@sabaiway/agent-workflow-kit 3.0.0 → 3.2.0

package/bridges/codex-cli-bridge/bin/codex-exec.test.mjs

@@ -1,13 +1,13 @@
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
 import {
   mkdtempSync, mkdirSync, writeFileSync, chmodSync, rmSync, readFileSync,
-  existsSync, readdirSync, symlinkSync,
+  existsSync, readdirSync, symlinkSync, cpSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFile } from 'node:child_process';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const WRAPPER = join(HERE, 'codex-exec.sh');
@@ -28,7 +28,7 @@ const FAKE_CODEX = [
   '{ for a in "$@"; do echo "$a"; done; } >"$CODEX_FAKE_ARGV"',
   '{ echo "HOME=${HOME:-}"; echo "CODEX_HOME=${CODEX_HOME:-}"; echo "XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-}"; echo "OPENAI_API_KEY=${OPENAI_API_KEY:-<unset>}"; echo "OPENAI_BASE_URL=${OPENAI_BASE_URL:-<unset>}"; echo "FOO_API_KEY=${FOO_API_KEY:-<unset>}"; echo "CODEX_REAL_GIT=${CODEX_REAL_GIT:-<unset>}"; } >"$CODEX_FAKE_ENV"',
   'cat >"$CODEX_FAKE_STDIN"',
-  'if [[ "${CODEX_FAKE_GIT_PROBE:-}" == "1" ]]; then { echo "realgit_env=${CODEX_REAL_GIT:-unset}"; echo "status=$(git status --short >/dev/null 2>&1; echo $?)"; echo "diff=$(git --no-pager diff >/dev/null 2>&1; echo $?)"; echo "dashC_read=$(git -C . status --short >/dev/null 2>&1; echo $?)"; echo "dashc_read=$(git -c core.pager=cat status --short >/dev/null 2>&1; echo $?)"; echo "bare=$(git >/dev/null 2>&1; echo $?)"; echo "commit=$(git commit -m x >/dev/null 2>&1; echo $?)"; echo "add=$(git add -A >/dev/null 2>&1; echo $?)"; echo "checkout=$(git checkout -- . >/dev/null 2>&1; echo $?)"; echo "unknown=$(git frobnicate >/dev/null 2>&1; echo $?)"; echo "config_read=$(git config user.name >/dev/null 2>&1; echo $?)"; echo "config_list=$(git config --list >/dev/null 2>&1; echo $?)"; echo "config_bare=$(git config >/dev/null 2>&1; echo $?)"; echo "config_write=$(git config user.name HACKED >/dev/null 2>&1; echo $?)"; echo "config_bypass=$(git config --get --add a.b v >/dev/null 2>&1; echo $?)"; echo "symref_write=$(git symbolic-ref HEAD refs/heads/x >/dev/null 2>&1; echo $?)"; echo "reflog_write=$(git reflog expire --all >/dev/null 2>&1; echo $?)"; } > "${CODEX_FAKE_GIT_RESULT:-/dev/null}" 2>&1; fi',
+  'if [[ "${CODEX_FAKE_GIT_PROBE:-}" == "1" ]]; then { echo "realgit_env=${CODEX_REAL_GIT:-unset}"; echo "status=$(git status --short >/dev/null 2>&1; echo $?)"; echo "diff=$(git --no-pager diff >/dev/null 2>&1; echo $?)"; echo "dashC_read=$(git -C . status --short >/dev/null 2>&1; echo $?)"; echo "dashc_read=$(git -c core.pager=cat status --short >/dev/null 2>&1; echo $?)"; echo "bare=$(git >/dev/null 2>&1; echo $?)"; echo "commit=$(git commit -m x >/dev/null 2>&1; echo $?)"; echo "add=$(git add -A >/dev/null 2>&1; echo $?)"; echo "checkout=$(git checkout -- . >/dev/null 2>&1; echo $?)"; echo "unknown=$(git frobnicate >/dev/null 2>&1; echo $?)"; echo "config_read=$(git config user.name >/dev/null 2>&1; echo $?)"; echo "config_list=$(git config --list >/dev/null 2>&1; echo $?)"; echo "config_bare=$(git config >/dev/null 2>&1; echo $?)"; echo "config_write=$(git config user.name HACKED >/dev/null 2>&1; echo $?)"; echo "config_bypass=$(git config --get --add a.b v >/dev/null 2>&1; echo $?)"; echo "symref_write=$(git symbolic-ref HEAD refs/heads/x >/dev/null 2>&1; echo $?)"; echo "reflog_write=$(git reflog expire --all >/dev/null 2>&1; echo $?)"; echo "cdaway=$(cd / && git --version >/dev/null 2>&1; echo $?)"; } > "${CODEX_FAKE_GIT_RESULT:-/dev/null}" 2>&1; fi',
   'if [[ -n "${CODEX_FAKE_SLEEP:-}" ]]; then sleep "${CODEX_FAKE_SLEEP}"; fi',
   'out=""',
   'prev=""',
@@ -55,13 +55,16 @@ const FAKE_CODEX = [
   '',
 ].join('\n');
 
-const makeSandbox = () => {
-  const root = mkdtempSync(join(tmpdir(), 'codex-exec-test-'));
+// The sandbox base and the PATH farms are READ-ONLY per invocation, so both are built ONCE and
+// shared (a per-test `git init`+commit and a per-call farm rebuild dominate the wall otherwise).
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'codex-exec-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+
+const TEMPLATE_ROOT = (() => {
+  const root = join(SHARED_ROOT, 'template-root');
   const bin = join(root, 'bin');
   mkdirSync(bin, { recursive: true });
-  const stub = join(bin, 'codex');
-  writeFileSync(stub, FAKE_CODEX, { mode: 0o755 });
-  chmodSync(stub, 0o755);
+  writeFileSync(join(bin, 'codex'), FAKE_CODEX, { mode: 0o755 });
   // A git work tree with a root AGENTS.md — the wrapper preflights both.
   const repo = join(root, 'repo');
   mkdirSync(repo);
@@ -72,7 +75,15 @@ const makeSandbox = () => {
   writeFileSync(join(repo, 'AGENTS.md'), '# AGENTS\n\nHard Constraints: none (test fixture).\n');
   g('add', '-A');
   g('commit', '-qm', 'base');
-  return { root, bin, repo };
+  return root;
+})();
+
+const makeSandbox = () => {
+  const root = mkdtempSync(join(tmpdir(), 'codex-exec-test-'));
+  cpSync(TEMPLATE_ROOT, root, { recursive: true });
+  const bin = join(root, 'bin');
+  chmodSync(join(bin, 'codex'), 0o755);
+  return { root, bin, repo: join(root, 'repo') };
 };
 
 // A PATH dir mirroring the real one MINUS the named binaries, to exercise the
@@ -96,6 +107,13 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
+const farms = new Map();
+const farmFor = (exclude) => {
+  const key = exclude.join('|');
+  if (!farms.has(key)) farms.set(key, makePathWithout(SHARED_ROOT, exclude));
+  return farms.get(key);
+};
+
 const run = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, path, cwd } = {}) => {
   const argvFile = join(repo, '.cap-argv');
   const envFile = join(repo, '.cap-env');
@@ -121,6 +139,33 @@ const run = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, pa
   return { ...r, argv: readIf(argvFile), capEnv: readIf(envFile), capStdin: readIf(stdinFile) };
 };
 
+// Async twin of run() for the sleep-bound timeout tests: spawnSync blocks the event loop for
+// the whole deliberate wait, so a concurrent describe could not overlap them. Same contract.
+const runAsync = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, path, cwd } = {}) =>
+  new Promise((done) => {
+    const argvFile = join(repo, '.cap-argv');
+    const envFile = join(repo, '.cap-env');
+    const stdinFile = join(repo, '.cap-stdin');
+    const child = execFile('bash', [WRAPPER, ...args], {
+      cwd: cwd || repo,
+      encoding: 'utf8',
+      timeout: 30000,
+      env: {
+        PATH: path || `${bin}:${process.env.PATH}`,
+        HOME: repo,
+        TMPDIR: process.env.TMPDIR ?? '/tmp',
+        CODEX_FAKE_ARGV: argvFile,
+        CODEX_FAKE_ENV: envFile,
+        CODEX_FAKE_STDIN: stdinFile,
+        ...env,
+      },
+    }, (error, stdout, stderr) => {
+      const readIf = (p) => (existsSync(p) ? readFileSync(p, 'utf8') : '');
+      done({ status: error ? (error.code ?? 1) : 0, stdout, stderr, argv: readIf(argvFile), capEnv: readIf(envFile), capStdin: readIf(stdinFile) });
+    });
+    child.stdin.end(input);
+  });
+
 describe('codex-exec.sh — quality-first model/effort guard (1.1)', () => {
   it('refuses a non-default CODEX_MODEL and never spends a run', () => {
     const sb = makeSandbox();
@@ -344,11 +389,11 @@ describe('codex-exec.sh — leaner prompt (1.4)', () => {
   });
 });
 
-describe('codex-exec.sh — hard timeout (1.3)', () => {
-  it('kills a hung codex at CODEX_HARD_TIMEOUT and reports it', () => {
+describe('codex-exec.sh — hard timeout (1.3)', { concurrency: true }, () => {
+  it('kills a hung codex at CODEX_HARD_TIMEOUT and reports it', async () => {
     const sb = makeSandbox();
     const started = Date.now();
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '30', CODEX_HARD_TIMEOUT: '2' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '30', CODEX_HARD_TIMEOUT: '2' } });
     const elapsed = Date.now() - started;
     rmSync(sb.root, { recursive: true, force: true });
     assert.ok(elapsed < 18000, `must return well under the kill-after window, took ${elapsed}ms`);
@@ -358,7 +403,7 @@ describe('codex-exec.sh — hard timeout (1.3)', () => {
 
   it('warns and runs uncapped when neither timeout nor gtimeout is on PATH', () => {
     const sb = makeSandbox();
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['timeout', 'gtimeout'])}`;
+    const path = `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`;
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -368,7 +413,7 @@ describe('codex-exec.sh — hard timeout (1.3)', () => {
 
   it('resume runs uncapped (and warns) when no timeout binary is on PATH', () => {
     const sb = makeSandbox();
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['timeout', 'gtimeout'])}`;
+    const path = `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`;
     const r = run(sb, { args: ['--resume', 'sess-1', '-'], input: 'go', path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
@@ -545,7 +590,7 @@ describe('codex-exec.sh — environment preflight (fail fast, before a run)', ()
   it('STOPs with 127 when codex is not on PATH', () => {
     const sb = makeSandbox();
     // PATH WITHOUT the fake codex bin and without any real codex.
-    const path = makePathWithout(sb.root, ['codex']);
+    const path = farmFor(['codex']);
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 127);
@@ -556,7 +601,7 @@ describe('codex-exec.sh — environment preflight (fail fast, before a run)', ()
   it('STOPs with 127 when git is not on PATH', () => {
     const sb = makeSandbox();
     // codex present (sb.bin) but git stripped — exercises the type -P git guard.
-    const path = `${sb.bin}:${makePathWithout(sb.root, ['git'])}`;
+    const path = `${sb.bin}:${farmFor(['git'])}`;
     const r = run(sb, { path });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 127);
@@ -681,7 +726,7 @@ const runHelp = (arg) => {
   const root = mkdtempSync(join(tmpdir(), 'codex-exec-help-'));
   const nongit = join(root, 'nongit');
   mkdirSync(nongit, { recursive: true });
-  const path = makePathWithout(root, ['codex', 'agy', 'git']);
+  const path = farmFor(['codex', 'agy', 'git']);
   const r = spawnSync('bash', [WRAPPER, arg], {
     cwd: nongit, encoding: 'utf8', timeout: 15000, env: { HOME: root, PATH: path },
   });
@@ -1027,20 +1072,20 @@ describe('codex-exec.sh — service tier knob (bridges 2.3.0)', () => {
 
 });
 
-describe('codex-exec.sh — bridge settings file semantics (bridges 2.3.0)', () => {
-  it('env overrides file: CODEX_HARD_TIMEOUT env=2 file=9999 → killed at the env cap', () => {
+describe('codex-exec.sh — bridge settings file semantics (bridges 2.3.0)', { concurrency: true }, () => {
+  it('env overrides file: CODEX_HARD_TIMEOUT env=2 file=9999 → killed at the env cap', async () => {
     const sb = makeSandbox();
     writeSettings(sb, 'CODEX_HARD_TIMEOUT=9999\n');
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '5', CODEX_HARD_TIMEOUT: '2' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '5', CODEX_HARD_TIMEOUT: '2' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the env cap (2s) must win over the file cap (9999s)');
     assert.match(r.stderr, /exceeded the hard cap CODEX_HARD_TIMEOUT=2s/);
   });
 
-  it('a file-set CODEX_HARD_TIMEOUT is effective (killed at the file cap)', () => {
+  it('a file-set CODEX_HARD_TIMEOUT is effective (killed at the file cap)', async () => {
     const sb = makeSandbox();
     writeSettings(sb, 'CODEX_HARD_TIMEOUT=2\n');
-    const r = run(sb, { env: { CODEX_FAKE_SLEEP: '5' } });
+    const r = await runAsync(sb, { env: { CODEX_FAKE_SLEEP: '5' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0, 'the file cap must apply when the env is unset');
     assert.match(r.stderr, /exceeded the hard cap CODEX_HARD_TIMEOUT=2s/);
@@ -1225,3 +1270,213 @@ describe('codex-exec.sh — settings surface ⟷ manifest (D6, manifest-pinned)'
     }
   });
 });
+
+describe('codex-exec.sh — dispatch-posture labeling (D5, AD-061)', () => {
+  const banners = (stderr) => stderr.split('\n').filter((l) => l.startsWith('exec posture: '));
+
+  it('ONE banner line carries the ACTUAL {model, effort, tier, sandbox, session, timeout} on a fresh run', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {});
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    const lines = banners(r.stderr);
+    assert.equal(lines.length, 1, 'EXACTLY ONE banner line per run');
+    assert.equal(lines[0],
+      'exec posture: model=gpt-5.6-sol effort=xhigh tier=standard sandbox=workspace-write session=fresh timeout=3600s');
+  });
+
+  it('an ARMED Fast tier rides the banner (tier=priority)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { env: { CODEX_SERVICE_TIER: 'priority' } });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^exec posture: .* tier=priority .*$/m);
+  });
+
+  it('a resume banner carries the RESOLVED session id (explicit --resume)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { args: ['--resume', 'sess-xyz', '-'] });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    const lines = banners(r.stderr);
+    assert.equal(lines.length, 1, 'EXACTLY ONE banner line on resume too');
+    assert.match(lines[0], / session=resume:sess-xyz /, 'the banner names the resolved id');
+  });
+
+  it('--resume-last resolves the sidecar id into the banner', () => {
+    const sb = makeSandbox();
+    writeFileSync(join(sb.repo, '.codex-last-session'), 'sess-from-sidecar\n');
+    const r = run(sb, { args: ['--resume-last', '-'] });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, / session=resume:sess-from-sidecar /);
+  });
+
+  it('a HOSTILE/malformed EXPLICIT session id refuses pre-spend (no codex invocation)', () => {
+    for (const hostile of ['evil;rm -rf /', 'a b', `x${String.fromCharCode(1)}y`]) {
+      const sb = makeSandbox();
+      const r = run(sb, { args: ['--resume', hostile, '-'] });
+      rmSync(sb.root, { recursive: true, force: true });
+      assert.notEqual(r.status, 0, `must refuse: ${JSON.stringify(hostile)}`);
+      assert.equal(r.capStdin, '', 'codex is never invoked');
+      assert.match(r.stderr, /session id/i, 'named as the session-id class');
+    }
+  });
+
+  it('a HOSTILE SIDECAR-READ session id refuses pre-spend the same way', () => {
+    const sb = makeSandbox();
+    writeFileSync(join(sb.repo, '.codex-last-session'), 'evil$(touch pwned)\n');
+    const r = run(sb, { args: ['--resume-last', '-'] });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.capStdin, '', 'codex is never invoked');
+    assert.match(r.stderr, /session id/i);
+  });
+
+  it('a FLAG-SHAPED sidecar id (leading dash) refuses at the grammar — never reaches codex as an option', () => {
+    for (const bad of ['--last\n', '-x\n']) {
+      const sb = makeSandbox();
+      writeFileSync(join(sb.repo, '.codex-last-session'), bad);
+      const r = run(sb, { args: ['--resume-last', '-'] });
+      rmSync(sb.root, { recursive: true, force: true });
+      assert.notEqual(r.status, 0, `must refuse: ${JSON.stringify(bad)}`);
+      assert.equal(r.capStdin, '', 'codex is never invoked');
+      assert.match(r.stderr, /session id/i, 'refused at the grammar, never parsed as a codex option');
+    }
+  });
+
+  it('a sidecar carrying a NUL byte refuses pre-spend — bash would silently repair it into a valid id', () => {
+    const sb = makeSandbox();
+    writeFileSync(join(sb.repo, '.codex-last-session'), Buffer.from('sess-\0target\n', 'binary'));
+    const r = run(sb, { args: ['--resume-last', '-'] });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.notEqual(r.status, 0);
+    assert.equal(r.capStdin, '', 'codex is never invoked');
+    assert.match(r.stderr, /NUL/i, 'named as the NUL class — the raw bytes are checked before the shell variable');
+  });
+
+  it('a valid id containing the ASCII digit 0 gets no false NUL refusal', () => {
+    const sb = makeSandbox();
+    writeFileSync(join(sb.repo, '.codex-last-session'), 'sess-01\n');
+    const r = run(sb, { args: ['--resume-last', '-'] });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, / session=resume:sess-01 /);
+  });
+
+  it('a sidecar id with inner WHITESPACE refuses — never silently repaired into a different id', () => {
+    for (const bad of ['sess bad\n', 'sess\tbad\n']) {
+      const sb = makeSandbox();
+      writeFileSync(join(sb.repo, '.codex-last-session'), bad);
+      const r = run(sb, { args: ['--resume-last', '-'] });
+      rmSync(sb.root, { recursive: true, force: true });
+      assert.notEqual(r.status, 0, `must refuse: ${JSON.stringify(bad)}`);
+      assert.equal(r.capStdin, '', 'codex is never invoked');
+      assert.match(r.stderr, /session id/i, 'the grammar refusal fires — the id is never whitespace-stripped into validity');
+    }
+  });
+
+  it('a banner field carrying CONTROL BYTES refuses pre-spend (model / effort / tier / timeout / DEL)', () => {
+    const cases = [
+      { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(1)}` },
+      { CODEX_EFFORT: `xhigh${String.fromCharCode(2)}` },
+      { CODEX_SERVICE_TIER: `priority${String.fromCharCode(3)}` },
+      { CODEX_HARD_TIMEOUT: `3600${String.fromCharCode(4)}` },
+      { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(127)}` },
+    ];
+    for (const env of cases) {
+      const sb = makeSandbox();
+      const r = run(sb, { env });
+      rmSync(sb.root, { recursive: true, force: true });
+      assert.notEqual(r.status, 0, `must refuse: ${JSON.stringify(env)}`);
+      assert.equal(r.capStdin, '', 'codex is never invoked');
+      assert.match(r.stderr, /control/i, 'named as the control-byte class');
+    }
+  });
+
+  it('timeout honesty: no timeout/gtimeout on PATH → timeout=uncapped, never a fabricated number', () => {
+    const sb = makeSandbox();
+    const r = run(sb, { path: `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}` });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^exec posture: .* timeout=uncapped$/m);
+  });
+
+  it('an EXPORTED shell function shadowing timeout never fools the banner (type -P discipline)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      path: `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`,
+      env: { 'BASH_FUNC_timeout%%': '() { return 0; }' },
+    });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^exec posture: .* timeout=uncapped$/m, 'a shell function is not a capping binary');
+  });
+
+  it('an EXPORTED `type` function faking a path never fools the resolver (builtin type discipline)', () => {
+    const sb = makeSandbox();
+    const r = run(sb, {
+      path: `${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`,
+      env: { 'BASH_FUNC_type%%': '() { echo /fake/timeout; }' },
+    });
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^exec posture: .* timeout=uncapped$/m, 'builtin type bypasses an exported type function');
+  });
+
+  it('a RELATIVE first PATH git entry + shadowed dirname/basename still bakes an ABSOLUTE real git into the shim', () => {
+    const sb = makeSandbox();
+    const realGit = (process.env.PATH || '').split(':').filter(Boolean).map((d) => join(d, 'git')).find((p) => existsSync(p));
+    assert.ok(realGit, 'a real git exists on PATH');
+    mkdirSync(join(sb.repo, 'relgit'), { recursive: true });
+    writeFileSync(join(sb.repo, 'relgit', 'git'), `#!/usr/bin/env bash\nexec ${realGit} "$@"\n`, { mode: 0o755 });
+    const gitResult = join(sb.repo, '.cap-git');
+    const r = run(sb, {
+      path: `relgit:${sb.bin}:${process.env.PATH}`,
+      env: {
+        CODEX_FAKE_GIT_PROBE: '1',
+        CODEX_FAKE_GIT_RESULT: gitResult,
+        'BASH_FUNC_dirname%%': '() { echo /shadowed; }',
+        'BASH_FUNC_basename%%': '() { echo shadowed; }',
+      },
+    });
+    const probe = existsSync(gitResult) ? readFileSync(gitResult, 'utf8') : '';
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(probe, /cdaway=0/, 'the shim git works from a different cwd — the embedded path is absolute, shadow-proof');
+  });
+
+  it('a RELATIVE PATH entry still yields an ABSOLUTE capping binary (the stub sees an absolute $0)', () => {
+    const sb = makeSandbox();
+    mkdirSync(join(sb.repo, 'relbin'), { recursive: true });
+    const cap = join(sb.repo, '.stub-argv0');
+    writeFileSync(join(sb.repo, 'relbin', 'timeout'), [
+      '#!/usr/bin/env bash',
+      'echo "$0" >"$TIMEOUT_STUB_CAP"',
+      'while [[ "$1" == --* ]]; do shift; done',
+      'shift',
+      'exec "$@"',
+      '',
+    ].join('\n'), { mode: 0o755 });
+    const r = run(sb, {
+      path: `relbin:${sb.bin}:${farmFor(['timeout', 'gtimeout'])}`,
+      env: { TIMEOUT_STUB_CAP: cap },
+    });
+    const argv0 = existsSync(cap) ? readFileSync(cap, 'utf8').trim() : '';
+    rmSync(sb.root, { recursive: true, force: true });
+    assert.equal(r.status, 0, r.stderr);
+    assert.match(r.stderr, /^exec posture: .* timeout=3600s$/m, 'the relative-PATH binary still caps the run');
+    assert.ok(argv0.startsWith('/'), `the stub must be invoked by ABSOLUTE path, got: ${JSON.stringify(argv0)}`);
+  });
+
+  it('an INVALID effective CODEX_HARD_TIMEOUT (env — the closed aw_settings_valid bypass) warns and falls back to the default', () => {
+    for (const bad of ['abc', '0', '999999999']) {
+      const sb = makeSandbox();
+      const r = run(sb, { env: { CODEX_HARD_TIMEOUT: bad } });
+      rmSync(sb.root, { recursive: true, force: true });
+      assert.equal(r.status, 0, r.stderr);
+      assert.match(r.stderr, new RegExp(`invalid value '${bad}' for CODEX_HARD_TIMEOUT`), 'the fallback is loud');
+      assert.match(r.stderr, /^exec posture: .* timeout=3600s$/m, 'the banner prints the built-in default, never the bad value');
+    }
+  });
+});

package/bridges/codex-cli-bridge/bin/codex-review-honesty.test.mjs

@@ -5,9 +5,9 @@
 // CODEX_SERVICE_TIER BEFORE tier validation (no multiline warning echo, no silent standard-tier
 // run). Colocated separately — codex-review.test.mjs is red-proof-frozen; standalone harness.
 
-import { describe, it } from 'node:test';
+import { describe, it, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync, existsSync, readdirSync, symlinkSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync, existsSync, readdirSync, symlinkSync, cpSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -46,12 +46,17 @@ const makePathWithout = (root, exclude = []) => {
   return dir;
 };
 
-const makeSandbox = () => {
-  const root = mkdtempSync(join(tmpdir(), 'codex-honesty-'));
+// Farm + sandbox base are READ-ONLY per invocation — built ONCE, shared (a per-run farm rebuild
+// plus a per-test `git init`+commit dominate the wall otherwise).
+const SHARED_ROOT = mkdtempSync(join(tmpdir(), 'codex-honesty-shared-'));
+after(() => rmSync(SHARED_ROOT, { recursive: true, force: true }));
+const FARM = makePathWithout(SHARED_ROOT, ['codex']);
+
+const TEMPLATE_ROOT = (() => {
+  const root = join(SHARED_ROOT, 'template-root');
   const bin = join(root, 'bin');
   mkdirSync(bin, { recursive: true });
   writeFileSync(join(bin, 'codex'), FAKE_CODEX, { mode: 0o755 });
-  chmodSync(join(bin, 'codex'), 0o755);
   const repo = join(root, 'repo');
   mkdirSync(repo);
   const g = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
@@ -62,7 +67,15 @@ const makeSandbox = () => {
   g('add', '-A');
   g('commit', '-qm', 'base');
   writeFileSync(join(repo, 'pending.txt'), 'PENDING\n');
-  return { root, bin, repo };
+  return root;
+})();
+
+const makeSandbox = () => {
+  const root = mkdtempSync(join(tmpdir(), 'codex-honesty-'));
+  cpSync(TEMPLATE_ROOT, root, { recursive: true });
+  const bin = join(root, 'bin');
+  chmodSync(join(bin, 'codex'), 0o755);
+  return { root, bin, repo: join(root, 'repo') };
 };
 
 const run = (sb, { args = ['code'], env = {} } = {}) => {
@@ -73,7 +86,7 @@ const run = (sb, { args = ['code'], env = {} } = {}) => {
     timeout: 30000,
     env: {
       HOME: sb.repo,
-      PATH: `${sb.bin}:${makePathWithout(sb.root, ['codex'])}`,
+      PATH: `${sb.bin}:${FARM}`,
       TMPDIR: process.env.TMPDIR ?? '/tmp',
       CODEX_HOME: join(sb.root, 'codex-home'),
       CODEX_FAKE_SENTINEL: sentinel,

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -79,12 +79,21 @@ Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins ov
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 1800)
   CODEX_REVIEW_MAX_TOTAL_BYTES — inline-payload cap, integer bytes 1..100000000 (default 1500000); above it the diff rides via a git-dir temp file
 
+Notes:
+  the review posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the
+  duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run;
+  INFORMATIONAL only: it never enters the receipt posture or the D5 banner↔receipt parity
+  quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
+  posture; a prose re-type drifts
+
 Honesty + posture (D4/D5):
   a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or
   missing output included — exits 4 with NO receipt: a FAILED review to RE-RUN, never a fatal
   session error. One stderr banner line states the ACTUAL run posture (review posture: model=…
-  effort=… tier=…) and the receipt records the same posture {model, effort, tier} (tier null on
-  the standard tier). A posture value carrying control bytes refuses pre-spend in every mode.
+  effort=… tier=… timeout=…) and the receipt records the same posture {model, effort, tier} (tier
+  null on the standard tier; the timeout field is banner-only — never a receipt field). Quote the
+  posture banner verbatim when labeling this dispatch. A posture value carrying control bytes
+  refuses pre-spend in every mode.
 
 Environment: CODEX_REVIEW_SCHEMA=1 (structured JSON findings), CODEX_HARD_TIMEOUT (seconds, default 1800), CODEX_PROBE=1 (throwaway probe only), AW_REVIEW_RECEIPTS (receipt file override).
 Requires at run time: the codex CLI on PATH, a ChatGPT-subscription login, a git work tree with a root AGENTS.md (--help needs none of these).
@@ -201,12 +210,62 @@ aw_apply_settings() {
 }
 aw_apply_settings
 
+# --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
+# ONE rule, both bridges: the posture banner prints EXACTLY the duration handed to timeout(1) —
+# an integer-seconds value rendered with the `s` suffix, a duration string verbatim — and
+# `timeout=uncapped` when no timeout/gtimeout binary can cap the run; never a fabricated number.
+# The EFFECTIVE value (env included — closing the aw_settings_valid env bypass) is validated by
+# the same per-key rule as the settings file, plus a 7-digit integer-part bound (overflow); an
+# invalid value warns + falls back to the built-in default — a typo never silently masquerades
+# as a cap. AGY_TIMEOUT shares AGY_HARD_TIMEOUT's duration rule (it has no settings-file arm).
+aw_effective_timeout() {
+  local key="$1" default="$2" value="${!1:-}" rule="$1" intpart
+  [[ "$rule" == "AGY_TIMEOUT" ]] && rule="AGY_HARD_TIMEOUT"
+  [[ -n "$value" ]] || { printf '%s' "$default"; return 0; }
+  intpart="${value%%[!0-9]*}"
+  if ! aw_settings_valid "$rule" "$value" || (( ${#intpart} > 7 )); then
+    # %q escapes the raw value so a control byte in it can never forge an extra diagnostic line
+    # (the direct agy-run lane has no pre-spend screen — the warning itself must be injection-proof).
+    printf "warning: invalid value '%q' for %s — using the built-in default %s.\n" "$value" "$key" "$default" >&2
+    printf '%s' "$default"
+    return 0
+  fi
+  printf '%s' "$value"
+}
+aw_timeout_label() {
+  local bin="$1" value="$2"
+  [[ -n "$bin" ]] || { printf 'uncapped'; return 0; }
+  case "$value" in
+    *[!0-9]*) printf '%s' "$value" ;;
+    *) printf '%ss' "$value" ;;
+  esac
+}
+aw_resolve_timeout_bin() {
+  local bin dir base
+  bin="$(builtin type -P timeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || bin="$(builtin type -P gtimeout 2>/dev/null || true)"
+  [[ -n "$bin" ]] || { printf ''; return 0; }
+  case "$bin" in
+    /*) ;;
+    *)
+      case "$bin" in
+        */*) dir="${bin%/*}"; base="${bin##*/}" ;;
+        *) dir="."; base="$bin" ;;
+      esac
+      dir="$(builtin cd -- "$dir" 2>/dev/null && builtin pwd -P)" || { printf ''; return 0; }
+      bin="$dir/$base"
+      ;;
+  esac
+  [[ -f "$bin" && -x "$bin" ]] || { printf ''; return 0; }
+  printf '%s' "$bin"
+}
+
 DEFAULT_CODEX_MODEL="gpt-5.6-sol"
 DEFAULT_CODEX_EFFORT="xhigh"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.0.0"
+AW_BRIDGE_VERSION="3.1.0"
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
 # Generous hard cap for a slow xhigh review (subscription latency varies).
@@ -225,12 +284,13 @@ CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
 # D5 pre-spend control-byte screen — BEFORE tier validation (a malformed value is not a policy
 # question; validating first would echo the hostile value into a multiline warning and then run
 # on the standard tier, defeating the stated refusal). Screens the RAW model/effort/tier.
-for _posture_pair in "CODEX_MODEL=$CODEX_MODEL" "CODEX_EFFORT=$CODEX_EFFORT" "CODEX_SERVICE_TIER=$CODEX_SERVICE_TIER"; do
-  if [[ "${_posture_pair#*=}" == *[$'\x01'-$'\x1f']* ]]; then
+for _posture_pair in "CODEX_MODEL=$CODEX_MODEL" "CODEX_EFFORT=$CODEX_EFFORT" "CODEX_SERVICE_TIER=$CODEX_SERVICE_TIER" "CODEX_HARD_TIMEOUT=$CODEX_HARD_TIMEOUT"; do
+  if [[ "${_posture_pair#*=}" == *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
     echo "error: ${_posture_pair%%=*} contains control bytes — fix the setting (env or bridge-settings.conf) and re-run." >&2
     exit 2
   fi
 done
+CODEX_HARD_TIMEOUT="$(aw_effective_timeout CODEX_HARD_TIMEOUT 1800)"
 if [[ -n "$CODEX_SERVICE_TIER" ]] && ! aw_settings_valid CODEX_SERVICE_TIER "$CODEX_SERVICE_TIER"; then
   echo "warning: CODEX_SERVICE_TIER='$CODEX_SERVICE_TIER' is not a supported service tier ('priority') — running on the standard tier." >&2
   CODEX_SERVICE_TIER=""
@@ -243,8 +303,15 @@ CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 
 # --- D5 banner (one line, the ACTUAL run posture) -------------------------------------------
 # The control-byte screen already ran above (BEFORE tier validation); the banner states the
-# EFFECTIVE posture (post tier validation) and the receipt records the same fields.
-echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard}" >&2
+# EFFECTIVE posture (post tier validation) and the receipt records the same fields — except
+# `timeout`, a BANNER-ONLY informational field (AD-061): it prints exactly the duration handed
+# to timeout(1), or `uncapped` without a capping binary, and never enters the receipt.
+# aw_resolve_timeout_bin: builtin type -P (an exported function can shadow neither `timeout` nor
+# `type` itself), normalized to an ABSOLUTE path fail-closed; the dispatch below reuses this SAME
+# resolved path (banner and run never make independent conclusions).
+timeout_bin="$(aw_resolve_timeout_bin)"
+aw_timeout_banner="$(aw_timeout_label "$timeout_bin" "$CODEX_HARD_TIMEOUT")"
+echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} timeout=$aw_timeout_banner" >&2
 
 # --- Quality-first guard: refuse a silent model/effort downgrade ---------------
 # A relaxed run is RECORDED, not just warned about: the receipt carries probe:true so the kit's
@@ -663,12 +730,8 @@ fence_env=(env
   CODEX_HOME="$real_codex_home")
 
 # --- Hard wall-clock cap via timeout(1) (gtimeout on macOS) -------------------
-timeout_bin=""
-if command -v timeout >/dev/null 2>&1; then
-  timeout_bin="timeout"
-elif command -v gtimeout >/dev/null 2>&1; then
-  timeout_bin="gtimeout"
-fi
+# $timeout_bin was resolved ONCE (absolute path, type -P) at the banner emit above — the run
+# reuses the exact binary the banner reported.
 if [[ -z "$timeout_bin" ]]; then
   echo "warning: no 'timeout'/'gtimeout' on PATH — running codex WITHOUT a hard wall-clock cap" >&2
   echo "         (install coreutils to enable CODEX_HARD_TIMEOUT=$CODEX_HARD_TIMEOUT)." >&2