@sabaiway/agent-workflow-kit 2.1.0 → 3.1.0

package/bridges/antigravity-cli-bridge/bin/agy.test.mjs

@@ -1,10 +1,10 @@
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, existsSync, readdirSync, symlinkSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const WRAPPER = join(HERE, 'agy.sh');
@@ -31,11 +31,23 @@ const runWrapper = (home, env, prompt = 'hello') =>
     timeout: 20000,
   });
 
-describe('agy.sh — hard wall-clock cap (timeout(1))', () => {
-  it('kills a hung agy at AGY_HARD_TIMEOUT and reports it (non-zero + actionable guidance)', () => {
+// Async twin of runWrapper for the sleep-bound suites below: spawnSync BLOCKS the event loop
+// and would serialize the deliberate timeout waits; the async form lets a concurrent describe
+// overlap them (the waiting children are idle, not CPU-bound). Same spawn contract.
+const runWrapperAsync = (home, env, prompt = 'hello') =>
+  new Promise((done) => {
+    execFile('bash', [WRAPPER, prompt], {
+      env: { HOME: home, PATH: `${join(home, '.local', 'bin')}:${process.env.PATH}`, TMPDIR: process.env.TMPDIR ?? '/tmp', ...env },
+      encoding: 'utf8',
+      timeout: 20000,
+    }, (error, stdout, stderr) => done({ status: error ? (error.code ?? 1) : 0, stdout, stderr }));
+  });
+
+describe('agy.sh — hard wall-clock cap (timeout(1))', { concurrency: true }, () => {
+  it('kills a hung agy at AGY_HARD_TIMEOUT and reports it (non-zero + actionable guidance)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 30\n');
     const started = Date.now();
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
     const elapsed = Date.now() - started;
     rmSync(home, { recursive: true, force: true });
     assert.ok(elapsed < 13000, `wrapper must return well under the kill-after window, took ${elapsed}ms`);
@@ -43,17 +55,17 @@ describe('agy.sh — hard wall-clock cap (timeout(1))', () => {
     assert.match(r.stderr, /exceeded the hard cap/, 'must explain the hard-cap kill');
   });
 
-  it('passes a fast agy run through unchanged (exit 0, stdout preserved)', () => {
+  it('passes a fast agy run through unchanged (exit 0, stdout preserved)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\necho "OK reply"\nexit 0\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `expected clean exit, got ${r.status}; stderr=${r.stderr}`);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('propagates a non-timeout agy failure code verbatim (no false hard-cap message)', () => {
+  it('propagates a non-timeout agy failure code verbatim (no false hard-cap message)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\necho "boom" >&2\nexit 3\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '10s', AGY_TIMEOUT: '10s', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 3, 'a genuine agy failure code must pass through');
     assert.doesNotMatch(r.stderr, /exceeded the hard cap/, 'must not mislabel a non-timeout failure');
@@ -178,6 +190,12 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
+// The farm is READ-ONLY per invocation — built ONCE and shared (a per-call rebuild is thousands
+// of symlinks).
+const FARM_ROOT = mkdtempSync(join(tmpdir(), 'agy-farm-'));
+after(() => rmSync(FARM_ROOT, { recursive: true, force: true }));
+const FARM = makePathWithout(FARM_ROOT, ['agy', 'git']);
+
 describe('agy.sh — --help (pre-preflight, candidate C)', () => {
   it('--help and -h exit 0 with NO agy on PATH and name the documented usage', () => {
     for (const arg of ['--help', '-h']) {
@@ -185,7 +203,7 @@ describe('agy.sh — --help (pre-preflight, candidate C)', () => {
       // the help must not need the CLI even when the host has a real agy installed.
       const home = mkdtempSync(join(tmpdir(), 'agy-help-'));
       const r = spawnSync('bash', [WRAPPER, arg], {
-        env: { HOME: home, PATH: makePathWithout(home, ['agy', 'git']) },
+        env: { HOME: home, PATH: FARM },
         encoding: 'utf8',
         timeout: 15000,
       });
@@ -226,77 +244,77 @@ const writeSettings = (home, text) => {
 };
 const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
 
-describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
-  it('a file-set AGY_HARD_TIMEOUT is effective (killed at the file cap)', () => {
+describe('agy.sh — bridge settings file (bridges 2.3.0)', { concurrency: true }, () => {
+  it('a file-set AGY_HARD_TIMEOUT is effective (killed at the file cap)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 5\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=2s\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the file cap must apply when the env is unset');
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
   });
 
-  it('env overrides file: env=2s file=10m → killed at the env cap', () => {
+  it('env overrides file: env=2s file=10m → killed at the env cap', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 5\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=10m\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '2s', AGY_TIMEOUT: '2s', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the env cap (2s) must win over the file cap (10m)');
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
   });
 
-  it('an EXPLICITLY EMPTY env (AGY_HARD_TIMEOUT=) disables the file knob for one run', () => {
+  it('an EXPLICITLY EMPTY env (AGY_HARD_TIMEOUT=) disables the file knob for one run', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 3\necho "OK reply"\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=2s\n');
-    const r = runWrapper(home, { AGY_HARD_TIMEOUT: '', AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_HARD_TIMEOUT: '', AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `built-in default must apply (not the 2s file cap): ${r.stderr}`);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('duplicate key → the LAST occurrence wins (10m then 2s → killed at 2s)', () => {
+  it('duplicate key → the LAST occurrence wins (10m then 2s → killed at 2s)', async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 5\n');
     writeSettings(home, 'AGY_HARD_TIMEOUT=10m\nAGY_HARD_TIMEOUT=2s\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.notEqual(r.status, 0);
     assert.match(r.stderr, /exceeded the hard cap AGY_HARD_TIMEOUT=2s/);
   });
 
-  it('an invalid duration warns and falls back to the built-in default', () => {
+  it('an invalid duration warns and falls back to the built-in default', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'AGY_HARD_TIMEOUT=abc\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /invalid value 'abc'/);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a bare-integer duration (no unit suffix) is invalid → warn + built-in default', () => {
+  it('a bare-integer duration (no unit suffix) is invalid → warn + built-in default', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'AGY_HARD_TIMEOUT=90\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /invalid value '90'/, 'duration values require a unit suffix (5m/30m/90s)');
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a ZERO duration is invalid — timeout 0 would silently DISABLE the hard cap', () => {
+  it('a ZERO duration is invalid — timeout 0 would silently DISABLE the hard cap', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'AGY_HARD_TIMEOUT=0s\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /invalid value '0s'/, 'a persistent settings line must never remove the stall guard');
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a DIRECTORY at the settings path warns loudly and falls back to built-ins (no crash)', () => {
+  it('a DIRECTORY at the settings path warns loudly and falls back to built-ins (no crash)', async () => {
     const home = makeSandbox(RECORDING_STUB);
     mkdirSync(join(home, '.config', 'agent-workflow', 'bridge-settings.conf'), { recursive: true });
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `a directory must degrade honestly, not kill the run: ${r.stderr}`);
     assert.match(r.stderr, /unreadable or not a regular file/);
@@ -304,20 +322,20 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it("another bridge's valid key is skipped silently (and never applied)", () => {
+  it("another bridge's valid key is skipped silently (and never applied)", async () => {
     const home = makeSandbox('#!/usr/bin/env bash\nsleep 3\necho "OK reply"\n');
     writeSettings(home, 'CODEX_SERVICE_TIER=priority\nCODEX_HARD_TIMEOUT=2\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, `a codex key must not cap an agy run: ${r.stderr}`);
     assert.doesNotMatch(r.stderr, /bridge settings/, 'a recognized non-applied key earns NO warning');
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a truly unknown key warns ONCE naming the file; the run is unaffected', () => {
+  it('a truly unknown key warns ONCE naming the file; the run is unaffected', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, 'TOTALLY_UNKNOWN=1\nTOTALLY_UNKNOWN=2\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     const warns = r.stderr.match(/unknown key 'TOTALLY_UNKNOWN'/g) ?? [];
@@ -326,10 +344,10 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('malformed lines warn and are ignored; comments and blank lines are silent', () => {
+  it('malformed lines warn and are ignored; comments and blank lines are silent', async () => {
     const home = makeSandbox(RECORDING_STUB);
     writeSettings(home, '# a comment\n\nNOT A KEY VALUE LINE\n');
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     const malformed = r.stderr.match(/malformed line/g) ?? [];
@@ -337,22 +355,22 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('an existing-but-unreadable file warns loudly and falls back to built-ins', { skip: isRoot }, () => {
+  it('an existing-but-unreadable file warns loudly and falls back to built-ins', { skip: isRoot }, async () => {
     const home = makeSandbox(RECORDING_STUB);
     const file = writeSettings(home, 'AGY_HARD_TIMEOUT=2s\n');
     chmodSync(file, 0o000);
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /unreadable/);
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('a settings line can NEVER execute code (command-substitution payload inert)', () => {
+  it('a settings line can NEVER execute code (command-substitution payload inert)', async () => {
     const home = makeSandbox(RECORDING_STUB);
     const pwned = join(home, 'pwned');
     writeSettings(home, `AGY_HARD_TIMEOUT=$(touch ${pwned})\nEVIL_KEY=\`touch ${pwned}2\`\n`);
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     const executed = existsSync(pwned) || existsSync(`${pwned}2`);
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -360,9 +378,9 @@ describe('agy.sh — bridge settings file (bridges 2.3.0)', () => {
     assert.match(r.stdout, /OK reply/);
   });
 
-  it('no file → byte-identical behaviour to today (no settings chatter)', () => {
+  it('no file → byte-identical behaviour to today (no settings chatter)', async () => {
     const home = makeSandbox(RECORDING_STUB);
-    const r = runWrapper(home, { AGY_MODEL: '' });
+    const r = await runWrapperAsync(home, { AGY_MODEL: '' });
     rmSync(home, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.doesNotMatch(r.stderr, /bridge settings/);
@@ -398,7 +416,7 @@ describe('agy.sh — settings surface ⟷ manifest (D6, manifest-pinned)', () =>
   const runHelpText = () => {
     const home = mkdtempSync(join(tmpdir(), 'agy-settings-help-'));
     const r = spawnSync('bash', [WRAPPER, '--help'], {
-      env: { HOME: home, PATH: makePathWithout(home, ['agy', 'git']) },
+      env: { HOME: home, PATH: FARM },
       encoding: 'utf8',
       timeout: 15000,
     });
@@ -475,7 +493,7 @@ describe('agy.sh — mode catalog ⟷ wrapper reality (the contract-free raw mod
   const helpText = () => {
     const home = mkdtempSync(join(tmpdir(), 'agy-catalog-help-'));
     const r = spawnSync('bash', [WRAPPER, '--help'], {
-      env: { HOME: home, PATH: makePathWithout(home, ['agy', 'git']) },
+      env: { HOME: home, PATH: FARM },
       encoding: 'utf8',
       timeout: 15000,
     });

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,8 +3,9 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "provides": ["review", "probe"],
+  "posture": { "model": "Gemini 3.1 Pro (High)" },
   "roles": {
     "review": {
       "cmd": "agy-review",
@@ -29,7 +30,7 @@
           "agy-review --continue [--decided @f] [--focus \"…\"]",
           "agy-review --conversation <id> [--decided @f] [--focus \"…\"]"
         ],
-        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); a write failure warns, never fails the review",
+        "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); a write failure warns, never fails the review",
         "notes": [
           "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt"
         ]

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '2.8.0'
+  version: '3.0.0'
 ---
 
 # codex-cli-bridge
@@ -96,6 +96,13 @@ codex-review code                                # review the current working-tr
 codex-review code "focus on the new reducer"     # review with extra focus
 ```
 
+**Honesty + posture (D4/D5):** a run whose final message has no recognized
+`Verdict: <ship|revise|rethink>` line — empty or missing output included — **exits 4 with NO
+receipt**: treat it as a *failed review to re-run*, never a fatal session error. One stderr banner
+states the actual posture (`review posture: model=… effort=… tier=…`) and the receipt records the
+same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes in a
+posture value refuse pre-spend in every mode.
+
 `codex exec` is headless: there is **no TTY**, so `approval_policy=never` — anything needing
 escalation is refused and reported, never interactively approved. The wrappers capture only codex's
 **final message** (`-o`; the JSON event stream + reasoning go to a discarded trace), so output is

package/bridges/codex-cli-bridge/bin/codex-exec.test.mjs

@@ -1,13 +1,13 @@
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
 import {
   mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
-  existsSync, readdirSync, symlinkSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const WRAPPER = join(HERE, 'codex-exec.sh');
@@ -55,13 +55,16 @@ const FAKE_CODEX = [
   '',
 ].join('\n');
 
-const makeSandbox = () => {
-  const root = mkdtempSync(join(tmpdir(), 'codex-exec-test-'));
+// The sandbox base and the PATH farms are READ-ONLY per invocation, so both are built ONCE and
+// shared (a per-test `git init`+commit and a per-call farm rebuild dominate the wall otherwise).
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'codex-exec-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+
+const TEMPLATE_ROOT = (() => {
+  const root = join(SHARED_ROOT, 'template-root');
   const bin = join(root, 'bin');
   mkdirSync(bin, { recursive: true });
-  const stub = join(bin, 'codex');
-  writeFileSync(stub, FAKE_CODEX, { mode: 0o755 });
-  chmodSync(stub, 0o755);
+  writeFileSync(join(bin, 'codex'), FAKE_CODEX, { mode: 0o755 });
   // A git work tree with a root AGENTS.md — the wrapper preflights both.
   const repo = join(root, 'repo');
   mkdirSync(repo);
@@ -72,7 +75,15 @@ const makeSandbox = () => {
   writeFileSync(join(repo, 'AGENTS.md'), '# AGENTS\n\nHard Constraints: none (test fixture).\n');
   g('add', '-A');
   g('commit', '-qm', 'base');
-  return { root, bin, repo };
+  return root;
+})();
+
+const makeSandbox = () => {
+  const root = mkdtempSync(join(tmpdir(), 'codex-exec-test-'));
+  cpSync(TEMPLATE_ROOT, root, { recursive: true });
+  const bin = join(root, 'bin');
+  chmodSync(join(bin, 'codex'), 0o755);
+  return { root, bin, repo: join(root, 'repo') };
 };
 
 // A PATH dir mirroring the real one MINUS the named binaries, to exercise the
@@ -96,6 +107,13 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
+const farms = new Map();
+const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
 const run = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, path, cwd } = {}) => {
   const argvFile = join(repo, '.cap-argv');
   const envFile = join(repo, '.cap-env');
@@ -121,6 +139,33 @@ const run = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, pa
   return { ...r, argv: readIf(argvFile), capEnv: readIf(envFile), capStdin: readIf(stdinFile) };
 };
 
+// Async twin of run() for the sleep-bound timeout tests: spawnSync blocks the event loop for
+// the whole deliberate wait, so a concurrent describe could not overlap them. Same contract.
+const runAsync = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, path, cwd } = {}) =>
+  new Promise((done) => {
+    const argvFile = join(repo, '.cap-argv');
+    const envFile = join(repo, '.cap-env');
+    const stdinFile = join(repo, '.cap-stdin');
+    const child = execFile('bash', [WRAPPER, ...args], {
+      cwd: cwd || repo,
+      encoding: 'utf8',
+      timeout: 30000,
+      env: {
+        PATH: path || `${bin}:${process.env.PATH}`,
+        HOME: repo,
+        TMPDIR: process.env.TMPDIR ?? '/tmp',
+        CODEX_FAKE_ARGV: argvFile,
+        CODEX_FAKE_ENV: envFile,
+        CODEX_FAKE_STDIN: stdinFile,
+        ...env,
+      },
+    }, (error, stdout, stderr) => {
+      const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+      done({ status: error ? (error.code ?? 1) : 0, stdout, stderr, argv: readIf(argvFile), capEnv: readIf(envFile), capStdin: readIf(stdinFile) });
+    });
+    child.stdin.end(input);
+  });
+
 describe('codex-exec.sh — quality-first model/effort guard (1.1)', () => {
   it('refuses a non-default CODEX_MODEL and never spends a run', () => {
     const sb = makeSandbox();
@@ -344,11 +389,11 @@ describe('codex-exec.sh — leaner prompt (1.4)', () => {
   });
 });
 
-describe('codex-exec.sh — hard timeout (1.3)', () => {
-  it('kills a hung codex at CODEX_HARD_TIMEOUT and reports it', () => {
+describe('codex-exec.sh — hard timeout (1.3)', { concurrency: true }, () => {
+  it('kills a hung codex at CODEX_HARD_TIMEOUT and reports it', async () => {
     const sb = makeSandbox();
     const started = Date.now();
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '30', CODEX_HARD_TIMEOUT: '2' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '30', CODEX_HARD_TIMEOUT: '2' } });
     const elapsed = Date.now() - started;
     rmSync(sb.root, { recursive: true, force: true });
     assert.ok(elapsed < 18000, `must return well under the kill-after window, took ${elapsed}ms`);
@@ -358,7 +403,7 @@ describe('codex-exec.sh — hard timeout (1.3)', () => {
 
   it('warns and runs uncapped when neither timeout nor gtimeout is on PATH', () => {
     const sb = makeSandbox();
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['timeout', 'gtimeout'])}`;
+    const path = `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`;
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -368,7 +413,7 @@ describe('codex-exec.sh — hard timeout (1.3)', () => {
 
   it('resume runs uncapped (and warns) when no timeout binary is on PATH', () => {
     const sb = makeSandbox();
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['timeout', 'gtimeout'])}`;
+    const path = `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`;
     const r = run(sb, { args: ['--resume', 'sess-1', '-'], input: 'go', path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -545,7 +590,7 @@ describe('codex-exec.sh — environment preflight (fail fast, before a run)', ()
   it('STOPs with 127 when codex is not on PATH', () => {
     const sb = makeSandbox();
     // PATH WITHOUT the fake codex bin and without any real codex.
-    const path = makePathWithout(sb.root, ['codex']);
+    const path = farmFor(['codex']);
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 127);
@@ -556,7 +601,7 @@ describe('codex-exec.sh — environment preflight (fail fast, before a run)', ()
   it('STOPs with 127 when git is not on PATH', () => {
     const sb = makeSandbox();
     // codex present (sb.bin) but git stripped — exercises the type -P git guard.
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['git'])}`;
+    const path = `${sb.bin}:${farmFor(['git'])}`;
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 127);
@@ -681,7 +726,7 @@ const runHelp = (arg) => {
   const root = mkdtempSync(join(tmpdir(), 'codex-exec-help-'));
   const nongit = join(root, 'nongit');
   mkdirSync(nongit, { recursive: true });
-  const path = makePathWithout(root, ['codex', 'agy', 'git']);
+  const path = farmFor(['codex', 'agy', 'git']);
   const r = spawnSync('bash', [WRAPPER, arg], {
     cwd: nongit, encoding: 'utf8', timeout: 15000, env: { HOME: root, PATH: path },
   });
@@ -1027,20 +1072,20 @@ describe('codex-exec.sh — service tier knob (bridges 2.3.0)', () => {
 
 });
 
-describe('codex-exec.sh — bridge settings file semantics (bridges 2.3.0)', () => {
-  it('env overrides file: CODEX_HARD_TIMEOUT env=2 file=9999 → killed at the env cap', () => {
+describe('codex-exec.sh — bridge settings file semantics (bridges 2.3.0)', { concurrency: true }, () => {
+  it('env overrides file: CODEX_HARD_TIMEOUT env=2 file=9999 → killed at the env cap', async () => {
     const sb = makeSandbox();
     writeSettings(sb, 'CODEX_HARD_TIMEOUT=9999\n');
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '5', CODEX_HARD_TIMEOUT: '2' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '5', CODEX_HARD_TIMEOUT: '2' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the env cap (2s) must win over the file cap (9999s)');
     assert.match(r.stderr, /exceeded the hard cap CODEX_HARD_TIMEOUT=2s/);
   });
 
-  it('a file-set CODEX_HARD_TIMEOUT is effective (killed at the file cap)', () => {
+  it('a file-set CODEX_HARD_TIMEOUT is effective (killed at the file cap)', async () => {
     const sb = makeSandbox();
     writeSettings(sb, 'CODEX_HARD_TIMEOUT=2\n');
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '5' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '5' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the file cap must apply when the env is unset');
     assert.match(r.stderr, /exceeded the hard cap CODEX_HARD_TIMEOUT=2s/);