0].posture), ['model', 'effort', 'tier'], 'timeout never enters the receipt posture');
   });
 

package/bridges/codex-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "posture": { "model": "gpt-6.1-sol", "effort": "high", "tier": null },
   "provides": ["execute", "review"],
   "roles": {
@@ -29,9 +29,9 @@
         },
         "notes": [
           "nested-sandbox limit: codex-exec ships its OWN OS sandbox (bwrap workspace-write) and cannot run nested inside a harness sandbox (the FS turns read-only) — route it OUTSIDE the harness sandbox (excludedCommands / a per-run consented bypass) on the OBSERVED bwrap/EPERM failure, never a preemptive blanket",
-          "exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> source=… timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend",
+          "exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=jev-profile|workspace-write session=fresh|resume:<id> jev=… source=… timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, control bytes in a model, effort, tier or timeout value refuse pre-spend, and a jev= reason shows a control byte as ?",
           "threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent environment. A hostile parent environment — including exported shell functions or PATH substitution of core/backend commands — is outside the threat model and can substitute the backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental shadowing; it is not an environment security boundary",
-          "the exec posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: neither is persisted in a receipt or session sidecar",
+          "the exec posture banner states what the run reaches in a jev= field: jev=api.typesafe.ai,docs.typesafe.ai when the run carries the permissions profile `jev` (Linux, codex-cli 0.160.0 or newer, a repository outside every temp root, a version and profile digest not recorded as refused), else jev=unreachable (<reason>) on today's workspace-write flags with network off; a run whose codex refuses the profile exits 72 with no success receipt and, for a refused profile key, records its version and digest when the state file can be written, so the next run on them takes today's flags; then a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: none of the three is persisted in a receipt or session sidecar",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts",
           "every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN (a nonzero exit_code, or the serialized status \"failed\"); a null exit_code is never failure by itself, tokens split across two items never fire, and a successful command's output never fires. The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit status alone can still bank an ungrounded answer — the stderr warning is the signal"
         ]
@@ -51,7 +51,7 @@
         "continue": [],
         "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of [blocker] and [major] lines (schema mode: findings with either severity; a payload whose findings cannot be counted fails the run, no receipt); artifactPath = the normalized realpath on plan receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, and a posture value carrying control bytes refuses pre-spend in every mode; a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or missing output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         "notes": [
-          "the review posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity",
+          "the review posture banner states what the run reaches in a jev= field: jev=api.typesafe.ai,docs.typesafe.ai when the run carries the read-only permissions profile `jev` (Linux, codex-cli 0.160.0 or newer, a version and profile digest not recorded as refused), else jev=unreachable (<reason>) under --sandbox read-only; a run whose codex refuses the profile exits 72 with no receipt; then a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and none of the three fields enters the receipt posture or the D5 banner↔receipt parity",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
         ]
       }
@@ -81,10 +81,10 @@
         { "slot": "<extra codex flags...>", "required": false, "description": "extra codex flags, filtered by the guarded passthrough tiers" }
       ],
       "guardrails": [
-        { "value": "runs under codex's OWN OS sandbox (workspace-write)", "enforcement": "enforced", "condition": "it cannot nest inside another sandbox — the FS turns read-only; route it outside on the OBSERVED failure", "source": "capability.json roles.execute.contract.notes" },
-        { "value": "the guarded passthrough blocks model / sandbox / approval overrides", "enforcement": "enforced", "source": "bin/codex-exec.sh" },
+        { "value": "runs under codex's OWN OS sandbox: the permissions profile `jev` (workspace writes, network to api.typesafe.ai and docs.typesafe.ai only), else workspace-write with network off", "enforcement": "enforced", "condition": "the profile needs Linux, codex-cli 0.160.0+, a repo outside every temp root and no recorded refusal; it cannot nest inside another sandbox — route it outside on the OBSERVED failure", "source": "capability.json roles.execute.contract.notes" },
+        { "value": "the guarded passthrough blocks model / sandbox / approval overrides", "enforcement": "enforced", "condition": "under the permissions profile `jev` even CODEX_PROBE=1 refuses --add-dir, -C, --cd, --enable and --disable", "source": "bin/codex-exec.sh" },
         { "value": "hard wall-clock cap CODEX_HARD_TIMEOUT (built-in default 3600s)", "enforcement": "enforced", "condition": "only while timeout(1)/gtimeout is on PATH — otherwise the wrapper warns and runs uncapped, and a NONCED run refuses pre-spend", "source": "capability.json settings.CODEX_HARD_TIMEOUT" },
-        { "value": "ONE exec posture stderr banner line states the ACTUAL run posture before dispatch (session=fresh|resume:<id>; timeout is banner-only)", "enforcement": "enforced", "source": "bin/codex-exec.sh" },
+        { "value": "ONE exec posture stderr banner line states the ACTUAL run posture before dispatch (session=fresh|resume:<id>; jev= names the reachable hosts or why none; jev= and timeout= are banner-only)", "enforcement": "enforced", "source": "bin/codex-exec.sh" },
         { "value": "a NONCED run reserves its nonce before any spend and publishes a fail-closed terminal receipt at exit", "enforcement": "enforced", "condition": "nonce-supplied runs only — a nonce-less invocation writes no artifact at all", "source": "capability.json roles.execute.contract.receipt" }
       ],
       "customHooks": ["CODEX_PROBE"]
@@ -140,7 +140,7 @@
         { "slot": "[--nonce <n>]", "required": false, "description": "the flow dispatch nonce — the plain-argument lane onto the AW_REVIEW_NONCE seam (round-open prints the value; flag and a non-empty env must agree)" }
       ],
       "guardrails": [
-        { "value": "read-only sandbox — codex cannot edit, create or delete a file", "enforcement": "enforced", "source": "bin/codex-review.sh" },
+        { "value": "read-only — the permissions profile `jev` with no write entry, else --sandbox read-only: codex cannot edit, create or delete a file", "enforcement": "enforced", "condition": "the profile runs on Linux with codex-cli 0.160.0 or newer, off a codex version and profile digest recorded as refused, and reaches api.typesafe.ai and docs.typesafe.ai only", "source": "bin/codex-review.sh" },
         { "value": "runs on the host posture's model and effort", "enforcement": "enforced", "condition": "a one-off is refused pre-spend unless CODEX_PROBE=1 marks a throwaway probe", "source": "bin/codex-review.sh" },
         { "value": "a successful review appends one receipt line the review-state gate reads", "enforcement": "enforced", "condition": "a receipt write failure warns and the review still succeeds — the tree then reads un-receipted", "source": "capability.json roles.review.contract.receipt" }
       ],
@@ -163,7 +163,7 @@
         { "slot": "[extra focus...]", "required": false, "description": "extra focus words appended to the review directive" }
       ],
       "guardrails": [
-        { "value": "read-only sandbox — codex cannot edit, create or delete a file", "enforcement": "enforced", "source": "bin/codex-review.sh" },
+        { "value": "read-only — the permissions profile `jev` with no write entry, else --sandbox read-only: codex cannot edit, create or delete a file", "enforcement": "enforced", "condition": "the profile runs on Linux with codex-cli 0.160.0 or newer, off a codex version and profile digest recorded as refused, and reaches api.typesafe.ai and docs.typesafe.ai only", "source": "bin/codex-review.sh" },
         { "value": "an oversized change set rides via a git-dir temp file, never truncated", "enforcement": "enforced", "source": "bin/codex-review.sh" },
         { "value": "a successful review appends one receipt line the review-state gate reads", "enforcement": "enforced", "condition": "a receipt write failure warns and the review still succeeds — the tree then reads un-receipted", "source": "capability.json roles.review.contract.receipt" }
       ],
@@ -228,7 +228,7 @@
       "effect": "codex-review code: above this assembled-payload size (bytes) the diff rides via a git-dir temp file instead of inline — never truncated."
     }
   ],
-  "networkHosts": ["chatgpt.com", "*.chatgpt.com"],
+  "networkHosts": ["chatgpt.com", "*.chatgpt.com", "api.typesafe.ai", "docs.typesafe.ai"],
   "writableDirs": [{ "env": "CODEX_HOME", "default": "~/.codex" }],
   "detect": {
     "installed": {

package/bridges/codex-cli-bridge/references/driving-codex.md

@@ -34,20 +34,23 @@ the one route to a one-off — never use its output as real work; its review rec
 ## Posture banners — quote them verbatim
 
 Every dispatch states its ACTUAL posture on ONE stderr line: `codex-exec` emits
-`exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> source=… timeout=…`
+`exec posture: model=… effort=… tier=… sandbox=jev-profile|workspace-write session=fresh|resume:<id> jev=… source=… timeout=…`
 (fresh and resume alike, only after the resume id is resolved and validated), `codex-review` emits
-`review posture: model=… effort=… tier=… source=… timeout=…`. When you label a dispatch for a user or a
+`review posture: model=… effort=… tier=… jev=… source=… timeout=…`. When you label a dispatch for a user or a
 record, **quote the posture banner verbatim** — the banner is the machine-stated posture; a prose
-re-type drifts. The `source=` field (`model:<s>,effort:<s>`, each `default`, `setting` or
-`environment`) and the `timeout=` field are **banner-only** (`timeout=` is exactly the duration handed
+re-type drifts. The `jev=` field says what the run reaches: `jev=api.typesafe.ai,docs.typesafe.ai` under
+the permissions profile `jev`, else `jev=unreachable (<reason>)` on today's flags (`codex-exec`:
+`sandbox=workspace-write`, network off; `codex-review`: `--sandbox read-only`); a run whose codex refuses
+the profile exits 72. The `jev=`, `source=` (`model:<s>,effort:<s>`, each `default`, `setting` or
+`environment`) and `timeout=` fields are **banner-only** (`timeout=` is exactly the duration handed
 to `timeout(1)`; on exec `uncapped` when no capping binary is on PATH, while `codex-review` fails
 CLOSED pre-spend there) — informational, never part of a receipt or the banner↔receipt parity.
 
 ## Exec vs review
 
 Use **`codex-exec`** when there is a concrete plan or focused instruction to implement, the project
-declares Hard Constraints + gates in `AGENTS.md`, the work fits network-off `workspace-write`, and you
-can review the resulting diff.
+declares Hard Constraints + gates in `AGENTS.md`, the work fits `workspace-write` with no network beyond
+`api.typesafe.ai` and `docs.typesafe.ai`, and you can review the resulting diff.
 
 Use **`codex-review plan`** for a cold second opinion on a plan before executing it (risks, missing or
 mis-ordered steps, scope creep, missing gates).
@@ -94,11 +97,12 @@ codex-exec --resume <session-id> <file|->  # explicit session id
 ```
 
 Resume continues the SAME codex session, so you avoid re-sending the original context. It runs through
-the wrapper, which **re-establishes every invariant** (subscription-only `*_API_KEY` scrub,
-`--ignore-user-config`, the host posture's model/effort) and **restates the full posture via `-c`** —
-because `codex exec resume` resets the sandbox/approval/network posture and rejects `-s`/`--add-dir`/`-C`,
-the wrapper passes `-c sandbox_mode=workspace-write -c approval_policy=never -c
-sandbox_workspace_write.network_access=false` explicitly. A resume takes no passthrough flags and an
+the wrapper, which **re-establishes every invariant** (the subscription-only key rule — every `*_API_KEY`
+but `TYPESAFE_API_KEY` unset — `--ignore-user-config`, the host posture's model/effort) and **restates the
+full posture via `-c`** — because `codex exec resume` resets the sandbox/approval/network posture and
+rejects `-s`/`--add-dir`/`-C`, the wrapper passes `-c approval_policy=never` and the posture it chooses
+afresh for this run: the profile `jev`'s four overrides, or `-c sandbox_mode=workspace-write -c
+sandbox_workspace_write.network_access=false`. A resume takes no passthrough flags and an
 empty resumed instruction is rejected. Prefer resume over re-dispatching a fresh run when you are
 iterating on the same task; start a fresh `codex-exec` when the task changes.
 
@@ -113,8 +117,8 @@ iterating on the same task; start a fresh `codex-exec` when the task changes.
   boundary must be a real executable; the real git path is baked into the shim, not exposed as an env
   var). `git config` is read-only too (blocked on a write flag or a `<name> <value>` set form). The
   orchestrator commits after review.
-- **New dependencies / network installs** are done by hand (exec has network OFF), then codex is
-  re-dispatched.
+- **New dependencies / network installs** are done by hand (exec reaches at most `api.typesafe.ai` and
+  `docs.typesafe.ai`), then codex is re-dispatched.
 - **A hung run** is killed at `CODEX_HARD_TIMEOUT` (exec 3600s / review 1800s) and reported (exit
   124/137); raise it for a known-healthy slow run.
 
@@ -124,7 +128,7 @@ iterating on the same task; start a fresh `codex-exec` when the task changes.
 Implement the change below from the current project root.
 Obey root AGENTS.md (already in your context), especially its Hard Constraints and declared gates.
 Do not run git write commands. Do not commit.
-If a dependency install, network call, missing gate set, or out-of-repo write is needed, STOP and report.
+If a dependency install, a network call to a host the execution contract does not name as reachable, a missing gate set, or an out-of-repo write is needed, STOP and report.
 
 <the focused instruction + relevant paths>
 ```